text:
Valérie Batteau
email: valerie.batteau@hepl.ch

Study of primary school teacher's practices for a lesson after a Lesson Study process in mathematics

Keywords: Teacher's practices, problem solving, lesson study. LS

This study presents the analysis of primary school teacher's practices in mathematics for a lesson that has taken place after a professional development training called lesson study (LS) in Lausanne, Switzerland. Practices are analysed in a double didactical and ergonomical approach. The methodology used is a case study of the particular teacher's practices. Results about the teacher's practices after the LS process are discussed.

Theoretical framework: The "double approach"

Teachers' practices are analysed using the following theoretical framework: the "double approach" based on a French didactical approach [START_REF] Robert | Le système complexe et cohérent des pratiques des enseignants de mathématiques : une double approche[END_REF][START_REF] Robert | A cross-analysis of the mathematics teacher's activity. An example in a french 10th-grade class[END_REF] and an ergonomical approach based on activity theory [START_REF] Leontiev | Activité, conscience, personnalité. Moscou: Edition du progrès[END_REF][START_REF] Leplat | Regards sur l'activité en situation de travail[END_REF].

This "double approach" distinguishes the task, the "goal to be attained under certain circumstances" and the activity, what the teacher engages in during the completion of the task (Rogalski, 2013, p. 4). The prescribed work fits the prescribed task (in our context: what the teacher must do according to Teacher's Handbook and the official program) and the real work fits the conducted task (in our context: what the teacher does in reality during the lesson). To appropriate the prescribed task, the teacher should modify it. Thus, a gap exists between the prescribed task and the conducted task: the reasons can be a lack of the necessary competencies or an inappropriate representation of the task for example (Ibid.). [START_REF] Leplat | Regards sur l'activité en situation de travail[END_REF] adds two levels of tasks: the represented task (in our context: how the teacher represents the prescribed task and what he thinks we attend of him) and the redefined task (in our context: the teacher redefines his task according to the prescribed task and his own professional goals). These levels of tasks are neither hierarchical nor time: the teacher can represent the prescribed task and can redefine a new task before and during the lesson in taking into account different sources (students' activity, his own activity, institutional constraints).

The teacher combines professional acts and knowledge (mathematical, didactical, pedagogical) in his representation of the prescribed task and in his redefinition of the represented task. This study focused on these professional acts and knowledge at stake in these representation and redefinition. Thus, the teacher's activity is analysed as a process of modifications between the prescribed and conducted tasks [START_REF] Leplat | Regards sur l'activité en situation de travail[END_REF]Mangiante, 2007).

Research question

This case study aims to provide elements to respond to the following question: what are the sources of the process of modifications between the prescribed and conducted tasks?

Methodology and data

This qualitative study used a case study to analyse teacher's practices. A LS process (see Figure 1) can be decomposed four steps (Lewis & Hurd, 2011, p. 2): the group studies a mathematical subject, standards and sets instructional goals (step 1), the group prepares a research lesson based on their study of the topic and standards (step 2), the group selects one teacher to conduct the research lesson while others observe and collet student data (step 3), and finally, the group analyses and reflects on the research lesson (step 4), with the option of teaching it again [START_REF] Batteau | Professional development of primary teachers during a lesson study in mathematics[END_REF]. In the Swiss context, some researchers chose to implement this form of LS process without modify the structure in four steps because this model fits a French didactical point of view [START_REF] Clivaz | French Didactique des Mathématiques and Lesson Study: a profitable dialogue[END_REF]: the Theory of Didactical Situations [START_REF] Brousseau | Theory of didactical situations in mathematics[END_REF][START_REF] Warfield | Invitation to Didactique[END_REF]. In the TDS, the methodological research tool consists of an a priori analysis of the possible teaching of a mathematical subject: the steps 1 and 2 fit a deepen a priori analysis with a study of the mathematical subject, the didactical variables, the student's strategies, and difficulties. A second methodological research tool (in the TDS) consists of an a posteriori analysis, who takes place during the step 4, which compares what would be anticipated and what is happened. Thus, a LS process in mathematics began in Lausanne in September 2013 and occurred over two years with two Thematic Working Group 20 collective sessions occurring per month [START_REF] Clivaz | Lesson Study: from professional development to research in mathematics education[END_REF]. The group consisted of eight primary school teachers ranging in experience, voluntary, and generalist 1 teachers, and two facilitators 2 . This study focused on Océanes' practices for one lesson observed after the end of this LS process. For this teacher, data were collective sessions during the LS process (cycles c and d about problem solving), one lesson after the LS process (about problem solving), informal meetings after this lesson, all written documents produced during the lesson, and student work. Video data (lesson and collective sessions) were transcribed. This teacher has seventeen years of experience and students eight to ten years old.

To operationalise the theoretical tools presented for this study, the prescribed task fit the aim of the problem chosen by Océane, the Teacher's handbook, and the planning material for this problem. The prescribed task is analysed a priori, which means the mathematical knowledge at stake in the problem, the possible resolutions, and the didactical variables were analysed. We analysed the modifications between the prescribed and conducted tasks. To explain these modifications, we analyse the representation of the prescribed task and the redefinition of the represented task with using the informal meetings and collective sessions. This paper presents first the mathematical subject worked during the LS cycles c and d before this lesson.

Analysis Cycles c and d of the LS process

During the cycles c and d, the group worked on problem solving and how to help students represent a problem. The group relied on an article [START_REF] Julo | Des apprentissages spécifiques pour la résolution de problèmes?[END_REF] 3 in which the main idea was explained during a collective session.

Facilitator: (quoting Julo) "this help doesn't give clues about the answer, doesn't guide to a strategy and doesn't suggest a modelling". But it's difficult to achieve, it's written just after that. It is an ideal […] but if we don't follow this ideal, it means that we do precisely a part of what students have difficulty to do.

The research lesson of the cycle d was based on this problem: examine the matchstick pattern represented below. How many matchsticks are needed to align 99 squares?

1 In the French speaking part of Switzerland, primary school teachers teach several school disciplines (mathematics, French, sciences...).

2 In this particular LS process, the two facilitators were researchers in Mathematics Education and in teaching and learning [START_REF] Clerc-Georgy | Evolution des rôles entre chercheurs et enseignants dans un processus lesson study: quel partage des savoirs?[END_REF]. They had the role of trainers and « knowledgeable others » (Lewis & Hurd, 2011, p. 30;33). The mathematical function at stake was u(n)=3n+1, where n is a whole number. The group worked on this problem focussing on how to help students represent and model this problem.

Context of the lesson observed after the LS process

For this lesson, Océane chose to manage problem solving and she explained it during a collective session at the end of the LS process.

Océane:

There is a lot of problem which I think oh I don't dare to try [...]

Océane: I think, this year with my students, I take the textbook and I do a lot of things I never did before.

Anaïs:

Oh, you dared.

Océane: Yeah, I did.

The prescribed task: some elements of analysis

For this lesson after LS, Océane chose the problem "Fold": Fold a strip of paper in half, here are two parts. Fold a strip of paper in half, then a second time, here are four parts and so on. How many parts are there with a folded strip of paper ten times? The aim of this problem is to develop reasoning capacities and research strategies (Ibid.). In this problem, students should go from handling to representation in order to predict the result of acts (Ibid.). To determine the number of parts when the strip of paper is folded 10 times, we should calculate 2x...x2 with ten factors 2 (or 2 power of ten). Thus, to find the number of parts with a strip of paper folded n times, it's not necessary to know the answer when the strip of paper is folded (n-1) times.

The problem solving "Fold" is similar to "99 squares" in that sense these two problems rely on functions (power function or affine function). The kind of functions and the context of these problems are different but the idea of function is the same and the idea that it's possible to determine the number of matchsticks whatever the number of squares or the number of parts whatever the number of times we fold the strip of paper.

Modifications between the prescribed and conducted tasks

Some significant elements of modifications between the prescribed and conducted tasks are summarized about the mathematics at stake in the problem. Océane took over the modelling of the problem: she realized a two-column table, then students had to complete it by calculating doubles. Thus, she modified the aim of the problem. During informal meetings, she said that she chose this problem to introduce the multiplication. The issue of the problem is not the same for her (involving the multiplication) and for the designer of the problem (modelling a problem). During the lesson, she took over the modelling of this problem instead of students. Furthermore, she reduced the problem to calculations of doubles of numbers as in this characteristic extract of the lesson.

Teacher: doubles. Here, we double. We double every time. The double of two, four. The double of four, eight. The double of eight, sixteen. The double of sixteen, thirty-two. The double of thirty-two, sixty-four. The double of sixty-four? All right? So Nadège, the double of sixty-four is? It folds in seven times.

[…] It's as if we calculate sixty-four more sixty-four. Is it? (Nadège looks all the folds in her strip of paper).

Nadège: one hundred twenty-six. One hundred twenty-eight.

Teacher: great. […] Next, Luc?

Luc: two hundred fifty-six.

Teacher: very well. Yes? If we fold it nine times, it should be?

Romuald: five hundred six.

When Océane prepared her lesson, she did not identify the mathematical knowledge at stake in the problem (power of two). She validated students' strategies only with calculations (see extract), and she did not link strategies together. In this extract, she said "the double of sixty-four is? It folds in seven times". However, she did not explain why it's necessary to multiply by two when the strip of paper is folded half. Her strategy of doubling could not allow to respond directly to the problem. With her strategy of doubling, in order to find the number of parts with a strip of paper folded ten times, it's necessary to know the answer when the strip of paper is folded nine times and eight times, …, until two times (see Figure 5). With the "expert" strategy, to find the number of parts when the strip of paper is folded n times, the students should calculate the product 2x2x….x2 with n factors 2.

Using a similar problem solving activity than for the research lesson of the cycle d, Océane could not identify the mathematical function at stake.

Another modification of the prescribed task was to propose to students to calculate the number of parts when the strip of paper is folded 11, 12, 13, and 14 times (see Figure 5). This modification was coherent with the teacher's strategy because it was not possible to propose to calculate the number of parts when the strip of paper is fold 100 times for example without the "expert" strategy. This modification illustrated the focus of the lesson on calculation of double (with additions) and nor on modelling the problem, neither on the explanation of strategies and the links between the different strategies.

Representation of the prescribed task

Océane represented the prescribed task in according to her mathematical analyses. Before teaching, she prepared her lesson and realised mathematical analysis. The issue of the problem (modelling) took over by the teacher. In her analysis, the mathematical knowledge at stake in the problem are multiplication and doubling of a number. In the teacher's handbook, the aim is to represent, to model a problem, to develop reasoning capacities and research strategies. Her analysis was in contradiction with the teacher's handbook. Thus, she took freedom in relation to institutional constraints of the Teacher's textbook.

Redefinition of the represented task

Océane anticipated the two-column table to fill in, so she anticipated to take over the representation of the problem and his modelling before this lesson. During this lesson, she taught vocabulary, "double of", and she focused only on calculations. In her redefinition of the task, she modified the problem in a problem of calculation when the strip of paper is folded 2 until 14 times.

In her redefinition of the task, she modified the problem according to her mathematical analysis and her representation of the task.

Process of modification between the prescribed and conducted tasks

The process of modification between the prescribed and conducted tasks had its origins in her representation of the prescribed task for this lesson. Océane took into account the students' activity for the first time she taught this problem (last year). Then, she adapted her teaching when she taught this problem for the second time (for this lesson after LS): she took over the modelling and imposed a two-column table to fill in. She did not take into account students' activity during this lesson but by anticipation.

Conclusion

This case study proposed an analysis of particular teacher's practices during a lesson after a LS process. After the LS process, this teacher has self-confidence over teaching problem solving. In teaching problem solving, it should be able to identify mathematics at stake in the problem.

Mathematics at stake should be given by the mathematical textbooks, but it was not the case. In the French part of Switzerland, official textbooks lack mathematical analysis for the teacher to use while planning lessons. For this lesson, the representation of the prescribed task relied on the Océane's mathematical analysis which were not sufficient. Thus, her representation and her redefinition of the prescribed task did not allow to reach the mathematical learning intended by this problem. To conclude, the sources of the process of modifications for this lesson were her representation of the prescribed task and her mathematical analysis. This case study highlighted a gap between the prescribed and conducted tasks due to the teacher's representation and mathematical analysis.

Figure 1 :

 1 Figure 1: A LS cycle (Lewis & Hurd, 2011)

3

  Figure 3: Problem "99 squares" (Teacher's handbook of 6H, Danalet, Dumas, Studer, & Villars-Kneubühler, 1999, p. 187)

Figure 4 :

 4 Figure 4: Problem "Fold" from (teacher's handbook, Danalet et al., 1998, p. 96)

  In the blackboard, Océane wrote only additions to fill in the table, but nor multiplication neither "double of a number". To fill in the second line of the table, she wrote two strategies without linking: count up to 4 and 2+2.

	FOLD	PARTS
	1 2	2 COUNT UP	2+2
		TO 4	4+4
	3	8	=8 8+8	9	512
	4 5 6 7	16 32 64 128	=16 32+32 16 +16 64+64	10 11 12 13	1024 2048 4096 8092
	8	256		14	16384
	Figure 5: Reconstitution of the blackboard

Proceedings of CERME10


domain: math shs

text:
Miriam Amit
email: amit@bgu.ac.il

Hodaya ( Liora
email: liora_h@macam.ac.il

) Hoch

The reasons underlying mathematics teachers' decisions about the teaching objectives of a mathematical task

Keywords: Pedagogical mathematical knowledge, assessment, mathematical knowledge, pre-service mathematics teachers, novice mathematics teachers

Responsibility for evaluation is assigned to teachers so that they can critique their own work and follow each of their students' progress. To succeed, teachers must build an appropriate means of assessment by themselves. This study examines the ability of pre-service and novice mathematics teachers in secondary schools to do so, using a questionnaire that requires them to make a connection between teaching objectives and mathematical tasks. The results show difficulties in matching teaching objectives to a given task and vice versa, with no significant differences between the preservice and novice mathematics teachers. Interviews show how their beliefs, and their lack of mathematical and pedagogical knowledge, influence the teaching objective and assessment task they choose.

Introduction

The aim of evaluation is to provide teachers with reliable information so they can make decisions regarding their teaching methods as well as track their students' learning (NCTM, 2000). To achieve that aim, teachers must design and construct assessment tools on a routine basis [START_REF] Magnusson | Nature, sources, and development of pedagogical content knowledge for science teaching[END_REF]. This means that teachers should have the capacity to find or develop assessment tasks that align with their teaching objective, and that have the potential to accurately reflect their students' knowledge and understanding (Siegel & Wissehr, 2011). They should also have the reverse capacity: they must know how to find the teaching objective behind a given mathematical task. The two capacities integrate pedagogical knowledge with mathematical (content) knowledge, which has been defined as a part of pedagogical mathematical knowledge in assessment which teachers should have [START_REF] Tamir | Subject matter and related pedagogical knowledge in teacher education[END_REF]. This study attempts to examine the pedagogical mathematical knowledge in assessment of pre-service and novice mathematics teachers by checking their ability to draw a connection between teaching objectives and mathematical tasks.

The theoretical framework

Teaching as a profession is characterized by the existence of a unique knowledge base for those involved in it. [START_REF] Shulman | Those who understand: Knowledge growth in teaching[END_REF] defined categories of knowledge that teachers need in order to be professionals. Among these, he listed content knowledge (in this case, of mathematics), pedagogical knowledge, and pedagogical-content knowledge. Toward the end of the last century, the assessment of students' achievement was placed in the teachers' hands, with the hope they would have the knowledge to develop a reliable and valid assessment methods aligned with the teaching objectives (NCTM, 2000). Thus, the topic of assessment became part of the knowledge base teachers have to have. [START_REF] Tamir | Subject matter and related pedagogical knowledge in teacher education[END_REF], followed by [START_REF] Magnusson | Nature, sources, and development of pedagogical content knowledge for science teaching[END_REF], expanded the definitions of Thematic Working Group 20 Proceedings of CERME10 pedagogical knowledge and pedagogical-content knowledge for the topic of assessment. Pedagogical knowledge in assessment means knowledge of general rules related to assessment that can be applied to every subject-matter, such as familiarity with the various means of assessment. Pedagogicalmathematical knowledge in assessment refers to the knowledge teachers need in order to implement the general assessment rules in mathematics, and also to the ability to build a means of assessment that aligns with their teaching objectives.

Connecting teaching objectives and mathematical tasks is the foundation upon which pedagogicalmathematical knowledge in assessment is based, and particularly all means of assessment, formal as well as informal. This capacity should be acquired by every teacher from the time he/she starts to work. To the best of our knowledge, research that examines teachers' ability to connect between tasks and objectives has yet to be done in any field. This study is the first attempt to explore this ability in general, and particularly in mathematics, among novice and pre-service mathematics teachers. This paper is aimed to check this ability in an innovative way.

Methodology

The data analyzed below derives from a research program about assessment that examines the pedagogical knowledge and pedagogical mathematical knowledge in assessment of pre-service and novice mathematics teachers for primary and secondary schools [START_REF] Hoch | Knowledge of assessment and its implications[END_REF][START_REF] Hoch | Assessing Evaluation: The problem of discriminatory students' evaluation[END_REF].

The research questions

The aim of this paper is to examine the ability of pre-service and novice mathematics teachers to find the most suitable teaching objectives to associate with a given mathematical task. The research questions are: a. Given a mathematical task, to what extent do the participants know how to match it to a suitable teaching objective which can be checked by that mathematical task? b. What are the sources of mismatching in selecting the appropriate teaching objective?

The population

The study focused on sixty-six participants: thirty-two pre-service teachers, who were taught in five teacher training colleges, and thirty-four novice teachers, who had also been trained in one of those colleges.

The pre-service teachers were near the conclusion of their studies, and about to become secondary school mathematics teachers (grades 7-10). The novice teachers were already teaching mathematics in secondary schools (grades 7-10), and had up to three years of teaching experience [START_REF] Vonk | Mentoring beginning teachers: Development of a knowledge base for mentors[END_REF].

All the participants had taken a one-semester course in student achievement assessment during their studies at the teacher training colleges. None of the novice teachers took any additional course besides the one in which they had trained.

The research approach

This study used the Mixed Method approach. First, quantitative data was gathered; then, on the basis of the gathered data, qualitative data was collected (see below).

The instruments

The research was conducted by means of a questionnaire, followed by interviews.

The questionnaire:

This study is innovative in that it examines assessment pedagogical-content knowledge in mathematics by checking teachers' ability to draw connections between teaching objectives and mathematical tasks. Specific questionnaires were created for this purpose. In this paper we shall focus on one of these, which checks the participants' ability to match a suitable teaching objective to a given mathematical task. Every question starts with a mathematical task followed by three teaching objectives that can assessed by that task. The participants were asked to rate those teaching objectives according to their suitability to the given mathematical task on the scale of 3 (= the most suitable) to 1(= the least suitable) (see Figure 1 below).

The questions focus on three central subjects in the curriculum of grades 7-10: algebraic expressions, equations and functions. All the mathematical tasks appear in the most widely used textbooks and in national tests. The teaching objectives were taken from the mathematics curriculum and from these textbooks, in order to simulate live classroom situations.

The questionnaire was given to a panel of judges which included seven experts in mathematics assessment. All have a PhD. in mathematics education, except for one who has an M.A. in mathematics education. All are familiar with the topic of assessment, and some of them even teach this topic in teacher training colleges. The panel of judges was asked to rate the teaching objectives in each question according to their suitability to the given mathematical task (just as the respondents would be, on a scale of 1-3). To ensure reliability (see [START_REF] Burstein | Describing performance standards: Validity of the 1992 national assessment of educational progress achievement level descriptions as characterization of mathematical performance[END_REF][START_REF] Burstein | Describing performance standards: Validity of the 1992 national assessment of educational progress achievement level descriptions as characterization of mathematical performance[END_REF]) each one of the judges was given the questionnaire discretely and did the assignment independently, without knowing who the other judges were.

After all the judges had completed the questionnaire, their ratings for each question were checked. Only questions that were given the same rating by at least five judges were left in the final version of the questionnaire. For the remaining questions, all the judges agreed which was the most appropriate teaching objective, but did not agree about the order of the other tasks.

The interviews:

Interviews were conducted with eight participants (four pre-service teachers and four novice teachers) a maximum of two days after they completed the questionnaire. The interviews were done in order to gain a deeper understanding of the participants' way of thinking and to find explanations to and elaborations for the results obtained from the questionnaire (see [START_REF] Burstein | Describing performance standards: Validity of the 1992 national assessment of educational progress achievement level descriptions as characterization of mathematical performance[END_REF][START_REF] Burstein | Describing performance standards: Validity of the 1992 national assessment of educational progress achievement level descriptions as characterization of mathematical performance[END_REF][START_REF] Ercikan | What good in polarizing research into qualitative quantitative[END_REF][START_REF] Luft | Capturing science teachers' epistemological beliefs: The development of the teacher beliefs interview[END_REF]. The interviewees were therefore chosen according to the degree of incompatibility between their own rating and the experts' rating, and subject to their willingness to be interviewed. The interviews were semi-structured so that for each item in the questionnaire the interviewees were asked: "Can you explain your considerations for the rating you gave?" Each interview was recorded rather than hand written so as to avoid interruptions and delays during the interviewing process. Later the interview was transcribed.

Data analysis

Quantitative analysis: For each question, each participant's rating was compared to that of the experts and received a mark indicating the degree to which it matched the experts' rating. The mark was on a scale from 4 to 0 following the rules: 4 points -the participant's rating is equal to the experts' rating; 3 points -the participant found the most suitable teaching objective but confused the order of the two other objectives; 2 points -the participant marked the most suitable teaching objective as the second and the second suitable teaching objective as the most suitable one; 1 point -the participant marked the most suitable teaching objective as the second and confused the order of the other two; 0 pointsany other option. As a result of this process each question got a score, thus enabling the use of common statistic tests.

Interview analysis: The material obtained from the interviews was coded and analyzed using content analysis (Bauer & Gaskell, 2010), with the explanation for each question used as an analysis unit. At the initial stage of the analysis, the participant's rating was compared to that of the experts for each question and the explanation for the rating was checked. In cases where the rating did not match that of the experts, or the interviewee's explanation for the rating (even when it was in alignment with the experts' rating) did not correspond to the experts' reasons, the causes that led to those mistakes were identified. Finally, all the causes which were found to have a common source were grouped together, thus creating several categories. Since similar research has not previously been undertaken, there

were not yet any known categories.

Findings and interpretations

General results for the questionnaire On average, the participants obtained 2.5 points (out of 4) in this questionnaire. This means that they managed to answer correctly an average of 6 questions out of 9. No significant differences were found between pre-service and novice teachers.

"Substitute Set" Question (see Figure 1

below).

In this question the participants obtained 2.51 points (out of 4). No significant differences were found between the two groups. Less than 50% of the participants correctly chose the most appropriate teaching objective.

For this question the causes that led to a mistaken rating were divided into four categories. .

Difficulties in content knowledge

The right answer is b and d, but many students of all ages have problems with the algebraic expression given in c. They need more than a few minutes to understand that c is a wrong answer. The one which is written in e caused problems for some interviewees, and one interviewee gave it as a correct answer without realizing that there was a problem. The fact that (-5) cannot be substituted, while 5 can, caused problems. This algebraic expression shows that the ability to find the substitute set is not sufficient for providing the right solution. Those interviewees who had difficulty with mathematical knowledge chose the second objective as the most suitable one or rated the teaching objectives in the same order as the experts.

Figure 1: "Substitute Set" Question (with the experts' rating)

Difficulties in pedagogical knowledge

The results showed that the participants did not clearly and unequivocally understand how a teaching objective should be determined. As a result, they made their choices based on several different criteria. Some of the interviewees chose the suitable teaching objective according to the order of the syllabus. In this case, for instance, finding a substitute set to an algebraic expression topic is learnt after the students know how to substitute numbers and practice doing so. According to Orna, "Here the student does not try to substitute numbers because this stage is already known, it is something obvious". Thus the teaching objective that would be suitable in this case is the second one, with the additional reasoning "that is the way I would do it" (Orna). Osama's rationale, on the other hand, led her to choose the first teaching objective, saying "Here the student first has to substitute in order to know if the denominator is equal to zero… [Therefore] I think this task checks very well if the student knows how to substitute". Others, like Yelena, based their determination of the most suitable teaching objective on a strict adherence to the exact phrasing of the assessment task. She declared that "the student does not have to know the idea behind the term 'a substitute set' because no one asks for this".

In a test that was given to 7 th grade students the following question was asked:

Find the algebraic expressions where the set {x| x   5} is the substitute set.

(There is more than one correct option.) To check if the student 1 Knows how to substitute numbers in an algebraic expression 2 Knows how to find a substitute set to an algebraic expression She thinks that a teaching objective should be determined according to what is specifically asked for in the written question.

a. (x-5)(x+5) b. ) 5 )( 5 ( 4   x x c. 25 5 2   x x d. 25 2  x x e.
Difficulties in pedagogical content knowledge Some of the interviewees did not take into consideration the difficulties students have when the substitute set of the algebraic expression is not the same as the given one. "Even those who do not understand the learnt material can substitute numbers and succeed in solving the question and the teacher will think he/she understands" (Osama). "In 'e' the student finds that the substitute set is all numbers except 5, so he will not mark this ['e'] because [it is given that] the substitute set should be different from 5 and also from (-5)" (Sharon). Knowing how to find the substitute set or knowing how to substitute numbers does not ensure that the student will come to the right conclusion because an additional step is requires, namely comparing the result obtained from the finding of the substitute set with the given substitute set and coming to a conclusion.

Beliefs/conceptions

The interviewees raised concerns about whether a task like this could in fact accurately reflect their students' understanding at all, or whether it just reflected their ability to follow instructions. Their responses addressed questions like: What is the nature of the rules that are provided by teachers or books? Do these rules replace the need for understanding the subject matter? Can students follow the rules and succeed in solving tasks without understanding? Anat, for example, pointed out that "If the teacher wrote down the rules on how to find a substitute set…all kinds of rules, the students may not understand what a substitute set means, but they will be able to solve exercises without such understanding." Anat expresses the belief that knowing the rules and using them correctly can cover up a lack of understanding, and that therefore this task cannot check the understanding of a substitute set.

Discussion and conclusions

This study attempts to give a preliminary idea of the mathematics teachers' pedagogical-content knowledge of assessment. It examined two groups: pre-service teachers in secondary schools just prior to their entering the educational system, and novice teachers in secondary schools. The example presented here shows the participants' difficulties finding the teaching objective behind the given mathematical task, dividing them into four categories: a. difficulties in mathematical knowledge, b. difficulties in pedagogical knowledge, c. difficulties in pedagogical mathematics knowledge and d. beliefs/conceptions teachers hold. The first three categories have already been discussed extensively by many researchers as an acknowledged part of the knowledge base all teachers must have (e.g. [START_REF] Shulman | Those who understand: Knowledge growth in teaching[END_REF][START_REF] Turner-Bisset | The knowledge bases of expert teacher[END_REF]. As this example shows, an incomplete knowledge base also influences the quality of the assessment teachers carry out. The application of beliefs in the teaching process has been well documented in the literature [START_REF] Eren | Consonance and dissonance between Turkish prospective teachers' values and practices: Conceptions about teaching, learning, and assessment[END_REF][START_REF] James | Beyond method: Assessment and learning practices and values[END_REF][START_REF] Turner-Bisset | The knowledge bases of expert teacher[END_REF] and arose in the context of assessment as well. In this case, it was the teachers' belief that providing students with rules could cover their lack of understanding. This issue has been dealt with by many researchers for many years (e.g. [START_REF] Skemp | Relational understanding and instrumental understanding[END_REF]. The belief that teaching students to follow a set of rules can be a substitute for teaching them the underlying ideas for those rules may be the result of what has, until recently, been the prevalent Israeli method of learning mathematicsa method that demanded low levels of thinking from the students. Various researchers (e.g. [START_REF] James | Beyond method: Assessment and learning practices and values[END_REF] have recommended encouraging the pre-service teachers to express their beliefs by opening them up for discussion them. Hearing and addressing these beliefs that can influence future behavior, can lead the holder to undergo a process of professional development.

Finally, this study showed that the abilities of the novice teachers are no better than those of preservice teachers. Both groups demonstrated the same problems, suggesting that experience in practice does not rectify problems that originate in training. This forces the assessment course's lecturers to focus on how to connect between teaching objectives and mathematical tasks. Moreover, every teacher educator should encourage preservice teachers to express their presumptions or beliefs, since discussing them can eliminate wrong beliefs and lead to a professional development [START_REF] James | Beyond method: Assessment and learning practices and values[END_REF].

The study's limitations

Although the number of participating in this research is small, and despite the fact that this research was restricted only to novice teachers, it is nevertheless important, since there is no study to date that examines the ability of teachers to identify a suitable teaching objective for a given mathematical task. Understanding the sources of the mismatching in selecting the appropriate teaching objective can help teacher educators focus their efforts on these problems, thus improving the training program's changes of preventing them.

The study looked at the participants' ability to connect between teaching objectives and mathematical tasks in three themes, limiting each theme to very few questions. These alone could not encompass all the aspects to be addressed in each theme. Further studies of this ability (and its opposite) should be done, preferably with every study conducting an in-depth examination (including interviews) of only one teaching theme.

Interviewer

  though in e you can substitute(-5) Interviewer: So what is the right answer?

Proceedings of CERME10


David Lanoe Centralesupelec

Michel Hurfin
email: michel.hurfin@inria.fr

Eric Totel
email: eric.totel@centralesupelec.fr

A Scalable and Efficient Correlation Engine to Detect Multi-step Attacks in Distributed Systems

In distributed systems and in particular in industrial SCADA environments, alert correlation systems are necessary to identify complex multi-step attacks within the huge amount of alerts and events. In this paper we describe an automatabased correlation engine developed in the context of a European project where the main stakeholder was an energy distribution company. The behavior of the engine is extended to fit new requirements. In the proposed solution, a fully automated process generates thousands of correlation rules. Despite this major scalability challenge, the designed correlation engine exhibits good performances. Expected rates of incoming low level alerts approaching several hundreds of elements per second are tolerated. Moreover, the used data structures allow to quickly handle dynamic changes of the set of correlation rules. As some attack steps are not observed, the correlation engine can be tuned to raise an alert when all the attack steps except k of them have been detected. To be able to react to an ongoing attack by taking countermeasures, alerts must also be raised as soon as a significant prefix of an attack scenario is recognized. Fulfilling these additional requirements leads to increase the memory consumption. Therefore purge mechanisms are also proposed and analyzed. An evaluation of the tool is conducted in the context of a SCADA environment.

I. INTRODUCTION

Many domains (industry, finance, health, education, culture, housing, transportation, . . .) are now managed by information and communication technology (ICT) systems. All these ICT systems represent potential targets for malicious attackers that aim at compromising their availability, integrity or confidentiality properties. Designing and implementing secure software and hardware systems is an ideal goal but it is rarely fully attained during the software conception phase. As the ICT systems are continuously growing in size and complexity, critical vulnerabilities remain in many systems and can be exploited by attackers as long as they are not patched. Thus, in addition to prevention approaches, supervision mechanisms are needed to detect on-line attacks. Once an alert is raised, appropriate countermeasures may be considered to reduce the impact of the suspected attack. A supervision process relies on intrusion detection systems (IDSes) installed at different places of an ICT system (both in the network and on the hosts) and configured to monitor local actions and to report occurrences of event (normal actions) as well as raw alerts (detected anomalies).

The numerous deployed IDSes produce a huge number of alerts. IDSes are often inaccurate and a large number of these alerts are false positives that overwhelm the administrator of a system. The original purpose of an alert correlation process was thus [START_REF] Totel | A Language Driven Intrusion Detection System for Event and Alert Correlation[END_REF] to reduce the number of false positives and [START_REF] Godefroy | Automatic Generation of Correlation Rules to Detect Complex Attack Scenarios[END_REF] to propose high semantic alerts to the administrator when an actual attack occurs. In particular, a correlation engine should be able to consider multi-step attacks and to warn the administrator when such a complex and meaningful attack occurs. In order to detect the chained actions of an attacker, the correlation component needs to rely on a set of correlation rules: each rule describes a known multi-step attack that may affect the system. The creation of these correlation rules is not trivial. Thus in current industrial SIEM (Security Information and Event Management) products, the defined rules are still either poor or incomplete.

The work we present in this paper has been conducted in the context of the PANOPTESEC European project. The purpose of this project, which ended in 2017, is to produce a supervision platform for a SCADA system managed by a major electricity distribution company in Italy. Due to the criticality of the industrial context, additional requirements have to be satisfied by the alert correlation process which is at the core of the platform. First, as it is difficult to write correlation rules, they are produced by a fully automated process. As a consequence, their number is much higher. Moreover, this set of several thousands rules has to be updated when the system configuration evolves. Consequently, while handling often hundreds of alerts per second, the correlation engine must also quickly reconfigure itself to ignore the suppressed rules and to cope with the new created ones. Second, the administrator wants to be aware of the actual attacks in real time while they are under progress. To be able to early apply countermeasures, the correlation engine should produce an alert before all the steps of an attack have been completed. Third, at a given step of the attack, an attacker can evade detection due to failures, misconfigurations or limitations of some IDSes. Due to these false negatives, one or several attack steps do not appear in the flow of processed alerts. Consequently, the correlation engine must be able to detect multi-step attacks despite a few missing steps.

The contribution of our work, with respect to the state of the art, is to design, implement and assess a correlation engine called ABE (Automaton Based Engine) that is able:

• to take as input automatically generated correlation rules;

• to predict incoming multi-step attacks;

• to detect attack scenarios with some missing steps;

• to scale to handle hundreds of alerts per second while supporting thousands of correlation rules. Over the past fifteen years, works [START_REF] Totel | A Language Driven Intrusion Detection System for Event and Alert Correlation[END_REF] have followed an automata based approach to develop correlation engines. More recently, the problem of automated generation of correlation rules has been studied in [START_REF] Godefroy | Automatic Generation of Correlation Rules to Detect Complex Attack Scenarios[END_REF]. However scalability issues raised by the mixing of both objectives have not been addressed. Furthermore to promote the use of such solutions, the requirements of the administrators have to be taken into account and practical problems related to memory consumption should not be ignored.

This paper is organized as follows. The next section discusses related work. The requirements the correlation engine has to fulfill are detailed in Section 3. Section 4 presents our correlation engine. An evaluation is proposed in Section 5 and Section 6 concludes the paper.

II. STATE OF THE ART: ALERT CORRELATION

An alert correlation process is composed of several phases [START_REF] Valeur | Real-Time Intrusion Detection Alert Correlation[END_REF]. The first one consists in normalizing the format of heterogenous events and alerts. After this homogenization phase, the diversity of the data sources is no more a problem. The second phase consists in verifying that an alert is correct (or at least it seems plausible). A base of knowledge describing the supervised system (the topology, the cartography, the base of vulnerabilities) is often used to verify if an alert is correct or not [START_REF] Morin | M4d4: a Logical Framework to Support Alert Correlation in Intrusion Detection[END_REF]. False positives are suppressed during this verification phase (e.g., an alert reveals an attack step against a process that does not exist). The third phase consists in merging alerts that are produced by various IDSes reacting to the same attack. This merge is also called Alert Fusion. Within this paper, once the third phase is achieved, the remaining events and alerts are called low level alerts. In a fourth and last phase, the flow of low level alerts is processed by a correlation engine to discover possible occurrences of complex attack scenarios.

Many correlation engines rely on a base of correlation rules which identifies all the patterns to look for in the flow of low level alerts. Several langages have been previously defined to describe correlation rules such as ADeLe [START_REF] Michel | ADeLe: an Attack Description Language for Knowledge-based Intrusion Detection[END_REF], LAMBDA [START_REF] Cuppens | LAMBDA: A Language to Model a Database for Detection of Attacks[END_REF] or STATL [START_REF] Eckmann | STATL: An Attack Language for State-based Intrusion Detection[END_REF]. An attack scenario is characterized by several attack steps against the system and some temporal relationships between them. A correlation rule describes an attack scenario and indicates, for each attack step, how to find within the incoming flow of low level alerts, an element that attests that this step has been performed. Indeed, one of the difficulties is to connect a low level alert (i.e., an observation performed by an IDS) and an attack step (i.e., an action performed during the computation). If low level alerts produced by the deployed IDSes match with the description of a correlation rule, an alert has to be raised by the correlation engine.

Most of the SIEMs on the market (for example, IBM QRadar or HP Arcsight) include an alert correlation mechanism configured by alert correlation rules. Orchids [START_REF] Goubault-Larrecq | A Smell of Orchids[END_REF], GNG [START_REF] Totel | A Language Driven Intrusion Detection System for Event and Alert Correlation[END_REF] or Hi-DRA [START_REF] Kemmerer | Hi-DRA: Intrusion Detection for Internet Security[END_REF] are well-known examples of more sophisticated academic correlation engines that use also correlation rules. In all these works, the production of the correlation rules requires to precisely know the attacker's strategy and how the IDSes may (or may not) detect his activities. When it is done by human experts, this is a non trivial, time consuming, and error-prone task. Thus a recent work [START_REF] Godefroy | Automatic Generation of Correlation Rules to Detect Complex Attack Scenarios[END_REF] aims at producing the correlation rules through an automated process.

Obviously, to produce a correlation rule, it is necessary to know how an attacker performs progressively his attack against the system. The representation of the attacker's activities can be made in different ways. The use of attack trees [START_REF] Schneier | Attack Trees: Modeling security threats[END_REF] is an usual approach. In these trees, the nodes are logical nodes (operators AND and OR), and the leafs are the attacker's actions. This representation of the attacker's behavior can be transformed into a correlation tree that represents all the sequences of events or alerts an attacker can generate in the supervised system. This approach has been followed in [START_REF] Godefroy | Automatic Generation of Correlation Rules to Detect Complex Attack Scenarios[END_REF] and demonstrates that an attack can be associated with two similar representations corresponding respectively to the point of view of the attacker (attack tree) and the point of view of the defender (correlation tree). A base of knowledge about the system can be used to develop an automated process which establish the links between actions and possible observations and thus deduce the correlation rules from the attacker description [START_REF] Godefroy | Automatic Generation of Correlation Rules to Detect Complex Attack Scenarios[END_REF]. Of course this requires to describe the attacker actions. Indeed there are well known research works such as MulVal [START_REF] Ou | A Scalable Approach to Attack Graph Generation[END_REF] that generates automatically the attacker behavior in a distributed environment: this work consists in generating attack graphs. There are various types of attack graphs. MulVal generates logical attack graphs where the nodes are states of the system, and the vertices are the attacker actions. Another sort of attack graph is called topological attack graph [START_REF] Jajodia | Topological Analysis of Network Attack Vulnerability[END_REF]. In these graphs, each node is a machine in the system, and each vertex the exploitation of a vulnerability that permits for an attacker to gain access from a source machine to a targeted machine.

The work we present here is a follow-up of the correlation based on a set of rules. However, the form of the correlation rules, the way they are produced and used are slightly different. Moreover, compared to various approaches, we scale to a large number of alerts per second and correlation rules.

III. THE CONTEXT OF THE PANOPTESEC PROJECT

Information about all the aspects of the PANOPTESEC project can be found in the dedicated web site [START_REF]PANOPTESEC Project[END_REF]. In this section, we give hints about the components in charge of providing inputs to the correlation engine (the flow of low level alerts and the set of correlation rules). Then the specific requirements that have to be fulfilled by the correlation engine are detailed.

A. Correlation Rules Generation

In the PANOPTESEC project, scanners of vulnerabilities and topology discovery techniques are used to generate topological attack graphs. In a first step, information about the devices present in the system, their known vulnerabilities and their connections are used to determine all the paths in the supervised system that can be followed by an attacker to reach and compromise some identified targets. A simple solution may consist in enumerating all attack paths in order to generate attack rules as sequences of attacker actions. However, this approach clearly does not scale. In the proposed approach, the generated graph is used to compute spanning attack trees but only scenarios that do not exceed 4 to 5 steps are considered. In practice, an attacker prefers to follow a short path. Furthermore a longer path often contains all the attack steps of a shortest one already identified. We suppose also that the attacker is coming from outside the supervised system. These realistic assumptions significantly reduce the number of attack paths. The trees obtained are in fact attack trees where each attacker's action corresponds to a vulnerability exploited to perform the attack step. Through the configuration of the deployed IDSes and thanks to the first steps of the correlation process (normalization, enrichment, fusion), the identification of the vulnerability (i.e., a CVE identifier) is also contained in most low level alerts that are generated when a vulnerability is exploited. Informally, a low level alert matches with an attack step of an attack path if 1) the two mentioned vulnerabilities are similar and 2) the identification of the source and target devices involved in this exploit are also the same.

Each correlation rule is represented as a correlation tree. Figure 1 is an example of a correlation tree where only two operators are used. The SEQ operator (sequence) states that all the children must be detected from left to right. The AND operator requires that all the children must be detected in any order. A tree may also use an operator OR to indicate that at least one of the children must be detected. In this example, the rule defines that the attack steps A, B, C and D must be detected in at least one of the orders {A, B, C, D} or {A, C, B, D}, leading to the definition of two sequences of alerts. Note that uppercase letters (A, B, C, ...) are used to identify the steps of an attack described in a rule (i.e., types of alerts) while lower case letters (a, b, c, ...) refer to low level alerts. We use the same letter to indicate that a low level alert b matches with an attack step B. In the incoming flow, the different occurrences of low level alerts that match with an attack step B are denoted b 1 , b 2 and so on. The correlation engine analyzes the incoming flow of low level alerts. Assume that this flow begins with the prefix "z 1 ; a 1 ; d 1 ; c 1 ; b 1 ; d 2 ; c 2 ; d 3 ". At this stage, the correlation engine should have raised three alerts because the sub-sequences "a 1 ; c 1 ; b 1 ; d 2 " , "a 1 ; c 1 ; b 1 ; d 3 ", and "a 1 ; b 1 ; c 2 ; d 3 " are corresponding to three different attacks that occur concurrently and match the attack scenario depicted by the above rule.

The generation of correlation rules is done at the very beginning of the computation. Yet the configuration of the system evolves. Changes in the topology and connectivity may have various legitimate causes: in particular, they may be the result of countermeasures applied when ongoing attacks are detected. In this work, the set of correlation rules used by the correlation engine can be updated at any time (See Section IV-E).

B. Specific Requirements

As indicated before, the requirements identified during the project were slightly different from those usually adopted for a standard correlation engine.

1) Ongoing Alerts: First of all, an engine usually produces an alert only after an attack scenario is entirely detected. In the previous example, we supposed that this usual strategy was adopted. Providing information about the progress of an attacker was a major requirement in the context of the project. Indeed, identifying a prefix of an attack scenario allows to identify the possible targets of an attacker and to consider quickly possible countermeasures. A visualization component has been developed to give a simple and rich view of the attacker's actions while the actual attack progresses. Even if a scenario is not finished, an early information may allow the administrator to predict and understand the possible goals of an attacker while being aware of the risk of error in the prediction. When the correlation engine raises an alert before the detection of the full scenario, the alert is called an Ongoing Alert. Consider again the previous example. At most five Ongoing Alerts can be generated corresponding respectively to the prefixes "a 1 ;", "a 1 ; c 1 ", "a 1 ; b 1 ","a 1 ; c 1 ; b 1 ", and "a 1 ; b 1 ; c 2 ". To limit the number of raised alerts and to reduce the risk of error in the prediction, Ongoing Alerts corresponding to the shortest prefixes should not be raised. In practice, for each rule, we consider the length of the longest attack scenario and the length of the prefix already observed. A threshold is defined to control the amount of generated Ongoing Alerts. For example, for a sequence of 5 steps, if the threshold is set to 40%, an alert is generated if the observed prefix identifies already more than 2 attack steps.

2) Missing Alerts: Secondly, we must consider that an attacker can evade IDSes detection. For example, it could be the case that no IDS has the right location and the right specification/configuration to detect the occurence a 1 . It could be the case also that an IDS fails to detect an attack step or the information it provides in the low level alert is not rich enough to discover that a 1 matches with the attack step A. In an usual correlation engine, this means that the scenario will not be detected. In this work, the correlation engine is designed to detect scenarios with missing steps and to generate a Missing Alert in that case. Obviously only a few missing low level alerts can be tolerated. Otherwise the accuracy of the detection is too low. An upper bound M ax k is defined: this bound must depend on the length of the longest scenario defined by a correlation rule. When the length of the attack paths is rather small, the value of M ax k is set either to 0 or 1.

3) Most Advanced Detection: The two above requirements may cause a significant increase both in the number of raised alerts and in the amount of memory space used by the correlation engine. An analysis of the procedures followed by the stakeholder indicates that, for a given attack path, the administrator is mainly interested by the level of progression of the attack(s). Moreover, when several low level alerts match with the same attack step of an attack path, the administrator focuses much more on the most recent one. Based on the fact that, at any time, for each attack path, the last most completed scenario has more interest, an alternative behavior for the correlation engine can be defined to focus on the progress of an attack. In the context of this project, the automated generation of attack rules ensures that the root of a correlation tree is always a SEQ operator. Consequently, this representation already identifies some major steps in the attack scenario that have to be achieved sequentially by an attacker. Thus the concept of most advanced detection (See Section IV-D) is natural and straightforward.

4) Performances: Throughout the design of the correlation engine, performance is a critical aspect. The main challenge is to obtain a solution able to cope with thousands of rules and hundreds of low level alerts per second. As the set of correlation rules is updated from time to time, the time required to initialize the data structures of the correlation engine is also critical. Indeed, while it is in the process of resetting, the analysis of the flow of low level alerts is suspended. New low level alerts that arrive are stored. During the reset time, the low level alerts that are waiting for a treatment are accumulated. When the correlation engine resumes its analysis, it must catch up with the accumulated delay.

IV. AUTOMATON BASED ENGINE (ABE) DESCRIPTION A. Automaton Generation

As indicated previously, a correlation rule is represented by a correlation tree. However, using these trees directly at detection time is not the best choice in term of performance. The goal is to raise alerts. Each alert must identify a particular attack scenario and a sub-sequence in the flow of low level alerts such that 1) each element of this sub-sequence matches with an attack step of the scenario (and vice versa) and 2) the temporal constraints between the attack steps are also respected by the sub-sequence. Low level alerts and attack steps can be attached to letters of an alphabet; the subsequence is a word and the rule is a language (i.e., a set of words). To detect and attest that a sub-sequence is an attack, a natural choice is to associate each rule with an automaton. Each time a new set of correlation rules is computed, the correlation trees are loaded and each of them is transformed into an automaton that is able to recognise the sequences of alerts specified by the correlation tree.

Figure 2 shows the automata that are generated in three particular cases where the correlation tree contains a single When a correlation tree is a mix of these three operators, the whole automaton is the result of the composition of the automata associated to each internal node. Figure 3 shows the correlation tree already presented in Figure 1 and its automaton that accepts the two sequences of alerts defined by the correlation rule. This automaton is the composition of the two automata generated for each used operators (i.e., SEQ and AND nodes).

B. Engine Attack Recognition Algorithm

Without loss of generality, we consider in a first step that the correlation engine is fed with a single correlation rule associated to a particular automaton A. Let us describe first a simple and inefficient solution: the correlation engine enumerates all the possible sub-sequences contained in the flow of low level alerts and tests for each of them if the corresponding word is accepted or not by the automaton. As the flow of low level alerts contains a lot of elements that are of no interest for the detection, creating the list of possible subsequences will be a time consuming operation and will require to keep track of the whole flow of low level alerts. Moreover, all the sub-sequences that share a non-matching prefix will be systematically enumerated and rejected.

The proposed solution follows a different strategy. We consider prefixes of sub-sequences. At any time, we keep track of all the prefixes that have been already observed and not rejected by the automaton. After the initialization phase, the empty word is the only prefix already observed and not rejected. During the analysis, the element of the incoming flow are taken into account sequentially, one by one. For each low level alert e, the correlation engine checks if an existing prefix H1 can be extended with this new letter to obtain a new prefix H2 (equal to H1 + e) that is not rejected by the automaton. When this is the case, the new prefix is saved. For efficiency reason, the state of the automaton after the prefix recognition is also saved: thus rather than checking entirely a new prefix, only the existence of a transition labelled with the new low level alert e is The saved information is structured as a collection of Plans. A plan P is a particular instance of the execution of an automaton A : P = {A, S, H} where S is the state reached during this particular execution of the automaton A and H is the history of low level alerts that have been recognized to reach this state S (i.e., H is a prefix). When S is not a final state, H is a sequence of low level alerts corresponding to the prefix of a known sequence of attack steps depicted by the automaton. If S is the final state of an automaton, then H is the sequence of alerts corresponding to a complete multi-step attack.

Assuming that M ax k = 0 (i.e., no missing alert is raised), the Algorithm 1 defines how the plans are managed by the correlation engine. In the pseudo code, the word event is used to refer to a low level alert. In practice, each plan subscribes to types of events that can permit to advance in the recognition (line 29). When a low level alert arrives (line 8), we build the set of plans that are concerned with this event (line 12). Then, for each of these plans, we create a new plan that is in the new state reached after firing the transition associated to the low level alert (lines 14-17). After this operation, the plan subscribes to the events that it is waiting for (line 23). If the plan created is in its final state, then an Alert (called a complete and exact alert) is generated, and the created plan disappears (lines 18-20). If it is not in a final state, it is added to the set of plans (line 30). In this case, an Ongoing Alert is generated if the prefix already recognized is longer than a threshold defined for each automaton. Note that, in this algorithm, the matching between a low level alert and an attack step is checked at line 12.

Lets illustrate this algorithm on the example of Figure 3. We suppose that the correlation engine treats the events a 1 ; d 1 ; b 1 ; e 1 ; c 1 ; d 2 that are of types A, D, B , E, C and D. P ← P ∪ {p} 31: end procedure read from first line to last line. At the initialisation, for each automaton, a plan that is in the initial state (0) and has an empty recognition history is created. This plan also subscribes to all event types that can fire a transition from the initial state. Here p 0 subscribes to event type A. When a 1 is generated and received, the correlation engine identifies the set of plans that have subscribed to events of type A. In our case, this set is composed of plan p 0 . A new plan p 1 is created on the basis of p 0 : the plan p 1 fires the transition A from state 0 of p 0 and reaches state 1. Its history also extends to event a 1 , that contributed to the recognition of a new attack step. The plan p 0 remains in memory, as it can detect new attack beginnings. The process is repeated for each alert. In this example, when d 2 is released, we generate a plan that reaches the final state [START_REF] Michel | ADeLe: an Attack Description Language for Knowledge-based Intrusion Detection[END_REF], with an history {a 1 , b 1 , c 1 , d 2 }. This history represents

p 0 = {A, (0), { }} A a 1 p 0 p 1 = {A, (1), {a 1 }} B, C d 1 - - - b 1 p 1 p 2 = {A, (2), {a 1 , b 1 }} C e 1 - - - c 1 p 1 p 3 = {A, (4), {a 1 , c 1 }} B p 2 p 4 = {A, (3), {a 1 , b 1 , c 1 }} D d 2 p 3 p 5 = {A, (5), {a 1 , b 1 , c 1 , d 2 }}
the attack steps as seen by the supervision mechanisms, and matches the correlation rule of Figure 3. Note that the last plan appears in a smaller font size to underline the fact that this plan is stored temporarily (line 20).

Let us now consider that several correlation rules exist. Each plan is associated to a single automaton. Yet plans related to different automata can be mixed in some data structures. For example, the set P that contains all the plans that have subscribed to a same event (line 12) can refer to distinct correlation rules. The fact that the correlation rules are not managed separately explains the good performance of the algorithm.

The above algorithm lacks one of the requirements: if some low level alerts have not been generated or if the information it carries does not allow to detect a matching with the corresponding attack step, the attack remains undetected. The algorithm will now be enhanced to be able to tolerate missing alerts.

C. Managing Missing Low Level Alerts

We designed an adaptation of Algorithm 1 in order to tolerate up to M ax k missing alerts in the sub-sequences expected by an automaton. Algorithm 2 is called the k-missing algorithm. Note that when M ax k = 0, Algorithm 2 behaves exactly like Algorithm 1. In this new algorithm, the definition of a plan P changes to P = {A, S, H, k} where S and H have the same meanings as before, but an integer k is now attached to each plan. By construction, 0 ≤ k ≤ M ax k . Roughly speaking, k is the number of remaining jokers that can be used during the next steps of the scenario recognition. Consequently, M ax k -k indicates how many low level alerts are already missing in the history H.

During the initialisation of the algorithm, the value of k for the first plan p 0 is set to M ax k . For sake of simplicity we assume that this initial bound is the same for all the correlation rules but, of course, it can be adjusted to fit with the complexity of each attack scenario (i.e., its number of attack steps). If the value of M ax k is not equal to 0, all the plans corresponding to possible prefixes of length 1 have to be created. These new initial plans have a value k equal to p 0 .k-1. Then the initialization process continues for plans with a unobserved prefix of length 2, 3, ..., p 0 .k. During the analysis, when a low level alert is received, the correlation engine calls recogniseAttack. This procedure allows to indicate that the event is not missing (line 10, call of the procedure managePlans with a boolean parameter equal to false). Like in Algorithm 1, new plans are built after firing the transitions associated to this low level alert (lines 15-18). Then, for each new plan p, new plans (where up to p.k low level alerts can be missing) are also built (line 39, call of the procedure managePlans with a boolean parameter equal to true).

To understand the k-missing algorithm, we consider again the example already used to explain Algorithm 1. As a reminder, the correlation rule and the corresponding automaton are depicted in Figure 3. We suppose that the observed flow of low level alerts is a 1 ; d end if 42: end procedure this explanation, we consider exactly the same flow while the management of missing low level alerts is done to tolerate the lack or an alteration of some elements within the flow. Assuming that M ax k = 1, the created plans are shown in Table II. At initialisation, the first plan p 0 in state 0 with an empty history is created. As M ax k = 1, we compute also plans as if the events in the immediate future have occurred (but have not been observed). Only one plan p 1 is created (after the transition A). We include in its history the event type A as a missing event (noted A). In this example, after the initialisation phase, two plans are waiting for different event types. When a 1 is received, it can only concern p 0 . We then generate p 2 (with p 2 .k=p 0 .k), and the plans in a future of length 1, that are p 3 and p 4 . The algorithm goes on until we consume all received alerts. At the end of the 1-missing algorithm, if we launch alerts only for completely recognized signatures, we generate 7 alerts, compared to 1 alert in the first algorithm. Moreover, for the same automaton and the same alerts as inputs, we generate 5 plans in the first algorithm, compared to 21 plans in the 1-missing algorithm.

As a consequence, we can guess that the k-missing algorithm is a very memory consuming algorithm. The high production of alerts is a side-effect that is not very compliant with the objectives of alert correlation. Indeed, we produce so many alerts that the administrator will again be overwhelmed under the mass of alerts. However, in the context of the project, it permits to visualise in real-time potential attacks with missing attack steps. As it is visually treated, the administrator does not have to dig into logs. The visualisation is the key functionality that permits to treat such a volume of alerts in real-time.

Obviously, adopting high values for M ax k is not a good idea. As indicated before, for each rule, the initial value of M ax k can be adapted according to the length of the scenario. For example, when the scenario has a length less than 3, the mechanism to tolerate missing low level alerts can be inhibited (i.e., M ax k = 0). When the length is greater than 10, considering up to 2 missing alerts is a reasonable choice. Otherwise M ax k = 1 is a good tradeoff.

The k-missing algorithm can also be coupled with Ongoing Alerts. This means that if the history of a plan is higher than a given length, an Ongoing Alert can be generated. Of course, these mechanisms have to be introduced carefully, as they can generate a high number of intermediate alerts.

D. Memory Consumption

As seen in Table II, the use of the k-missing algorithm generates in memory a lot of plans, that represent ongoing at-tack recognitions. Even when M ax k is set to 0 (Algorithm 1), the number of plans continuously increases. As the intrusion detection process is an online everlasting process, the number of plans depends mainly on the number of low level alerts that match with attack steps. These plans should be kept in memory as long as necessary in order to detect further attack steps that could occur within hours or days. However, the accumulation of plans results rapidly in an exhaustion of the memory. This implies that we must carry out a garbage collector to reduce the memory consumption.

In practice, when the correlation engine heap is full, we must delete some plans that are not useful for future recognitions. As it is difficult to predict the future, we have to implement heuristics to decide which plans must be deleted. Without any additional knowledge, the plans that are least likely to be useful to recognize an attack are the oldest plans. This means, that we can arbitrarily decide to suppress from memory for example 20% of the oldest plans. However, this heuristic is not sufficient, as it can suppress almost recognized correlation rules. Even if it seems reasonable, the above strategy relies on the assumption that performing a complex attack is never spread over a long period of time. This hypothesis is very questionable.

To tackle this problem, we propose to tag plans that are of interest (and not necessarily the most recent ones). As indicated previously, in the context of this project, it has been stated that administrators are interested by the most advanced scenarios and among these scenarios by one of the most recent ones. As the correlation tree attached to a correlation rule is such that its root is always a SEQ operator, it is simple to identify a sequence of steps that have to be performed by the attacker. Thus we can observe a progress level in the recognition process. This notion of level is used to manage the threshold mechanism that controls the generation of the Ongoing Alerts. It can also be used to identify plans that allow to reach a particular level. For a given rule and for each level already reached, we select a particular plan called the most advanced plan. By construction, each new plan that allows to reach a level in the recognition process is a most advanced plan at the time of its creation. The plan may lost its privilege later if, in the future, a new low level alert allows to reach exactly the same level of recognition in the same scenario. During the purge performed by the garbage collector mechanism, any plan with this special tag is kept in memory. Thus we avoid to loose recognitions that may be of interest in the future even if the attack steps already performed are very old. Note that a purge mechanism may keep only the most advanced plans. In that case, the number of plans is bound. If r is the number of correlation rules and if l is the maximum number of levels in any rule, at most r.l plans are kept in memory.

E. Reaction to Dynamic System Changes

Till now, the presentation of the algorithm assumes that the base of correlation rules is statically defined once and for all. This does not reflect the reality, where an equipment can be removed or inserted dynamically in the information system: this modifies the topology of the network and the vulnerabilities present in the system. Moreover any countermeasure adopted by an administrator to block an attacker may also have an impact on the topology (a machine is stopped), the connectivity (a port is closed) or the present vulnerabilities (a patch is applied). Thus dynamic aspects of the supervised system must be taken into account.

In practice, the attack graphs are periodically computed on the system. If necessary an update of the correlation rules is launched. Once a modification on the set of rules is triggered (at time t 1 ), the correlation engine suspends its analysis of the flow of low level alerts to update its data structures. When a correlation rule is suppressed, the corresponding automaton and all the associated plans are removed. When an new rule is defined, the initial plans are created.

t1 t2

Window of events Update period Already analyzed Never analyzed

Fig. 4: Log of Events when an Update of the Set of Rules Occurs

When the analysis can start again (at time t 2 , Figure 4), for all the rules, the correlation engine analyzes the flow of incoming low level alerts from the point where it stopped (time t 1 ). Yet, regarding the new rules (and only for them), an alternative solution consists in replaying part of the most recent low level alerts that have been already considered before the new set of rules has been adopted. When a change occurs, the time that elapses between the notification of the change and the end of the update (i.e., t 2 -t 1 ) is not mastered. Yet low level alerts that occur during this interval are useful for the recognition of the new scenarios. Moreover, as a new rule often replaces a previous one that has been suppressed during the update, low level alerts that have been generated before this interval may also be useful. Thus it is necessary to manage an history of events on a period of time sufficient to detect attacks occurring during the changes of the architecture. In practice, a time window of several minutes is used. In the proposed solution, the size of the window is dynamically adapted: it is reduced when the workload of the correlation engine is high. At time t 2 , the number of low level alerts that have been received and never analysed is a good measure to estimate the current workload of the correlation engine.

V. ASSESSMENT AND MEASURES

In the context of the European project PANOPTESEC, partners have created an emulation environment which corresponds faithfully to the system for energy distribution managed by the main stakeholder of the project: a water and energy distribution company of Italy. The original system is based on SCADA equipments and communication protocols. Obviously, as lives and critical infrastructure are at stake, our new software components cannot be integrated and tested directly within the operational network. The emulation platform that has been realized integrates devices and software that are exactly the same as those used in the disaster recovery site of the company. In particular some used physical system are in fact cold stand-by devices located in the Disaster Recovery site. To obtain an emulated environment very similar to a recent snapshot of the real one, elements of the production environment have been combined with virtualized clones. In the emulated environment, real data generated at runtime by the devices are mixed with real SCADA traffic.

This emulated environment allows us to work on realistic data. In particular, at runtime, the other components feed our correlation engine with sets of correlation rules and a flow of low level alerts that are very representative of what would have been obtained in the real system. The flow of low level alerts is generated by the various security devices integrated in the SCADA system. As indicated before, we limit the exploitation of the attack graph to attack scenarios of length less or equal to 5. This allows us to have sets of nearly 20 thousands correlation rules. To obtain this number of rules, the generator of rules (quite close from [START_REF] Jajodia | Topological Analysis of Network Attack Vulnerability[END_REF]) was tuned to generate sequences without trying to merge rules with a same prefix. Moreover, as some nodes have different communication interfaces, the number of discovered topological paths (and thus the number of correlation rules) is rather high.

Note that during the PANOPTESEC project [START_REF]PANOPTESEC Project[END_REF], another partner (Sapienza University of Rome) was in charge of developing the same services using an existing software, namely the Complex Event Processing engine Esper [START_REF] Espertech | Esper product webpage[END_REF]. Their querybased tools exhibit quite similar performances when the set of rules is stable. Their query-based approach allows to consider other approximations of the scenario (for example, they can check if all the steps of a scenario occur in an order that is not the one described by a rule). Yet, using an on-shelf component appears to be less performant and flexible when the set of queries may change: a complet reset is more often unavoidable. Moreover it is sometimes more difficult to obtain information that concerns all the queries/rules. For example, in the automata-based approach, it is trivial to identify a low level alert that did not allow to advance in any scenario recognition. Memory management is also less easy to manage directly in the query-based approach.

A. Accuracy and Amount of Raised Alerts

First the accuracy of the whole intrusion detection process has been evaluated. As the emulation platform is a controlled environment, we can assert with an high level of confidence that no attack is underway as long as an attack scenario is not explicitly played by us. When the parameters (namely M ax k for the Missing Alerts and the threshold for the Ongoing Alerts) are tuned in a reasonable way, no false positive has been generated. With a few multi-step attack scenarios against the command and control centres, we study the occurrence of false negatives. When the knowledge base used both to generate the attack graph and to enrich alerts is up-to-date, all the attacks have been detected. Yet, when some IDSes are not able to detect attack steps, false negatives may occur. Among the played attacks, one attack is a denial of service attack against high voltage nodes of the infrastructure. In a first step, an external attacker exploits SMB vulnerabilities to take the control of the file server of a first machine. Then this machine is used as a gateway. In a second step, an archive server on a second machine is compromised. At this stage, the attacker is now able to open connections with all the high voltage Front End devices. In a third step, the attacker gains control of one of them by exploiting a vulnerability of the running ftp server. From this compromised front end, the attacker performs ssh connections with the other active front ends to send shutdown commands. Communication paths from SCADA Servers to RTUs (Remote Terminal Units) are broken. The command and control system is taken offline.

Regarding the above scenario, we provide now more detailed information about the raised alerts. Our objective is to distinguish complete alerts (where all the attack steps are identified) from Ongoing Alerts (where only a prefix is identified) and from missing alerts (where one step is missing). To show the interest of the k-missing algorithm and to show that false negatives may occur if the deployment and/or the configuration of some IDSes is not satisfactory, we have considered two different settings. In one case, all the steps of the attacker have been recognized and at least one low-level alert refers to each of them. In the second case, the second step of the attack remains undetected. Results are summarized in Table III.

= 0 0 0 0 M ax k = 1 0 1 45
Around 20 thousands correlation rules were specified. A complete and exact alert is raised when all the attack steps of a given scenario are identified. When a missing attack step is allowed, a complete alert is always raised. A false negative (i.e., the lack of a complete alert) only occurs in case 2 when Algorithm 1 is running (i.e., max k = 0). Note that the number of Ongoing Alerts remains quite low (equal to either 0, 12, or 45) except in case 1 when max k = 1 (equal to 320). Indeed in this particular case, as all the steps of the attack are observable in the flow of low level alerts, the use of the joker does not palliate the absence of a specific type of low level alert. Here the use of the joker leads to identify variants of the right attack scenario. More precisely, many Ongoing Alerts will correspond to correlation rules where the first step differs (the attacker can select different entry points) or the third step differs (the attacker can select different front end devices). In some sense, all these additional alerts are approximations of the right one: their multiplicity does not mean that they are without interests. Moreover, as each alert is explicitly tagged "Complete and Exact", "Complete with Missing" or "Ongoing", the administrator can adopt this order of priority during the analysis of the alerts already received: the many Ongoing Alerts are useful as long as no complete alert is available.

B. Performance Evaluation

The environment used for the evaluation (i.e., the machine on which the correlation engine runs) has the following characteristics: Intel(R) Core(TM) i7-4500U CPU @ 1.80GHz, RAM 4GB.

1) Initialization Time and Updates: The time required to initialize all the data structures is linear with the number of rules (Figure 5). Only one plan is created per automaton when In the worst case, at runtime, an update may lead to suppress all the previous rules and to consider a whole set of new rules.

In that case, the analysis may be suspended during a period of several hundreds of milliseconds. Yet most of the time, updates are incremental and impact a much smaller number of rules. Of course, the set of rules can be spread over several machines to considerably reduce this cost.

2) Tolerated Rate of Incoming Low Level Alerts: Here we analyse the highest rate tolerated when no garbage collection is launched and no update of the set of rules is performed. Obviously, the percentage of low level alerts that corresponds to attack steps of some rules has an influence on processing times. Thus we create an artificial flow of alerts where this parameter is taken into account. Five percentages are considered (0%,10%,30%,50%,100%). Through an analysis of real logs, it seems that a realistic percentage is usually between 10% and 30%. To see the cost of generating Missing Alerts, we analyze the two cases M ax k = 0 (Algorithm 1) and M ax k = 1 (Algorithm 2). Moreover, to show the interest of distributing the rules on two machines (which analyze the same flow), we indicate the maximum rate for the complete set of rules (18767 rules) and for half (9384 rules). The results are described in Table IV.

3) Memory Consumption: Memory consumption is a real problem because the number of plans grows continuously. When M ax k = 1, the garbage collector approach (Figure 6) is compared with an extreme case where only the most advanced plans are kept (Figure 7). The first figure shows that new plans are continuously created while the second figure indicates that the number of most advanced plans is bounded. A mixing between the two approaches seems to be the best strategy to obtain a good tradeoff between the memory consumption and the accuracy of the analysis. If an attack occurs, it will be detected even if all the plans except the most advanced ones have been suppressed. Yet, when the alert is raised, the administrator is not informed of all the combinations of low level alerts that are matching with the scenario. For example, the administrator may have a partial view of the situation when several distinct attackers are concurrently executing the same attack. Keeping additional plans, even if they are not tagged as being one of the most advanced plans is a simple solution to tackle these extreme cases.

VI. CONCLUSION

In distributed systems and in particular in industrial SCADA environments, alert correlation systems are necessary to identify complex multi-step attacks within the huge amount of alerts and events. We have described an automata-based correlation engine developed in the context of a European project where the main stakeholder was an energy distribution company. In the proposed solution, a fully automated process generates thousands of correlation rules. Despite this major scalability challenge, the designed correlation engine exhibits good performances. Expected rates of incoming low level alerts approaching several hundreds of elements per second are tolerated. Moreover, the used data structures allow to quickly handle dynamic changes of the set of correlation rules.

Fig. 1 :

 1 Fig. 1: A Correlation Tree

Fig. 2 :

 2 Fig. 2: Basic Correlation Trees and their Automata

Fig. 5 :

 5 Fig. 5: Time Required to Initialized the Whole Set of Rules max k = 0. More than one plan is created when max k = 1.In the worst case, at runtime, an update may lead to suppress all the previous rules and to consider a whole set of new rules. In that case, the analysis may be suspended during a period of several hundreds of milliseconds. Yet most of the time, updates are incremental and impact a much smaller number of rules. Of course, the set of rules can be spread over several machines to considerably reduce this cost.2) Tolerated Rate of Incoming Low Level Alerts: Here we analyse the highest rate tolerated when no garbage collection is launched and no update of the set of rules is performed. Obviously, the percentage of low level alerts that corresponds to attack steps of some rules has an influence on processing times. Thus we create an artificial flow of alerts where this parameter is taken into account. Five percentages are considered (0%,10%,30%,50%,100%). Through an analysis of real logs, it seems that a realistic percentage is usually between 10% and 30%. To see the cost of generating Missing Alerts, we analyze the two cases M ax k = 0 (Algorithm 1) and M ax k = 1 (Algorithm 2). Moreover, to show the interest of distributing the rules on two machines (which analyze the same flow), we indicate the maximum rate for the complete set of rules (18767 rules) and for half (9384 rules). The results are described in TableIV.3) Memory Consumption: Memory consumption is a real problem because the number of plans grows continuously. When M ax k = 1, the garbage collector approach (Figure6) is

Fig. 7 :

 7 Fig. 6: Garbage with Threshold

  Table I describes the different computation steps. It must be

	Algorithm 1 Plan management algorithm
	1: procedure INITPLANS(A)
	2:	p ← NEWPLAN
	3:	p.A ← A
	4:	p.H ← ∅
	5:	p.S ← 0
	6:	COMPUTEFUTURE(p)
	7: end procedure
	8: procedure RECOGNISEATTACK(event)
	9:	MANAGEPLANS(event)
	10: end procedure
	11: procedure MANAGEPLANS(event)
	12:	P ← PLANSSUBSCRIBED(event)
	13:	for all Pi in P do
	14:	p ← NEWPLAN
	15:	p.A ← Pi.A
	16:	p.S ← NEXTAUTOMATONSTATE(p.A, Pi.S, event)
	17:	p.H ← Pi.H+event
	18:	if ISFINALSTATE(p.S) then
	19:	GENERATEALERT(p)
	20:	DELETEPLAN(p)
	21:	else
	22:	GENERATEONGOINGALERT(p)
	23:	COMPUTEFUTURE(p)
	24:	end if
	25:	end for
	26: end procedure
	27: procedure COMPUTEFUTURE(p)
	28:	f uture ← NEXTTRANSITIONS(p.A, p.S)
	29:	SUBSCRIBE(p, f uture)
	30:

TABLE I :

 I Recognition process

	Low Parent		Subscribed
	Level Plan	New Plan	Event
	Alerts
	-	-

  Plan management k-missing algorithm 1: procedure INITPLANS(A, max k )

	2:	p ← NEWPLAN
	3:	p.A ← A
	4:	p.H ← ∅
	5:	p.S ← 0
	6:	p.k ← max k
	7:	COMPUTEFUTURE(p)
	8: end procedure
	9: procedure RECOGNISEATTACK(event)
	10:	MANAGEPLANS(event, false)
	11: end procedure
	12: procedure MANAGEPLANS(event, missing)
	13:	P ← PLANSSUBSCRIBED(event)
	14:	for all Pi in P do
	15:	p ← NEWPLAN
	16:	p.A ← Pi.A
	17:	p.S ← NEXTAUTOMATONSTATE(p.A, Pi.S, event)
	18:	p.k ← Pi.k
	19:	event.missing ← missing
	20:	if missing then
	21:	p.k ← p.k -1
	22:	end if
	23:	p.H ← Pi.H+event
	24:	if ISFINALSTATE(p.S) then
	25:	GENERATEALERT(p)
	26:	DELETEPLAN(p)
	27:	else
	28:	GENERATEONGOINGALERT(p)
	29:	COMPUTEFUTURE(p)
	30:	end if
	31:	end for
	32: end procedure
	33: procedure COMPUTEFUTURE(p)
	34:	f uture ← NEXTTRANSITIONS(p.A, p.S)
	35:	SUBSCRIBE(p, f uture)
	36:	P ← P ∪ {p}
	37:	if p.k > 0 then
	38:	for all event in f uture do
	39:	MANAGEPLANS(event, true)
	40:	end for
	41:

1 ; b 1 ; e 1 ; c 1 ; d 2 . Note that, in Algorithm 2

TABLE II :

 II Recognition process 1-missing Algorithm {A, (3), {a 1 , b 1 , c 1 }, k=1} D p 14 p 15 = {A, (5), {a 1 , b 1 , c 1 , D}, k=0} {A, (5), {a 1 , C, b 1 , d 2 }, k=0} {A, (5), {a 1 , b 1 , C, d 2 }, k=0} {A, (5), {a 1 , b 1 , c 1 , d 2 }, k=1}

	Low Parent		Subscribed
	Level Plan	New Plan	Event
	Alerts
	-	-	p 0 = {A, (0), {}, k=1}	A
		p 0	p 1 = {A, (1), {A}, k=0}	B, C
	a 1	p 0	p 2 = {A, (1), {a 1 }, k=1}	B, C
		p 2	p 3 = {A, (2), {a 1 , C}, k=0}	B
		p 2	p 4 = {A, (2), {a 1 , B}, k=0}	C
	d 1	-	-	-
	b 1	p 1	p 5 = {A, (2),{A, b 1 }, k=0}	C
		p 2	p 6 = {A, (2), {a 1 , b 1 }, k=1}	C
		p 3	p 7 = {A, (2), {a 1 , C, b 1 }, k=0}	D
		p 6	p 8 = {A, (3), {a 1 , b 1 , C}, k=0}	D
	e 1	-	-	-
	c 1	p 1	p 9 = {A, (4), {A, c 1 }, k=0}	B
		p 2	p 10 = {A, (4), {a 1 , c 1 }, k=1}	B
		p 10	p 11 = {A, (3), {a 1 , c 1 , B}, k=0}	D
		p 4	p 12 = {A, (3), {a 1 , B, c 1 }, k=0}	D
		p 5	p 13 = {A, (3), {A, b 1 , c 1 }, k=0}	D
		p 6	p 14 = Complete & Missing
	d 2	p 7	p 16 = Complete & Missing
		p 8	p 17 = Complete & Missing
				Complete & Missing
		p 14	p 21 = Complete & Exact

p 11 p 18 = {A, (5), {a 1 , c 1 , B, d 2 }, k=0} Complete & Missing p 12 p 19 = {A, (5), {a 1 , B, c 1 , d 2 }, k=0} Complete & Missing p 13 p 20 = {A, (5), {A, b 1 , c 1 , d 2 }, k=0}

TABLE III :

 III Detection of an Attack Scenario Composed of 4 Steps

	Setting	Case 1 (second step detected)
	Type of	Complete	Complete	Ongoing
	Alerts	& Exact	with Missing
	M ax k = 0	1	0	12
	M ax k = 1	1	20	320
	Setting	Case 2 (second step not detected)
	Type of	Complete	Complete	Ongoing
	Alerts	Exact	with Missing
	M ax k

TABLE IV :

 IV Average Number of Analyzed Low Level Alerts per Second

		M ax k = 0	M ax k = 1
	Matching %	18767 rules	9384 rules	18767 rules	9384 rules
	0%	15178	15363	14901	15017
	10%	4048	4208	3981	4098
	30%	1200	1300	1060	1172
	50%	770	825	676	703
	100%	347	708	260	485

Complete & Exact Alert

ACKNOWLEDGMENT This work has been partially supported by the European Union Seventh Framework Programme under grant agreement No. 610416 (PANOPTESEC) and by the French Ministry of Defence (DGA).


Philippe Borsa

Bertrand Richer De Forges

Julien Baudat-Franceschi

Keep cruises off remote coral reefs

To be cited as: Borsa P, Richer de Forges B, Baudat-Franceschi J (2018) Keep cruises off remote coral reefs. Nature 558, 372. doi : 10.1038/d41586-018-05453-x

Keep cruises off remote coral reefs

Just 3% of the world's coral reefs remain in near-pristine condition; about onethird of these are located in the Coral Sea in the South Pacific Ocean. The Chesterfield reef ensemble, one of the world's largest atolls, is an example. It is part of France's overseas territory of New Caledonia, and its remoteness has so far preserved its wealth of biodiversity. We therefore call for the territory's government to drop its plans to open these precious reefs to the destructive effects of cruise ships and mass ecotourism.

The Chesterfield reefs were spared the 2016 mass-bleaching phenomenon that affected coral reefs around the world. They host the largest seabird colonies in the tropical western Pacific. Indeed, nitrogen from seabird guano may contribute to the resilience of reef-building corals. Comprising a remarkable variety of corals, the reefs host an abundance of diverse fish shoals and species such as the threatened fairy tern (Sternula nereis), several endemic marine gastropods and an endemic sea snake (Hydrophis laboutei). They are also a nesting site of regional importance for the green sea turtle (Chelonia mydas).

Cruise ships will inevitably disrupt the reef and lagoon habitats and fauna. Their hundreds of passengers will lethally disturb breeding seabird colonies, by repeatedly scaring away nesting adults. This could particularly affect the brown booby (Sula leucogaster), the lesser and greater frigatebirds (Fregata ariel and F. minor) and the sooty tern(Onychoprion fuscatus).

Philippe Borsa, Bertrand Richer de Forges Institut de recherche pour le développement, Nouméa, New Caledonia. Julien Baudat-Franceschi Corte, France. philippe.borsa@ird.fr


Americo Cunha

Fernando Luís

Figueira Da Silva

Figueira

Development of an Adaptive Technique to Reduce Combustion Thermochemistry

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

The numerical study of combustion requires description of chemical kinetic mechanisms of the reactions involved in the process. Typically, a detailed chemical kinetic mechanism for description of hydro-carbons reaction with air involves tenths of species, hundreds of elementary reactions and timescales that vary up to nine orders of magnitude.

The solution of a detailed reaction mechanism is computationally demanding. This leads to the development of techniques that allow the reduction of the computational cost of the problem. A methodology that may allow to decrease the computational time by three orders of magnitude is the in situ adaptive tabulation (ISAT), proposed by Pope (1997). The objective of this work is the development of such a technique.

Americo Barbosa da Cunha Junior, Luís Fernando Figueira da Silva

Pontifícia Universidade Católica do Rio de Janeiro americo.cunhajr@gmail.com | luisfer@esp.puc-rio.br

  Pope, S. B. Computationally efficient implementation of combustion chemistry using in situ adaptive tabulation, Combustion Theory Modelling, Vol. 1, No. 1, pp 41-63, 1997

Acknowledgement

To professor Guenther Carlos Krieger Filho for providing the code which serves as example to the present. The first author acknowledge CNPq and FAPERJ for the financial aid.

Development of an Adaptive Technique to Reduce

Combustion Thermochemistry

Methodology

The ISAT technique was implemented in a structurade modular ANSI C computational code. Currently this code is being submited to a series of functional verification tests to check if the algorithm was implemented correctly.

Final Remarks

In the near future its expected to test the ISAT method in the modelling of a transient one-dimensional perfect reactor, which is a stringent than situation than the current one.

This technique should be coupled to an existing Lardy Eddy Simulation (LES) code in a combustion modelling approach which would allow to combine detailed information about thermochemistry and large scale flow fields.