Judith Eschbach

Anissa Fergani

Hugues Oudart

Jean-Patrice Robin

Frédérique Rene

Jose-Luis Gonzalez De Aguilar

Yves Larmet

Joffrey Zoll

Majid Hafezparast

Birgit Schwalenstocker

Jean-Philippe Loeffler

Albert C Ludolph

Luc Dupuis
email: ldupuis@unistra.fr

Mutations in

Keywords: White adipose tissue, Brown adipose tissue, thermogenesis, lipolysis, Huntington's disease, molecular motors, lipid droplets

Please cite this article as: Judith Eschbach, Anissa Fergani, Hugues Oudart, Jean-Patrice Robin, Frédérique Rene, Jose-Luis Gonzalez de Aguilar, Yves Larmet, Joffrey Zoll, Majid Hafezparast, Birgit Schwalenstocker, Jean-Philippe Loeffler, Albert C. Ludolph, Luc Dupuis, Mutations in cytoplasmic dynein lead to a Huntington's disease-like defect in energy metabolism of brown and white adipose tissues, BBA -Molecular Basis of Disease (2010), doi: 10.1016/j.bbadis.2010.09.009 This is a PDF file of an unedited manuscript that has been accepted for publication. As a service to our customers we are providing this early version of the manuscript. The manuscript will undergo copyediting, typesetting, and review of the resulting proof before it is published in its final form. Please note that during the production process errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain.

Introduction

The cell cytoskeleton is a network of different types of filaments on which molecular motors drive specific cargoes. Microtubules constitute one of the major cytoskeletal filaments and two types of motors, namely cytoplasmic dynein (later referred as dynein) and kinesins, use them as railroad tracks. Dynein is the only motor that drives cargoes towards the minus end of microtubules and, as such, appears responsible for most, if not all, the transport of cargoes from the cell periphery towards the cell body. Dynein is involved in the late phases of mitosis and its function has been extensively studied in neurons in which it appears crucial for retrograde transport in axons [START_REF] Chevalier-Larsen | Axonal transport and neurodegenerative disease[END_REF] and dendritic morphogenesis [START_REF] Zheng | Dynein is required for polarized dendritic transport and uniform microtubule orientation in axons[END_REF].

Studies on dynein functions have been previously hampered by the lack of genetic tools. Indeed, the complexity of the motor, with numerous subunits yielding a 2 million Dalton molecular complex, render gain of function experiments currently impossible.

Conversely, embryos with ablated dynein heavy chain do not survive, showing the important functions of dynein during development [START_REF] Harada | Golgi vesiculation and lysosome dispersion in cells lacking cytoplasmic dynein[END_REF]. However, mice with mildly compromised dynein function have been generated in 2003 by Hafezparast and collaborators [START_REF] Hafezparast | Mutations in dynein link motor neuron degeneration to defects in retrograde transport[END_REF]. These authors showed that two independent mouse strains generated by N-ethyl-N-nitrosourea-induced mutagenesis, Legs at odd angles (Loa) and Cramping 1 (Cra1, further referred to as Cra), harboured dominantly inherited missense point mutations in the cargo-binding domain of the dynein heavy chain 1. The Loa and Cra mutations did not appear to affect basic cellular functions of dynein such as mitosis. However, dynein mutation impaired the ability of dynein motors to sustain fast retrograde transport leading to a decreased efficiency of these motors in situations of cellular stress [START_REF] Hafezparast | Mutations in dynein link motor neuron degeneration to defects in retrograde transport[END_REF][START_REF] Perlson | A switch in retrograde signaling from survival to stress in rapid-onset neurodegeneration[END_REF] and retrograde transport in adult Loa/+ motor neurons was decreased [START_REF] Hafezparast | Mutations in dynein link motor neuron degeneration to defects in retrograde transport[END_REF][START_REF] Perlson | A switch in retrograde signaling from survival to stress in rapid-onset neurodegeneration[END_REF]. Homozygous mice die at birth but heterozygous mice are viable and present with a striking motor phenotype later ascribed to an early-onset proprioceptive sensory neuropathy [START_REF] Ilieva | Mutant dynein (Loa) triggers proprioceptive axon loss that extends survival only in the SOD1 ALS model with highest motor neuron death[END_REF][START_REF] Dupuis | Mice with a mutation in the dynein heavy chain 1 gene display sensory neuropathy but lack motor neuron disease[END_REF][START_REF] Chen | Proprioceptive sensory neuropathy in mice with a mutation in the cytoplasmic Dynein heavy chain 1 gene[END_REF].

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

Eschbach et al.

4/41

Dynein dysfunction is a potential causal mechanism in neurodegenerative diseases, most notably in degenerative diseases of the striatum such as Huntington's disease (HD).

Indeed, huntingtin, the protein mutant in HD, and its associated protein HAP1 are binding partners of dynein and the activity of the dynein motor is positively regulated by wild type huntingtin, and strongly decreased by HD associated mutations of huntingtin [START_REF] Caviston | Huntingtin facilitates dynein/dynactin-mediated vesicle transport[END_REF][START_REF] Gauthier | Huntingtin controls neurotrophic support and survival of neurons by enhancing BDNF vesicular transport along microtubules[END_REF]. Our most recent studies showed that Cra/+ mice developped striatal atrophy and its expected behavioural and pathological consequences [START_REF] Braunstein | A point mutation in the dynein heavy chain gene leads to striatal atrophy and compromises neurite outgrowth of striatal neurons[END_REF]. These results show that a point mutation in dynein is sufficient to lead to a pathology analogous to HD, although milder.

Besides central nervous system pathology, it is increasingly recognized that HD leads to a number of peripheral defects. Indeed, HD-associated mutations of huntingtin have systemic effects on energy metabolism. In particular, HD animal models develop defects in both brown and white adipose tissues leading to compromised lipolysis and thermogenesis [START_REF] Petersen | Hypothalamic-endocrine aspects in Huntington's disease[END_REF][START_REF] Weydt | 22/41 Thermoregulatory and metabolic defects in Huntington's disease transgenic mice implicate PGC-1alpha in Huntington's disease neurodegeneration[END_REF][START_REF] Fain | Abnormalities in the functioning of adipocytes from R6/2 mice that are transgenic for the Huntington's disease mutation[END_REF].

Whether dynein dysfunction leads to similar defects in the periphery remains unknown. We studied here the peripheral phenotype of dynein mutant mice and showed that dynein mutations compromise adipose tissue lipolysis and thermogenesis. We further provide evidence that the defect triggered by mutant dynein is due, at least in part, to increased oxidative stress in response to norepinephrine. Interestingly, protein levels of huntingtin were decreased in dynein mutant adipose tissue. This peripheral phenotype of dynein mutant mice is similar to that observed in various animal models of HD, lending further support for a functional link between huntingtin and dynein.

A C C E P T E D M A N U S C R I P T

ACCEPTED MANUSCRIPT

Eschbach et al. 5/41

Materials and methods

Animals

All the experiments were performed on male mice. Heterozygous Cra/+ mice were F1 generation of a C57Bl6/C3H crossing and were identified by tail DNA genotyping as described previously [START_REF] Hafezparast | Mutations in dynein link motor neuron degeneration to defects in retrograde transport[END_REF]. Wild-type littermates were used as controls. Heterozygous Loa/+ mice were in a pure C57Bl6 background. Mice were maintained at 23°C with a 12h light/dark cycle and had food and water ad libitum. For biochemical analysis, animals were sacrificed at the ages indicated in the figures (2, 4 and 8 months of age), and tissues were quickly dissected, frozen in liquid nitrogen and stored at -80°C until use. All animal experiments were performed under the supervision of authorized investigators and followed current EU regulations. For the high-fat diet (HFD) experiments, C57Bl6/C3H wild type mice were fed with chow diet supplemented with 20% (wt/wt) saturated fat.

RT-qPCR

Real time RT quantitative PCR was performed as described [START_REF] Dupuis | Mice with a mutation in the dynein heavy chain 1 gene display sensory neuropathy but lack motor neuron disease[END_REF]. The relative levels of each RNA were normalized to the corresponding polymerase II RNA levels. Table S1 indicates the primers used for qPCR.

Histology

For adipose tissues histology, 24h post-fixed tissues were embedded in paraffin and cut on a microtome into slices of 16µm thickness. Sections were then deparaffinized and rehydrated before hematoxylin and eosin staining and then dehydrated for observation.

2.4

Leptin ELISA

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT Eschbach et al. 6/41
Leptin levels in serum were measured using an ELISA kit from Assay Pro (St Charles, MO, USA), following instructions of the manufacturer.

Indirect Calorimetry

We measured O 2 consumption and CO 2 production by using an open-circuit indirect calorimetry system (Klogor, Lannion, France) as described [START_REF] Dupuis | Evidence for defective energy homeostasis in amyotrophic lateral sclerosis: benefit of a high-energy diet in a transgenic mouse model[END_REF]. Energy expenditure was calculated during a 24h cold challenge at 7°C.

Body composition analysis

Carcasses were freeze-dried to constant mass and ground under liquid nitrogen to a fine homogenous powder kept at -20°C until chemical analysis. Samples were lyophilized for 48h just before analysis to eliminate any traces of water. Body lipid content was determined on duplicate samples by a solvent extraction procedure (chloroform/methanol; 2/1, v/v) adapted from Folch et al. [START_REF] Folch | A simple method for the isolation and purification of total lipides from animal tissues[END_REF] on 1 g of powder. The nitrogen content of the carcass was determined in triplicate using the Kjeldahl method on 100-150 mg of sample. Protein content was calculated as nitrogen content *6.25. Ash content was measured on duplicate 1-2-g samples after total combustion at 400°C for 24 h in a muffle furnace. Giles, United Kingdom). Results were quantified using imageJ software [START_REF] Rasband | ImageJ[END_REF].

WAT explants and lipolysis assays

Epididymal WAT was dissected immediately after sacrifice, weighed, and minced with scissors in warm glucose-free Krebs-Ringer bicarbonate buffer, pH 7.4 containing 4% BSA.

Samples were incubated in 3 ml of buffer, pretreated or not with 1mM EHNA (erytro-9-(2-Hydroxy-3-nonyl) adenine hydrochloride, Sigma-Aldrich, Lyon France) or 10µM apocynin for 15 minutes, and then stimulated with 10µM isoproterenol or 10µM forskolin. Incubation medium was collected and assayed for glycerol content (Randox, Antrim, United Kingdom).

Glycerol levels were normalized to the corresponding tissue weight. Similar results were obtained by standardization with protein content (not shown). software. This cut-off of 5 droplets per cell was chosen because (i) all cells studied showed at least 5 droplets, and (ii) it was not possible to measure the diameter of most small droplets in conditions treated with isoproterenol (see Fig. 4B).

2.9

Oxidative stress measurements

Statistical Analysis

Statistical comparisons were accomplished with the unpaired Student t test for comparison of two groups or ANOVA followed by the post hoc Newman-Keuls multiple comparisons test for multiple comparisons using PRISM version 2.0a software (GraphPad, San Diego, USA).

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

Eschbach et al. 10/41

3 Results

Hyperadiposity in the absence of energy imbalance in dynein mutant mice

To explore the potential role of dynein in adipocytes, we used mice heterozygous for the Cramping mutation (Cra/+) and the Legs at odd angles mutation (Loa/+). Both Loa/+ and Cra/+ mice showed increased weight of the white adipose tissue (WAT), including epididymal (Fig. 1A,B), interscapular and retroperitoneal (data not shown) fat pads.

Interestingly, increased mass of the fat pads was already significant at 2 months of age in Cra/+ animals and progressed with age. Adipocytes of Cra/+ and Loa/+ mice were larger than those of their corresponding +/+ mice at 8 months of age (Fig. 1C). Before that age, mRNAs of perilipin and leptin, two genes whose expressions are correlated with adipose mass were increased in epididymal fat of 4 months old Cra/+ mice (Fig. 1D) and circulating levels of leptin were increased at 4 months of age (Fig. 1E). Increased adipose mass was not due to enhanced adipogenesis since the expression of adipogenic genes such as PPAR R , aP2 and LPL were unchanged (Fig. 1D). Consistent with increased adiposity, adipose triglyceride lipase (ATGL) protein levels increased at 4 months of age in dynein mutant WAT, while hormone sensitive lipase (HSL) protein levels were unchanged (Fig. 1F). Hyperadiposity might be driven by changes in energy balance of the animal, for instance by increased energy intake or decreased energy expenditure. Despite an already detectable hyperadiposity, Cra/+ mice were not obese at 2 or 4 months of age, but only at 8 months of age (Fig. 2A). Resting and total energy expenditure (Fig. 2B), food intake (Fig. 2C) and spontaneous locomotor activity (Fig. 2D) were unchanged at 4 months of age. Furthermore, despite a trend towards increased lipid content, body composition of Cra/+ mice was not significantly different from that of wild type littermates at 4 months of age (Table 1), suggesting that increased WAT deposition in these animals was compensated by decreased lipid content in other tissues. Altogether, dynein

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT Eschbach et al. 11/41
mutant mice developed increased WAT deposition, in the absence of detectable energy imbalance.

Dynein is expressed in white adipose tissue

The increase in WAT accumulation suggested that dynein was involved in adipose tissue lipid metabolism. Such an involvement could be direct, through dynein action in adipocytes, or indirect through an impairment of CNS derived cues. If dynein has a function in lipid metabolism in WAT, it should first be expressed in this tissue. Indeed, mRNA levels of dynein heavy chain (DHC) were detectable in WAT and many other non-CNS tissues (Fig. 3A). Moreover, mutant DHC mRNA was observed in WAT of Cra/+ mice (Fig. 3B).

Consistent with a role in lipid metabolism, DHC mRNA levels mildly but significantly increased after 3 weeks of high fat feeding in wild type mice, in a manner similar to perilipin mRNA (Fig. 3C). In these experiments, the large increases in leptin mRNA (Fig. 3C) and ATGL protein levels (Fig. 3D) were consistent with efficient high fat feeding. Thus, dynein is expressed in adipocytes and regulated by high fat feeding, consistent with a function in lipid metabolism.

Dynein activity is required for norepinephrine-induced lipolysis

We next explored whether intrinsic defects in adipose tissue could be the cause of WAT accumulation in dynein mutant mice. The CNS mostly controls adipose tissue energy metabolism through activation of the sympathetic nervous system. Thus, if adipose tissues of Cra/+ mice were normal, and the increased adiposity of Cra/+ mice was the result of a "pure" CNS defect, their responses to norepinephrine should be similar to those of +/+ littermates.

Obesity is a confounding factor since development of obesity leads to blunted norepinephrine stimulated lipolysis [START_REF] Langin | Adipocyte lipases and defect of lipolysis in human obesity[END_REF]. To take this factor into account, we performed lipolysis experiments

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT Eschbach et al. 12/41
in 4 months old mice, i.e. an age when adiposity was increased but mice were not obese and not insulin resistant (not shown). In WAT, sympathetic activation stimulates lipolysis leading to enhanced release of NEFAs. When +/+ mice were challenged with norepinephrine, blood levels of NEFAs almost doubled 20 minutes after injection. In contrast, Cra/+ mice injected in parallel showed only a non-significant 25% increase in NEFAs levels (Fig. 4A). In order to directly measure lipolysis, we cultured WAT explants of +/+ and Cra/+ mice at 4 months of age, stimulated them with norepinephrine and measured glycerol in the culture medium as lipolysis index. As shown in Fig. 4B, lipolysis was unchanged in basal conditions but after norepinephrine stimulation the lipolytic response was two-fold less in Cra/+ than in +/+ mice.

Similar results were obtained by standardizing either by tissue weight or protein content (not shown). We next sought to determine whether pharmacological inhibition of dynein ATPase activity also inhibited lipolysis. For this, we used explants of WAT from wild type animals and treated them or not with EHNA, a widely documented inhibitor of dynein ATPase activity [START_REF] Ravikumar | Dynein mutations impair autophagic clearance of aggregate-prone proteins[END_REF][START_REF] Ekstrom | Inhibition of fast axonal transport by erythro-9-[3-(2hydroxynonyl)[END_REF]. Consistent with the results obtained in Cra/+ mice, basal lipolytic activity of WAT explants was unchanged by EHNA treatment while norepinephrine-stimulated lipolysis was completely blunted by EHNA coapplication (Fig. 4C). To further document this point, we turned to the differentiated 3T3L1 cell line. In these cells, multiple lipid droplets are readily observable in the cytosol. The diameter of lipid droplets increased with EHNA treatment (Fig. 4D), suggesting that dynein inhibition resulted in increased lipid storage in these cells.

Furthermore, the decrease in droplet diameter elicited by isoproterenol treatment was potently inhibited by EHNA coapplication (Fig. 4D-E). Thus, here again, dynein ATPase activity was required for adipocyte lipolysis. To define the mechanisms underlying defective lipolysis in dynein mutant mice, we first studied -adrenergic signalling. The expressions of HSL and 2 adrenergic receptor were roughly normal in Cra/+ WAT (Fig. S1) and HSL protein levels were unchanged (Fig. 1E).

Decreased lipolysis in dynein mutant

Upon isoproterenol stimulation, WAT explants of Cra/+ mice showed blunted phosphorylation of HSL (Fig. 5A-B). PKA activity, as evaluated by PKA substrate immunoreactivity, appeared however not significantly decreased (Fig. 5A-B). Thus, dynein mutation triggered specifically abnormal PKA-mediated phosphorylation of HSL. However, direct adenylate cyclase activation by forskolin did not correct lipolysis deficiency (Fig. S2),

showing that the defect was independent of adenylate cyclase activation. Beta-adrenergic stimulation is known to modulate hydrogen peroxide production in adipocytes through PKAindependent pathways [START_REF] Krieger-Brauer | Inhibitory effect of isoproterenol on NADPH-dependent H(2)O(2) generation in human adipocyte plasma membranes is mediated by betagamma-subunits derived from G(s)[END_REF][START_REF] Moniri | Agonist-stimulated reactive oxygen species formation regulates beta2-adrenergic receptor signal transduction[END_REF]. Interestingly, hydrogen peroxide is known to inhibit norepinephrine induced-lipolysis [START_REF] Muller | Inhibition of lipolysis by palmitate, H2O2 and the sulfonylurea drug, glimepiride, in rat adipocytes depends on cAMP degradation by lipid droplets[END_REF][START_REF] Gauthier | AMP-activated protein kinase is activated as a consequence of lipolysis in the adipocyte: potential mechanism and physiological relevance[END_REF] and drugs interfering with the stability of microtubules, i.e. the dynein railroad tracks, are known to increase oxidative stress through NADPH oxidase activation [START_REF] Alexandre | Novel action of paclitaxel against cancer cells: bystander effect mediated by reactive oxygen species[END_REF][START_REF] Jang | Taxol induces oxidative neuronal cell death by enhancing the activity of NADPH oxidase in mouse cortical cultures[END_REF]. To directly study whether dynein mutation might lead to exacerbated oxidative stress, we measured H 2 O 2 production in response to norepinephrine stimulation. Consistent with previous works, H 2 O 2 was decreased in +/+ mice after norepinephrine stimulation (Fig. 6A). H 2 O 2 was less in basal conditions in Cra/+ WAT explants, but potently stimulated after isoproterenol stimulation (Fig. 6A). In WAT, oxidative stress is largely NADPH oxidase-dependent [START_REF] Furukawa | Increased oxidative stress in obesity and its impact on metabolic syndrome[END_REF] and inhibition of NADPH oxidase with apocynin completely abolished H 2 O 2 production in both Cra/+ and +/+ mice (Fig. 6A). To further document the existence of oxidative stress in Cra/+ WAT after norepinephrine stimulation, we treated WAT explants with the superoxide probe hydroethidine, which yields a nuclear fluorescent staining when superoxide is produced. Upon norepinephrine treatment, nuclei of Cra/+ WAT became brightly fluorescent, an event not observed in +/+ WAT explants (Fig. 6C). We next measured the expression levels of NADPH oxidase subunits (gp47 and gp91) in WAT, as well as known antioxidant enzymes (SOD1 and glutathione peroxidase), and NFkappaB targets induced after oxidative stress (MCP-1 and IL6). All these genes were intensely up regulated in Cra/+ mice WAT at 4 months of age (Fig. 6B). Although these upregulations do not necessarily mean that the corresponding proteins are increased, their coordinations provide indirect evidence of a potent antioxidant response. Last, in order to determine whether the defect in lipolysis was due to NADPH oxidase dependent oxidative stress, we treated WAT explants with apocynin and followed glycerol release upon isoproterenol stimulation. In these experiments, apocynin partially reverted Cra/+ defect in stimulated lipolysis (Fig. 6D) and restored HSL phosphorylation (Fig. 6E). Thus, dynein mutation limits stimulated lipolysis through a deregulation of endogenous oxidative stress.

Defective thermogenesis in dynein mutant mice

We next sought to determine whether the defect in lipolysis was restricted to the WAT. The interscapular brown adipose tissue (BAT) was paler (not shown), increased in size at 4 months of age (Fig. 7A) and brown adipocytes accumulated fat as observed on histological sections of both Cra/+ and Loa/+ BAT (Fig. 7B). This abnormal BAT phenotype was not due to transcriptional down regulation of UCP1 since mRNA levels of both UCP1 and PGC1 , one of its key activators, were unchanged at 4 months of age. Cra/+ mice displayed normal rectal temperature at 4 months of age but were hypothermic at 8 months of age (Fig. 8A).

BAT function was however already abnormal at 4 months of age since a 4h cold challenge lead to hypothermia in Cra/+ mice in 4 and 8 months old mice (Fig. 8B and data not shown).

Furthermore, 4 months old Cra/+ mice were unable to increase energy expenditure upon cold at levels similar to +/+ mice (Fig. 8C). We reasoned that the BAT defect lied also in a decreased response to norepinephrine. To test this hypothesis, we challenged Cra/+ mice with norepinephrine and measured their oxygen consumption (Fig. 8D). The burst in oxygen consumption after norepinephrine injection reflects sympathetic-like BAT activation. We observed that saline injection led to a transient increase in oxygen consumption during the first fifteen minutes after the injection, an increase probably due to the stress response induced by animal handling. However, the increase in oxygen consumption was sustained at least thirty minutes after norepinephrine injection (Fig. 8D). Most interestingly, norepinephrineevoked oxygen consumption was strongly decreased in Cra/+ mice as compared with +/+ littermates (Fig. 8E). In all, our results obtained in vivo, ex vivo and in vitro all converge to ascertain a key role to dynein in the control of adipose tissue lipolysis underlying lipid accumulation in the WAT and dysfunctional BAT-mediated thermogenesis. These defects are intrinsic to adipose tissues and independent of other CNS-linked consequences of dynein mutation.

Dynein mutation decreases levels of huntingtin in the WAT

The previous results obtained in WAT and BAT of dynein mutant animals are reminiscent of HD-associated defects observed in animal models of HD [START_REF] Weydt | 22/41 Thermoregulatory and metabolic defects in Huntington's disease transgenic mice implicate PGC-1alpha in Huntington's disease neurodegeneration[END_REF][START_REF] Fain | Abnormalities in the functioning of adipocytes from R6/2 mice that are transgenic for the Huntington's disease mutation[END_REF][START_REF] Phan | Adipose tissue dysfunction tracks disease progression in two Huntington's disease mouse models[END_REF]29]. To strengthen the analogy between the animal models we studied the expression levels of huntingtin and its associated protein HAP-1 [START_REF] Engelender | Huntingtin-associated protein 1 (HAP1) interacts with the p150Glued subunit of dynactin[END_REF][START_REF] Li | A huntingtin-associated protein enriched in brain with implications for pathology[END_REF] in WAT of dynein mutant mice. Huntingtin, but not HAP-1, was expressed at significant levels in WAT (results not shown) and huntingtin mRNA levels appeared unchanged in WAT of 4 months old dynein mutant mice (figure 9A).

Interestingly however, protein levels of full length huntingtin were decreased in the WAT of 4 months old dynein mutant mice (figure 9B). Thus the dynein mutation led to decreased huntingtin protein levels in adult WAT.

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

Eschbach et al. [START_REF] Folch | A simple method for the isolation and purification of total lipides from animal tissues[END_REF]/41

Discussion

The molecular motor dynein is ubiquitously expressed in adult animals, including in postmitotic cells, yet its role remains obscure in adult cells other than neurons. Our results document a previously unknown function for dynein in adipose tissue response to norepinephrine and lipolysis. The dynein-mutant associated defect in lipolysis was due to a dysfunctional -adrenergic signalling and appeared to be, at least in part, dependent on NADPH oxidase derived oxidative stress. These findings define dynein as a novel potential actor in energy homeostasis that could be of interest for type 2 diabetes. Furthermore, the peripheral phenotype described here in dynein mutant mice is strikingly similar to that of various animal models of Huntington's disease, further supporting the idea that dynein and huntingtin are functionnally linked.

The adipocyte phenotype of dynein mutant mice is independent of the central nervous system

Dynein function has been largely studied in the CNS, yet this motor is ubiquitously expressed.

We show here that dynein function is critical in the response of adipose tissues to norepinephrine. This requirement is due to a function of dynein in adipocytes themselves and is not a secondary consequence of a CNS abnormality in dynein mutant mice. Several lines of evidence support this claim. First, dynein is expressed in adipose tissue and regulated in a manner consistent with a function in lipid metabolism. Second, the WAT phenotype occurs in early adulthood, long before neurodegeneration was thought to occur [START_REF] Hafezparast | Mutations in dynein link motor neuron degeneration to defects in retrograde transport[END_REF]. Third, the defect in lipolysis is recapitulated ex vivo, in the absence of CNS-derived cues and in vitro upon chemical inhibition of dynein. Fourth, this defect occured in mice with normal energy balance, most notably with normal energy intake and energy expenditure. This however does

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

Eschbach et al. 17/41 not fully exclude a CNS influence on the adipose phenotype. The generation of conditional knock out animals will be a necessary step to solve this question.

Dynein is required at several steps in lipid metabolism

The dynein motor has been firmly established as a major actor in lipid droplet formation [START_REF] Andersson | PLD1 and ERK2 regulate cytosolic lipid droplet formation[END_REF][START_REF] Bostrom | SNARE proteins mediate fusion between cytosolic lipid droplets and are implicated in insulin sensitivity[END_REF][START_REF] Bostrom | Cytosolic lipid droplets increase in size by microtubuledependent complex formation[END_REF][START_REF] Gross | Dynein-mediated cargo transport in vivo. A switch controls travel distance[END_REF][START_REF] Guo | Functional genomic screen reveals genes involved in lipid-droplet formation and utilization[END_REF]. First, an RNAi-based functional screen revealed that dynein knockdown resulted in strikingly diminished lipid accumulation in drosophila cells [START_REF] Guo | Functional genomic screen reveals genes involved in lipid-droplet formation and utilization[END_REF]. Furthermore, dynein is a component of mammalian lipid droplets [START_REF] Andersson | PLD1 and ERK2 regulate cytosolic lipid droplet formation[END_REF] and appears required for the formation of these organelles [START_REF] Andersson | PLD1 and ERK2 regulate cytosolic lipid droplet formation[END_REF][START_REF] Bostrom | SNARE proteins mediate fusion between cytosolic lipid droplets and are implicated in insulin sensitivity[END_REF][START_REF] Bostrom | Cytosolic lipid droplets increase in size by microtubuledependent complex formation[END_REF]. Indeed, chemical inhibition of dynein in differentiated 3T3L1 cells increased the size of lipid droplets not only in isoproterenol treated cells, but also in basal conditions, consistent with dynein involvement in lipid droplet trafficking [START_REF] Andersson | PLD1 and ERK2 regulate cytosolic lipid droplet formation[END_REF][START_REF] Bostrom | Cytosolic lipid droplets increase in size by microtubuledependent complex formation[END_REF]. This function of dynein resembles that demonstrated for perilipin [START_REF] Tansey | Perilipin ablation results in a lean mouse with aberrant adipocyte lipolysis, enhanced leptin production, and resistance to diet-induced obesity[END_REF] or caveolin 1 [START_REF] Cohen | Role of caveolin-1 in the modulation of lipolysis and lipid droplet formation[END_REF], both of these proteins being involved in lipid droplet formation in adipocytes. Nevertheless, and contrary to either perilipin -/-or caveolin1 -/-mice, dynein mutant mice were not lean, but showed strikingly enhanced adipose fat pads with strongly increased WAT weight long before obesity was observed and WAT explants of dynein mutant mice did not show changes in basal lipolysis. This suggests that lipid droplet formation and protection of lipids from lipases was not changed by the dynein mutation, consistent with the fact that dynein mutation does not significantly impair housekeeping functions of dynein but rather decreases dynein transport upon cellular stress [START_REF] Hafezparast | Mutations in dynein link motor neuron degeneration to defects in retrograde transport[END_REF]. Despite normal basal lipolysis, Cra/+ WAT showed decreased ability to provide an adequate lipolytic response to norepinephrine. Importantly, BAT norepinephrine response was also defective and underlied the defect in thermogenesis observed in mutant animals. Thus, a first important result of this study is that, besides its known role in lipid droplet formation, dynein is involved in adipose tissue response to norepinephrine.

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

Eschbach et al.

18/41

Mechanisms underlying dynein involvement in stimulated lipolysis

We next defined the mechanisms underlying dynein function in stimulated lipolysis. First, dynein mutation blunted the effects of norepinephrine on HSL phosphorylation. This signalling defect was not due to strongly impaired PKA activation but rather to a selective inhibition of PKA-mediated HSL phosphorylation. Two lines of evidence suggested that dynein did not impair the classical cAMP/PKA axis after norepinephrine stimulation: first, PKA activity appeared only mildly decreased in Cra/+ WAT after stimulation. Second, direct activation of adenylate cyclase by forskolin did not correct the lipolysis defect, suggesting that the defect was either downstream adenylate cyclase or affecting other pathways elicited by the beta-adrenergic receptors. A number of accessory pathways have been described after beta-adrenergic stimulation. Among them, we chose to focus on NADPH oxidase oxidative stress production. Indeed, NADPH oxidase-dependent oxidative stress has been shown to participate in several aspects of the transduction pathway of beta-adrenergic receptors, independently of PKA [START_REF] Moniri | Agonist-stimulated reactive oxygen species formation regulates beta2-adrenergic receptor signal transduction[END_REF][START_REF] Gong | A novel protein kinase A-independent, beta-arrestin-1-dependent signaling pathway for p38 mitogen-activated protein kinase activation by beta2-adrenergic receptors[END_REF] although whether norepinephrine actually increases [START_REF] Moniri | Agonist-stimulated reactive oxygen species formation regulates beta2-adrenergic receptor signal transduction[END_REF][START_REF] Gauthier | AMP-activated protein kinase is activated as a consequence of lipolysis in the adipocyte: potential mechanism and physiological relevance[END_REF] or decreases [START_REF] Krieger-Brauer | Inhibitory effect of isoproterenol on NADPH-dependent H(2)O(2) generation in human adipocyte plasma membranes is mediated by betagamma-subunits derived from G(s)[END_REF] oxidative stress production in adipocytes remains controversial. Furthermore, NADPH activation has been shown to be downstream the cellular effects of microtubules depolymerising drugs [START_REF] Alexandre | Novel action of paclitaxel against cancer cells: bystander effect mediated by reactive oxygen species[END_REF][START_REF] Jang | Taxol induces oxidative neuronal cell death by enhancing the activity of NADPH oxidase in mouse cortical cultures[END_REF]. Here, we observed that norepinephrine decreased H2O2 production in wild type adipocytes, a result similar to Krieger and collaborators [START_REF] Krieger-Brauer | Inhibitory effect of isoproterenol on NADPH-dependent H(2)O(2) generation in human adipocyte plasma membranes is mediated by betagamma-subunits derived from G(s)[END_REF].

Contrasting with this, H2O2 production was potently increased in Cra/+ adipocytes suggesting that an inhibitory mechanism was lost in dynein mutant WAT. Consistent with increased oxidative stress, superoxide production in response to norepinephrine was noticeable in dynein mutant adipocytes and we observed an oxidative stress-like transcriptional fingerprint in WAT. Interestingly, previous work has indicated that NADPH oxidase inhibition after beta-adrenergic stimulation was due to the beta-gamma subunits of

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT Eschbach et al. 19/41
G(s) protein [START_REF] Krieger-Brauer | Inhibitory effect of isoproterenol on NADPH-dependent H(2)O(2) generation in human adipocyte plasma membranes is mediated by betagamma-subunits derived from G(s)[END_REF] and that the dynein light chain Tctex1 is known to modulate G protein beta gamma subunits [START_REF] Sachdev | G protein beta gamma subunit interaction with the dynein light-chain component Tctex-1 regulates neurite outgrowth[END_REF]. Another dynein light chain, LC8, was involved in the attenuation of NFkappaB signalling after NADPH oxidase stimulation by oxidative stress [START_REF] Jung | Dynein light chain LC8 negatively regulates NF-kappaB through the redox-dependent interaction with IkappaBalpha[END_REF]. Whether dynein mutation leads to abnormal function of Tctex1 and/or LC8 underlying increased NADPH oxidase dependent oxidative stress in Cra/+ WAT will require further work. Our study however shows that NADPH-oxidase ROS production was responsible for at least part of the inhibition of lipolysis since HSL phosphorylation was restored by apocynin, a specific NAPDH oxidase inhibitor [START_REF] Stefanska | Apocynin: molecular aptitudes[END_REF] and since apocynin treatment also reverted the defect in lipolysis.

Potential consequences for Huntington's disease

Dynein is especially known for its involvement in neurodegenerative diseases, especially in motor neuron diseases and in Huntington's disease (HD). More specifically for HD, mutant Huntingtin decreases dynein activity and this might be crucial for the pathogenesis [START_REF] Caviston | Huntingtin facilitates dynein/dynactin-mediated vesicle transport[END_REF][START_REF] Gauthier | Huntingtin controls neurotrophic support and survival of neurons by enhancing BDNF vesicular transport along microtubules[END_REF].

Interestingly, our current results show that huntingtin protein levels are decreased in dynein mutant mice. The mechanisms underlying this defect, as well as its relationship with the phenotype described here are still elusive. It is striking to note that a very similar metabolic phenotype was observed in HD animal models (for review see [START_REF] Ferrante | Mouse models of Huntington's disease and methodological considerations for therapeutic trials[END_REF][START_REF] Petersen | Huntington's disease -new perspectives based on neuroendocrine changes in rodent models[END_REF][START_REF] Sassone | Huntington's disease: the current state of research with peripheral tissues[END_REF]). Notably, R6/2 transgenic mice show increased adiposity [START_REF] Fain | Abnormalities in the functioning of adipocytes from R6/2 mice that are transgenic for the Huntington's disease mutation[END_REF][START_REF] Phan | Adipose tissue dysfunction tracks disease progression in two Huntington's disease mouse models[END_REF], in the absence of obesity [START_REF] Fain | Abnormalities in the functioning of adipocytes from R6/2 mice that are transgenic for the Huntington's disease mutation[END_REF][START_REF] Phan | Adipose tissue dysfunction tracks disease progression in two Huntington's disease mouse models[END_REF]29].

Adipose tissue of R6/2 mice show decreased isoproterenol stimulated lipolysis [START_REF] Fain | Abnormalities in the functioning of adipocytes from R6/2 mice that are transgenic for the Huntington's disease mutation[END_REF] and brown adipose tissue mediated thermogenesis was profoundly impaired [START_REF] Weydt | 22/41 Thermoregulatory and metabolic defects in Huntington's disease transgenic mice implicate PGC-1alpha in Huntington's disease neurodegeneration[END_REF]. In all, the peripheral phenotype observed in R6/2 mice was strikingly similar to dynein mutant phenotype suggesting that common pathways, for instance through modification of PGC1alpha function [START_REF] Weydt | 22/41 Thermoregulatory and metabolic defects in Huntington's disease transgenic mice implicate PGC-1alpha in Huntington's disease neurodegeneration[END_REF][START_REF] Phan | Adipose tissue dysfunction tracks disease progression in two Huntington's disease mouse models[END_REF], might be at work upon dynein mutation and mutant huntingtin

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT Eschbach et al. 20/41
expression. To our knowledge, similar studies in HD adipose tissues are lacking, although a large consensus exists that HD leads to a widespread pathology besides CNS pathology [46].

Conclusions

In all, our study provides the first in vivo evidence of a key role for a molecular motor in adipose tissue physiology through its regulatory role on reactive oxygen species production after norepinephrine stimulation. Exploration of the contribution of dynein and its interacting proteins to human diabetes and metabolic syndrome is warranted. Our study also provides further support for decreased dynein function as a potential mechanism of HD.

A C C E P T E D M A N U S C R I P T

[46] J.M. van der Burg, M. Bjorkqvist, P. Brundin, Beyond the brain: widespread pathology in Huntington's disease, Lancet Neurol 8 (2009) 765-774.

  WAT explants were incubated with 5µM hydroethidine during 15 minutes and further stimulated with 10µM isoproterenol. Tissues were immediately fixed in 4%PFA and mounted for observation. H 2 O 2 production was measured with Amplex Red reagent (Invitrogen, Cergy-Pontoise, France), which reacts with H 2 O 2 in a 1:1 stoichiometry catalyzed by HRP (Fluka Biochemika, Lyon, France) to yield the fluorescent compound resorufin and molar equivalent O 2 . Resorufin has excitation/emission characteristics of 563 nm/587 nm and is extremely stable once formed. Fluorescence was measured continuously [change in fluorescence ( F)/sec] with a Fluoromax 4 (Jobin Yvon, Longjumeau, France) spectrofluorometer with temperature control and magnetic stirring. After baseline, F (reactants only) was established, the reaction was initiated by addition of a weighed amount of minced WAT to 600 µl of buffer Z containing (in mM) 110 K-MES, 35 KCl, 1 EGTA, 10 K 2 HPO 4 and 3 MgCl 2 (pH 7.3 at 37°C). We first added 5 µM Amplex Red and 0.5 U/ml HRP. We recorded baseline production of H 2 O 2 in these conditions and then added 10µM isoproterenol to stimulate lipolysis. After 3 min of recordings, we added 10µM apocynin and further recorded fluorescence for 3 min. H 2 O 2 production rate was calculated from the slope of F/sec, after subtracting background, from a standard curve established with the appropriate reaction conditions. H 2 O 2 production was expressed as pmoles per minute per milligram of wet weight.

  WAT is associated with defectiveadrenergic signalling and due to increased oxidative stress A C C E P T E D M A N U S C R I P T

Figure 1 :

 1 Figure 1: increased adiposity in dynein mutant mice

Figure 7 :

 7 Figure 7: defective brown adipose tissue morphology in dynein mutant mice

Figure 8 :

 8 Figure 8: defective brown adipose tissue thermogenic function in dynein mutant mice

Figure 9 :

 9 Figure 9: decreased huntingtin protein levels in dynein mutant WAT

Figure 1 A

 1 Figure 1

Figure 2 A

 2 Figure 2

Figure 3 A

 3 Figure 3

Figure 4 A

 4 Figure 4

Figure 5 A

 5 Figure 5

Figure 6 A

 6 Figure 6

Figure 7 A

 7 Figure 7

Figure 8 A

 8 Figure 8

Figure 9 A

 9 Figure 9

Cell culture & treatments

	ACCEPTED MANUSCRIPT
	methylxanthine, PDE inhibitor) (Sigma-Aldrich, Lyon France) and 1µM insulin (Sigma-
	Aldrich, Lyon France) during two days. Cells were further maintained for 6 days in DMEM
	high glucose containing 10% FCS, 1µM insulin and 1% Penicillin/streptomycin before
	experiments. For lipolysis experiments, 4 hours starved differentiated 3T3-L1 were pre-treated with 1mM EHNA for 15 minutes, and stimulated with 10µM isoproterenol (Sigma-Aldrich, Lyon, France) in the presence of 0.5mM IBMX for 4 hours. Lipid droplets were stained with bodipy 493/503 (Invitrogen, Cergy-Pontoise, France) and nuclei with Hoechst. Lipid droplets were visualized using epifluorescence microscopy. For quantification of the diameter of lipid M A N U S C R I P T droplets, we measured the area of the five largest lipid droplets per cell by using ImageJ
	A C C E P T E D
	3T3-L1 pre-adipocytes from ATCC (Manassas, USA) were grown until confluence in DMEM
	high glucose containing 10% FCS and 1% Penicillin/streptomycin in plates coated with
	0.01% collagen. After two days of confluence, cells were differentiated into adipocytes by
	using DMEM high Glucose containing 10% FCS, 1% Penicillin/streptomycin, 1µM
	Dexamethasone (Sigma-Aldrich, Lyon, France), 0.5mM of IBMX (3-isobutyl-1-
	Eschbach et al.	8/41

Figure 2: normal energy balance in dynein mutant mice

	A-body weight of wild type (+/+, black columns) and dynein mutant (Cra/+) mice at 2
	(2mo), 4, (4mo) and 8 (8mo) months of age. *P<0.05 vs. +/+ (n=5-8 mice per group).
	B-	resting (REE) and total (TEE) energy expenditure of wild type (+/+, black columns)
	and dynein mutant (Cra/+) mice at 4 months of age. There is no global decrease in energy
	expenditure in dynein mutant mice at this age. No significant difference is observed. N=6 per
	group.
	C-	food intake of wild type (+/+, black columns) and dynein mutant (Cra/+) mice at 4,
	(4mo) and 8 (8mo) months of age. No significant difference is observed. N=10 per group
	D-	overnight spontaneous locomotor activity as measured using infrared beams in wild
	type (+/+, black columns) and dynein mutant (Cra/+) mice at 4 (4mo) months of age. No
	difference is observed between both genotypes. N=12 per group

Figure 3: dynein is expressed in the WAT and regulated by high fat feeding

		ACCEPTED MANUSCRIPT ACCEPTED MANUSCRIPT
	representative mice of each genotype are shown (n=8). The results indicate that both DHC B-mRNA levels of monocyte chemotactic protein 1 (MCP-1), interleukin-6 (IL-6),
	alleles (wild type and Cra) are expressed in the WAT. Cu/Zn superoxide dismutase (SOD1), glutathione peroxidase (Gpx), NAPDH oxidase
	C-subunits gp47 (gp47) and gp91 (gp91) in white adipose tissue from +/+ and Cra/+ mice at 4 mRNA levels of dynein heavy chain (DHC), leptin and perilipin in the epididimary
	M A N U S C R I P T white adipose tissue from wild-type mice fed with chow (-) or high fat diet (HFD, +). *P<0.05 versus chow. n=6 mice per group. D-Representative western blotting of ATGL and actin in the epididimary white adipose tissue from wild-type mice fed with chow (-) or high fat diet (HFD, +). Figure 4: dynein involvement in adipose lipolysis All values are indicated as mean +/-SEM. months of age. *P<0.05 vs. +/+ (n=5-7 mice per group). C-Hydroethidine staining in +/+ and Cra/+ WAT explants 15 min exposure to 10µM isoproterenol or vehicle. Note that a number of nuclei are brightly stained in treated Cra/+ WAT showing that isoproterenol treatment increased superoxide production. D-Glycerol release in nmol/mg of tissue of white adipose tissue explants stimulated by 10 µM isoproterenol from +/+ (left panel) and Cra/+ (right panel) mice in the presence (open circles) or absence (black circles) of 10µM apocynin. *, P<0.05 vs. corresponding untreated M A N U S C R I P T condition. A representative experiment out of 3 independent experiments is shown.
	A-condition. RT-PCR analysis of dynein heavy chain (DHC) and 18S ribosomal RNA in various A C C E P T E D B-Glycerol release in nmol/mg of tissue of WAT explants from +/+ and Cra/+ mice of 2 months of age in basal (left panel) or stimulated by isoproterenol (right panel) condition. *, P<0.05 vs. corresponding +/+. A representative experiment out of 4 independent experiments is shown. A C C E P T E D E-Representative western blotting of phosphorylated Ser 563 hormone sensitive lipase
	tissues of +/+ and Cra/+ mice of 4 months of age. Note the broad expression pattern of dynein
	C-Glycerol release in nmol/mg of tissue of WAT explants from wild type mice in basal or
	outside the CNS.
	stimulated by isoproterenol conditions in the presence or absence of EHNA. Measures were
	B-	RT-PCR analysis of dynein heavy chain (DHC) and 18S ribosomal RNA in the WAT
	done after 15 (left) or 90 minutes (right) of isoproterenol stimulation. *, P<0.05 vs.
	of +/+ and Cra/+ mice. The primers used for DHC cDNA amplification span the Cra
	corresponding unstimulated condition; #, p<0.05 vs. corresponding condition without EHNA.
	mutation and this mutation deletes an endogenous RsaI site. Thus, digestion of the amplified
	A representative experiment out of 3 independent experiments is shown.
	DHC PCR product with RsaI (middle panel, DHC+RsaI) allows distinguishing between RsaI-
	D-Representative photomicrographs showing differentiated 3T3L1 stimulated or
	resistant Cra mutation bearing cDNAs and RsaI sensitive wild type cDNAs. Two
	unstimulated with isoproterenol and the PDE inhibitor 3-isobutyl-1-methylxanthine (IBMX)
	Eschbach et al. Eschbach et al.	26/41 28/41

A-NEFAs levels in mmol/L before (black columns) and 20 minutes after (open columns) norepinephrine injection in +/+ and Cra/+ mice (Cra/+) of 4 months of age. N=6 mice per group. *, p<0.05 vs. corresponding « before » condition; #, p<0.05 vs. corresponding +/+ (P-HSL), and total hormone sensitive lipase (HSL), of +/+ and Cra/+ mice WAT explants treated for 3 hours with 10µM isoproterenol in the absence (Iso) or presence (Iso+Apo) of 10µM apocynin.

Table 1 . body composition of dynein mutant mice.

 1

		+/+, 4mo (n=9)	Cra/+, 4mo (n=9)
	Body weight, g	28.7+/-1.0	30.3+/-1.2
	Water, %	61.9+/-1.3	59.9+/-1.2
	Proteins, g	5.66+/-0.14	5.92+/-0.15
	Proteins, %	19.8+/-0.5	19.6+/-0.5
	Lipids, g	4.24+/-0.65	5.55+/-0.83
	Lipids, %	14.5+/-1.7	17.8+/-1.8
	Minerals, g	1.13+/-0.03	1.12+/-0.03

ACCEPTED MANUSCRIPTEschbach et al. 9/41

Acknowledgements

The study was supported by grants from the ALS association ( 2008) and Association pour la Recherche sur la Sclerose Laterale Amyotrophique (A.R.S.) to L.D. (2007) and A.R.S. to J.L.G.D.A (2006); Association Francaise contre les Myopathies, A.R.S. and Association pour la Recherche et le Developpement de Moyens de Lutte contre les Maladies Neurodegeneratives to J.P.L. ; KFO142 for ACL; JLGDA is the recipient of chaire INSERM/Université de Strasbourg.

corresponding wild-type, $ P<0.05 vs. corresponding Iso condition.


J G Alfaro

Frédéric Cuppens
email: frederic.cuppens@enst-bretagne.fr

Nora Cuppens-Boulahia

Towards Filtering and Alerting Rule Rewriting on Single-Component Policies

Keywords: Network Security, Firewalls, NIDSs, Policy Anomalies

The use of firewalls and network intrusion detection systems (NIDSs) is the dominant method to survey and guarantee the security policy in current corporate networks. On the one hand, firewalls are traditional security components which provide means to filter traffic within corporate networks, as well as to police the incoming and outcoming interaction with the Internet. On the other hand, NIDSs are complementary security components used to enhance the visibility level of the network, pointing to malicious or anomalous traffic. To properly configure both firewalls and NIDSs, it is necessary the use of a set of configuration rules, i.e., a set of filtering or alerting rules. Nevertheless, the existence of anomalies within the set of configuration rules of both firewalls and NIDSs is very likely to degrade the network security policy. The discovering and removal of these anomalies is a serious and complex problem to solve. In this paper, we present a set of mechanisms for such a management.

Introduction

Many companies and organizations use firewalls to police their incoming and outcoming flow of traffic between different zones of the network, as well as network intrusion detection systems to monitor and survey such a traffic. A firewall is a network security component, with several interfaces associated with the different zones of the network. The company may partition, for instance, its network into three different zones: a demilitarized zone (or DMZ), a private network and a zone for security administration. This way, one may use a single firewall setup, with three interfaces associated with these three zones, to police the protection of each zone 3 . Network intrusion detection systems (NIDSs for short), on the other hand, are complementary network security components which are in charge of detecting malicious or anomalous activity in the network traffic, such as denial of service (DoS) attacks or intrusion attempts. NIDSs can employ different families of detection methods, being anomaly detection and misuse detection two of the most frequently used methods. We refer to [START_REF] Northcutt | Network Intrusion Detection: An analyst's Hand Book[END_REF] for a good survey on the field.

In order to apply a filtering policy, it is necessary to configure the firewall with a set of filtering rules. Similarly, and in order to apply an alerting policy, it is also necessary to configure the NIDS with a set of alerting rules (i.e., detection signatures when using misuse detection methods). Both filtering and alerting rules are specific cases of a more general configuration rule, which typically defines a decision (such as f ilter, alert, pass, etc.) that applies over a set of condition attributes, such as protocol, source, destination, classification, etc.

For our work, we define a general configuration rule as follows:

R i : {condition i } → decision i ( 1
)
where i is the relative position of the rule within the set of rules, {condition i } is the conjunctive set of condition attributes such that {condition i } equals C 1 ∧ C 2 ∧ ... ∧ C p -being p the number of condition attributes of the given rule -and decision is a boolean value in {true, f alse}.

Let us notice that the decision of a filtering rule will be positive (true) whether it applies to a specific value related to deny (or filter) the traffic it matches, and will be negative (f alse) whether it applies to a specific value related to accept (or pass) the traffic it matches. Similarly, the decision of an alerting rule will be positive (true) whether it applies to a specific value related to warn (or alert) about the traffic it matches, and will be negative (f alse) whether it applies to a specific value related to ignore the traffic it matches.

In the configuration policy of a component, conflicts due to rule overlaps, i.e., the same traffic matching more than one rule, can occur. To solve these conflicts, most components implement a first matching strategy through the ordering of rules. This way, each packet processed by the component is mapped to the decision of the rule with highest priority. This strategy introduces, however, new configuration errors, often referred in the literature as policy anomalies.

In [START_REF] Cuppens | Detection and Removal of Firewall Misconfiguration[END_REF], we presented an audit process to manage firewall policy anomalies, in order to detect and remove anomalies within the set of rules of a given firewall. This audit process is based on the existence of relationships between the condition attributes of the filtering rules, such as coincidence, disjunction, and inclusion, and proposes a transformation process which derives from an initial set of rules -with potential policy anomalies -to an equivalent one which is completely free of such anomalies.

In this paper, we extend our proposal of detecting and removing firewall policy anomalies [START_REF] Cuppens | Detection and Removal of Firewall Misconfiguration[END_REF], to a more complete setup where both firewalls and NIDSs are in charge of the network security policy. Hence, assuming that the role of both prevention and detection of network attacks is assigned to these two components, our objective is to completely correct the anomalies within their configuration.

We also extend in this paper the set of anomalies studied in [START_REF] Cuppens | Detection and Removal of Firewall Misconfiguration[END_REF] which, in turn, are not reported, as defined in this paper, in none of the studied related work. For such a purpose, we also introduce in this paper the use of a model to specify some properties of the network, e.g., vulnerabilities, as well as to determine whether the network traffic that matches a given configuration rule, may or may not cross the component configured by such a rule.

The advantages of our proposal are threefold. First, when performing our proposed discovery and removal of anomalies, and after rewriting the rules, one can verify that the resulting configuration of each component in the network is free of misconfiguration. Each anomalous rule will be reported to the administration console. This way, the security officer in charge of the network can check the network policy, in order to verify the correctness of the whole process, and perform the proper policy modifications to avoid such anomalies.

Second, the resulting rules are totally disjoint, i.e., the ordering of rules is no longer relevant. Hence, one can perform a second transformation in a positive or negative manner, generating a configuration that only contains positive rules if the component default policy is negative, and negative rules if the default policy is positive.

Third, the set of configuration rules enhanced through our algorithms may significatively help to reduce the number of false positive events warned by NIDSs (i.e., alerts that the NIDS reports when it is not supposed to) since we best fit the number and type of alerting rules to the network properties.

The rest of this paper is organized as follows. Section 2 starts by introducing a network model that is further used in Section 3 when presenting our set of algorithms. Section 4 overviews the performance of our proposed algorithms, and Section 5 introduces an analysis of some related work. Finally Section 6 closes the paper with some conclusions.

Network Model

The purpose of our network model is to determine whether the traffic that matches a given configuration rule R i may or may not cross the component configured by such a rule. It is defined as follows. First, and concerning the traffic flowing from two different zones of the network, we may determine the set of components that are crossed by this flow. Regarding the scenario shown in Figure 1 Let C be a set of components and let Z be a set of zones. We assume that each pair of zones in Z are mutually disjoint, i.e., if z i ∈ Z and z j ∈ Z then z i ∩ z j = ∅.

We then define the predicate connected(c 1 , c 2 ) as a symmetric and anti-reflexive function which becomes true whether there exists, at least, one interface con- Let us now define a set of functions related with the order between paths. We first define functions f irst, last, and the order functor between paths. We first define function f irst from P in C such that if p is a path, then f irst(p) corresponds to the first component in the path. Conversely, we define function last from P in C such that if p is a path, then last(p) corresponds to the last component in the path. We then define the order functor between paths as p 1 ≤ p 2 , such that path p 1 is shorter than p 2 , and where all the components within p 1 are also within p 2 .

Two additional functions are route and minimal route. We define first define function route from Z to Z, i.e., {route(z 1 , z 2 ) : Z × Z in 2 P }, such that p ∈ route(z 1 , z 2 ) iff the path p connects zone z 1 to zone z 2 . Formally, we define p ∈ route(z 1 , z 2 ) iff adjacent(f irst(p), z 1 ) and adjacent(last(p), z 2 ). Similarly, we then define minimal route from Z to Z, i.e., {minimal route(z 1 , z 2 ) : Z × Z in 2 P }, such that p ∈ minimal route(z 1 , z 2 ) iff the following conditions hold: (1) p ∈ route(z 1 , z 2 ); (2) There does not exist p ′ ∈ route(z 1 , z 2 ) such that p ′ < p.

Regarding Figure 1, we can verify that the minimal route from zone private 3 to zone private

2 equals [C 4 , C 2 , C 3 ], i.e., minimal route(private 3 , private 2 ) = {[C 4 , C 2 , C 3 ]}.
Let us finally conclude by defining the predicate affects(Z, A c ) as a boolean expression which becomes true whether there is, at least, an element z ∈ Z such that the configuration of z is vulnerable to the attack category A c ∈ V , where V is a vulnerability set built from a vulnerability database, such as CVE [START_REF]Common Vulnerabilities and Exposures[END_REF] or OSVDB [START_REF]Open Source Vulnerability Database[END_REF].

Our Proposal

In this section we present our set of audit algorithms, whose main objective is the complete discovering and removal of policy anomalies that could exist in a single component policy, i.e., to discover and warn the security officer about potential anomalies within the configuration rules of a given component. Let us start by classifying the complete set of anomalies of our proposal.

Classifying the Anomalies

We classify in this section the complete set of anomalies that can occur within a single component configuration. An example for each anomaly will be illustrated through the sample scenarios shown in Figure 2. Shadowing A configuration rule R i is shadowed in a set of configuration rules R whether such a rule never applies because all the packets that R i may match, are previously matched by another rule, or combination of rules, with higher priority in order. Regarding Figure 2, rule C 1 {R 6 } is shadowed by the overlapping of rules C 1 {R 3 } and C 1 {R 5 }. Redundancy A configuration rule R i is redundant in a set of rules R whether the rule is not shadowed by any other rule or set of rules and, when removing R i from R, the security policy does not change. For instance, referring to Figure 2, rule C 1 {R 4 } is redundant, since the overlapping between rules C 1 {R 3 } and C 1 {R 5 } is equivalent to the police of rule C 1 {R 4 }. Irrelevance A configuration rule R i is irrelevant in a set of configuration rules R if one of the following conditions holds:

(1) Both source and destination address are within the same zone, and its decision is f alse. For instance, rule C 1 {R 1 } is irrelevant since the source of this address, external network, as well as its destination, is the same.

(2) The component is not within the minimal route that connects the source zone, concerning the irrelevant rule which causes the anomaly, to the destination zone. Hence, the rule is irrelevant since it matches traffic which does not flow through this component. Rule C 2 {R 3 }, for example, is irrelevant since component C 2 is not in the path which corresponds to the minimal route between the source zone windows network to the destination zone unix network.

(3) At least one of the condition attributes in R i is related with a classification of attack A c which does not affect the destination zone of such a rule, i.e., the predicate affects(z d , A c ) becomes f alse. Regarding Figure 2, we can see that rule C 2 {R 2 } is irrelevant since the nodes in the destination zone unix network are not affected by vulnerabilities classified as winworm.

Proposed Algorithms

Our proposed audit process is a way to alert the security officer in charge of the network about these configuration errors, as well as to remove all the useless rules in the initial component configuration. The data to be used for the detection process is the following. A set of rules R as a list of initial size n, where n equals count(R), and where each element is an associative array with the strings condition, decision, shadowing, redundancy, and irrelevance as keys to access each necessary value.

For reasons of clarity, we assume one can access a linked-list through the operator R i , where i is the relative position regarding the initial list size -count(R). We also assume one can add new values to the list as any other normal variable does (element ← value), as well as to remove elements through the addition of an empty set (element ← ∅). The internal order of elements from the linked-list R keeps with the relative ordering of rules.

Each element R i [condition] is a boolean expression over p possible attributes. To simplify, we only consider as attributes the following ones: szone (source zone), dzone (destination zone), sport (source port), dport (destination port), protocol, and attack class -or A c for short -which will be empty whether the component is a firewall. In turn, each element R i [decision] is a boolean variable whose values are in {true, f alse}. Finally, elements R i [shadowing], R i [redundancy], and R i [irrelevance] are boolean variables in {true, f alse} -which will be initialized to f alse by default.

We split the whole process in four different algorithms. The first algorithm (cf. Algorithm 1) is an auxiliary function whose input is two rules, A and B. Once executed, this auxiliary function returns a further rule, C, whose set of condition attributes is the exclusion of the set of conditions from A over B. In order to simplify the representation of this algorithm, we use the notation A i as an abbreviation of the variable A[condition][i], and the notation B i as an abbreviation of the variable

B[condition][i] -where i in [1, p].
The second algorithm is a boolean function in {true, f alse} which applies the necessary verifications to decide whether a rule r is irrelevant for the configuration of a component c. To properly execute this algorithm, let us define Z as the set of zones, source(r) as a function in Z such that source(r) = szone, and dest(r) as a function in Z such that dest(r) = dzone.

The third algorithm is a boolean function in {true, f alse} which, in turn, applies the transformation exclusion (cf. Algorithm 1) over a set of configuration rules to check whether the rule obtained as a parameter is potentially redundant.

The last algorithm (i.e., Algorithm 4) performs the whole process of detecting and removing the complete set of anomalies. This process is split in three different phases. During the first phase, a set of shadowing rules are detected and removed from a top-bottom scope, by iteratively applying Algorithm 1 -when the decision field of the two rules is different. Let us notice that this stage of detecting and removing shadowed rules is applied before the detection and removal of proper redundant and irrelevant rules.

The resulting set of rules is then used when applying the second phase, also from a top-bottom scope. This stage is performed to detect and remove proper redundant rules, through an iterative call to Algorithm 3 (i.e., testRedundancy), as well as to detect and remove all the further shadowed rules remaining during the latter process. Finally, during a third phase the whole set of non-empty rules is analyzed in order to detect and remove irrelevance, through an iterative call to Algorithm 2 (i.e., testIrrelevance).

Let us conclude by giving an outlook to the set of warnings send to the security officer after the execution of Algorithm 4 over the configuration of the two components shown in Figure 2.

First case of irrelevance on

C 1 {R 1 } Redundancy on C 1 {R 4 } Shadowing on C 1 {R 6 } Third case of irrelevance on C 2 {R 2 } Second case of irrelevance on C 2 {R 3 } Redundancy on C 2 {R 6 }

Correctness of the Algorithms

Lemma 1 Let R i : condition i → decision i and R j : condition j → decision j be two configuration rules.

Then {R i , R j } is equivalent to {R i , R ′ j } where R ′ j ← exclusion(R j , R i ). Proof of Lemma 1 Let us assume that R i [condition] = A 1 ∧ A 2 ∧ ... ∧ A p , and R j [condition] = B 1 ∧ B 2 ∧ ... ∧ B p . If (A 1 ∩ B 1 ) = ∅ or (A 2 ∩ B 2 ) = ∅ or . . . or (A p ∩ B p ) = ∅ then exclusion(R j , R i ) ← R j .
Hence, to prove the equivalence between {R i , R j } and {R i , R ′ j } is trivial in this case. Let us now assume that (A 1 ∩B 1 ) = ∅ and (A 2 ∩B 2 ) = ∅ and ... and (A p ∩B p ) = ∅. If we apply rules {R i , R j } where R i comes before R j , then rule R j applies to a given packet if this packet satisfies

R j [condition] but not R i [condition] (since R i applies first). Therefore, notice that R j [condition] -R i [condition] is equivalent to (B 1 -A 1 ) ∧ B 2 ∧ ... ∧ B p or (A 1 ∩ B 1 ) ∧ (B 2 -A 2 ) ∧ ... ∧ B p or (A 1 ∩ B 1 ) ∧ (A 2 ∩ B 2 ) ∧ (B 3 -A 3 ) ∧ ... ∧ B p or ... (A 1 ∩ B 1 ) ∧ ... ∧ (A p-1 ∩ B p-1 ) ∧ (B p -A p ), which corresponds to R ′ j = exclusion(R j , R i ).
This way, if R j applies to a given packet in {R i , R j }, then rule R ′ j also applies to this packet in

{R i , R ′ j }. Conversely, if R ′ j applies to a given packet in {R i , R ′ j }, then this means this packet satisfies R j [condition] but not R i [condition]. So, it is clear that rule R j also applies to this packet in {R i , R j }. Since in Algorithm 1 R ′ j [decision] becomes R j [decision], this enables to conclude that {R i , R j } is equivalent to {R i , R ′ j }. ⊓ ⊔
Theorem 2 Let R be a set of configuration rules and let T r(R) be the resulting rules obtained by applying Algorithm 4 to R. Then R and T r(R) are equivalent.

Proof of Theorem 2 Let T r ′ 1 (R) be the set of rules obtained after applying the first phase of Algorithm 4. Since T r ′ 1 (R) is derived from rule R by applying exclusion(R j , R i ) to some rules R j in R, it is straightforward, from Lemma 1, to conclude that T r ′ 1 (R) is equivalent to R. Let us now move to the second phase, and let us consider a rule R i such that testRedundancy(R i ) (cf. Algorithm 3) is true. This means that R i [condition] can be derived by conditions of a set of rules S with the same decision and that come after in order than rule R i . Since every rule R j with a decision different from the one of rules in S has already been excluded from rules of S in the first phase of the Algorithm, we can conclude that rule R i is definitely redundant and can be removed without changing the component configuration. This way, we conclude that Algorithm 4 preserves equivalence in this case. On the other hand, if testRedundancy(R i ) is f alse, then transformation consists in applying function exclusion(R j , R i ) to some rules R j which also preserves equivalence.

Similarly, and once in the third phase, let us consider a rule R i such that testIrrelevance(c, R i ) is true. This means that this rule matches traffic that will never cross component c, or that is irrelevant for the component's configuration. So, we can remove R i from R without changing such a configuration. Thus, in this third case, as in the other two cases, T r ′ (R) is equivalent to T r ′ 1 (R) which, in turn, is equivalent to R.

⊓ ⊔ Lemma 3 Let R i : condition i → decision i and R j : condition j → decision j be two configuration rules. Then rules R i and R ′ j , where R ′ j ← exclusion(R j , R i ) will never simultaneously apply to any given packet.

Proof of Lemma 3

Notice that rule R ′ j only applies when rule R i does not apply. Thus, if rule R ′ j comes before rule R i , this will not change the final decision since rule R ′ j only applies to packets that do not match rule R i .

⊓ ⊔

Theorem 4 Let R be a set of configuration rules and let T r(R) be the resulting rules obtained by applying Algorithm 4 to R. Then the following statements hold:

(1) Ordering the rules in T r(R) is no longer relevant; (2) T r(R) is completely free of anomalies.

Proof of Theorem 4

For any pair of rules R i and R j such that R i comes before R j , R j is replaced by a rule R ′ j obtained by recursively replacing R j by exclusion(R j , R k ) for any k < j.

Then, by recursively applying Lemma 3, it is possible to commute rules R ′ i and R ′ j in T r(R) without changing the policy.

Regarding the second statement -T r(R) is completely free of anomalies -notice that, in T r(R), each rule is independent of all other rules. Thus, if we consider a rule R i in T r(R) such that R i [condition] = ∅, then this rule will apply to any packet that satisfies R i [condition], i.e., it is not shadowed.

On the other hand, rule R i is not redundant because if we remove this rule, since this rule is the only one that applies to packets that satisfy R i [condition], then configuration of the component will change if we remove rule R i from T r(R).

Finally, and after the execution of Algorithm 4 over the initial set of configuration rules, one may verify that for each rule R i in T r(R) the following conditions hold:

(1) s = z 1 ∩ source(r) = ∅ and d = z 2 ∩ dest(r) = ∅ such that z 1 = z 2 and component c is in minimal route(z 1 , z 2 ); (2) if A c = attack category(R i ) = ∅, the predicate af f ects(A c , z 2 ) becomes true. Thus, each rule R i in T r(R) is not irrelevant. ⊓ ⊔

Default policies

Each component implements a positive (i.e., close) or negative (i.e., open) default policy. In the positive policy, the default policy is to alert or to deny a packet when any configuration rule applies. By contrast, the negative policy will accepts or pass a packet when no rule applies.

After rewriting the rules with our algorithms, we can actually remove every rule whose decision is pass or accept if the default policy of this component is negative (else this rule is redundant with the default policy) and similarly we can remove every rule whose decision is deny or alert if the default policy is positive. Thus, we can consider that our proposed algorithms generate a configuration that only contains positive rules if the component default policy is negative, and negative rules if the default policy is positive.

Performance Evaluation

In this section, we present an evaluation of the performance of MIRAGE (which stands for MIsconfiguRAtion manaGEr), a software prototype that implements the algorithms presented in sections 3. MIRAGE has been developed using PHP, a scripting language that is especially suited for web services development and can be embedded into HTML for the construction of client-side GUI based applications [START_REF] Castagnetto | Professional PHP Programming[END_REF]. MIRAGE can be locally or remotely executed by using a HTTP server (e.g., Apache server over UNIX or Windows setups) and a web browser. We evaluated our algorithms through a set of experiments over an IPv4 network. The topology for this network consisted of a single firewall based on Netfilter [START_REF] Welte | The netfilter project: firewalling, nat and packet mangling for linux 2[END_REF], and a single NIDS based on Snort [START_REF] Roesch | Snort: lightweight intrusion detection for networks[END_REF] -both of them connected to three different zones with more than 50 hosts. The whole of these experiments were carried out on an Intel-Pentium M 1.4 GHz processor with 512 MB RAM, running Debian GNU/Linux 2.6.8, and using Apache/1.3 with PHP/4.3 configured.

During our experiments, we measured the memory space and the processing time needed to perform Algorithm 4 over several sets of IPv4 filtering and alerting policies for the two IPv4 networks, according to the three following security officer profiles: beginner, intermediate, and expert -where the probability to have overlaps between rules increases from 5% to 90%. The results of these measurements are plotted in Figure 3(a) and Figure 3(b). Although the plots reflect strong memory and process time requirements, we consider they are reasonable for off-line analysis, since it is not part of the critical performance of an alerting or filtering component.

Related Work

A first approach to get a configuration free of errors is by applying a formal model to express the network policy. In [START_REF] Cuppens | In Second Workshop on Formal Aspects in Security and Trust. A formal approach to specify and deploy a network security policy[END_REF], for example, we presented a model with this purpose. This way, a set of configuration rules, whose syntax is specific to a given component, may be generated using a transformation language.

The proposals in [START_REF] Adiseshu | Detecting and Resolving Packet Filter Conflicts[END_REF][START_REF] Gupta | Algorithms for Routing Lookups and Packet Classification[END_REF][START_REF] Liu | Complete Redundancy Detection in Firewalls[END_REF][START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF], provide means to directly manage the discovery of anomalies from the components' configuration. For instance, the authors in [START_REF] Adiseshu | Detecting and Resolving Packet Filter Conflicts[END_REF] consider that, in a configuration set, two rules are in conflict when the first rule in order matches some packets that match the second rule, and the second rule also matches some of the packets that match the first rule. This approach is very limited since it just detects a particular case of wrongly defined rules in a single configuration, i.e., just ambiguity within the set of rules is detected.

In [START_REF] Gupta | Algorithms for Routing Lookups and Packet Classification[END_REF], two new cases of anomalies are considered. First, a rule R j is defined as backward redundant iff there exists another rule R i with higher priority in order such that all the packets that match rule R j also match rule R i . Second, a rule R i is defined as forward redundant iff there exists another rule R j with the same decision and less priority in order such that the following conditions hold: (1) all the packets that match R i also match R j ; (2) for each rule R k between R i and R j , and that matches all the packets that also match rule R i , R k has the same decision as R i . We consider this approach as incomplete, since it does not detect all the possible cases of anomalies defined in this paper. For instance, given the set of rules shown in Figure 4(a), since R 2 comes after R 1 , rule R 2 only applies over the interval [51, 70] -i.e., R 2 is redundant. Their approach, however, cannot detect the redundancy of rule R 2 within this setup.

Another similar approach is presented in [START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF]. Again, and even though the efficiency of their proposed discovering algorithms and techniques is very promising, we con- sider this approach not complete since, given a misconfigured component, their detection algorithms could not detect all the possible errors. For example, given the set of rules shown in Figure 4(b) their approach cannot detect that rule R 3 will be never applied due to the union of rules R 1 and R 2 .

Conclusions

In this paper we presented an audit process to set the configuration of both firewalls and network intrusion detection systems (NIDSs) free of anomalies. Our audit process is based on the existence of relationships between the condition attributes of the configuration rules of those network security components, such as coincidence, disjunction, and inclusion. Then, our proposal uses a transformation process which derives from an initial set of rules -potentially misconfigured -to an equivalent one which is completely free of anomalies.

We also presented in this paper a network model to determine whether the network traffic that matches a given configuration rule, may or may not cross the component configured by such a rule, as well as other network properties. Thanks to this model, our approach best defines all the set of anomalies studied in the related work, and it reports, moreover, a new anomaly case not reported, as defined in this paper, in none of the other approaches.

Some advantages of our approach are the following. First, our transformation process verifies that the resulting rules are completely independent between them. Otherwise, each rule considered as useless during the process is reported to the security officer, in order to verify the correctness of the whole process. Second, we can perform a second rewriting of rules, generating a configuration that only contains positive rules if the component default policy is negative, and negative rules if the default policy is positive. Third, the elimination of alerting rules during the audit process helps to reduce future false positive events alerted by a NIDS.

Regarding a possible increase of the initial number of rules, due to the applying of our algorithms, it is only significant whether the associated parsing algorithm of the component depends on the number of rules. In this case, an increase in such a parameter may degrade the performance of the component. Nonetheless, this is not a disadvantage since the use of a parsing algorithm independent of the number of rules becomes the best solution as much for our proposal as for the current deployment of network technologies. The set pruning tree algorithm is a proper example, because it only depends on the number and size of attributes to be parsed, not the number of rules [START_REF] Paul | A full bandwidth ATM Firewall[END_REF].

The implementation of our approach in a software prototype demonstrate the practicability of our work. We shortly discussed this implementation, based on a scripting language [START_REF] Castagnetto | Professional PHP Programming[END_REF], and presented an evaluation of its performance. Although these experimental results show that our algorithms have strong requirements, we believe that they are reasonable for off-line analysis, since it is not part of the critical performance of the audited component.

  , for example, the set of components crossed by the network traffic flowing from zone external network to zone private 3 equals [C 1 ,C 2 ,C 4 ], and the set of components crossed by the network traffic flowing from zone private 3 to zone private 2 equals [C 4 ,C 2 ,C 3 ].

Fig. 1 .

 1 Fig. 1. Simple distributed policy setup.

  necting component c 1 to component c 2 . On the other hand, we define the predicate adjacent(c, z) as a relation between components and zones which becomes true whether the zone z is interfaced to component c. Referring to Figure 1, we can verify that predicates connected(C 1 , C 2 ) and connected(C 1 , C 3 ), as well as adjacent(C 1 , DM Z), adjacent(C 2 , private 1 ), adjacent(C 3 , DM Z), and so on, become true. We then define the set of paths, P , as follows. If c ∈ C then [c] ∈ P is an atomic path. Similarly, if [p.c 1 ] ∈ P (be "." a concatenation functor) and c 2 ∈ C, such that c 2 / ∈ p and connected(c 1 , c 2 ), then [p.c 1 .c 2 ] ∈ P . This way, we can notice that, concerning Figure 1, [C 1 , C 2 , C 4 ] ∈ P and [C 1 , C 3 ] ∈ P .

  (a) Example scenario with a single filtering policy. (b) Example scenario with a single alerting policy.

Fig. 2 .

 2 Fig. 2. Example filtering and alerting policies.

Fig. 3 .

 3 Fig. 3. Memory and processing time evaluation.

R1 : s ∈ [ 10 ,Fig. 4 .

 104 Fig. 4. Example of some firewall configurations.

Firewalls also implement other functionalities, such as Proxying and Network Address Transfer (NAT), but it is not the purpose of this paper to cover these functionalities.

Acknowledgments

This work was supported by funding from the French ministry of research, under the ACI DESIRS project, the Spanish Government project TIC2003-02041, and the Catalan Government grants 2003FI126 and 2005BE77.