Yannick Aoustin
email: yannick.aoustin@irccyn.ec-nantes.fr

Alexander Formal'skii

Yuri Martynenko
email: marty-nenko@imec.msu.ru

Yannick Aoustin

Pendubot: Combining of Energy and Intuitive Approaches to Swing up, Stabilization in Erected Pose

Keywords: Underactuated system, Pendubot, Swing up, Unstable equilibrium, Stabilization, Saturated control

The objective of this paper is to define a strategy for the swing up of a doublelink pendulum and its stabilization in the unstable equilibrium state with both erected links. The first joint of this double-link pendulum, which is the suspension joint, is actuated and the second joint is passive. This double-link pendulum, usually called pendubot, is an underactuated system. The double-link pendulum is straightened during the energy boosting process. The swing up control switches to the balancing mode at the instant when the system comes to the basin of attraction. The limits on the torque amplitude are taken into account. The gains of the saturated balancing control are chosen to ensure the basin of attraction as large as possible. Simulation results demonstrate that our strategy is efficient.

Introduction

Motivation. The pendulums with more joints than actuators are mechanical systems, which belong to the family of underactuated systems. They represent an attractive but also a difficult challenge for the control theory. During the World Exhibition EXPO 2010 in Shangai the German Pavilion has featured a larges interactive 3D-pendulum as its main attraction [START_REF] Eberhard | The big expo 2010 world exhibition pendulum-dynamics and control[END_REF]. A mechanical system is considered as underactuated if the number of actuators is less than the number of degrees of freedom [START_REF] Aoustin | Numerical and experimental study of the virtual quadruped -semiquad[END_REF]. During a walking gait a modification of contact conditions can lead to an underactuated walking robot, [START_REF] Schiehlen | Energy-optimal design of walking machines[END_REF] and [START_REF] Zaoui | Simulations of the dynamic behavior of a bipedal robot with trunk and arms subjected to 3d external disturbances in a vertical posture, during walking and during object handling[END_REF]. The inverted pendulums can play the role of a didactic platform, see for example [START_REF] Lewis | Applied Optimal Control and Estimation[END_REF], where usual digital controls are illustrated with an inverted pendulum on a cart, the so-called Cart-Pole System. The pendulum systems attract also the attention of researchers in control as a benchmark for testing and evaluating of control strategies, to mention a little set of references only, see [START_REF] Spong | The swing up control problem for the acrobot[END_REF][START_REF] Albouy | On the use of dynamic invariants and forwarding for swinging up a spherical inverted pendulum[END_REF][START_REF] Astrom | Swinging up a pendulum by energy control[END_REF][START_REF] Fantoni | Energy based control of the pendubot[END_REF][START_REF] Shiriaev | Vss-version of energy based control for swinging up a pendulum[END_REF][START_REF] Olfati-Saber | Normal forms for underactuated mechanical systems with symmetry[END_REF][START_REF] Zhang | Hybrid control of the pendubot[END_REF][START_REF] Furuta | Control of pendulum: From super mechano-system to human adaptive mechatronics[END_REF][START_REF] Chernous'ko | Methods of control of nonlinear mechanical systems[END_REF][START_REF] Muskinja | Swinging up and stabilization of a real inverted pendulum[END_REF][START_REF] Reschmin | Method of decomposition in the problem of control of inverted double-link pendulum using one control torque[END_REF][START_REF] Lai | Comprehensive unified control strategy for underactuated two-link manipulators[END_REF].

For the pendulums usually two problems have to be taken into account, which are the swing up to reach an upright unstable equilibrium and the stabilization in this position.

Acrobot. For example with an acrobot, which is a two-link pendulum, whose first link is not actuated whereas the second one is actuated, authors of [START_REF] Spong | The swing up control problem for the acrobot[END_REF] and [START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF] define a method in two stages. At first, a slow swinging up process, founded on a passivity-based approach, brings the acrobot close to the upright position. After switching control to a balancing linear controller, the pendulum is locally asymptotically stabilized around its upright equilibrium position. A new control law to swing up an acrobot and to stabilize it in the upright position is developed in [START_REF] Formal'skii | On global stabilization of the double inverted pendulum with control at the hinge between the links[END_REF]. A swing-up controller that can bring a n-link revolute acrobot is considered by Xin et al [START_REF] Xin | Swing-up control based on virtual composite links for n-link underactuated robot with passive first joint[END_REF]. The first joint of the acrobot is passive and the others are actuated. The swing-up controller can bring the robot into any arbitrarily small neighborhood of the upright equilibrium point with all links in the upright position. The strategy is first to iteratively devise a series of virtual composite links to be used for designing a coordinate transformation on the angles of all the active joints. Second, an energy-based swing-up controller that uses a new Lyapunov function based on that transformation is devised. Conditions on the control parameters are established to ensure attainment of the swing-up control objective.

Pendubot. In [START_REF] Spong | The pendubot: A mechatronic system for control reaserch and education[END_REF] and [START_REF] Block | Mechanical design and control of the pendubot[END_REF], the underactuated planar revolute robot, usually called pendubot, is presented. A pendubot is also a two-link pendulum with an actuator at the shoulder, but no actuator at the elbow. One very interesting distinction of the pendubot over both the classical cart-pole system and Furuta's system is the continuum of equilibrium positions. The partial feedback linearization technique is used to design the control that swings the two links from their hanging stable equilibrium to the unstable erected position. A linear state feedback is designed to balance the pendulum at the erected equilibrium. The LQR or pole placement technique can be used to find the feedback gains. In [START_REF] Fantoni | Energy based control of the pendubot[END_REF], an algorithm has been proposed to swing up a pendubot. This algorithm brings the pendulum close to the top unstable equilibrium. The second link remains swinging while getting closer and closer to the top equilibrium. In [START_REF] Zhang | Hybrid control of the pendubot[END_REF], the swing up controller switches to a hybrid controller for feedback stabilization among the erected position of an experimental pendubot. This hybrid controller is composed of a continuous-time control part, which contributes for partial feedback linearization, and a discrete-time control part, which can be regarded as cancelation of the drift terms. A pendubot is also considered in [START_REF] Orlov | Swing up and balancing control of pendubot via model orbit stabilization: algorithm synthesis and experimental verififcation[END_REF]. A variable structure controller from [START_REF] Orlov | Finite-time stability and robust control synthesis of uncertain switched systems[END_REF], based on the second order sliding mode method, drives the pendubot to a periodic reference orbit in finite time. A modified Van der Pol oscillator is involved into the controller synthesis as a reference model. The resulting closed-loop system is capable of moving from one orbit to another by changing the parameters of the Van der Pol oscillator.

In [START_REF] Astr Öm | A new family of smooth strategies for swinging up a pendulum[END_REF], authors investigate some properties of the simple strategies for swinging up a one-link pendulum based on energy approach. The position and the velocity of the pivot are not considered. The global behavior of the swing up is completely characterized by the ratio of the maximum acceleration of the pivot and the acceleration of gravity. The swing up and the stabilization problems for the considered one-link pendulum with a limited actuator, are simultaneously solved with a single, smooth law by authors. The idea is to shape the potential energy and to introduce in the control law an additional dumping or pumping term following the state of the pendulum. In [START_REF] Lozano | Stabilisation of the inverted pendulum around its homoclinic orbit[END_REF], the problem of the stabilization a one-link inverted pendulum around its homoclinic orbit is addressed. A control strategy, based on an energy approach of the cart and pendulum system is proposed to balance the inverted pendulum and raise it to its upper equilibrium position while the cart displacement is brought to zero. A one-link pendulum with an inertia-wheel is considered in [START_REF] Beznos | A pendulum controlled by a flywheel[END_REF]. Taking into account the limits of the actuator, authors have designed a swing up control law. The switching time between the swing up control and the stabilization control is defined by comparing the global energy of the pendulum to its potential energy in the upright equilibrium and getting its basin of attraction. Using the Jordan form of the equations of motion, the authors extract the unstable mode. Suppressing this unstable mode, they obtain a basin of attraction, which is as large as possible. The experimental results show the remarkable efficient of the design control.

Lai et al. [START_REF] Lai | Comprehensive unified control strategy for underactuated two-link manipulators[END_REF] propose a unified treatments of the motion control of underactuated twolink manipulators, including acrobots and pendubots. The global stability of the control system is analyzed and guaranteed by using arguments from the Lyapunov's theory. In [START_REF] Aoustin | Stabilisation of unstable equilibrium postures of a two-link pendulum using a flywheel[END_REF], a stabilization control of a two-link inverted pendulum with an inertia-wheel is designed for the three unstable equilibriums.

An approach of the nonlinear control design is proposed in [START_REF] Olfati-Saber | Nonlinear control of underactuated mechanical systems with application to robotics and aerospace vehicles[END_REF] for underactuated mechanical systems and results of global stabilization for an acrobot, a Cart-pole system, an inertia-wheel pendulum, a rotating pendulum are presented. This approach is based on an explicit change of coordinates and control that transform several classes of underactuated mechanical systems into cascade nonlinear systems with structural properties that are convenient for the control design purposes.

In literature for the swing up and the local stabilization of a pendubot, to our best knowledge, first, there is no explicit way to avoid antagonistic movements of the swing links during the process of swinging up. Secondly, during the process of stabilization, it does not exist a control law with saturation, founded on the basin of attraction (or its approximation, the largest possible) and treating explicitly the unstable modes. However it is very important to take into account the limits of the actuators, see Val á šek and Šika, [START_REF] Valasek | Evaluation of dynamic capabilities of machines and robots[END_REF] who provide us a global overview about the dynamic capabilities of a mechanical system, i.e. about the accessible motion described by accessible positions, accessible velocities, accessible accelerations and the required (given) forces.

Contribution. The paper proposes a control strategy that makes a pendubot upright by swinging up, and stabilizing the erected position. The limits on the torque amplitude in the suspension point are taken into account. The original switching control scheme consists of three parts:

-When the pendulum is in some neighborhood of the downward resting position, a local controller, based on the energy boosting algorithm, is employed. -When the pendulum is out of this neighborhood, a saturated nonlinear controller is used in order to straighten the double-link pendulum (to make it close to a one-link pendulum). -When the pendulum reaches the basin of attraction of the upright position, a saturated linear feedback is used.

The novelty in our control strategy is the following. We take into account the limits imposed on the control torque. In the process of swinging up, the pendubot with the designed control performs a number of vibrations from side to side with increasing amplitude as a one-link pendulum. Remind, under algorithm designed in [START_REF] Fantoni | Energy based control of the pendubot[END_REF], the first link converges to the top position after several initial oscillations, while the second link performs oscillations with increasing amplitude. Second, the gains of the saturated balancing control are chosen to ensure the basin of attraction as large as possible. The swing up control switches to the balancing mode at the instant when the system comes to the basin of attraction.

Structure of the paper. Section 2 is devoted to the model of the double pendulum. The linearized model is discussed in Section 3. The statement of the problem is defined in Section 4. Section 5 presents the controls for the local stabilization of the double-link pendulum in the unstable equilibrium posture. Section 6 is devoted to the definition of the swing up strategy. Simulation results are presented in Section 7. Finally, Section 8 presents our conclusion and perspectives.

Model Description of the Double-Link Pendulum

Let us consider a mechanical system with two rigid bodies depicted in Figure 1. The DC motor actuates the suspension joint O 1 . We assume a direct drive shaft for the actuated joint. But there is no actuator in the inter-link joint O 2 . Let C 1 and C 2 be the centers of mass of the first and second link respectively. The center of mass

C 1 is located on line O 1 O 2 . Let the following lengths be O 1 O 2 = l, O 1 C 1 = r 1 and O 2 C 2 = r 2 .
Let m 1 and m 2 be the masses of the first and second links. The moment of inertia of the first link about joint O 1 plus the moment of inertia of the rotor of the actuator is denoted I 1 , the moment of inertia of the second link about joint O 2 is denoted I 2 .

The generalized coordinates are the angles ϕ and γ, Figure 1. The joint variable α = γ-ϕ is also used in our study. So, our system has two degrees of freedom, but one actuator only. Thus, this system has one degree of underactuation. Consider the following constraint imposed on torque Γ, which is developed by the motor in the suspension point O 1 :

|Γ| ≤ Γ 0 , Γ 0 = const (1)
Considering inequality (1) we assume the back electromotive force in the motor sufficiently small. For the pendulum stabilization in upward position this assumption is well justified. In this case, inequality (1) corresponds to limits imposed on the voltage.

The expressions for the kinetic energy T and the potential energy Π of the two-link pendulum are well-known:

2T = a 11 φ2 + 2a 21 cos(γ -ϕ)γ φ + a 22 γ2 , Π = b 1 cosϕ + b 2 cosγ
Here

a 11 = I 1 + m 2 l 2 , a 21 = m 2 r 2 l, a 22 = I 2 , b 1 = (m 1 r 1 + m 2 l)g, b 2 = m 2 r 2 g (g is the gravity acceleration).
Lagrangian L = T -Π yields the following well known equations of motion:

a 11 φ + a 21 cos(γ -ϕ)γ -a 21 sin(γ -ϕ)γ 2 -b 1 sinϕ = Γ (2)
a 21 cos(γ -ϕ) φ + a 22 γ + a 21 sin(γ -ϕ) φ2 -b 2 sinγ = 0 (3)
The angular momentum K with respect to the suspension joint O 1 of the double-link pendulum is

K = ∂T ∂ φ = a 11 φ + a 21 cos(γ -ϕ)γ (4)
System ( 2), ( 3) with Γ = 0 has the unstable equilibrium state:

ϕ e ≡ 0, 2π, γ e ≡ 0, 2π (5)
We consider the problem to transfer the double pendulum to the equilibrium posture (5) from the stable equilibrium posture

ϕ ≡ π, γ ≡ π (6)
3 Linearized Model of the Double-Link Pendulum

In the last phase of the pendulum transferring process to the desired final position, we stabilize it. The linear model, but with limits (1) imposed on the control torque is used to design the feedback for the stabilization. Let us denote the state vector by

x = ϕ -ϕ e , γ -γ e , φ, γ * = ϕ, γ, φ, γ * .
Star * means transposition. Equations ( 2), (3) linearized near the equilibrium (5) have the following matrix form:

ẋ = Ax + pΓ = 0 2×2 I 2×2 D -1 E 0 2×2 x +   0 2×1 D -1 1 0   Γ (7)
Matrices D and E are:

D = a 11 a 21 a 21 a 22 , E = b 1 0 0 b 2 . ( 8
)
The determinant of the Kalman controllability matrix [START_REF] Kalman | Topics in mathematical system theory[END_REF] of the model ( 3), ( 8) is

- b 2 2 a 2 21 (a 11 a 22 -a 2 21 ) 4 (9)
Value a 11 a 22a 2 21 = 0 because it is the determinant of the inertia matrix with α = 0. Thus, the linear model is Kalman controllable, if and only if r 2 = 0 and l = 0.

Introducing a nondegenerate linear transformation x = Sy with a constant matrix S, it is possible to obtain the well-known Jordan form of the matrix equation (3) ẏ = Λy + dΓ [START_REF] Shiriaev | Vss-version of energy based control for swinging up a pendulum[END_REF] where Λ is a diagonal matrix

Λ = S -1 AS =     λ 1 0 . . 0 λ 4     , d = S -1 p = (d 1 , d 2 , d 3 , d 4 ) * . (11)
Here, λ 1 , ..., λ 4 are the eigenvalues of the matrix A. They are the roots of the characteristic equation for the linear system (3) with Γ = 0. This characteristic equation is biquadratic

a 0 λ 4 + a 1 λ 2 + a 2 = 0 (12)
because the system (2), ( 3) is conservative.

Statement of the Problem

The upright equilibrium posture ( 5) is unstable. The objective is to design a feedback control, satisfying the constraint (1), to swing up the pendulum and to stabilize it in this unstable equilibrium posture.

We consider the problem of local stabilization of equilibrium (5) firstly, whereas the stabilization is the last phase of the transferring pendulum process. The asymptotic local stabilization around the unstable equilibrium is realized here with an approach defined in [START_REF] Formal'skii | On stabilization of an inverted double pendulum with one control torque[END_REF].

Local Stabilization of the Double-Link Pendulum

The coefficients of the characteristic equation [START_REF] Zhang | Hybrid control of the pendubot[END_REF] for the system (3), ( 8) are:

a 0 = a 11 a 22 -a 2 12 = detD > 0, a 1 = -(a 11 b 2 + a 22 b 1 ) < 0, a 2 = b 1 b 2 = detE > 0
The leading coefficient a 0 is positive because it is the determinant of the positive definite matrix D; a 1 < 0 because a 11 , a 22 , b 1 and b 2 are positive values. Consequently equation [START_REF] Zhang | Hybrid control of the pendubot[END_REF] has two real positive roots λ 1 , λ 2 and two real negative roots

λ 3 = -λ 1 , λ 4 = -λ 2 .
We intend to design an admissible (satisfying the inequality (1)) feedback control Γ(x) to ensure the asymptotic stability of the equilibrium state x = 0 of system (3) or [START_REF] Shiriaev | Vss-version of energy based control for swinging up a pendulum[END_REF] with the largest possible basin of attraction (the larger the basin of attraction, the more robust the control).

Let us consider the first two scalar differential equations of the system (10), [START_REF] Olfati-Saber | Normal forms for underactuated mechanical systems with symmetry[END_REF], corresponding to the positive eigenvalues λ 1 and λ 2 :

ẏ1 = λ 1 y 1 + d 1 Γ, ẏ2 = λ 2 y 2 + d 2 Γ (13)
The system (3), ( 8) is Kalman controllable. Therefore, the subsystem ( 13) is also controllable (see [START_REF] Kalman | Topics in mathematical system theory[END_REF]) and

d 1 = 0, d 2 = 0.
Let W be the set of the piecewise continuous functions Γ(t), satisfying the inequality (1). Let Q be the set of the initial states x(0) of the system (3), from which origin x = 0 can be reached, using an admissible control functions Γ(t) ∈ W . In other words, the system (3) can reach the origin x = 0 with control Γ(t) ∈ W , only starting from the initial states x(0) ∈ Q. Set Q is called controllability domain. If matrix A has eigenvalues with positive real parts and the control variable Γ is restricted, then the controllability domain Q for the system ( 3) is an open subset of the phase space X (see [START_REF]Controllability and stability of systems with limited ressources[END_REF]).

For any admissible feedback control Γ = Γ(x) (with the saturation |Γ(x)| ≤ Γ 0 ) the corresponding basin of attraction B belongs to the controllability domain: B ⊂ Q. Here, as usual, B is the set of the initial states x(0), from which the system (3), with the feedback Γ = Γ(x) asymptotically tends to the origin x = 0 as t → ∞.

The controllability domain Q ′ of the system (13) in plane y 1 , y 2 is an open bounded set with the following boundaries (see [START_REF]Controllability and stability of systems with limited ressources[END_REF], [START_REF] Boltyansky | Mathematical methods of optimal control[END_REF])

y 1 (τ) = ± d 1 Γ 0 λ 1 2e -λ1τ -1 , y 2 (τ) = ± d 2 Γ 0 λ 2 2e -λ2τ -1 (0 ≤ τ < ∞) (14)
The boundary of the controllability region Q ′ has two corner points depicted in Figure 2:

y 1 = -d 1 Γ 0 λ 1 , y 2 = -d 2 Γ 0 λ 2 ; y 1 = d 1 Γ 0 λ 1 , y 2 = d 2 Γ 0 λ 2 (15)
These points [START_REF] Muskinja | Swinging up and stabilization of a real inverted pendulum[END_REF] are the equilibrium points of the system (13) under the constant controls:

Γ = ±Γ 0 (16)
We can "suppress" the instability of equilibrium y 1 = 0, y 2 = 0 of the system (13) by a linear feedback control,

Γ = k 1 y 1 + k 2 y 2 (17)
with k 1 , k 2 = const. It is shown in the paper [START_REF] Hu | Stabilization of exponentially unstable linear systems with saturating actuators[END_REF] and the book [START_REF] Hu | Control systems with actuator saturation, analysis and design[END_REF] that using a linear feedback [START_REF] Lai | Comprehensive unified control strategy for underactuated two-link manipulators[END_REF] with saturation (β = const),

Γ =    Γ 0 , i f β(k 1 y 1 + k 2 y 2 ) ≥ Γ 0 β(k 1 y 1 + k 2 y 2 ), i f |β(k 1 y 1 + k 2 y 2 )| < Γ 0 -Γ 0 , i f β(k 1 y 1 + k 2 y 2 ) ≤ -Γ 0 ( 18
)
the basin of attraction B ′ of the system (13), ( 18) can be made arbitrary close to the controllability domain Q ′ .

The straight line crossing two points [START_REF] Muskinja | Swinging up and stabilization of a real inverted pendulum[END_REF] is the following:

k 1 y 1 + k 2 y 2 = 0 with k 1 = - d 2 λ 2 , k 2 = d 1 λ 1 ( 19
) If signβ = sign (d 1 d 2 (λ 1 -λ 2 ))
and |β| → ∞, then the basin of attraction B ′ of the system (13) under the nonlinear control [START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF] with the coefficients [START_REF] Formal'skii | On global stabilization of the double inverted pendulum with control at the hinge between the links[END_REF] tends to the controllability region Q ′ . Consequently, using the gains [START_REF] Formal'skii | On global stabilization of the double inverted pendulum with control at the hinge between the links[END_REF], basin B ′ (two-dimensional) can be made arbitrary close to domain Q ′ . If |β| → ∞, the control (18) tends to the bang-bang control. Solutions y 1 (t) and y 2 (t) of equations ( 13) with control (18) tend to 0 as t → ∞ for the initial values y 1 (0), y 2 (0), belonging to the basin of attraction B ′ . But if y 1 (t) → 0 and y 2 (t) → 0, then, according to the expression [START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF], Γ(t) → 0. Therefore, solutions y 3 (t), y 4 (t) of the third and fourth equations of system [START_REF] Shiriaev | Vss-version of energy based control for swinging up a pendulum[END_REF] with any initial conditions y 3 (0), y 4 (0) converge to zero as t → ∞, because λ 3 , λ 4 < 0. Thus, under control [START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF] with coefficients [START_REF] Formal'skii | On global stabilization of the double inverted pendulum with control at the hinge between the links[END_REF], the basin of attraction B (four-dimensional) of system ( 10), ( 18) is described by the same relations, which describe the basin of attraction B ′ (two-dimensional) of system ( 13), [START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF]. Basin B (and controllability domain Q) is limited in unstable coordinates y 1 , y 2 only. The boundary of the basin B ′ is the periodical cycle of the system (13), [START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF]. This cycle can be computed, using the backward motion of the system (13), ( 18) from a state close to the origin y 1 = y 2 = 0.

Variables y 1 and y 2 depend on the original variables from the vector x, according to transformation y = S -1 x. Due to this, formula (18) defines a nonlinear feedback control, which depends on vector x of the original variables.

According to Lyapounov's theorem (see [START_REF] Khalil | Nonlinear systems[END_REF]), the equilibrium state x = 0 of the nonlinear system (2), ( 3) is asymptotically stable under the control (18) because system (2), ( 3), (18) linearized near the state x = 0 is asymptotically stable.

A similar approach to design the control law with a large basin of attraction has been applied to an original circular beam and ball system, which has two unstable modes [START_REF] Aoustin | Ball on a beam: Stabilization under saturated input control with large basin of attraction[END_REF].

The double-link pendulum is here assumed with similar homogeneous links and parameters:

m 1 = m 2 = 0.2 kg, l = 0.15 m, Γ 0 = 0.2 N . m ( 20
)
With parameters [START_REF] Xin | Swing-up control based on virtual composite links for n-link underactuated robot with passive first joint[END_REF] the positive eigenvalues λ 1 , λ 2 are the following: λ 1 = 18.5611, λ 2 = 6.920. Using formulas [START_REF] Chernous'ko | Methods of control of nonlinear mechanical systems[END_REF] we design the controllability domain Q ′ depicted in Figure 2. The boundary of this domain is shown in Figure 2 by dashed line; the boundary of the basin of attraction B ′ with β = 0.025 is shown by solid line. If β = 0.1, then basin B ′ is very close to domain Q ′ and it is difficult to see on the sketch the difference between them. In this case, we can use domain Q ′ as a basin of attraction.

Swing up Via Energy and An Intuitive Control

In this Section, we describe two stages of the developed control. The process of the local stabilization starts after these two stages.

Energy approach

The process of the double-link pendulum transferring from the stable equilibrium ( 6) to the unstable one (5) contains several phases. First, the pendulum is swinging up to increase its total mechanical energy T + Π. This energy in the desired unstable equilibrium state, which is the upright position ( 5) equals to the potential energy

P = b 1 + b 2 .
In the area

π -∆ϕ ≤ ϕ ≤ π + ∆ϕ (21)
the following control

Γ = Γ 0 /σ, i f φ > 0 -Γ 0 /σ, i f φ ≤ 0 ( 22
)
is used. Here ∆ϕ = const > 0, σ > 1 are parameters, which we choose by simulation. Under the control [START_REF] Block | Mechanical design and control of the pendubot[END_REF] (in area ( 21)), the total energy T + Π increases monotonically because its time derivative changes according to the equality:

d(T + Π) dt = Γ φ = | φ|Γ 0 /σ (23)

Double pendulum straightening

Out of area ( 21) we try to keep angle α near zero, because α = 0 in the desired upward equilibrium state [START_REF] Lewis | Applied Optimal Control and Estimation[END_REF]. Also straightening the double pendulum, we try to avoid the movements of the links in the opposite directions. If angle α is close to zero, then the double-link pendulum is "similar" to a one-link pendulum and it is naturally to swing up a one-link pendulum with the control [START_REF] Block | Mechanical design and control of the pendubot[END_REF].

From system (2), (3) to make the exact partial input-output feedback linearization such that α = -c 2 αc 1 α,

the control torque is: [START_REF] Astr Öm | A new family of smooth strategies for swinging up a pendulum[END_REF] Here c 1 and c 2 are positive feedback gains. The denominator in expression ( 25) is far from zero, if angle α is close to zero. Under control [START_REF] Astr Öm | A new family of smooth strategies for swinging up a pendulum[END_REF], system (2), ( 3) has (independently of the behavior of angle ϕ) an asymptotically stable solution:

Γ = Γ d = -a 21 ( φ + α) 2 sinα -b 1 sinϕ + (c 1 α + c 2 α)(
α(t) = 0 (ϕ(t) = γ(t)) (26)
If the inequality ( 1) is taken into account, the saturated control law can be defined instead of ( 25):

Γ =    Γ 0 , i f Γ d ≥ Γ 0 Γ d , i f |Γ d | < Γ 0 -Γ 0 , i f Γ d ≤ -Γ 0 (27)
Let us note:

-If we put α = α = 0 in formula ( 25), then we obtain the following expression:

Γ = a 11 + a 21 a 21 + a 22 b 2 -b 1 sinϕ
Under this control torque, the system (2), (3) has solution [START_REF] Lozano | Stabilisation of the inverted pendulum around its homoclinic orbit[END_REF].

The simulation demonstrates that in order to straighten the pendulum it is also possible to use control simpler than [START_REF] Astr Öm | A new family of smooth strategies for swinging up a pendulum[END_REF]:

Γ = a 11 + a 21 a 21 + a 22 b 2 -b 1 sinϕ + c 1 α + c 2 α -Consider system α = v, |v| ≤ v 0 , v 0 = const (28)
The time-optimal control v(α, α), which brings system [START_REF] Aoustin | Stabilisation of unstable equilibrium postures of a two-link pendulum using a flywheel[END_REF] to origin α = α = 0 is [START_REF] Boltyansky | Mathematical methods of optimal control[END_REF][START_REF] Pontryagin | The Mathematical Theory of Optimal Processes[END_REF]:

v = -v 0 sign(2v 0 α + α| α|) (29)
Instead of the discontinuous function [START_REF] Olfati-Saber | Nonlinear control of underactuated mechanical systems with application to robotics and aerospace vehicles[END_REF] it is better for the realization to use the following continuous function

v = -v 0 th(τ[2v 0 α + α| α| ]) (30)
with τ as parameter. Substituting expression (30) instead of -c 1 αc 2 α in formula [START_REF] Astr Öm | A new family of smooth strategies for swinging up a pendulum[END_REF] we obtain

Γ = Γ d = -a 21 ( φ + α) 2 sinα -b 1 sinϕ + v 0 th(τ[2v 0 α + α| α| ])(a 22 a 11 -a 2 21 cos 2 α) a 21 cosα + a 22 + (a 11 + a 21 cosα)[b 2 sin(ϕ + α) -a 21 φ2 sinα] a 21 cosα + a 22 (31)
We also tested successfully control [START_REF] Kalman | Topics in mathematical system theory[END_REF] with several parameters v 0 and τ on the stages of the pendulum straightening.

Each stage of our control strategy is provided by mathematical consideration. But the demonstration of the efficiency of the complete control strategy is supported by successful computer simulation and intuition only (see below).

Simulation

The double-link pendulum is simulated with the numerical parameters [START_REF] Xin | Swing-up control based on virtual composite links for n-link underactuated robot with passive first joint[END_REF], and we have chosen ∆ϕ = π/12. But the control law is not very sensitive to the value ∆ϕ; the values ∆ϕ in the interval [π/24, π/6] are also acceptable. If the value ∆ϕ decreases, interval [START_REF] Spong | The pendubot: A mechatronic system for control reaserch and education[END_REF] and the time of the energy boosting decreases. Due to this the time of the swing up increases. But the control law remains applicable. For example, if instead of ∆ϕ = π/12 we use ∆ϕ = π/16, the time of swing up increases by 33%.

The appropriate coefficients c 1 = 144 s -2 and c 2 = 28 s -1 of the feedback control [START_REF] Beznos | A pendulum controlled by a flywheel[END_REF] are chosen in the simulation. The gains c 1 , c 2 , which significantly differ from the chosen values can be also used successfully. We tested successfully, for example, values c 1 = 5.76 s -2 , c 2 = 5.76 s -1 . Thus, our approach is robust to the variations of the mentioned above parameters.

As we see in simulation under control [START_REF] Block | Mechanical design and control of the pendubot[END_REF], [START_REF] Beznos | A pendulum controlled by a flywheel[END_REF], the pendulum sways from side to side and its energy T + Π increases "in average" (not monotonically). The stages of the energy boosting (see control [START_REF] Block | Mechanical design and control of the pendubot[END_REF]) and the straightening of the pendulum (see control [START_REF] Beznos | A pendulum controlled by a flywheel[END_REF]) are alternating.

If value Γ 0 /σ is too large, the pendulum may race through the desired equilibrium [START_REF] Lewis | Applied Optimal Control and Estimation[END_REF]. In simulation the value σ = 7 is used. This means that with the control law [START_REF] Block | Mechanical design and control of the pendubot[END_REF] we do not use all the amplitude diapason of the torque of the actuator. During the pendulum straightening phase and then during the upward stabilization phase all resources can be used.

After several vibrations, control [START_REF] Block | Mechanical design and control of the pendubot[END_REF], [START_REF] Beznos | A pendulum controlled by a flywheel[END_REF] brings the double-link pendulum close to the upright position [START_REF] Lewis | Applied Optimal Control and Estimation[END_REF] with angular velocities close to zero and to the basin of attraction. (Remind we try to obtain the basin of attraction as large as possible.) When the system reaches the basin of attraction, the control law [START_REF] Block | Mechanical design and control of the pendubot[END_REF], [START_REF] Beznos | A pendulum controlled by a flywheel[END_REF] switches on the stabilization control law [START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF] (with β = 0.1). At this time, the phase of the pendulum stabilization in the equilibrium (5) starts. This is the last phase of the pendubot transferring process.

To design a more robust control it is useful to increase the coefficient σ, when the full energy becomes closer to the potential energy P = b 1 + b 2 of the pendulum in the upright position [START_REF] Lewis | Applied Optimal Control and Estimation[END_REF].

In Figure 3, the process of the pendubot swinging up and its stabilization in erected pose is shown. The amplitude of angle α vibrations becomes large initially, but after it becomes small and the pendubot sways from side to side like a one-link pendulum. (Note, control [START_REF] Block | Mechanical design and control of the pendubot[END_REF] is natural to swing up the one-link pendulum.) The amplitude of these vibrations increases. After some number of vibrations, at time 14.7 s approximately, the system comes to the basin of attraction and after to the desired equilibrium. 22), [START_REF] Beznos | A pendulum controlled by a flywheel[END_REF] and stabilization in state [START_REF] Lewis | Applied Optimal Control and Estimation[END_REF] with control [START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF], ϕ → 0, α → 0, Γ → 0.

In Figure 4, the graph of the total energy T + Π is shown. The energy increases "in average" and at the end becomes the desired constant P = b 1 + b 2 . In Figure 5, snapshots of the swing-up maneuver are depicted in six sequences (times). In area [START_REF] Spong | The pendubot: A mechatronic system for control reaserch and education[END_REF], instead of ( 22), the control law

Γ = Γ 0 /σ, i f K > 0 -Γ 0 /σ, i f K ≤ 0 ( 32
)
can be also used. Here K is the angular momentum (4). In Figure 6, the corresponding process of the swinging up and stabilization is plotted. We can observe the effect of control [START_REF] Formal'skii | On stabilization of an inverted double pendulum with one control torque[END_REF] at the beginning of the swing up control process, where the torque switches between Γ 0 /σ and -Γ 0 /σ until time 2 s. The maximal amplitude of the angle α vibrations is less than with control [START_REF] Block | Mechanical design and control of the pendubot[END_REF]. 32), [START_REF] Beznos | A pendulum controlled by a flywheel[END_REF] and stabilization in state ( 5), ϕ → 0 with control (18), α → 0, Γ → 0.

Using the designed controls we can bring the pendubot to the upright position (5) not from the initial downward position [START_REF] Spong | The swing up control problem for the acrobot[END_REF] only, but also from some another initial states. For example, Figure 7 shows that it is possible to erect both links, starting from the state ϕ = π, γ = π + π/3 (α = π/3), φ = γ = 0, which significantly differs from the state (6).

In our paper, the basin of attraction of the desired upright unstable equilibrium of the pendulum for its local stabilization is designed taking into account the limits for the control torque. This basin depends on the limits and increases, if the limits increase. Designing the control law, we tried to obtain this basin as large as possible with the given limits. The basin of attraction was constructed using the linearized model of the system. At the instant when the phase trajectory of our system intersects the boundary of the basin of attraction the control torque becomes Γ 0 or -Γ 0 . We see this instant, for example, in Figure 7 (see time instant 14 s). Sometimes we do not see such an instant in the figures, may be due to nonlinear effect.

It is obvious that the double-link pendulum can be transferred to the stable equilibrium (6) from any initial state. Thus, the control law that transfers pendulum from the downward equilibrium (6) to the upward equilibrium (5) ensures the global stability of this upward equilibrium. 32), [START_REF] Beznos | A pendulum controlled by a flywheel[END_REF] and stabilization in state [START_REF] Lewis | Applied Optimal Control and Estimation[END_REF] with control (18), ϕ → 0, α → 0, Γ → 0.

In this paper we have tried to bring the pendulum in the unstable equilibrium state [START_REF] Lewis | Applied Optimal Control and Estimation[END_REF]. But the pendubot has a continuum of equilibrium positions. We cannot affirm that our intuitive strategy can be applied for this continuum of equilibrium positions. Currently we have successfully used the same strategy for the two following unstable equilibrium states: ϕ e ≡ 0, 2π, γ e ≡ π, -π, [START_REF]Controllability and stability of systems with limited ressources[END_REF] ϕ e ≡ π, -π, γ e ≡ 0, 2π.

If the goal of our control is equilibrium, ϕ e = 0, γ e = π, then out of area [START_REF] Spong | The pendubot: A mechatronic system for control reaserch and education[END_REF] we try to keep the angle γ close to π. If the goal of our control is equilibrium, ϕ e = π, γ e = π, then out of area [START_REF] Spong | The pendubot: A mechatronic system for control reaserch and education[END_REF] we try to bring the angle γ to 0.

However, here we have described with details only the most difficult case with erection of the both links. Note, system (2), (3) linearized near unstable equilibrium (5) has two unstable modes, but the same system linearized near unstable equilibriums [START_REF]Controllability and stability of systems with limited ressources[END_REF] and [START_REF] Boltyansky | Mathematical methods of optimal control[END_REF] has only one unstable mode.

Conclusion

The pendulum systems have become an exciting topic in the theory of control for mechanical multibody systems. The object of this paper is a double-link pendulum. This pendulum belongs to the family of the double-link pendulums, so-called pendubot. A theoretical and numerical study is done with simulation of its swing up and stabilization in the unstable equilibrium state with two erected links. The strategy is founded on the nonlinear control law. This control is based on the combining of the energy and intuitive approaches. The number of parameters, which are needed to find by simulation is small. Furthermore all of them have a physical sense. Under the designed feedback control, the pendubot performs a number of vibrations from side to side with increasing amplitude as a one-link pendulum. At every cycle we slightly increase the energy of the system. The tested algorithms can be used during on-line control process, if computer in the feedback control loop is fast enough.

We have successfully developed and tested two energy boosting algorithms and several algorithms to straighten the pendulum.

The basin of attraction is a natural criterion to define the switching time between the swing up process and the stabilization of the pendulum in the equilibrium state. The larger the basin of attraction, the more robust the control law and the shorter the duration of the erection process. Thus, it is important to have a basin of attraction as large as possible. The basins of attraction for the nonlinear model and for the linear model are close. We think that our study is of a theoretical interest and is also interesting for the education. The simulation tests demonstrate that the perspective of our swing up control and the stabilization of an experimental two-link pendulum is realistic.

Fig. 1 :

 1 Fig. 1: Scheme of the double-link pendulum.

2 Fig. 2 :

 22 Fig. 2: The boundaries of the controllability domain Q ′ (dashed line) and of the basin of attraction B ′ (solid line) with β = 0.025.

Fig. 3 :

 3 Fig.3: Swing up with control (22),[START_REF] Beznos | A pendulum controlled by a flywheel[END_REF] and stabilization in state[START_REF] Lewis | Applied Optimal Control and Estimation[END_REF] with control[START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF], ϕ → 0, α → 0, Γ → 0.

Fig. 4 :

 4 Fig. 4: Swing up with control (22), (27) and stabilization in state (5) with control (18), T + Π → b 1 + b 2 .

Fig. 5 :

 5 Fig. 5: Snapshots of the swing-up maneuver during the swing up and the stabilization of the double pendulum.

Fig. 6 :

 6 Fig.6: Swing up with control (32),[START_REF] Beznos | A pendulum controlled by a flywheel[END_REF] and stabilization in state (5), ϕ → 0 with control[START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF], α → 0, Γ → 0.

Fig. 7 :

 7 Fig.7: α(0) = π/3, Swing up with control (32),[START_REF] Beznos | A pendulum controlled by a flywheel[END_REF] and stabilization in state[START_REF] Lewis | Applied Optimal Control and Estimation[END_REF] with control[START_REF] Bortoff | Pseudolinearisation of the acrobot using spline functions[END_REF], ϕ → 0, α → 0, Γ → 0.

  a 22 a 11a 2 21 cos 2 α) a 21 cosα + a 22 + (a 11 + a 21 cosα)[b 2 sin(ϕ + α)a 21 φ2 sinα] a 21 cosα + a 22


Wael Kanoun
email: wael.kanoun@enst-bretagne.fr

Nora Cuppens-Boulahia

Frédéric Cuppens
email: nora.cuppens@enst-bretagne.fr

Fabien Autrel
email: autrel.fabien@gmail.com

Advanced Reaction using Risk Assessment in Intrusion Detection Systems

Keywords: Intrusion detection system, attack scenario, countermeasure, risk analysis, potentiality, impact

Current intrusion detection systems go beyond the detection of attacks and provide reaction mechanisms to cope with detected attacks or at least reduce their effect. Previous research works have proposed methods to automatically select possible countermeasures capable of ending the detected attack. But actually, countermeasures have side effects and can be as harmful as the detected attack. In this paper, we propose to improve the reaction selection process by giving means to quantify the effectiveness and select the countermeasure that has the minimum negative side effect on the information system. To achieve this goal, we adopt a risk assessment and analysis approach.

Introduction

In intrusion detection approach [START_REF] Bace | Intrusion Detection[END_REF], several security monitoring modules exist. A module gathers and correlates the generated alerts to recognize the current attack and ask the administrator to take action to prevent the damage of the attacks [START_REF] Cuppens | Managing Alerts in a Multi-Intrusion Detection Environment[END_REF]. After all, in the intrusion detection approach, it is almost useless to recognize the attack without having the means to stop it. There are two different approaches for the reaction perspective: Hot reaction and policy based reaction. The first aims to launch a local action on the target machine to end a process, or on target network component to block a traffic, that are the cause of the launched alerts. For example Kill process, Reset connection, Quarantine can be used to react against an attack. The second acts on more general scope; it considers not only the threats reported in the alerts, but also constraints and objectives of the organization operating the information system and this by modifying the access policy. Therefore a trade-off can be established between security objectives, operation objectives and constraints.

Whatever the adopted approach, each countermeasure can have negative or positive side effects. The same countermeasure that was activated to end an attack can make the information system more vulnerable, expose it to other attacks, or even have an impact more disastrous than the attack itself. For example Firewall reconfiguration is effective against a DOS attack, but can be very harmful if valuable connections will be lost, therefore many questions emerge: Is it better to stand still? Or is the attack harmful enough to react? In this case, which countermeasure must be selected with minimum negative side effects?

To answer these questions, we adopt a risk analysis approach. Risk analysis is a known method to analyze and evaluate the risks that threaten organization assets. The fist step of a risk analysis method is to collect data that describes the system state; the second step is analyze them and find the potential threats and their severity; and the final step is to study the countermeasure effectiveness to eliminate these threats or reduce their severity. The existing methods are used to manage system assets and evaluate the risk that threatens these assets: they are unfortunately abstract, informal and not fully compatible with intrusion detection and computer systems. In section 2, related works are presented. The model is presented in section 3, and an implementation is showed in section 4. Finally section 5 concludes this paper.

Related Works

In intrusion detection approach, the final objective is to detect intrusions and then block them to prevent the attacker to achieve his or her objective. First, to detect and recognize the current attack, an alerts correlation procedure is needed. The correlation procedure recognizes relationships between alerts in order to associate these alerts into a more global intrusion scenario, and the intrusion objectives that violates the predefined organization security policies. There are many approaches that can be used for this purpose: implicit [START_REF] Lippmann | Using Key String and Neural Networks to Reduce False Alarms and Detect New Attacks with Sniffer-Based Intrusion Detection Systems[END_REF], explicit [START_REF] Huang | A Large-scale Distributed Intrusion Detection Framework Based on Attack Strategy Analysis[END_REF][START_REF] Morin | Correlation of Intrusion Symptoms: an Application of Chronicles[END_REF] and semi-explicit [START_REF] Cuppens | Recognizing Malicious Intention in an Intrusion Detection Process[END_REF][START_REF] Ning | Reeves: Constructing attack scenarios through correlation of intrusion alerts[END_REF] correlations. The semi-explicit approach is based on the description of the elementary intrusions corresponding to the alerts. This approach then finds causal relationships between these elementary alerts and connects these elementary alerts when such a relationship exists. The correlation procedure then consists in building a scenario that corresponds to an attack graph of steps corresponding to the elementary intrusions. This approach is more generic and flexible because only the elementary steps are defined as entities and not the whole attacks scenarii. Regarding reaction, it is also the most interesting because it provides a precise diagnosis of the ongoing intrusion scenario. Using an approach similar to the one used to describe elementary intrusions, elementary countermeasures can be specified. In this case, anti-correlation [START_REF] Cuppens | Anticorrelation as a criterion to select appropriate counter-measures in an intrusion detection framework[END_REF] can be used to find the countermeasures capable of ending a detected scenario. Anti-correlation approach is based upon finding the appropriate countermeasure that turn an elementary future step of an attack inexecutable due to preconditions value modifications. Therefore, using anti-correlation approach, the administrator knows which countermeasures from a predefined library those who are capable of blocking the threat.

There are two types of reaction: Hot Reactions and Policy Based Reactions [START_REF] Debar | Using contextual security policies for threat response[END_REF]. In the first case, simple countermeasures are activated to end the detected attack. The advantage is fast reaction guaranteed by activating a simple countermeasure; therefore the threat is instantaneously terminated. In other hand, hot reactions do not prevent the occurrence of the attack in the future, therefore a countermeasure is activated each time the attack occurs. Policy based reactions consists of modifying or creating new rules in the access policy to prevent an attack in the future, therefore it corresponds to a long term reaction.

Whatever the adopted type of reaction, a countermeasure could have negative impact on the information system. For example, in some situations, an administrator prefers not to react because the risk of the detected attack is smaller than the risk resulting from triggering off a candidate countermeasure. The goal is not always to block the attack, but to minimize the risk incurred by target information system. Therefore a risk assessment method is needed to evaluate and quantify the risk of an attack and its countermeasures. The method is useful to decide when it is preferable to react, and which countermeasure should be activated. There are several Risk Assessment methods like EBIOS [11,12], MARION [13], MEHARI [14], etc. These methods are used to manage system assets and evaluate the risk that threatens these assets; they are unfortunately abstract, informal and incompatible with intrusion detection and computer systems: Many elements and parameters are related to physical and nature disasters (fire, earthquake, failure, etc.). Besides, their are many essentials factors that exists in intrusion detection systems and even in computer systems (networks, firewall, software, etc.) that does not exist in these methods. There are also elements that need redefinition to be compatible with the intrusion systems like potentiality and impact of a threat.

Risk Assessment Model

MEHARI method is the latest, more accurate and flexible risk analysis method, and that is why we decided to adapt this method to detection intrusion systems. Therefore, we propose a new risk analysis method compatible with intrusion detection systems inspired from MEHARI, by adapting, redefining and adding new parameters and functions.

The risk is defined as a potential exploitation of an existing vulnerability; this exploitation has an impact on the affected assets. Therefore, the gravity of risk Grav of an attack scenario is the combination of two major factors: Potentiality P ot and Impact Imp. Each of the major factors depends on minor factors. In turn, these minor factors are evaluated using audit clusters. In MEHARI method, an audit cluster is a group of general questions to determine the general system state. In our approach, an audit cluster contains multiple coherent questions or tests, therefore the value of an audit cluster is the arithmetic mean value of all the questions-tests. These questions-tests aim to evaluate a specific service state (antivirus, firewall, vulnerabilities, etc.) in real time when an attack occurs.

In our method, we choose to evaluate the risk gravity, the major and minor factors and the audit clusters with a scale that ranges from 0 to 4. The value 0 is used when the studied element does not exist, and the value 4 in the maximum value that an element can have. This scale is sufficient to evaluate these factors, and a larger scale would be more confusing for the system administrators.

The structure of the model is shown in Fig. 1. The total risk T otal Grav is the combination of the candidate scenarii risk gravities. In the following sections we detail each of the risk gravity's factors.

Potentiality P ot

The major factor Potentiality P ot measures the probability of a given scenario to take place and achieve its objective with success. To evaluate P ot, we must first evaluate its minor factors: natural exposition Expo and dissuasive measures Diss and we have to take into account classification of the attack also. The minor factors can be evaluated after the appropriate audit clusters are calculated. These questions-tests aim to evaluate the system state (active services, existent vulnerabilities, etc.). As we aforementioned, all these elements can have values between 0 and 4. The value 0 indicates that the studied scenario is impossible, and the value 4 indicates that the occurrence and the successful execution of the scenario are inevitable.

Natural Exposure Expo This minor factor measures the natural exposure of the target system faced to the detected attack, and by adopting a defensive centric view. It reflects the system state contribution (established connections, acquired privileges, existing vulnerabilities, time, previous incidents, etc.). We propose the following audit clusters that contribute in the evaluation of Expo:

-LAM BDA P rediction: This is the most important cluster for the Expo evaluation. It estimates the probablility of occurrences of the studied scenario. This is possibly done by the analysis of the predicates and the facts that describes the pre and post conditions of an elementary attack step.

LAMBDA language [START_REF] Cuppens | LAMBDA: A Language to Model a Database for Detection of Attacks[END_REF] is an example to describe these elementary steps by defining the pre and post conditions. The value of this cluster increases each time the attacker gets closer to his or her intrusion objective. This cluster is estimated in real time.

-History: This cluster indicates the number of scenario incidents achieved with success in the past. If History increases, EXPO increases as well. This cluster is most useful in the situation where an elementary step in the attacks graph is common to two or more scenarii. This cluster is very similar to the concept of Natural Exposure in MEHARI method, and it is estimated offline. -Global T ime: Some attacks occur in special hours or dates (at night, weekends or holidays), and the same behavior could be normal during a time, but it is an evidence of an attack during another time. For example, a high level of network traffic is normal during the day, but suspicious during the night. If the scenario is independent of time, this cluster will have the mid scale value (thus 2).

Using these audit clusters, Expo can now be calculated:

EXP O = α * LAM BDA P redict + β * History + γ * Global T ime α + β + γ (1)
where α, β and γ are three coefficients that depend on the system.

Dissuasive Measures Diss To reduce the probability of an attacker to progress with his or her attack (and thus to decrease the potentiality P ot), dissuasive measures Diss can be enforced. They aim particularly to reduce the attackers' aggression. There are useful against human attackers, not automated attacks or accidents. If Diss increases, P ot normally will decrease because Diss makes the attacks riskier and more difficult. We propose three clusters to evaluate these measures:

-Logging: This cluster joins all the questions-tests that check the installation and the state of all logging mechanisms. This cluster is evaluated in real time to verify that the attack actions are logged. -Send W arning: This cluster indicates if it is possible to send warning to an attacker (knowing his or her IP, his or her username, etc.). In fact, warnings play a significant role to reduce scenarios P ot because the attackers knows that he or she was caught red handed and it is risky to let the attack goes on. This cluster is evaluated in real time.

-Laws: This cluster checks if the current attack can be considered a violation of the local, national or international laws. The fact that a law forbids a particular attack reduces its probability because it is risky for the attacker. This cluster is evaluated offline and in real time, because we should first verify the laws in the attackers country and the target country as well.

The minor factor Diss can now be calculated, using the three audit clusters presented above. These clusters have the same weight effect on the attacker aggression level:

DISS = LOGGIN G + SEN D W ARN IN G + LAW S 3 (2)
Evaluation of Potentiality P ot After we had estimated Expo and Diss,we can now estimate the major factor P ot. However, the attacks scenarii are too far to have the same proprieties regarding their potentiality. Therefore, we will propose a classification, and associate each class with a specific function to calculate P ot. This classification provides means to evaluate POT more accurately and realistically. Many taxonomies were proposed in [START_REF] Kendall | A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems[END_REF][START_REF] Mirkivich | Towards a Taxonomy of Intrusion Detection Systems and Attacks[END_REF]. In our approach, we will consider two classes: Malicious Actions and Accidents. These two classes allow us to consider if the human factor is involved, and therefore the effectiveness of Diss.

For Malicious Actions, having Expo and Diss, we propose to use a predefined 2D matrix to calculate P ot. For Accidents and Non-Malicious Actions, Diss is useless and therefore:

P ot = Expo (3)

Impact Imp

The second major factor to evaluate Risk Gravity of an attack scenario is Impact Imp.

--→ Imp is defined as a vector with three cells that correspond to the three fundamental security principles: Availability Avail, Confidentiality Conf and Integrity Integ. Therefore, with each Intrusion Objective, a vector --→ Imp is associated and should be evaluated. Actually, it is not possible to statically evaluate --→ Imp of a scenario (or more precisely the --→ Imp of the scenario's intrusion objective) directly because it depends on several dynamic elements. The impact depends on the importance of the target assets ---→ Class, and the impact reduction measures level -→ IR that are deployed on the system to reduce and limit the impact once the attack was successful.

Assets Classification Class For each attack, the attacker seeks to achieve it by successfully executing the last node in the scenario graph: The final intrusion objective that violates the system security policy. Each intrusion objective is of course associated with a sensitive asset. However, the assets have different levels of classification that depend on their importance for system functionalities and survivability. Therefore, for each asset, we will associate the vector ---→ Class with 3 cells that represent three types of classification relative to the three cells of --→ Imp (Avail, Conf and Integ).

---→ Class will be the sum of two components: ---------→ Static Class that is evaluated offline and reflects the intrinsic value of the asset, and -----------→ Dynamic Class that can be evaluated online using the following audit clusters:

-Global T ime: The assets value can depend on time. For instance, confidentiality level of information decreases over the time, or the availability of a server is less required during holidays, etc. -Conn N br: Connection number is most useful to calculate Dynamic Class that increases if the number of connections increases.

Impact Reduction IR To face attacks, many measures are used to reduce their impact. Vector -→ IR aims to evaluate the measures levels that reduce the impact relative to Avail, Conf and Integ. Therefore vector -→ IR contains three cells: IR Avail , IR Conf and IR Integ . There are three sets of measures: Protective Measures P RO to reduce direct consequences, Palliative Measures P all to reduce indirect consequences and Recuperative Measures Recup to reduce the final losses. Once P ro, P all and Recup are calculated, we can evaluate the three cells of -→ IR. For each cell, we define a 3D matrix to calculate the component IR x in function of the three types of measures. In the following sections, we present the three sets of impact reduction measures and then how to calculate them using a specific taxonomy:

Protective Measures P ro: The Protective Measures or P ro aim, once the attack was executed successfully, to limit and contain direct negative consequences. Therefore, the goal of P ro is not to prevent the attack itself, but to confine the attack damage and prevent its propagation and therefore the infection of other assets of the system. For instance, a firewall prevents worms from propagating through the network. Thus, P ro is a major factor to reduce the impact of an intrusion. To evaluate P ro, we propose the use of the following audit clusters:

-Antivirus: The role of this cluster is to check if an antivirus is installed. It also checks if its signature base is up to date. -Antispyware: Similar to the previous Cluster, it checks the antispyware deployed in the system. -Quarantine: This cluster checks if quarantine mechanisms are installed and if they are effective against the detected scenario. -F irewall: This cluster checks if filtering components, like firewalls, are installed and the effectiveness of their configuration against the detected attack.

-Global T ime: The systems level of protection depends on time. For instance, many machines are turned off during night and therefore they are protected. It checks the system clock to verify if the target assets are more vulnerable or exposed in the attack occurrence time. -Admin Avail: Actually, the attacks can occur anytime and anywhere. This cluster aims to determine if the administrator is available when the attack is detected. In other hand, the administrator works in specific period and he or she is not always present when an attack occurs. Therefore, when the administrator is absent, P rot and the three cells of -→ IR decrease and those of --→ Imp increase.

Palliative Measures P all: Palliative Measures P all verify the system capability of reducing indirect consequences of attacks. In other words, P all is used to maintain the system functionalities running as normally as possible. These measures are essential to reduce the impact and the risk gravity of the detected attacks. To evaluate P all, we propose the following audit clusters:

-Backup Ready: This cluster checks if the target assets (especially if they were victim of an attack that violates their integrity or availability) have ready-to-use backups (or already in use as it is the case for load distribution).These backups reduce significantly the impact of an attack on the system. For example, the impact of a DOS attack on a given server has low impact if an existing backup server is ready to be used. -Admin Avail: If the administrators, who are capable to properly react and limit the indirect consequences and to assure the good operation of the system, are not available, P all will dramatically decreases and the impact of the attack increases.

Recuperative Measures Recup: After every attack, the system will suffer from losses: confidentiality, integrity or availability of hardware or software assets that can ultimately leads to financial losses. To reduce these kind of losses, Recuperative Measures Recup can be used. The recuperation process is generally complex, but it reduces the final losses of the system and the company who owns that system. To evaluate Recup, we propose the following audit clusters:

-Backup Exist: This cluster checks if the target assets have backups. In general, these backups are not ready-to-use (offline backups), and a specific procedure is required to put them into service. In spite of that, they are much useful to reduce final losses, for instance: Stored hard disks containing redundant data, or a router waiting to be configured and activated. -T hird P arty: In some special cases, we cannot limit the losses, but it is possible to subscribe to a third party like an assurance company that takes charge of these losses. Thus, the final losses and the impact of an attack are reduced. Therefore, this cluster verifies if the target assets are assured, or if the cost and the losses are partially or totally undertaken by a third party.

Evaluation of P ro, P all and Recup: As we explained, the impact gravity depends on the attack's intrusion objective. These objectives are not similar: An impact reduction measure that can be effective against an objective A can be useless against another objective B. Therefore we need "attack centric" taxonomy to classify these objectives and associate each class with the functions to calculate P ro, P all and Recup using their audit clusters. We propose to define five categories: (1) User to Root, (2) Remote to Local, (3) Denial of Service, (4) Probe and (5) System Access.

Evaluation of Impact After having calculated the ---→ Class and -→ IR vectors, we can evaluate --→ Imp. Like ---→ Class and -→ IR, --→ Imp is a vector with three components:

Imp Avail , Imp Conf and Imp Integ . To calculate the component Imp x , we can use a predefined 2D matrix to combine IR x and Class x . The IR x has the effect to reduce Imp x whereas Class x has the opposing effect. After that the three components of --→ Imp are calculated, we keep the component that has the highest value therefore:

Imp = max(Imp x ) ; x ∈ {Avail, Conf, Integ} (4)

Risk Gravity of an Attack Scenario Grav

For each detected attack, the risk gravity must be evaluated to estimate the danger level of this attack. The risk is the combination of Potentiality and Impact.

An attack that occurs frequently with little impact may have the same risk level as another rare attack that have significant impact. In our approach, we use a 2D matrix to calculate the scenario's gravity of risk. If a scenario has P ot or Imp equal to zero, the scenario's gravity risk Grav will be null. Grav of a scenario u can be calculated using the function f defined as a 2D matrix: If a scenario u has Imp u = 3 but P ot u = 1 , therefore Grav u will be lower (= 2) than Imp u considering the fact that scenario u has a low potentiality.

Grav u = f (P ot u ; Imp u ) (5)

Total Risk Gravity T otal Grav

In most situations, the correlation and reaction module do not deal with one specific scenario. Instead, the module have to take into account many candidate and even simultaneous scenarios. Therefore, before estimating the total gravity of risk, we must evaluate the gravity of risk of each scenario separately as mentioned in the sections 3.1, 3.2 and 3.3. Then we define the Total gravity as an ordered vector containing the values of gravity risk of each candidate scenario (See Fig. 2). An order relation can be defined between the different instances of --------→ T otal Grav using the lexicographic comparison. Therefore we are able to judge which graph has the highest risk gravity.

Reaction and Countermeasure Selection

The correlation and reaction modules suggest for each detected attack a set of countermeasures using anti-correlation [START_REF] Cuppens | Anticorrelation as a criterion to select appropriate counter-measures in an intrusion detection framework[END_REF] approach. This set is called Anticorrelation CM . These countermeasures are capable of stopping the detected attack. In other hand, the reaction is based on the assessment of the countermeasure negative and/or positive side effects on the information system. These side effects can be evaluated using the previously introduced method. Therefore, to judge if a countermeasure u is acceptable, a comparison must be done between:

-Situation "Before" : This is the state of the Information system before the execution of a countermeasure u. The correspondent risk is --------→ T otal Grav -Situation "After" : This is the state of the Information system after the simulated execution of a countermeasure u. The correspondent risk is -------------→ T otal Grav CM u that depends on two elements: (1) countermeasure intrinsic impact G CMu and (2) information system future state ---------→ T otal Grav u that we define below.

Countermeasure Intrinsic Impact and Risk Gravity A countermeasure can have negative impact on the information system due to its intrinsic impact. We propose to associate with the countermeasure description a field called Impact. This field is an integer between 0 and 4. To calculate the Risk Gravity G CMu of the countermeasure u, the function f is used, the P ot parameter value is 4 because the execution of the studied countermeasure is guaranteed once it was selected, and the Imp parameter value is the one that exists in the countermeasure description.

G CMu = f (P ot = 4, Imp = CM.Impact) (6)
System Information Risk Gravity after Reaction A countermeasure u modifies P ot or Imp. Therefore, we must evaluate the new ---------→ T otal Grav u after the selection of the countermeasure u. The same method is used to calculate ---------→ T otal Grav u as --------→ T otal Grav, but using the new graph attack and the information system state after the simulated execution of the countermeasure u. The new graph attack is due to the modification caused by the simulated countermeasure execution in the relations found by the correlation module.

Countermeasure Selection Procedure Once for each countermeasure u, G CMu and ---------→ T otal Grav u are evaluated, -------------→ T otal Grav CM u can be evaluated :

-

------------→ T otal Grav CM u = ---------→ T otal Grav u ∪ G CMu (7)
Now, only the countermeasures from Anticorrelated CM that decrease the total gravity risk are kept and a new set Risk Ef f CM is defined that contains only risk efficient countermeasures:

∀CM u ∈ Anticorrelated CM ; -------------→ T otal Grav CM u ≤ --------→ T otal Grav (8)
⇒ CM u ∈ Risk Ef f CM

Deployment Application

To verify the utility and the effectiveness of our model, we seek in this section to evaluate the risk of the Mitnick attack and the candidate countermeasure to judge if the countermeasure is effective. The Mitnick attack graph generated by CRIM [START_REF] Autrel | CRIM : un module de corrlation d'alertes et de raction aux attaques[END_REF] using the LAMBDA language [START_REF] Cuppens | LAMBDA: A Language to Model a Database for Detection of Attacks[END_REF] is composed of four elementary steps (See Fig. 4). We suppose that the attacker was capable to execute successfully the first three steps. Therefore one final step remains before the attacker achieves his or her intrusion objective Illegal Remote Shell on a critical machine, and we suppose the correspondent Impact is maximum (= 4).

Conclusion

In this paper, a risk assessment model is presented to improve the reaction in the detection intrusion system. This model is used to assess and quantify the risk of attacks and countermeasures. Therefore, a clear procedure can be used to judge if a reaction is necessary, and which countermeasure must be chosen. Using the risk analysis approach, the reaction against an attack is more efficient, and harmful countermeasures may be avoided. There are several perspectives to this work: First, the audit clusters are so far considered as inputs; we will propose the evaluation method of each cluster. Second, the functions used can be more precise by using advanced ponderable mean functions, and use more sophisticated taxonomies.

Fig. 1 .

 1 Fig. 1. Risk Assessment structure

Fig. 2 .

 2 Fig. 2. Construction of--------→T otal Grav

Fig. 3 .

 3 Fig. 3. Anticorrelated CM and Risk Ef f CM sets

Fig. 4 .

 4 Fig. 4. Mitnikc Attack graph generated by CRIM using LAMBDA language

Table 1 .

 1 Example of function f for Grav u evaluation

	P P OT u P P P	P P P Imp u	0	1	2	3	4
	0		0	0	0	0	0
	1		0	0	1	2	3
	2		0	0	1	3	4
	3		0	1	2	3	4
	4		0	2	3	4	4

Acknowledgments

This work was partially supported by the European CELTIC RED project.