Jonathan Rodriguez
email: jonathan.rodriguez@airbus.com

Luc Gaudiller
email: luc.gaudiller@insa-lyon.frsimon.chesne@insa-lyon.fr

Simon Chesné

Paul Cranga
email: paul.cranga@airbus.com

Simon Chesne

Control of an helicopter main gearbox active suspension system

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

NOMENCLATURE

b Number of blades of the main rotor Ω Rotational speed of the main rotor [rad.s -1 ] MGB Main gearbox FR front right actuator FL front left actuator RR rear right actuator RL rear left actuator V Potential energy T Kinetic energy Q nc Non conservative generalized forces q Generalized coordinates vector τ Actuation vector M Mass matrix K Stiffness matrix D Damping matrix ξ i modal damping of the i th mode K f voice coil actuator force constant K s voice coil actuator back EMF constant R voice coil actuator resistance L a voice coil actuator inductivity x act voice coil actuator displacement Φ modes shape matrix F x i dynamic force magnitude on longitudinal axis for i th harmonic F y i dynamic force magnitude on lateral axis for i th harmonic F z i dynamic force magnitude on vertical axis for i th harmonic M x i dynamic moment magnitude on longitudinal axis for i th harmonic M y i dynamic moment magnitude norm on lateral axis for i th harmonic M z i dynamic moment magnitude norm on vertical axis for i th harmonic φ f x i dynamic force phase on longitudinal axis for i th harmonic φ f y i dynamic force phase on lateral axis for i th harmonic 1 φ f z i dynamic force phase on vertical axis for i th harmonic φ mx i dynamic moment phase on longitudinal axis for i th harmonic φ my i dynamic moment phase on lateral axis for i th harmonic φ mz i dynamic moment phase on vertical axis for i th harmonic E number of error sensors R number of actuators L filtering order w(t) weighting factors vector y(t), u(t) control command signals d(t) disturbance signal vector e(t) error signal vector x(t) reference signal vector X(t) reference signal matrix X ′ (t) filtered reference signal matrix Ŝ(s) transfer functions estimation matrix µ convergence factor α leak coefficient Q weighting matrix for FXLMS [A B C D] state space system matrices

INTRODUCTION

Vibrations have always been a main issue in helicopter design, flight handling and crew comfort. Firstly, aerodynamic forces acting on blades create heavy cyclic loads on the rotor hub. Then, a helicopter includes many rotating parts at a wide range of frequencies from the engines to the main gearbox and the rotor hub. Finally, external aerodynamic charges coming from air flow exciting the structure also create vibrations inside the cabin. This paper will focus on the cyclic loads due to main rotor which major part of there energy is acting at the frequency bΩ (see [START_REF] Bramwell | Bramwells Helicopter Dynamics[END_REF] p290 to 294). Many passive anti-vibration devices were designed since the early 70's going from simple elastomeric mounts for the main gearbox to more complex vibration absorbers.

In 1976, Flannelly describes in [START_REF] Flannelly | The dynamic anti-resonant vibration isolator[END_REF] an anti-resonant vibration absorber called DAVI which uses a rigid arm carrying a small mass (bobweight mass). This flapping inertia creates an anti-resonance at the desired frequency depending on the tuning parameters (flapping mass, dynamic amplification, overall stiffness). Based on this principle, in the early 90's Eurocopter company develops the SARIB R , an efficient passive suspension between the main gear box and the structure creating an anti-resonance at the bΩ frequency. Another example of effective passive anti-resonant absorber is the Lord Fluidlastic R [START_REF] Michael | The model 427 pylon isolation system[END_REF] which also applies the DAVI principle. A high density fluid with low viscosity (mercury was used for the first prototypes) is moving between two chambers. These two chambers communicate by an inner cylinder with a reduced section which create a dynamic amplification. The fluid inertia acts exactly the same as the tuning weight on the arm of the DAVI. Elastomeric parts play as mechanical spring and the overall system has a frequency response equivalent to the DAVI. Using a fluid allows a much more compact device but force to deal with its inherited viscosity, creating damping a the anti-resonance frequency and so lowering its efficiency.

With the fade-in of variable engine RPM during flight, it became relevant to consider having active suspension systems to "track" the main frequency bΩ. Intents have been done to integrate such systems to the struts [START_REF] Sutton | Active isolation of multiple structural waves on a heli-copter gearbox support strut[END_REF] but low power actuators could only control high frequency vibrations. In 1993, Eurocopter also developed in partnership with Liebherr an active hydraulic strut, able to counteract directly the low frequency rotor hub loads (see [START_REF] Bramwell | Bramwells Helicopter Dynamics[END_REF] for principle). The control was acting at 30Hz, 4 actuators were generating 2.5kN each and a 70% global vibration level reduction was achieved. Unfortunately the overall system remained too heavy and complex to maintain for an industrial application.

During the last years, active vibration absorbers have also been placed directly in the cabin to be as close as posible to the deck. In [START_REF] Vignal | Development and qualification of active vbration control system for the eurocopter ec225/ec725[END_REF] and [START_REF] Benjamin Kerdreux | Vibration comfort through active cabin vibration control and its certification on ec130t2[END_REF] it is shown that several low power actuators (1kW for the overall system) cleverly placed in the cabin, near structural parts could achieve a significant reduction in vibration level and adapt itselves to variable RPM with a suitable control. In 2006, Lord presented its well known Fluidlastic R pylon in its active version [START_REF] Mcguire | Active vibration control using fluidlastic pylon strut[END_REF]. An hydraulic actuator acts on the fluid and allows to control the output force of the pylon. Theoretically, the force generated by the actuator cancels the system damping due to the fluid at the anti-resonance frequency. The passive fluid inertia forces cancel around 70% of the input while the active force can virtually cancel the remaining 30%. The main advantage of DAVI principle combined with an active part is that the power required to cancel the bΩ frequency is much less than an active strut thanks to the anti-resonance phenomenon.

This paper considers control of a helicopter suspension between the main gearbox and the structure based on DAVI principle (Eurocopter SARIB R ). Different FXLMS controllers will be compared. Efficiency will be studied for a bandwidth centered at the original anti-resonance frequency of the DAVI (bΩ + / -10%). As for every controller, efficiency and power consumption will also be comparison criteria. Design of the controllers was done using a complete three-dimensionnal multibody model of the SARIB R suspension coupled to a rigid gear box and rotor hub and a modal base of a heavy-weight helicopter fuselage. The use of a full structure model allows to be more predictive about the vibration level expected in the cabin and have much more possibilitites of locations for the error sensors (force or acceleration).

The outline of the paper is as follows, in section 2 the system model will be discussed which consists of an introduction to the active SARIB R suspension, the fuselage model that will be used for simulation and the rotor dynamic loads. After this the main control problem will be presented and the controller design will TABLE 1: NH90 main model parameters be presented in detail. In section 5, the simulation results will be presented. Finally, conclusions are drawn in section 6.

SYSTEM MODEL

In this section will be described the model used for the simulation of the active suspension system. As a basis for the model set up, the Eurocopter NH90 was used (figure 1). First of all, it was one of the two Eurocopter helicopters to already have an operational passive SARIB R suspension. Then active suspensions are well suited for heavy-weight helicopters due to high level of vibrations coming from the rotor hub and the space available on the upper deck superior to smaller machines. In the table 1, the NH90 main parameters that are used for the multibody model are shown.

The active SARIB R suspension

The active SARIB R suspension based on DAVI principle (see figure 2) consists of 4 individual units around the gearbox. Each unit includes a leaf spring, a rigid flapper arm carrying the flapper mass and a strut to link the gearbox to it. A 2 dimensionnal view of the dynamic model of this system is presented on figure 3 and some main parameters are presented in the table 2. For more accurate behaviour of the model, it has been added

k b strut stiffness [N.m -1 ] k l leaf spring stiffness [N.m -1 ] k f fitting stiffness [N.m -1 ]
TABLE 2: SARIB R isolated unit main parameters the struts stiffness (k b ), the fittings linking the flapper arm to the structure (k f ), and the leaf spring linking the flapper arm to the main gearbox (k l ). The command force u is generated by an actuator acting between the flapper mass and the main gearbox in order to control the relative rotational movement of the flapper arm with respect to the structure. As the inertia of the mass m b defines the DAVI anti-resonance frequency, controlling its movement around this particular frequency allows a low power atuator like a voice-coil to significantly reduce the suspension's transmissibility for a small bandwidth.

Once the model of the isolated SARIB R unit is defined, it has to be implemented to a full three dimensional multibody model. As it is presented in figure 4, this model includes the ro-

-1.2 -1 -0.8 -0.6 -0.4 -0.2 0 0.2 0.4 0.6 -1 -0.5 0 0.5 1 -1.5 -1 -0.5 0 x [m] y [m] z [m]
Main Gearbox flapper arms struts engines engine rods FIGURE 4: 3D SARIB suspension model tor hub and the main gearbox linked rigidly, four SARIB R units, two engines with their links to the main gearbox and the structure. Equations of motion are first computed using Lagrangian method [START_REF] De Wouw | Multibody Dynamics Lecture Notes[END_REF] as follows:

d dt (T, q ) -T, q +V, q = (Q nc ) T (1)
As we avoid putting contraints in the system by replacing all joints between bodies by springs, Lagrange multipliers are not needed. The equation (1) can know be rewritten in the following form:

M(q) q + H(q, q) = S(q)τ (2)
with the matrix H containing all Coriolis terms, joint flexibility effects and gravitationnal effects. In order to study the frequency behaviour of the model, we split the generalized coordinates q = q e +q l (t) in a constant part q e corresponding to equilibrium point and a linear time dependent part q l (t). This new formulation of (2) leads to the linearization of the problem and we obtain

M ql (t) + D ql (t) + Kq l (t) = S τ l (t) (3)
For frequency behaviour, it is more convenient to use modal damping. From the mass and stiffness matrices, the mode shapes matrix Φ is computed by eigenvalue decomposition. The modal

M mod = Φ T M Φ K mod = Φ T K Φ (4)
With ξ i as the modal damping coefficient of the i th mode, The modal damping matrix D mod is a diagonal matrix whose terms are

D mod i = 2ξ i K mod i M mod i (5)
Finally, the matrix damping used is

D = (Φ T ) -1 D mod Φ -1 (6)

Fuselage model

Once the multibody model of the whole suspension is set up, it is coupled to a modal base from a fuselage FEM model (see [START_REF] Cranga | Helicopter dynamic behavior contribution to general architecture definition[END_REF]) condensated using Craig and Bampton method [START_REF] Craig | Coupling of substructures for dynamic analysis[END_REF]. This model includes nodes situated at the pilot and copilot seats and feet added to eight nodes uniformly placed on deck and a node corresponding to the tail rotor (see figure 5). Let us define p the fuselage number of DOF, n the number of common nodes from the two models and m the free DOF of the suspension multibody model. The fuselage mass and stiffness matrix extracted from Craig and Bampton are in the form:

M f us = I p M f us 1,2 M T f us 1,2 M f us 2,2 K f us = K f us 1,1 0 0 K f us 2,2 (7)
With M f us 2,2 ∈ ℜ [n×n] , K f us 1,1 ∈ ℜ [p×p] and K f us 2,2 ∈ ℜ [n×n] . K f us 1,1 is defined as diagonal matrix. The multibody model presented in the previous section can also be rearranged to this form:

M = M 1,1 0 0 M 2,2 K = K 1,1 K 1,2 K 2,1 K 2,2 (8)
With

M 1,1 ∈ ℜ [n×n] ,M 2,2 ∈ ℜ [m×m] ,K 1,1 ∈ ℜ [n×n] and K 2,2 ∈ ℜ [m×m]
. It is now obvious that the equations of motion of the complete model can be written as follows:

  I p M f us 1,2 0 M T f us 1,2 M f us 2,2 + M 1,1 0 0 0 M 2,2   q + (9)   K f us 1,1 0 0 0 K f us 2,2 + K 1,1 K 1,2 0 K 2,1 K 2,2   q + D q = 0 S τ (10)
S ∈ ℜ [(m+n)×k] with k defined as the number of inputs of the model. The damping matrix D is computed using the same method as in the equations ( 4) to (6).

Actuator dynamics

In order to bring additional mechanical energy to the system, four voice coil actuators (see figure 6) are added as shown in figure 3. This technology choice is made regarding the specifications of electromagnetic actuation compared to hydraulic for instance. Voice coil actuators allow low time response and easy control of the generated force by voltage and current supply. Furthermore, the high weight of the permanent magnets is also used as passive bobweight mass which reduces significantly the mass cost of such system comparing active and passive device. During flight, the controller computes the necessary force to be generated by each actuator of the suspension. As presented in common litterature [START_REF] Preumont | Vibration Control of active structures, an introduction[END_REF], the current and voltage supply of the actuators can be derived from these expressions:

F act (t) = K f I(t) U(t) = L a İ(t) + RI(t) + K s ẋact (t) (11)
with U, I and x act (t) representing respectively the voltage supply, current supply and the actuator displacement. F act is the force

K f force constant [N.A -1 ] K s back EMF effect constant [V.s.m -1 ] L a coil inductivity [H] R coil resistance [Ω]

Rotor hub input

In [START_REF] Bramwell | Bramwells Helicopter Dynamics[END_REF], the theoretical calculation of the dynamic rotor loads are presented. when passing from the rotating rotor fixed frame to the structure fixed frame, it is demonstrated that the forces and moments transmitted from the blades to the fuselage are in the following form:

τ r (t) =             ∑ n i=1 F x i e ibΩt-φ f x i ∑ n i=1 F y i e ibΩt-φ f y i ∑ n i=1 F z i e ibΩt-φ f z i ∑ n i=1 M x i e ibΩt-φ mx i ∑ n i=1 M y i e ibΩt-φ my i ∑ n i=1 M z i e ibΩt-φ mz i             (12)
The amplitude of every harmonics ibΩ is decreasing with the frequency which explains that most of the vibrational energy comes from the first component at bΩ. This is tipically to reduce acceleration level in cabin around this frequency that the controller is designed for. For the Airbus Helicopter NH90, bΩ = 17Hz so the controller should emphasize on a bandwidth b ω = [15 -19]Hz. Forces and moments amplitudes also change regarding to the

CONTROL PROBLEM

In a helicopter, the global objective is to improve the pilots and crew comfort. Since exposure to vibrations for humans inside transports is submitted to legislation (see [START_REF]Guide for the evaluation of human exposure to whole-body vibration[END_REF]), some helicopters could never be certified without anti vibration devices. In order to attain such global objective, several ways of controlling the actuators of the active SARIB R can be considered:

• Take as objective function only signals from pilot seat/feet and copilot seat/feet accelerometers or a specific crew seat (local control). • Use all accelerometers availables on the structure to set the objective function of the controller (global control). • Use the fittings accelerometers to control the vibration transmission between the suspension and the fuselage. • Use selected accelerometers in order to control a specific mode of the structure. • Use force sensors on the struts to reduce the load transmisibility from main gearbox to the structure.

As long as all these objectives are not necessarily compatible and even can be opposite, a choice has to be made regarding efficiency and mission needs (crew transport for offshore is different to sea surveillance for instance).

CONTROLLER DESIGN: FXLMS with derivative state feedback

The controllers designed for the suspension system are called FXLMS [START_REF] Sen | Active Noise Control Systems, Algorithms and DSP implementations[END_REF] (Filtered X Least Mean Square) from the adaptive control theory also often used for noise control. This algorithm uses a reference signal (feedforward control) to generate command inputs which update at each time step to gradually reduce the RMS norm of the error signals. It is called adaptive as the controller parameters are time dependent.

The principle of FXLMS method is presented on figure 7 with P and S as the dynamic model controlled (Plant). R is defined as the number of actuators (4 for the active SARIB R and E as the number of error sensors. The rotor RPM information is used in order to build the reference signal x(t) = [cos(Ωt) sin(Ωt)] T . Then the reference vector x(t) is computed:

x(t) = [x 1 (t) x 2 (t) • • • x L (t)] T (13)
L is defined as the order of the adaptative filters (length of x(t)). The next step consists in computong the adaptive weighting vector w(t):

w(t) = [w T 1 (t) w T 2 (t) • • • w T R (t)] T (14)
with

w r (t) = [w r,0 (t) w r,1 (t) • • • w r,L-1 (t)] T , r ∈ [1, R] (15)
Finally, the command vector y(t) ∈ ℜ [ R × 1] corresponding to the ideal signals sent to the actuators is defined as it follows:

y(t) = [y 1 (t) y 2 (t) • • • y R (t)] T . (16)
Each command signal is computed by filtering the reference signal with its corresponding weighting filter w r (t). This leads to the expression of the command vector y(t)

y(t) =       x(t) 0 • • • 0 0 x(t) 0 . . . . . . 0 . . . 0 0 • • • 0 x(t)       T w(t) (17) = X T (t)w(t) (18)
X ∈ ℜ [(RL)×L] is a block diagonal matrix. let S(s) be the transfer functions matrix between control actuators and each error sensors and Ŝ(s) its estimation computed as follows:

Ŝ(s) =      ŝ11 (s) ŝ12 (s) • • • ŝ1R (s) ŝ21 (s) ŝ22 (s) • • • ŝ2R (s) . . . . . . . . . . . . ŝE1 (s) ŝE2 (s) • • • ŝER (s)      (19)
The error signal vector e(t) measured by the E error sensors is defined as:

6 e(t) = d(t) -S(t) * y(t) (20)
with d(t) ∈ ℜ [E×1] the unobservable disturbance vector of the system. Combining (20) with ( 17), the following expression can be written:

e(t) = d(t) -S(t) * [X T (t)w(t)] (21)
The cost function of the algorithm is defined as the sum of the mean square errors:

ε(t) = E ∑ e=1 E[e 2 e (t)] (22)
which can be approximated by

ε(t) = e T (t)e(n) (23)
The adaptive weight vector is updated a each time step in the negative gradient direction to minimize the cost function ε(t), this update is defined as follows:

w(t + t e ) = w(t) - µ 2 ∇ε(t) (24)
µ ∈ ℜ + * is the arbitrary defined convergence factor of the algorithm. Depending on the system controlled, it exists a upper limit for the parameter µ to not exceed in order to avoid divergence of signal y(t). The gradient of ( 24) is expressed with respect to the r th vector at each time step which leads to the following important result:

∇ε(t) = -2[ ŜT (t) ⊛ x(t)]e(t) (25) = -2X ′ (t)e(t) (26)
Where ⊛ denotes the Kronecker product convolution obtained by convolving each element of ŜT (t) with x(t). The next equation presents the detailed calculation of this filtered reference matrix X ′ (t). 24), ( 25) and ( 27), the general update equation of the weighting vector is defined as:

X ′ (t) =    ŝ11 * x(t) • • • ŝE1 * x(t) . . . . . . . . . ŝ1R * x(t) • • • ŝER * x(t)    (27) =    x ′ 11 (t) • • • x ′ 1E (t) . . . . . . . . . x ′ R1 (t) • • • x ′ RE (t)    (
w(t + t e ) = w(t) + µX ′ (t)e(t) (29)
In order to have a more efficient local control on some error sensors, it is possible to premultiply the matrix X ′ by a diagonal coefficient matrix Q ∈ ℜ [E×E] .

X ′ c (t) = QX ′ (t) (30)
Furthermore, it is necessary to add a leak coefficient α in the equation ( 29) to control the norm of the command inputs. This coefficient between 0 and 1 represents the level of attenuation wanted on the error sensors. For complex systems, crossed effects between control actuators and sensors can lead to impossible convergence to the null error on every error sensor. This phenomenon explains the need of a leak coefficient included in the equations as follows:

w(t + t e ) = αw(t) + µX ′ (t)e(t) (31)
On the figure 8 is represented the global system including the main plant P, the adaptive controller and the inverse dynamics P -1 act of the actuator in order to compute the current and voltage supply necessary to generate the force signal y(t).

SIMULATION RESULTS

The parameters shown in the table 1 and 2 are put into the model and controller equations presented before. In order to compute the transfer function estimations ŝer (s) from each control actuator to every error sensor, the state space formulation is used. First is defined the state vector of the system x = [q q] T . The equations of motion can be formulated as follows:

q q = 0 I -M -1 K -M -1 D q q + 0 0 S S c τ u c (32)
with S c ∈ ℜ [2(p+n)×E] the direction control matrix and u c ∈ ℜ [E×1] the command vector containing all command inputs. This formulation leads to the state space representation

ẋ(t) = Ax(t) + Bu(t) ẏ(t) = C ẋ(t) + Du(t) (33)
One can notices that the observation matrix C is multiplying the time derivative of the state vector. This method, different than the classical one using the state vector allows to directly control the acceleration measure signals.

Ŝ(s) = Cs(sI -A) -1 B c + D c (34)
With the matrices B c and D c representing the columns of B and D from (33) multiplied by the control inputs (see S c from (32)). Now that the frequency response of each sensor to every control input is estimated, the system can be simulated. The rotor input force used to compare the performance of the controllers is a variable frequency sine wave of 8kN arbitrary amplitude in vertical direction varying from 15Hz to 19Hz in a 10s time simulation.

All the equations presented in the section before are used to design the adaptive FXLMS controller. As a comparison criteria, the RMS value of acceleration level on each sensor of the fuselage is taken. Three different controllers are computed changing one from another in the error sensors selected:

• Controller 1: 2 nodes in the cockpit corresponding to the pilot and copilot seat. • Controller 2: 2 nodes in the cabin corresponding to the frame number 6 situated under the main gearbox (high vibration level). • Controller 3: 4 nodes corresponding to the fittings linking the suspension to the structure in order to stop vibrations propagation closer to the source. • Controller 4: 2 nodes in the nose of the structure to control a bending mode situated around 17Hz.

On the tables 4, 5 and 6 are presented the main results of the simulations performed for each controller. The figure 9 presents level maps of RMS acceleration value in the structure. On these maps the x axis represents the fuselage width and the y axis its length (y = 0 means the helicopter front part). All these calculations are done with a leak coefficient α = 1 -10 -6 and a convergence factor µ = 3.10 3 . An exception has been made for the controller 4 with µ = 5.10 2 due to the structural bending mode controlled generating fast phase changes on the error sensors signal placed in the nose of the fuselage.

Simulation results show that a 20% reduction in RMS acceleration level can be achieved with the controller 3. The controller 1, emphasizing on the control of the cockpit amplifies the vibration level in the cabin (+7%). However the reverse behaviour is not verified since the controller 2 minimizes the vibration of the frame 6 in the cabin. This phenomenon can be explained by the location of the main gearbox on the frame 6 of the structure. Indeed, these nodes are closer to the vibration source and allow better control of their propagation. Following this logic, it also explains the excellent results obtained whith the controller 3 due to the very close position in the fuselage of the error sensors from the vibration source: the rotor hub. The controller 4 obtains good results minimizing the bending mode effect on the cockpit (-22.49%) but deteriotates the comfort in the cabin. One can notices in the table 5 the low power and force needed to control the vibrations of the structure around 17Hz due to the passive DAVI suspension SARIB R . Comparing the four controllers, the number 2 appears to be best compromise between efficiency and power consumption while the number 3 is the most efficient. These results show that local control or global control of vibration level in the structure always brings compromise in terms of performance localization. However, this problem is canceled when the error sensors are placed directly in the main vibration propagation path as for the controller 3.

An other simulation is performed at a fixed frequency of 17Hz with the objective to observe the convergence of the weighting filters w(t). The results are presented on figure 10. The controller is switched on at t=4s and the convergence is achieved in about 4 seconds. Even if the system is excited at the nominal frequency of the passive DAVI suspension, a reduc- tion of 21.2dB on the pilot seat and 9.36dB on the copilot seat is still reached. Even if the suspension system is symmetrically designed, a clear dissimmetry of control force from the actuators appears. This behaviour can be observed and anticipated by the use of a realistic modal base as structure to isolate instead of a rigid body. It can be noticed that front actuators needs to develop aproximately two times the forces needed for rear actuators. Furthermore, the high number of estimated transfer functions necessary to run the FXLMS algorithm (E × R) and the high importance of crossed effects between actuators and error sensors due to their non-colocalization increase the time for convergence of the weighting factors and so decrease the controller global efficiency in time response and acceleration level reduction. However, this conclusion supports the idea from previous part that controlling the vibrations transmission directly with error sensors between the suspension system and the structure improves the algorithm efficiency by minimizing phase delay and crossed effects from actuators to sensors.

CONCLUSION

A complete multibody model of a passive helicopter suspension was developed and coupled to a fuselage modal base. Then an adaptive FXLMS controller with acceleration error sensors on the helicopter structure was set up in order to command a hybrid suspension (passive vibration absorbers coupled to force actuators) based on DAVI principle. Four controllers have been tested to compare different locations for the error sensors: in the nose, the cockpit, the cabin and under the fittings of the suspension. Results show that with command forces lower than 180N we proven to decrease the RMS vibration level in the whole structure by 20%. Furthermore, for command actuators placed between the source and the structure to control, minimizing the vibration level directly on the vibration main propagation path is much more efficient than controlling local sensors inside the structure. This conclusion allows to consider relevant the choice of such active anti-vibration device regarding classical cabin vibration absorbers with only local effects in terms of global performance and hardware integration.

FIGURE 1 :

 1 FIGURE 1: Airbus Helicopters NH90 helicopter

FIGURE 2 :FIGURE 3 :

 23 FIGURE 2: DAVI principle with active control

FIGURE 5 :

 5 FIGURE 5: 3D SARIB suspension model with its associated helicopter structure

FIGURE 6 :

 6 FIGURE 6: Voice coil actuator for the active SARIB R suspension

FIGURE 9 :

 9 FIGURE 9: RMS acceleration level maps for each controller: passive suspension (a), controller 1 (b), controller 2 (c), controller 3 (d), controller 4 (e).

FIGURE 10 :

 10 FIGURE 10: switch off/on of the FXLMS control at t=4s at 17Hz (controller 1), 8kN vertical force input on the rotor hub: acceleration level on the error sensors (a), weighting filter values (b), command forces (c).

TABLE 3 :

 3 Voice coil actuator main parameters output generated by the actuator. All the parameters are listed in table3.

TABLE 4 :

 4 results

			from the simulation: 8kN vertical force input
	on the rotor hub from 15Hz to 19Hz in 10s, average vibration
	reduction compared to passive SARIB R suspension on different
	part of the helicopter for each controller.
		maximum force norm [N]	command power [W]
		FR	FL	RR	RL	FR	FL	RR	RL
	controller 1	78.7	80.65	41.83	29.69	5.8	6.1	1.59	0.73
	controller 2	92.6	89.5	32.2	34.7	8.05	7.47	0.88	0.97
	controller 3	176	161	42	40	28.86	24.2	2.37	2.08
	controller 4	81	80	38	39	6.32	6.05	1.32	1.44

TABLE 5 :

 5 results from the simulation: power consumption and actuator force necessary to each controller( FR: front right, FL: front left, RR: rear right, RL: rear left ).

			voltage supply [V]			current supply [A]
		FR	FL	RR	RL	FR	FL	RR	RL
	controller 1	4.28	3.11	1.51	1.21	2.02	2.07	1.08	0.66
	controller 2	3.5	3.36	1.06	1.15	2.38	2.3	0.83	0.9
	controller 3	8.17	7.52	2.35	2.37	4.54	4.66	1.09	1.04
	controller 4	3.77	3.11	1.37	1.25	2.06	0.99	0.99	1

TABLE 6 :

 6 results from the simulation: voltage and current supply for the actuators ( FR: front right, FL: front left, RR: rear right, RL: rear left ).


Pierre Fraigniaud

Patrick Lambein-Monette

Mikaël Rabie

Colorier le cycle sans attendre ses voisins: tolérance aux pannes dans les réseaux asynchrones †

Keywords: Réseaux asynchrones, Tolérance aux pannes, Renaming, Coloration de graphe distribuée, Algorithmes wait-free, Modèle LOCAL

Nous présentons un algorithme distribué calculant une bonne coloration du cycle 𝐶 𝑛 , à partir d'identifiants uniques initiaux, dans un modèle calculatoire totalement asynchrone et où les processus peuvent tomber en panne (crash). Notre algorithme est sans attente (wait-free) : les processus corrects terminent en un nombre borné d'étapes calculatoires, indépendamment du nombre de pannes ou des choix de l'ordonnanceur. L'algorithme est indépendant de 𝑛 ⩾ 3, et s'exécute sur 𝐶 𝑛 en 𝑂 (log * 𝑛) étapes, égalant la complexité optimale du problème dans le modèle synchrone et sans pannes. Notre algorithme est également (quasi)-optimal en nombre de couleurs utilisées -au plus six -grâce à une borne inférieure connue de 2𝑛 -1 noms nécessaires pour résoudre sans attente le problème du renommage (renaming) dans les systèmes à mémoire partagée à 𝑛 processus, dès lors que 𝑛 est une puissance d'un nombre premier. En effet, notre modèle coïncide avec le modèle à mémoire partagée pour 𝑛 = 3 processus, où cinq noms sont nécessaires au renommage distribué sans attente du système. Ce travail est le premier à considérer la tolérance forte aux pannes dans les réseaux asynchrones, et constitue un premier pas vers le rapprochement entre deux grandes théories en calcul distribué : d'une part, celle des réseaux fiables et synchrones, et, d'autre part, celle des systèmes asynchrones et sujets aux pannes.

Introduction

Objective

Two forms of coloring tasks are at the core of distributed computing. One is vertex-coloring [START_REF] Barenboim | Distributed Graph Coloring: Fundamentals and Recent Developments[END_REF] in the framework of synchronous distributed network computing [START_REF] Cole | Deterministic Coin Tossing with Applications to Optimal Parallel List Ranking[END_REF][START_REF] Linial | Locality in Distributed Graph Algorithms[END_REF], the so-called LOCAL model. The other is renaming [START_REF] Attiya | Renaming in an asynchronous environment[END_REF] in the framework of asynchronous shared-memory or message-passing distributed computing [START_REF] Herlihy | The topological structure of asynchronous computability[END_REF]. For both tasks, each process 𝑝 starts with its own identifier 𝑋 𝑝 ∈ N as input, which is supposed to be unique in the system, and must compute a color as output. The identifiers are supposed to be in a large range of values (typically of size poly(𝑛) when there are 𝑛 processes), while the output colors are expected to be in a small range of values (typically { 1, . . . , 𝑘 } for some small 𝑘 ⩾ 1); depending on the context, we speak of 𝑘-coloring the network, or of 𝑘-renaming the system. In the context of network computing, the output color of every processing node must be different from the color of each of its neighboring nodes in the network. In the context of shared-memory or message-passing computing, each process's output color must be unique in the system, i.e., different from the color of any other process.

On the negative side, the distributed 2-coloring of even-sized cycles is known [START_REF] Linial | Locality in Distributed Graph Algorithms[END_REF] to be a "hard" problem, in the sense that Ω(𝑛) synchronous rounds of communication are required to solve this problem in 𝑛-node cycles. A round consists of (1) an exchange of information between the two end-points of every edge in the network, and (2) a local computation at every node. Similarly, it is known [CR10; HS99] that wait-free 𝑘-renaming an 𝑛-processes asynchronous shared-memory system is impossible when 𝑘 < 2𝑛 -1 and 𝑛 is a power of a prime number (𝑛 = 6 is the smallest integer for which this bound does not hold [START_REF] Castañeda | New combinatorial topology bounds for renaming: the upper bound[END_REF]). In this model, processes alternate between read and write operations, as dictated by an asynchronous scheduler; waitfree essentially means that each process terminates in a bounded number of read/write steps, independently from the asynchronous scheduling of the 𝑛 -1 other processes.

On the positive side, it is known that 3-coloring the 𝑛-node cycle can be achieved in 1 2 log * 𝑛 + O(1) § synchronous rounds thanks to an efficient color-reduction technique due to Cole and Vishkin [START_REF] Cole | Deterministic Coin Tossing with Applications to Optimal Parallel List Ranking[END_REF]. This bound is tight: no algorithms can 3-color the 𝑛-node cycle in less than 1 2 log * 𝑛 -1 rounds, thanks to Linial's celebrated lower bound [START_REF] Linial | Locality in Distributed Graph Algorithms[END_REF]. In shared-memory systems, while (2𝑛 -2)-coloring (a.k.a., (2𝑛 -2)-renaming) is impossible wait-free for infinitely many values of 𝑛, (2𝑛 -1)-coloring can be achieved wait-free for all values of 𝑛 ⩾ 2 [START_REF] Attiya | Renaming in an asynchronous environment[END_REF].

In pursuit of bringing these two rich lines of research closer, we study wait-free vertex coloring of the 𝑛-node cycle 𝐶 𝑛 , in a round-based and asynchronous computing model, where each round of a processing node consists of the following sequence of operations: (1) writing in its local register, (2) reading the local registers of its two neighbors in 𝐶 𝑛 , and (3) updating its local state. The rounds are asynchronous, and some processes may perform many rounds at the same time other processes perform just a few, or even zero, rounds. We address basic questions in this classic model: Is wait-free proper vertex-coloring at all possible in 𝐶 𝑛 ? If yes, with how many colors? And in how many rounds?

Related Work

The recent contributions that are the most related to our work are [START_REF] Castañeda | Making Local Algorithms Wait-Free: the Case of Ring Coloring[END_REF], and the follow up work [START_REF] Delporte-Gallet | Distributed Computing in the Asynchronous LOCAL Model[END_REF]. In these papers, the DECOUPLED model considers 𝑛 asynchronous and crash-prone processes that occupy the 𝑛 nodes of a synchronous and reliable network. It is a stronger model than the one considered here; in fact, [START_REF] Delporte-Gallet | Distributed Computing in the Asynchronous LOCAL Model[END_REF] shows that tasks solvable in poly-logarithmic time in the LOCAL model continue to be solvable, with the same complexity, in the DECOUPLED model. In contrast, some tasks that are trivial in the LOCAL model, like 3-coloring the ring 𝐶 3 , become just impossible in our fully asynchronous model.

The model considered in this paper bears similarities with some of the models used in the context of self-stabilization. Many papers (see, e.g., [START_REF] Blin | Memory Lower Bounds for Self-Stabilization[END_REF] and references therein) have addressed the design of self-stabilizing algorithms for 3-coloring the cycles, or for ( 𝛥 + 1)-coloring graphs with maximum degree 𝛥. Self-stabilization assumes that the processing elements can behave arbitrarily bad (all variables can be corrupted). The objective is to design algorithms which, starting from an arbitrary initial configuration, eventually compute a legal configuration (e.g., a configuration in which the colors assigned to the nodes form a proper coloring) whenever no failures occur during a sufficiently long period. In contrast, we assume an initial configuration in which variables are correctly set (e.g., the content of the shared registers are initialized to ⊥). However, we do not assume that the system will be failure-free during the execution of the algorithm, and the presence of crash-failures should not prevent the correct processing nodes from computing a solution. While 3-coloring the cycle 𝐶 𝑛 is possible in a self-stabilizing manner for all 𝑛 ⩾ 3, 𝑘-coloring 𝐶 3 is impossible in our fully asynchronous model for 𝑘 < 5.

Our Results

We describe a wait-free algorithm for proper coloring the 𝑛 nodes of the asynchronous crash-prone cycle 𝐶 𝑛 , given in Algorithm 1. The algorithm is independent of 𝑛 ⩾ 3, uses a palette of 𝑘 = 6 colors, and runs in 𝑂 (log * 𝑛) rounds in 𝐶 𝑛 , as expressed in our main theorem. Theorem. In any execution of Algorithm 1 over the ring 𝐶 𝑛 with a proper coloring provided by the values (𝑋 𝑝 ) 𝑝∈ [𝑛] given to the processes as input:

Colorier le cycle sans attendre ses voisins 2 Fast, wait-free coloring of the cycle Our main algorithm, given in Algorithm 1, runs two parallel "coloring" schemes in separate components: processes try to pick a unique color 𝑐 𝑝 from a small palette, while adjusting their larger identifier 𝑋 𝑝 , to speed up the first component.

The first component spans lines 7 to 10 of the algorithm, and guarantees that every process eventually adopts a color from a palette of six; call it the wait-free component. A process 𝑝 tries to find a color 𝑐 𝑝 = (𝑎 𝑝 , 𝑏 𝑝 ) that does not appear in its neighborhood. Upon success, 𝑝 returns 𝑐 𝑝 ; otherwise it tries a new color, adjusting 𝑎 𝑝 to avoid conflict with its neighbors with a larger identifier, and similarly adjusting 𝑏 𝑝 for its other neighbors. Note that 𝑎 𝑝 = 2 implies 𝑏 𝑝 = 0, and symmetrically 𝑏 𝑝 = 2 implies 𝑎 𝑝 = 0, and thus 𝑎 𝑝 + 𝑏 𝑝 ⩽ 2, resulting in a six-color palette.

Moreover, processes with locally extremal identifiers stubbornly maintain either 𝑎 𝑝 or 𝑏 𝑝 constant, and terminate quickly, leading their neighbors to become, in turn, locally extremal among the remaining active processes. Convergence then propagates through the network, from neighbor to neighbor, and the worstcase complexity thus grows with the length of the longest sequence of neighboring nodes with increasing identifiers. As such, it may take some nodes as much as Θ(𝑛) rounds before returning a color.

The second component spans lines 11 to 17, and serves to shorten such monotonous sequence through iterate calls of a function ¶ 𝑓 , adapted from Cole and Vishkin's algorithm [START_REF] Cole | Deterministic Coin Tossing with Applications to Optimal Parallel List Ranking[END_REF]. Each process 𝑝 tracks, in a counter 𝑟 𝑝 , its number of iterate calls to 𝑓 , to avoid progressing in this component faster than its neighbors, which could break the proper coloring of the identifiers, no longer unique in the system. Because of this synchronization mechanism, this component is not, itself, wait-free; call it the blocking component.

Lack of progress in the blocking component indicates that some process is progressing faster than a neighbor; in this case, the wait-free component quickly terminates. Otherwise, by construction of the function 𝑓 , each iteration of the blocking component logarithmically shrinks the identifiers, which end up in constant bounds after O(log * 𝑛) iterate calls to 𝑓 . The wait-free component then terminates in O(1) rounds, as all monotonous sequences are of bounded length.

The interaction between the two components of our algorithm guarantees that every node eventually decides a final color in { 1, . . . , 6 }, in 𝑂 (log * 𝑛) asynchronous rounds. The termination condition ensures that a process never returns a color that might have been returned by a neighbor, ensuring a proper coloring of the output.

Conclusion and future works

We have presented a wait-free distributed algorithm for proper coloring the 𝑛 nodes of the asynchronous cycle 𝐶 𝑛 , for every 𝑛 ⩾ 3. This algorithm performs in O(log * 𝑛) rounds, which is optimal, thanks to Linial's lower bound [START_REF] Linial | Locality in Distributed Graph Algorithms[END_REF] that applies even to the synchronous execution. The algorithm uses 6 colors to properly color any cycle 𝐶 𝑛 , 𝑛 ⩾ 3, which is close to the minimum number 5 of colors required to properly color the asynchronous cycle 𝐶 3 [CR10; HS99]. It is not clear whether a wait-free algorithm exists for 5-coloring all cycles 𝐶 𝑛 , 𝑛 ⩾ 3, in O(log * 𝑛) rounds, or even just in O(𝑛) rounds. In fact, for 𝑛 > 3, the existence of a 3-coloring algorithm is not directly ruled out by [START_REF] Castañeda | New combinatorial topology bounds for renaming: the lower bound[END_REF][START_REF] Herlihy | The topological structure of asynchronous computability[END_REF].

A natural extension of this work is to consider wait-free coloring arbitrary graphs. Note that, by the renaming lower bound, coloring graphs with maximum degree 𝛥 requires a palette of at least 2𝛥 + 1 colors whenever 𝛥 + 1 is a power of a prime. This is because the shared memory model coincides with ours in the clique with 𝑛 = 𝛥 + 1 nodes. We do not know if 2𝛥 + 1 colors suffice for properly coloring all graphs of maximum degree 𝛥 in a wait-free manner. It is however easy to extend the wait-free component of our algorithm into an algorithm that colors any connected graph using a palette of 𝑘 = O( 𝛥 2 ) colors when the maximum degree is 𝛥 ⩾ 2. We omit this algorithm for brevity, but note that its running time may be as large as O(𝑛).

  ¶. For any natural number 𝑍, we denote its binary decomposition by 𝑍 = 𝑘 ∈N 𝑍 𝑘 2 𝑘 , whose length is | 𝑍 | log 2 (𝑍 + 1) . The function 𝑓 is as follows. Given two natural numbers 𝑋 and 𝑌 , we set 𝑓 (𝑋,𝑌 ) = 2𝑖 + 𝑋 𝑖 where 𝑖 min{ | 𝑋 |, |𝑌 | } ∪ { 𝑘 ∈ N | 𝑋 𝑘 ≠ 𝑌 𝑘 }

† Extended abstract. The full paper was submitted for publication at the 41st ACM Symposium on Principles of Distributed Computing (PODC 2022), review pending.‡ Additional support from the project ANR-20-CE48-0006 (DUCAT).

Algorithm 1: Fast 6-coloring algorithm, code for process 𝑝 with neighbors 𝑞 and 𝑞 ′ .

1 Input: 𝑋 𝑝 ∈ N ⊲ process 𝑝's unique identifier 2 Initially:

In the synchronous setting, there is an algorithm for O( 𝛥 2 )-coloring performing in O(log * 𝑛) rounds [START_REF] Linial | Locality in Distributed Graph Algorithms[END_REF]. However, the techniques used for reducing the number of colors from O( 𝛥 2 ) to 𝛥 + 1 seem hard to transfer to the asynchronous setting.

More generally, it is not clear which of the classical graph problems studied in synchronous failure-free networks (e.g., maximal independent set, maximal matching, etc.) can be solved wait-free, and with what complexity.


Michal Ruzek

Didier Simon Chesné

Didier Rémond

Identification of a time-varying mechanical system using the Akaike information criterion

Keywords: Information criteria, inverse problems, identification

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Identification of a time-varying mechanical system using the Akaikeinformation criterion M.RUZEK a , S.CHESNE a ,D.REMOND a a.Université de Lyon,LaMCoS, CNRS UMR5259, INSA-Lyon, F-69621 Villeurbanne, michal.ruzek@insa-lyon.fr

Résumé :

Cet article démontre l'intérêt du critère d'information d'Akaike pour les méthodes d'identification contenant une étape de projection de signaux de mesure sur des bases spécifiques. On s'intéresse particulièrement au problème d'identification de paramètres mécaniques variant dans le temps.La méthode est testée expérimentalement avec succès sur un système à un degré de liberté, constitué d'une inertie et d'une poutre à longueur variable travaillant en torsion. Les variations de cette longueur rendent les paramètres du système dynamique changeant. Une approche par moindre carré combinée à une projection des signaux mesuré sur une base polynomiale permet de reconstruire aisément les fluctuations des paramètres mécaniques. Cependant le choix de l'ordre de troncature de la base de projection est toujours un problème clef dans ce genre de méthode inverse et reste bien souvent une question ouverte. On propose ici d'utiliser le critère d'information Akaikepermettant ainsi une sélection robuste et automatique de cet ordre de troncature. L'étude présentée ici ainsi que l'expérimentation montrent la pertinence et l'intérêt de ce type de critère associé aux méthodes d'identification.

Abstract:

This article deals with the use of Akaike Information Criterion in the case of an identification problem of a time varying mechanical system.. This system studied to illustrate the approach is physically realized by a prismatic beam with a disk excited in torsion. The boundary conditions of the beam can change in a controlled way during the experiment. Therefore, our system can be considered as a 1 d.o.f. system with time-varying parameters. A method based on least-square estimates is used for the identification of the parameters. However, the major contribution of this article is the use of the Akaike information criterion in order to choose automatically the order of polynomial basis used during the estimationstep of the derivatives of the measured angle signal. It is shown through an experimental validation that the AIC criterion is robust and automatic tool for numerical estimation of signal derivatives.

Introduction

In many engineering problems we are interested in identifying some real physical system. In other words, we want to identify a mathematical model which would describe the physical phenomenon, which we observe. In this article, we deal with the identification of a simple mechanical system with one degree of liberty and one time-varying parameter.

The systems with time-varying parameters can be found in many physical problems. For example, the mechanics of biological and human tissues and joints can be described by time-varying models [START_REF] Kearney | System identification of human joint dynamics[END_REF]. In the same works, the robotics and joystick command systems are also considered as time-varying mechanical systems. The identification of the time-varying systems has been studied by different approaches: by the ensemble average method [START_REF] Baker | Time-varying Parallel-cascade System Identification of Ankle Stiffness from Ensemble Data[END_REF], by a parallel-cascade algorithm [START_REF] Ludwig | Identification of Time-Varying Intrinsic and Reflex Joint Stiffness[END_REF], or by a wavelet method [START_REF] Xu | Identification of linear time-varying systems using a wavelet-based statespace method[END_REF]. Numerous techniques use the projection of the time-varying parameters on an orthogonal basis of functions [START_REF] Mouroutsos | Identification of time-varying linear systems using orthogonal functions[END_REF][START_REF] Morais | Time-varying parameter identification using orthogonal functions[END_REF]. The choice of this basis can be a bit arbitrary, there were methods using Legendre polynomials [START_REF] Chou | Identification of time-varying bilinear systems using Legendre series[END_REF][START_REF] Hwang | Parameter identification of a class of tie-varying systems via orthogonal shifted Legendre polynomials[END_REF], block-pulse functions [START_REF] Hwang | Identification of lumped linear time-varying systems via block-pulse functions[END_REF], Fourier series [START_REF] Razzaghi | Identification of time-varying linear and bilinear systems via Fourier series[END_REF], Laguerre polynomials [START_REF] Clement | Laguerre functions in signal analysis and parameter identification[END_REF],Chebyshev polynomials [START_REF] Lapin | Identification of time-varying nonlinear systems using Chebyshev polynomials[END_REF][START_REF] Shih | Parameter estimation of time-varying systems via Chebyshev polynomials of the second kind[END_REF][START_REF] Paraskevopoulos | Chebyshev series approach to system identification, analysis and optimal control[END_REF][START_REF] Rémond | Onimproved use of Chebyshev expansion for mechanical system identification[END_REF][START_REF] Chochol | An original differentiation tool for identification on continuous structures[END_REF][START_REF] Martel | Time-varying torsional stiffness identification on a vertical beam using Chebyshev polynomials[END_REF] or classical polynomial basis [START_REF] Chesné | Identification of time varying stiffness using derivative estimator and polynomial basis[END_REF][START_REF] Chesné | Identification of time varying parameters using numerical differentiation by integration[END_REF]. In principle, all of these methods work quite well. However, their weakness is the choice of the size of the functional basis. Indeed, we have no clue how large the basis of polynomial functions should be. Most often, one must use some iterative scheme and see how the results look like. Then, some human judgement is necessary to choose a good size of the basis of polynomial functions. This human factor makes these methods a bit cumbersome and time-costly.

In this article, we propose to apply a simple statistical tool called Akaike information criterion (AIC) to choose a suitable polynomial basis automatically. We deal with the same experimental data as described in [START_REF] Martel | Time-varying torsional stiffness identification on a vertical beam using Chebyshev polynomials[END_REF]. The AIC criterion was developed by H.Akaike [START_REF] Akaike | A new look at the statistical model identification[END_REF] in 1974. Its goal is to choose the optimal model from a set of candidate models and some observation. It was widely used in statistics and applied in many real-life problems, mostly in biology [START_REF] Burnham | Model selection and multimodel inference[END_REF][START_REF] Butler | Phylogenetic comparative analysis: A modeling approach for adaptive evolution[END_REF][START_REF] O'meara | Testing for different rates of continuous trait evolution using likelihood[END_REF][START_REF] Posada | Selecting the best-fit model of nucleotide substitution[END_REF]. So far, its use for the mechanical problems was very limited. Its use for a choice of vibration models was proposed in [START_REF] Ruzek | Information criteria and selection of vibration models[END_REF]. This article is organized as follows. Section 2 describes the experimental set-up and measured data. Section 3 describes the technique of identification of the model and presents the results. Section 4 concludes the article and Appendix describes the AIC criterion.

Experimental set-up

To build an accurate and easy to used mechanical system with time varying parameters is not so easy.

The experimental set-up can be seen in Fig. 1. It consists of a triangular prism mounted vertically. At the lower end of the bar, there is a disk which serves as an inertia. At the upper end of the prism, there is a slider. This slider serves as a clamped boundary condition, but it can move freely up and down during the experiment. This motion changes the boundary condition and, consequently, changes also the torsional stiffness of the prismatic beam. If we know the position of the slider in time, we are able to calculate the theoretical torsional stiffness of the beam in time. This is very useful, because we can compare this time-varying stiffness to the stiffness identified by our method. Finally, the excitation is achieved via an electric motor which is connected to the disk through the torque cell and rotation accelerometer. During the experiment, we are able to measure simultaneously the driving torque, the rotation angle and the position of the slider. A typical measure is shown in Fig. 2. We note that the torque signal is by far the noisiest one. This is probably due to some microgaps in the screwing mechanism and maybe due to the influence of the flexural vibration of the beam. On the other hand, the rotation angle signal is very neat, which is necessary because we will be dealing with estimation derivatives of this signal. The sampling frequency of the measure was 1000Hz. More information about this set up can be found in [START_REF] Martel | Time-varying torsional stiffness identification on a vertical beam using Chebyshev polynomials[END_REF].

Fig. 1: Experimental mounting of the prism beam in torsion and its representative scheme on left.

3

Identification of the system

The system described in Section 2 can be approximately described as a system with one (rotational) degree of freedom. Its equation of motion can be written as

𝐼𝜃 + 𝐶𝜃 + 𝐾𝜃 = 𝑇 (1)
Where I is the global inertia of the beam and the disk, C is the damping coefficient, K is the rotational stiffness, θ(t) is the rotation angle and T(t) is the driving torque.In our case, we want to identify the parameters I, C and K while we measure θ(t) and T(t). In previous studies [START_REF] Martel | Time-varying torsional stiffness identification on a vertical beam using Chebyshev polynomials[END_REF][START_REF] Chesné | Identification of time varying stiffness using derivative estimator and polynomial basis[END_REF][START_REF] Chesné | Identification of time varying parameters using numerical differentiation by integration[END_REF], the torsional inertia and damping were considered constant in time, but the torsional stiffness is necessarily a function of time K=K(t). In this paper, the three mechanical parameters are considered as time-varying.

The process of identification can be separated into several parts as it can be seen in Fig. 3. First, the first and second derivatives of the angle θ should be obtained. This is done with the help of the polynomial fitting and the AIC criterion. Second, once all the derivatives are estimated, we identify the optimal parameters I,C and K to satisfy the equation of motion given by (1). Both of these procedures are detailed in the following.

Fig. 3: The steps of the identification method

Estimation of derivatives

The heart of the problem of identifying the parameters of the equation (1) lies in the fact that we only measure the angle θ. The time derivatives of this angle are unknown and we need to estimate them from θ. There are many methods for the estimation of derivatives. Here, we opt for the polynomial regression optimized by the AIC criterion.

Let us look the derivative of θ at some time t i . We suppose that we dispose the measurement of θ for the neighboring times to t i . In a small interval of interest we dispose 2N+1 measures of θ. We can put them in the vector θ= [θ(t i-N ),…,θ(t i ),…,θ(t i+N )] T . In this small interval around the time t i the function θ(t) can be developed in the Taylor series as

θ Polynom Fitting AIC θ 𝜃 𝜃 T Ident. I,C,K I(t) C(t) K(t)

Estimation of derivatives Identification of the parameters

𝜃 𝑡 = 𝛼 𝑗 𝑡 -𝑡 𝑖 𝑗 𝑛 𝑗 =0 (2)
The coefficients α of the expansion given by ( 2) can be easily obtained by the least-square linear fit of the measured vector θ by the Taylor series decomposition. However, how should we choose the number of polynomialsn in the Taylor series decomposition? This is the main problem of many identification methods using an expansion process.

The AIC criterion can answer this question (definition of the AIC criterion can be found in the appendix). Let us consider a small interval of time and the corresponding measure of angle θ. This measure can be seen in Fig. 4 in the upper-left corner. Now, we can fit this function by Taylor series with different maximal polynomial order n. The optimal fit should be the one which minimizes the value of the AIC function. To illustrate the approach, let's consider the measured angle on a short time window (Fig. 4(a)). According to the Fig. 4(b), the Taylor series with n=13 is the optimal fit for the measured function. However, to highlight the main interest of this kind of criterion, if we add artificially some uncorrelated noise as it is shown in Fig. 5(a), than the AIC criterion would choose the optimal model among the Taylor series the one having n=7(Fig. 5(b)).Practically, that means that polynomial function of higher order would be used to fit the noise. The strength of this approach is its robustness and automatism. A simple program can be constructed to automatically choose the model (Taylor series) having the lowest value of AIC among all the other models. Whatever is the shape of the function, we are dealing with, and whatever is the noise, AIC criterion always chooses the optimal fit for the measurement in question.

Once the optimal model (Taylor series) is identified via AIC criterion, it can be easily derived to obtain the first and second derivatives. In a certain point of view, the AIC avoids an unwanted expansion of the noise on the polynomial basis. These expansions usually disturb drastically the derivation step.

It should be noted that the maximal number of polynomials (so-called candidate models) to be used is a bit arbitrary. Here, we use the maximal polynomial degree 15 for all the measured intervals. It is recommended that the optimal model should not be the first neither the last model among the candidate models.

Identification of parameters

Once the derivatives of θ are identified for all measured points, we can identify the optimal parameters of the equation of motion [START_REF] Kearney | System identification of human joint dynamics[END_REF]. For the i-th measured time t i , we can write the equation (1) as

𝐼𝜃 (𝑡 𝑖 ) + 𝐶𝜃 (𝑡 𝑖 ) + 𝐾𝜃(𝑡 𝑖 ) = 𝑇(𝑡 𝑖 ) (3)
This equation cannot be solved for I, C and K, because we have more unknowns than equations. On the other hand, we can assume that the variation of these parameters is much slower than the sampling frequency of the time. Under these assumptions, we can consider the values of I, C and K constant over some short interval of time. According to the method used in Section 3.1, we consider that we dispose 2N+1 values of 𝜃, 𝜃, 𝜃 in the vicinity of time t i . Then, we can write a system of linear equations for the parameters I, C and K at the time t i

𝜃 (𝑡 𝑖-𝑁 ) 𝜃 (𝑡 𝑖-𝑁 ) 𝜃(𝑡 𝑖-𝑁 ) ⋮ 𝜃 (𝑡 𝑖 ) ⋮ ⋮ 𝜃 (𝑡 𝑖 ) ⋮ ⋮ 𝜃(𝑡 𝑖 ) ⋮ 𝜃 (𝑡 𝑖+𝑁 ) 𝜃 (𝑡 𝑖+𝑁 ) 𝜃(𝑡 𝑖+𝑁 ) * 𝐼 𝐶 𝐾 = 𝑇(𝑡 𝑖-𝑁 ) ⋮ 𝑇(𝑡 𝑖 ) ⋮ 𝑇(𝑡 𝑖+𝑁 ) (4)
Where the parameters I, C and K correspond to the time point t i . Parameters I, C and K can be easily obtained from Eq. ( 4) by pseudo-inversing the matrix of the system. The number of equations to take into account into the system (4) is a bit arbitrary. More equations we take into account, smoother is the solution, but this filtering property can badly reconstruct fast variations of the identified parameters.. It is possible to use some iterative technique to find a suitable number of equations to use. However, the influence of the number of equations in (4) is not so important in the studied case. In Fig. 6, there are identified parameters I, C and K obtained by the method described above. The number of equations in the system (4) was 200, which means physically that these parameters were considered constant over 0.2s (the sampling frequency was 1000Hz). We note that the identified inertia parameter is noisy,which is probably due to its link with the second derivative, which ismuch more sensitive to noise than the others. On the other hand, the stiffness corresponds well to the theoretical stiffness parameter obtained from the measured position of slider (see Fig. 2 above). Inertia and stiffness was the two main parameter of this study. They are well reconstructed, specially the variation of the stiffness. The damping of the real system is very low. In previous studies [START_REF] Martel | Time-varying torsional stiffness identification on a vertical beam using Chebyshev polynomials[END_REF][START_REF] Chesné | Identification of time varying stiffness using derivative estimator and polynomial basis[END_REF][START_REF] Chesné | Identification of time varying parameters using numerical differentiation by integration[END_REF] it has been set to zero without disturbing drastically the identification of the time varying stiffness. The identified damping coefficient here is very small, but it cannot be compared to other independent measure. Never the less the mean value of this coefficient over the time domain is positive, which is in concordance with the physics of the system. The identification is generally bad at the beginning and the end of the measure. This is due to erroneous derivative estimation at the borders.

Fig. 6: Parameters of the time-varying system identified by the inverse method. Above on the left: the identified torsional inertia (blue) compared to the theoretical inertia (black). Above on the right: the identified torsional damping coefficient. Below: the identified torsional stiffness (blue) compared to the stiffness obtained from the slider position (black).

Conclusion

In this article, an inverse method using on the Akaike information criterion is presented. This method enables us to estimate the temporal derivatives of a measured signal and consequently to identify the parameters of a mechanical system. It has been illustrated with a single degree of freedom system. The AIC criterion is used to choose automatically the optimal polynomial for fitting locally a measured signal which is of great interest for this kind of identification problem. The advantage of this approach is the robustness of this method. It can deal with different level of noise and automatically choose the optimal polynomial model, contrary to previous developed methods [START_REF] Martel | Time-varying torsional stiffness identification on a vertical beam using Chebyshev polynomials[END_REF][START_REF] Chesné | Identification of time varying stiffness using derivative estimator and polynomial basis[END_REF][START_REF] Chesné | Identification of time varying parameters using numerical differentiation by integration[END_REF] Three parameters of the single degree of freedom system were determined: inertia, damping and stiffness coefficients. While the identified damping parameter cannot be verified independently, the identified inertia and stiffness coefficients correspond wellto other independent measures (see [START_REF] Martel | Time-varying torsional stiffness identification on a vertical beam using Chebyshev polynomials[END_REF]).

The proposed approach could be applied to other identification problems. One perspective is the identification of the systems with a few degrees of freedom. Another perspective would be to increase the accuracy of the identificationby making constant (but still unknown) some of the non-varying parameters (I and C in this case).

Appendix: Akaike information criterion

The Akaike information criterion was introduced by Akaike in [START_REF] Akaike | A new look at the statistical model identification[END_REF]. A more recent critical review is proposed by Burnham and Anderson in [START_REF] Burnham | Model selection and multimodel inference[END_REF]. In a simplified version the problem solved by the AIC criterion is as follows. Let us have a system of N (generally nonlinear) equations

𝑓 𝑖 𝑀 𝑗 𝑝 𝑗 = 𝑑 𝑖 , i=1..N (5)
wherethe coefficient i represents different independent measures d i . The i-th value of the model M j is described by the function f i (M j (p j )). This function depends on some vector of parameters p j , which is to be determined. This parameter vector can be determined by the nonlinear least squares, in other words by minimizing the sum of residuals𝑅 𝑗 = 𝜀 𝑖𝑗

𝑖

, where

𝜀 𝑖𝑗 𝑝 𝑗 = 𝑓 𝑖 𝑀 𝑗 𝑝 𝑗 -𝑑 𝑖 (6)
The optimal least-square estimate of the parameter 𝑝 𝑗 for the model j is obtained as

𝑝 𝑗 = argmin 𝑝 𝑗 𝑅 𝑗 (𝑝 𝑗 ) (7)
The AIC function for a model j is defined as follows

𝐴𝐼𝐶 𝑗 = 𝑁 ln 𝜎 𝑗 2 + 2𝐾 𝑗 + 2𝐾 𝑗 (𝐾 𝑗 + 1) 𝑁 -𝐾 𝑗 -1 (8)
Where K j is the number of elements in the vector of parameters p j , and σ j is the estimate of the standard deviance of the measure using the model j:

𝜎 𝑗 2 = 𝑅 𝑗 (𝑝 𝑗 ) 𝑁 -1 (9)
Under the assumptions that the measures d i are independent identically normally distributed random variables, the AIC function is an unbiased estimate of the Kullback-Leibler distance between the measure and the model. In practice, we want this distance to be minimal; we want the model to be as close to the reality as possible. This means, that we search for the model with the lowest value of AIC.

In order to compare different models, we must choose some candidate models at first. In our case, these candidate models are simple polynomials of the Taylor series, but these models can be represented by any function. Then, the optimal parameters 𝑝 𝑗 of the models are determined by the least-squares and the minimal residuals [START_REF] Hwang | Identification of lumped linear time-varying systems via block-pulse functions[END_REF] are evaluated. The model chosen by the AIC criterion is not simply the model having the lowest residuals. It is a model which has a low residual but a low number of parameters as well. AIC criterion selects a model which is optimal in a sense of the prediction. It means that the selected model would give the best prediction of unmeasured data.

Bibliography

Fig. 2 :

 2 Fig.2:A typical measure obtained from our experimental setup: above -the slider position, in the middle -the torque applied, below -rotation angle.

Fig. 4

 4 Fig.4 Example of the use of AIC to fit measured data. (a) By fitting an experimental curve with low noise, (b) AIC favors high polynomial fit.

Fig. 5

 5 Fig.5 Example of the use of AIC to fit a noisy curve..(a) By fitting the same curve with artificially added noise, (b) AIC favors lower degree polynomials


Anand Kumar Mishra

Mahesh Govil

Emmanuel Pilli

A Taxonomy of Hypervisor Forensic Tools

Keywords: Cloud computing, hypervisors, forensic tool taxonomy

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In 2003, National Institute of Standards and Technology (NIST) [START_REF]Computer Forensic Tools and Techniques Catalog[END_REF] initiated the Computer Forensic Tool Testing (CFTT) Project to support the international digital forensics community. The project has classified computer forensic tools according to their specifications, test procedures, test criteria, test sets and test hardware. A similar taxonomy is required for cloud forensic tools.

Previous research has developed a taxonomy of cloud endpoint forensic tools [START_REF] Mishra | A taxonomy of cloud endpoint forensic tools[END_REF]. This chapter extends the previous research by presenting a taxonomy for hypervisor forensic tools that considers the various layers of a hypervisor system. The chapter also discusses the potential data sources in virtual machines (VMs) and virtual machine managers (VMMs), and discusses the uses of the extracted data in forensic investigations. A case study using a KVM hypervisor demonstrates the valuable evidence that can be found in a virtual machine at the virtual machine manager and host system layers.

Hypervisors

A hypervisor is a software system that abstracts the storage, operating system (OS), network and applications. The software layer is implemented on top of hardware to enable multiple virtual machines to be created in isolation. The virtual machines incorporate a processor, memory, secondary storage and networking. The hypervisor also controls the host processor and assets, dispensing resources to virtual machines and ensuring that they are isolated from each other.

A virtualized environment has multiple layers. The hardware layer comprises the processor for computation, network interface card, memory and secondary storage. The host operating system layer is situated between the hardware and hypervisor layers. Virtual machines are created on top of the hypervisor layer. A guest operating system is installed in each virtual machine for user interactions and running applications. The applications execute in a virtualized environment in the guest operating system.

A hypervisor is a software system that virtualizes hardware resources and manages the resources for virtual machines. There are two types of hypervisors. In a Type 1 or bare-metal or native-type hypervisor, the hypervisor software runs directly on the computer system hardware. Example Type

Hypervisor Attacks and Vulnerabilities

Previous work [START_REF] Mishra | Cloud forensics: Stateof-the-art and research challenges[END_REF] has discussed the top threats to cloud computing, including wrapping, malware-injection, flooding and browser attacks, insecure interfaces and APIs, malicious administrators, data theft and data leakage. Pearce et al. [START_REF] Pearce | Virtualization: Issues, security threats and solutions[END_REF] have conducted a detailed study of virtualization techniques and the accompanying security threats.

When a cloud environment is attacked, the impacts can occur throughout the environment; this complicates evidence collection. Figure 1 shows an attack on the hypervisor layer of a private cloud. When a compute node is compromised, changes occur not only at the node, but also at the cloud controller node, hypervisor level and storage systems.

Forensic investigations of cloud environments are also challenging due to the movement of data within providers. Attacks on a hypervisor are serious because they may crash the hypervisor and the guest or virtual machines. A vulnerable hypervisor can render every installed guest machine vulnerable. The increased asset utilization by a virtual machine that causes a denial-of-service attack on a service provider server is exacerbated when multiple virtual servers are involved. An attacker typically targets hypervisor services such as created(), delete(), clone() and migrate() to exploit and expand vulnerabilities.

System Calls and Hypercalls

System calls enable a user application to perform specific instructions that maintain the safety of user mode operations and kernel changes to the execution mode. In a system call. the kernel stack is initialized and the framework call handler is invoked. After the execution of a user request, execution returns to the user mode and the unprivileged register connection is restored. Control then returns to the instruction after the system call. Because of the discriminating extension between user applications and the host operating system, system call disruptions are attractive to malicious entities that have access to cloud services.

Attackers often focus on the hypervisor layer and leverage hypercalls, which are software traps from a kernel of a guest virtual machine to the hypervisor. Milenkoski et al. [START_REF] Milenkoski | Technical Information on Vulnerabilities of Hypercall Handlers[END_REF] have listed vulnerabilities in several hypercalls: memory op, gnttab op, set debugreg, physdev op and mmuext op (Table 1). Because cloud computing architectures are based on virtualization, these hypercall vulnerabilities can affect cloud services. Due to the ubiquity of cloud computing, forensic investigations of hypercall-based attacks are on the increase.

Perez-Botero et al. [START_REF] Perez-Botero | Characterizing hypervisor vulnerabilities in cloud computing servers[END_REF] have analyzed vulnerabilities in the Xen and KVM hypervisors. Their analysis covers hypervisor functionalities, which are mapped to vulnerabilities and attack vectors.

Virtual Machine Introspection

Virtual machine introspection (VMI) is used to investigate real-time events in a virtual machine and to ensure that the virtual system is running properly. Garfinkel and Rosenblum [START_REF] Garfinkel | A virtual machine introspection based architecture for intrusion detection[END_REF] originally defined virtual machine introspection as examining a virtual machine from the outside with the goal of dissecting the software running inside it.

Virtual machine introspection enables an investigation to be conducted without interrupting the monitored virtual machine. Virtual machine introspection assists in malware collection, malware analysis, intrusion detection, intrusion prevention, stealthy debugging, cloud security and mobile security [START_REF] Xiong | LibVMI: A library for bridging the semantic gap between guest OS and VMM[END_REF]. Figure 2 shows the virtual machine introspection components. The components are:

Virtual Machine Introspection API: This library module serves as an interface between a virtual machine introspection application and the virtual machine monitor.

Virtual Machine Introspection Application:

This application observes the monitored guest virtual machine using the virtual machine introspection API functions, which support memory introspection, data streaming and storage performance evaluation. utilities, LiveView, Bitdefender Hypervisor Introspection and Volatility. Interested readers are referred to [START_REF] Hebbal | Virtual machine introspection: Techniques and applications[END_REF][START_REF] More | Virtual machine introspection: Towards bridging the semantic gap[END_REF] for details about virtual machine introspection techniques and their applications.

Guest OS Symbol

Taxonomy of Hypervisor Forensic Tools

Hypervisor forensics is the application of digital forensic techniques and tools to collect and analyze digital evidence for event construction, interpretation and reporting in order to prove hypervisor usability and exploitation. The primary goal of the hypervisor forensic tool taxonomy presented in this section is to provide a searchable catalog of digital forensic tools. Forensic practitioners can use the taxonomy to identify tools that meet the technical requirements of hypervisor investigations.

Figure 3 shows the taxonomy of hypervisor forensic tools. Evidentiary data can be extracted from five distinct layers or levels: (i) virtual machine layer; (ii) virtual machine manager layer; (iii) network layer; (iv) host operating system layer; and (v) hardware layer.

Virtual Machine Layer Data

Virtual machines are the most important sources of evidence, including data that can support complete event reconstruction. However, virtual machine data is volatile and is an easy target for attackers.

Virtual machine data includes memory content, register contents, input/output device flags, Ethernet/Internet address changes, process list, kernel symbol table, virtual machine physical address space, guest page table, etc. In a virtual machine, vCPU, vRAM, vNIC and vDisk also provide useful data related to processes, threads and control data. Figure 4 shows the virtual machine evidence acquisition process.

Virtual Machine Manager Layer Data

Information residing in the virtual machine manager layer includes virtual machine logs, disk images, snapshots, configuration files, etc.

Shavers [START_REF] Shavers | A Discussion of Virtual Machines Related to Forensic Analysis[END_REF] has identified useful types of virtual machine files that reside in a VMWare hypervisor. These include virtual machine activity log files (.log), virtual machine disk files (.vmdk), paging files of running virtual machines (.vmem), virtual machine snapshots (.vmsn), metadata snapshots (.vmsd), virtual machine BIOS data (.nvram), stored virtual machine configurations (.vmx) and suspended virtual machine data (.vmss). Other important files are lock files created for configuration (.lck) and disk files of running virtual machines.

A virtual machine manager supports an interface similar to /dev/kmem that provides access to the monitored host's memory in the form of a flat file. This enables the capture of virtual machine layer events such as virtual machine rebooting or powering down. Hypercalls can also be monitored to enable the analysis of guest machine execution. Additionally, copies of virtual machine images can be preserved.

Forensic tools such as FTK Imager and OSForensics can be used to mount a virtual machine on an external drive. The virtual machine manager needs the virtual machine control structure (VMCS) that holds all the data pertaining to virtual machine configuration and the rules that must be obeyed. This control structure contains a shadow indicator, indicator, guest state area, host state area, virtual machine execution control fields, virtual machine exit control fields, virtual machine entry control fields and virtual machine exit information fields. These fields are very important because the values are stored in registers.

Network Layer Data

Network layer evidentiary data is crucial when a live acquisition is performed to investigate an active network intrusion. Network managers help analyze and manage overall network traffic and performance.

Host Machine Layer Data

Hypervisor logs, system calls and hypervisor events are maintained in the host machine layer. An image of a host machine should also be preserved because it contains all the details of the virtual machine and virtual machine manager. Files and folders associated with virtual machines should also collected from the host machine.

Hardware Layer Data

A RAM capture is one of the most important tasks in live acquisition. This is because the capture contains the footprints of running processes that can be analyzed further in the case of malicious events.

Related Work

This section summarizes key research in the areas of hypervisor introspection and forensic investigations. Most of the approaches employ virtual machine introspection techniques for malware detection and/or vulnerability detection.

Tables 2 through 4 list research published from 2003 to 2018. The first column presents author-year information, the second column presents the hypervisor (virtual machine manager) used and the third column the forensic method or methods used. The fourth and fifth columns list [START_REF] Riaz | Analysis of VMware virtual machine in forensics and anti-forensics paradigms[END_REF] acquisition and snapshot

the layer or layers containing data and the extracted data, respectively.

The sixth column provides the objective or objectives of the research.

Other research focusing on virtual machines and introspection methods include ReVirt [START_REF] Dunlap | ReVirt: Enabling intrusion analysis through virtual-machine logging and replay[END_REF], network attack detection using Collapsar [START_REF] Jiang | Collapsar: A VM-based architecture for a network attack detention center[END_REF], trustworthy intrusion detection using Psyco-Virt [START_REF] Baiardi | Building trustworthy intrusion detection through VM introspection[END_REF], virtual machine monitoring with XenAccess [START_REF] Payne | Secure and flexible monitoring of virtual machines[END_REF][START_REF] Payne | Lares: An architecture for secure active monitoring using virtualization[END_REF], direct kernel structure manipulation attack analysis using virtual machine introspection [START_REF] Bahram | DKSM: Subverting virtual machine introspection for fun and profit[END_REF], live digital forensic analysis using the Xen VIX tool [START_REF] Hay | Forensic examination of volatile system data using virtual introspection[END_REF], rootkit detection in Xen using Patagonix [START_REF] Litty | Hypervisor support for identifying covertly executing binaries[END_REF], peer-to-peer network monitoring using virtual machine introspection [START_REF] Ando | Blink: Large-scale P2P network monitoring and visualization system using VM introspection[END_REF], and virtual machine privacy and integrity protection using CloudVisor [START_REF] Zhang | CloudVisor: Retrofitting protection of virtual machines in a multi-tenant cloud with nested virtualization[END_REF] and CryptVMI [START_REF] Yao | CryptVMI: A flexible and encrypted virtual machine introspection system in the cloud[END_REF].

KVM Hypervisor Forensics

In the KVM hypervisor forensics case study, LibVMI [START_REF]LibVMI: LibVMI Virtual Machine Introspection[END_REF] was installed in a QEMU-KVM hypervisor v2.0.0 on a Linux Ubuntu 14.04.1 operating system (64-bit, v3.13.0-32 generic kernel). The KVM made it possible to spin up multiple virtual machines running unmodified Linux or Windows operating systems with private virtualized hardware, a network card, disk, graphics adapter, etc.

Figure 5 shows virtual machine data acquisition using hypervisor introspection. In the scenario, an attacker targets the virtualized environment containing the compute nodes C1, C2 and C3.

The LibVMI C language library provides low-level information about running virtual machines such as memory, process lists and process IDs. Using LibVMI, it is possible to examine process records, kernel module records, system call observations and memory page information. The core function of virtual machine introspection, specifically vmi read(), makes it possible to read the virtual machine memory that supports translation, caching and hypervisor access. The translation of the kernel virtual address to the physical address is performed by vmi translate kv2p.

cuting. The CR3 register, which indicates the page directory base, holds the physical address of the initial structure used for address translation.

The following data related to the KVM hypervisor and its virtual machines was obtained:

Process List: The list of running processes was extracted via LibVMI using the command: $sudo ./process-list VIRTUAL MACHINE NAME.

Disk Images and Formats: Virtual machine disk images with format qcow2 at /var/lib/libvirt/images were obtained. The image format can be converted using the command: $ sudo qemuimg convert -O qcow2 vm1.img vm1.qcow2.

Virtual Machine Logs:

The log file for each running virtual machine at /var/log/libvirt/qemu/VM.log was obtained.

SSH Login: SSH login information at /var/log/auth.log along with the IP addresses and login times were obtained.

Audit Logs: Hypervisor audit logs at /var/log/audit/audit. log were obtained.

Conclusions

Hypervisor operations generate considerable data that is of evidentiary value in forensic investigations of virtualized environments. The evidence may be extracted from multiple layers -virtual machine layer, virtual machine manager layer, host operating system layer, network layer and hardware layer. As such, there is a need for forensic tools that can extract hypervisor-based native artifacts from virtualized environments with minimum effort and time. The taxonomy of hypervisor forensic tools provides a searchable catalog that assists forensic practitioners in identifying specific tools that fulfill their technical requirements. Additionally, the taxonomy could play a vital role in steering the development of standard forensic tools for virtualized environments.

Future research will enhance the tool taxonomy by incorporating features that cover the entire hypervisor forensic process, including acquisition and analysis.

Figure 3 .Figure 4 .

 34 Figure 3. Taxonomy of hypervisor forensic tools.

PC Request VM Login Hardware Hypervisor VM VM VM Controller Nodes Compute Nodes Log into VM Image Padding Network Bridge Virtual MAC Attacker

  1 hypervisors include VMware ESX and ESXi, Microsoft Hyper-V, Citrix XenServer and Oracle VM (based on opensource Xen). In a Type 2 or hosted or application level hypervisor, the hypervisor software runs on a host operating system that provides virtualization services such as input/output device support and memory management. Example Type 2 hypervisors include VMware Workstation/Fusion/Player, VMware Server, Microsoft Virtual PC, Oracle VM VirtualBox, Red Hat Enterprise Virtualization and KVM. Depending of their underlying technologies, several types of virtualization techniques have been deployed, including full virtualization, hardware-assisted virtualization and paravirtualization. In full virtual-

	Client

Figure 1. Attack on the hypervisor layer.

Table 1 .

 1 Hypercall vulnerabilities.

	Vulnerability	Hypercall Description	Post-Attack State
	CVE-2012-3496, memory op	Management of Hypervisor crash,
	CVE-2012-5513		virtual machine overwritten memory
			memory
	CVE-2012-4539, gnttab op	Management of Hypervisor crash,
	CVE-2012-5510,		shared memory virtual machine
	CVE-2013-1964		among virtual	hanging, operation
			machines	disruption
	CVE-2012-3494	set	Register value	Hypervisor crash
		debugreg	management of
			CPU allocated
			to a guest
			virtual machine
	CVE-2012-3495	physdev op Management of Hypervisor crash,
			component	overwritten memory
			requests by a
			guest virtual
			machine
	CVE-2012-5525	mmuext op	Management of Hypervisor crash,
			memory pages	invalid page
				information

Table :

 : This virtual machine introspection component collects low-level information that is acquired externally. The low-level information includes the virtual address, system call table and interrupt descriptor table (IDT).

				UserProcess
			VMI Application
				System Call
	VM Memory State Translation	VMI API	Kernel Symbol
	Guest OS
	Symbol Table
			{Disk Information}
			{Memory Information}	Hypercalls
			{Network Information}
			{Hardware Events}
	Hypervisor Specific API
	Hypervisor (vCPU)	Core Hypervisor Functionalities	VM Memory State
			Hardware (CPU)
	Figure 2. Virtual machine introspection components.
	Several tools and utilities have been developed to support hypervisor
	forensics. These include LibVMI, file carving tools, disk image mounting

Hypervisor Forensic Tool Taxonomy VM Layer Info . VMM Layer Info . Host OS Layer Info Hardware Layer Info Network Layer Info .

	Memory Info
	Hypervisor Logs	System Call
	Packet Capture
	VM Events	VM Disk	VM Logs	VM Snapshot	Hypercall
	Running Process List
	Virtual Hardware	vCPU	vRAM	vNIC	vDisk

Table 2 .

 2 Hypervisor introspection and forensic investigation research.

	Authors	Hypervisor Forensic	Layer	Extracted	Objective
			Method		Data
	Garfinkel et	VMware	VMI	VMM to VM, Guest OS	Intrusion
	al., 2003 [11] Workstation		VM to VM	metadata	detection
	Joshi et	User mode	VMI	Host OS to	Guest OS	Vuln.
	al., 2005 [21] Linux		VM	processes,	detection
					kernel
					processes
	King et al.,	VMware	VM-based VMM to VM Keystrokes,	Malware
	2006 [22]	Workstation rootkit,		packets,	detection
		Windows XP, VM		disk state,
		Linux	detection		memory
	Kourai et	Persona OS	VM	VMM to VM Processes,	Intrusion
	al., 2005 [24] FreeBSD	monitoring		packets,	detection
			mechanisms		disk state
	Quynh et	Xen	Filesystem VMM to VM, System	Intrusion
	al., 2007 [39]		integrity	VM to VM	calls, log	detection,
			tools		files	system
						monitoring
	Jones et	Xen v3.0.3	Cross-view VMM to VM Guest OS	Hidden
	al., 2008 [20]		validation		processes
	Gu et al.,	KVM	VMI	VMM to VM, Process	Malware
	2011 [13]	Ubuntu 10.04		inside VM	list	tracing
						in VM
	Dolan-Gavitt QEMU	Trace	VMM to VM, Process	Secure
	et al., 2011 [6]		logging,	VM to VM	IDs,	VMI
			preproc.,		process
			merging		list
	Thorpe et	VMware	Log	Inside VM	VM	Event
	al., 2011 [42]; ESXi	synch.		networks	reconstrn.
	2012 [44]
	Harrison et	Xen	Forensic	VM to VM	Processes	Malicious
	al., 2012 [14]		VM and	via		behavior
			VM	hypervisor
	Lim et al.,	VMware	Direct VM Inside VM	VM and vDisk VM and
	2012 [28]	Workstation image		config., VM	VM state
	Kourai et	Xen	Packet	VMM to VM Attack	Outbound
	al., 2012 [23]		filtering		source,	attack
			at VMM		log info.	detection,
			recovery		log, etc.	recovery

Table 3 .

 3 Hypervisor introspection and forensic investigation research (continued).

	Authors	Hypervisor Forensic	Layer	Extracted	Objective
			Method		Data
	Alarifi et	KVM	VM host	Inside VM	VMM system Anomaly
	al., 2012 [1]		system call		calls	detection
			analysis
	Deng et	KVM	User level VM	Log files	Dynamic
	al., 2012 [5]		library			malware
			call			analysis
			tracing
	Fu et al.,		OS level,	VMM to VM, VM logs,	VMI
	2012 [8]	QEMU	binary	VM to VM	system
		v0.15.50	code reuse		calls
	Wang et	Xen	VMI	VMM to VM Process	Virus
	al., 2012 [45]				list	detection
	Jin et al.,	Xen	Network	VM to VM	Packets	Anomaly
	2013 [19]		packet			detection,
			capture			file
						integrity
	Fu et al.,	QEMU	OS	VMM to VM VM details	VMI
	2013 [9]	v0.15.50	kernel
			code
	Fu et al.,	QEMU	Exterior	VMM to VM VM details	VMI
	2013 [10]	v1.0	data acq.
	Thorpe et	VMware	VM log	VMM, VM	VM events,	VM log
	al., 2013 [43] ESXi	auditing		hypervisor	auditing
					logs,
					kernel logs
	Graziano et HyperDbg, VM control VMM	Hypervisor	Memory
	al., 2013 [12] KVM, Xen, structure		RAM data	acq. and
		VirtualBox,				analysis
		VMware
	Lamps et	Xen	WinWizard VMM to VM, VM data,	VMI
	al., 2014 [26]			VM to VM	VM layer
					info.
	Kumara et	Xen	System call VMM to VM, VM data	Malicious
	al., 2015 [25]		tracing,	VM to VM		process
			LibVMI			detection
	Xiao et al., QEMU	Hyperlink VMM to VM, VM data	VMI
	2016 [46]			VM to VM

Table 4 .

 4 Hypervisor introspection and forensic investigation research (continued).

	Authors	Hypervisor Forensic	Layer	Extracted	Objective
			Method		Data
	Jia et al.,	KVM	Trusted VMI VMM to VM, VM data	VMI
	2017 [17]		model	VM to VM
	Riaz et al., VMware	VM data	VMM to VM VM log files VMI
	2018

Storage

The code snippet in Figure 6 shows that, if the process ID (PID) is known, then the vmi pid to dtb function returns the virtual address of the directory table base (DTB) for the process address space. This address is effectively in the CR3 control register while the process is exe-