Ons Aouedi
email: ons.aouedi@ls2n.fr

Kandaraj Piamrat

F-BIDS: Federated-Blending based Intrusion Detection System

Keywords:

The rapid development of network communication along with the drastic increase in the number of smart devices has triggered a surge in network traffic, which can contain private data and in turn affect user privacy. Recently, Federated Learning (FL) has been proposed in Intrusion Detection Systems (IDS) to ensure attack detection, privacy preservation, and cost reduction, which are crucial issues in traditional centralized machine-learning-based IDS. However, FLbased approaches still exhibit vulnerabilities that can be exploited by adversaries to compromise user data. At the same time, meta-models (including the blending models) have been recognized as one of the solutions to improve generalization for attack detection and classification since they enhance generalization and predictive performances by combining multiple base models. Therefore, in this paper, we propose a Federated Blending model-driven IDS framework for the Internet of Things (IoT) and Industrial IoT (IIoT), called F-BIDS, in order to further protect the privacy of existing ML-based IDS. The proposition consists of a Decision Tree (DT) and Random Forest (RF) as base classifiers to first produce the meta-data. Then, the meta-classifier, which is a Neural Networks (NN) model, uses the meta-data during the federated training step, and finally, it makes the final classification on the test set. Specifically, in contrast to the classical FL approaches, the federated meta-classifier is trained on the meta-data (composite data) instead of user-sensitive data to further enhance privacy. To evaluate the performance of F-BIDS, we used the most recent and open cyber-security datasets, called Edge-IIoTset (published in 2022) and InSDN (in 2020). We chose these datasets because they are recent datasets and contain a large amount of network traffic including both malicious and benign traffic.

Introduction

Recently, strict laws such as the General Data Protection Regulation (GDPR) in European Union 1 have completely redefined the data management policy. As a result, Federated Learning (FL) has appeared as a valuable approach in enabling collaborative training of ML-based models among several clients/devices under privacy restrictions. More specifically, it has been introduced by Google as a decentralized approach [START_REF] Mcmahan | Communication-efficient learning of deep networks from decentralized data[END_REF] in order to decouple the model training from the need for direct access to the end-user data. Since FL was introduced in order to keep the data where they are generated and to preserve data privacy, several solutions have attempted to integrate FL into real-life applications [START_REF] Gadekallu | Federated learning for big data: A survey on opportunities, applications, and future directions[END_REF] including Intrusion Detection Systems (IDS) [START_REF] Agrawal | Federated learning for intrusion detection system: Concepts, challenges and future directions[END_REF] [START_REF] Ferrag | Federated deep learning for cyber security in the internet of things: Concepts, applications, and experimental analysis[END_REF].

In fact, IDS is considered an important tool for network security as it is used to detect attacks from incoming network traffic. However, despite that FL-based approaches exchange the model parameters instead of the raw data, the recent attacks (e.g., membership inference attack) demonstrate that such an approach does not provide sufficient privacy guarantee [5] [6]. This is because the FL training process is based on the communication between the clients and the FL server that can expose the model and in turn be a target for several security threats. For example, Shokri et al. [START_REF] Shokri | Membership inference attacks against machine learning models[END_REF] demonstrated inference attacks and in particular membership inference attacks can leak private information about their data owners. The membership inference attacks aim to determine whether or not target data was used to train the target model (victim model) [START_REF] Hu | Membership inference attacks on machine learning: A survey[END_REF]. To solve these issues, FL's serious privacy concerns motivated several privacy-preservation approaches against membership inference attacks such as Differential Privacy (DP) and encryption. Unfortunately, these approaches produce federated models with unacceptable computation overhead and classification performance.

As a consequence, the FL-based IDS requires a new solution with a better guarantee of security and privacy while keeping good performance.

Contribution

Based on the above motivations, in this paper, we design a Federated Blending model for IDS, called F-BIDS, in order to reduce the reverse engineering attack on the FL training process, while keeping costs low. The main purpose behind our model is to incorporate only the meta-classifier into the FL framework in order to further enhance data privacy. In particular, the base classifiers, which are Random Forest (RF) and Decision Tree (DT), will be trained in the first communication round only on the client's side using their private data. After that, the meta-classifier, which is Neural Network (NN) model, uses only the meta-data generated by the base classifiers for the training process. Then, the NN models of each device are transferred to the FL server for global aggregation and the creation of the new global model. Finally, the global model is returned to the clients for further updates. To the best of our knowledge, F-BIDS model is the first model that combines the FL with the meta-classifier and blending ensemble for attack classification.

The proposed F-BIDS supports heterogeneous architectures across the local and the global model.

In brief, the key contributions of this paper can be summarized as follows:

• An FL-based blending scheme using deep learning (DL) that can analyze and generalize a huge amount of sensitive data rapidly.

• A reduction in privacy risk was brought by blending ensemble learning and the classical FL process.

• An evaluation of the proposed scheme using recent and realistic datasets (Edge-IIoTset and InSDN).

• A comparative analysis of the proposed scheme, the centralized machine learning (ML) model, and the state-ofthe-art.

Background

This section details the theoretical background of the basic concepts, which are useful to understand our proposition.

Federated Learning

Given the privacy concerns and data governance challenges, FL has been proposed as an alternative solution for centralized learning [START_REF] Mcmahan | Communication-efficient learning of deep networks from decentralized data[END_REF]. It attempts to answer the main question: Can we train the model without needing to transfer data over a central location? [START_REF] Truex | A hybrid approach to privacy-preserving federated learning[END_REF]. The learning process of FL is divided into three phases: initialization, local training on end-user devices, and central model aggregation. In the beginning, the FL server sends the initial global model to the selected clients/devices. Then, each client calculates a local update of the global model using its own private data.

Once all the updates are received, the FL server aggregates the model's parameters. This process is repeated several rounds until the desired performance is achieved. Within the FL, the learning phase occurs locally at each client or device, and only model parameters are transferred. Also, it comes with another benefit of having a model trained on larger landscape data. It is an iterative process, wherein each communication round the model performance can be improved. The Federated Average (FedAvg) algorithm is the most popular algorithm for model aggregation, which is the core of FL [START_REF] Mcmahan | Communication-efficient learning of deep networks from decentralized data[END_REF]. At each communication round, the FL server uses the FedAvg algorithm in order to aggregate the local model after the local update by the clients. The FedAvg can be calculated as follows.

Definition: Global Model Aggregation

𝜃 𝑡+1 = 𝐾 ∑ 𝑘=1 𝐷 𝑘 𝐷 𝜃 𝑘 𝑡+1 (1)
Given a client's model update, the equation (1) performs the global aggregation at each communication round. 𝜃 corresponds to the model parameters at iteration 𝑡 + 1, 𝐷 is the amount of data from all the 𝐾 clients, 𝐷 𝑘 is the amount of the data of the client 𝑘.

Blending Ensemble

Ensemble learning is one of the promising directions where it has established its superiority in recent years. In practice, it combines the prediction of several heterogeneous or homogeneous models. In other words, it tries to imitate nature by seeking different opinions before making any decision where we combine weighted and various individual opinions to find a final decision. It can be generally divided into two groups: (i) homogeneous ensemble (such as bagging or boosting) and (ii) heterogeneous ensembles such as blending. The blending ensemble tries to take advantage of several heterogeneous models, which is not the case with bagging and boosting models [START_REF] Aouedi | Decision tree-based blending method using deep-learning for network management[END_REF]. As a result, it can achieve a remarkable generalization performance [START_REF] Xiao | A deep learning-based multi-model ensemble method for cancer prediction[END_REF]. Moreover, individual models in blending can be trained in parallel and hence requires less training time than boosting models. Therefore, this can be used to provide an efficient mechanism for the Internet of Things (IoT) environment. In particular, the blending ensemble consists of two levels known as base-classifiers and meta-classifier. The objective of the base classifiers is to train ML models using the raw data and produce the meta-data through the validation set. It is important to note here that data need to be split into training, validation, and test sets. Then, the meta-classifier training process uses the meta-data generated by the base classifiers to make the final classification. Therefore, the meta-classifier uses the intermediate data (i.e., meta-data)

whereas the original data is used only by the base classifiers in the first level.

As mentioned above, blending is a type of ensemble learning model, which has been originally introduced in the Netflix competition [START_REF] Töscher | The bigchaos solution to the netflix grand prize[END_REF] in 2009. The main objective of blending is to combine and improve the prediction of several models (base-classifiers), through the meta-classifier. In other words, the base classifiers are used to provide base predictions as new features, which is the meta-data. Then the meta-classifier is trained on these new features to give the final decision. A general overview of the training and testing process is shown in Figure 1. In practice, the blending ensemble is based on several steps as described in the following.

1. Apply a hold-out method to divide the training set into a new training set and validation set.

Related Work

Due to the continuous changes in the behaviors of cyber-attacks within the IoT environment, several ML/DL-based approaches have been proposed. In this section, we first provide a brief overview of some IDS based on conventional ensemble learning (Section 3.1). Then, we present the recent achievements of state-of-the-art approaches that proposed IDS using FL-based architecture (Section 3.2). Finally, we present recent works on improving the privacy of FL-based solutions in (Section 3.3).

Conventional ensemble models

Kumar et al. [START_REF] Kumar | A distributed ensemble design based Intrusion Detection System using fog computing to protect the Internet of Things networks[END_REF] proposed an ensemble learning for intrusion detection using fog nodes. It is composed of two levels. In the first level, three supervised models are trained on the initial data (XGBoost, K-Nearest Neighbor, Naive Bayes). Then, in the second level, Random Forests (RF) have been used to combine the output of the first level and provide the final classification ("attack" or "benign"). Kumar et al. [START_REF] Kumar | An ensemble learning and fog-cloud architecture-driven cyber-attack detection framework for iomt networks[END_REF] also proposed another ensemble model by combining several conventional ML models on the Internet of Medical Things (IoMT) environment. Specifically, the Decision Tree, Naive Bayes, and RF are used in the first level, and in the second level, the classification results are obtained by XGBoost for identifying normal and attack instances. To evaluate the performance of these ensemble models the authors used ToN_IoT, DS2OS, and UNSW-NB15 datasets which are obsolete and can lack modern IoTbased attacks.

Also, Folino et al. [START_REF] Folino | On learning effective ensembles of deep neural networks for intrusion detection[END_REF] combined four base DNN classifiers, trained on disjoint chunks of the data instances' stream, and the meta classifier uses both the base classifiers predictions and original instance features for training and the final prediction tasks. Using two datasets the experimental results showed that the proposed ensemble model can act as a methodological basis robust and scalable enough for intelligent systems for the analysis of streaming IDS. Furthermore, in our previous work [START_REF] Aouedi | Decision tree-based blending method using deep-learning for network management[END_REF], a blending ensemble has been proposed for network traffic classification within centralized learning using a decision tree-based blending method and DL as a meta-classifier. The evaluation results demonstrate that the proposed ensemble can prevent overfitting and reduces bias simultaneously to some extent. Specifically, the use of a meta-classifier corrects the errors that occur during the learning process of the base classifiers. The presented results also confirm that using neural networks as a meta-classifier enables to discover the nonlinear relationships with very little handcrafted engineering and increases the learning ability of the whole model. However, this ensemble is limited to a centralized version and is not dedicated to intrusion/attack detection.

The aforementioned approaches are based on a centralized model where the data are collected on a central entity.

Despite the effectiveness of these approaches, they can cause problems with information security and leakage of confidential data. In contrast, our F-BIDS approach takes advantage of both ensemble learning and FL to detect the attack without data leakage and reduce communication overhead as much as possible by sending only the metaclassifier model parameters to the central entity instead of the end-user data.

Federated Learning-based models

As a solution to privacy problems, FL has been proposed to ensure data privacy during ML/DL model training.

In this context, Nguyen et al. [START_REF] Nguyen | Dïot: A federated self-learning anomaly detection system for iot[END_REF] of parameters as well as investigations on the trade-offs between data privacy and model system performance for attack detection. In this direction, Al-Marri et al. [START_REF] Al-Marri | Federated mimic learning for privacy preserving intrusion detection[END_REF] proposed a federated mimic learning by combining FL and mimic learning in order to better preserve the privacy of end-users. Using the NSL-KDD dataset, the results show that the federated mimic learning-based method can achieve 98% detection accuracy, which is close performance to the centralized DL while improving the privacy preservation of the user data significantly. However, the NSL-KDD dataset is obsolete and can lack modern IoT-based attacks.

Privacy enhancement

To enhance FL security and better preserve the privacy of the end-user data, some techniques have been used such as differential privacy (DP) and data encryption. For example, Li et al. [START_REF] Li | Deepfed: Federated deep learning for intrusion detection in industrial cyber-physical systems[END_REF] proposed an FL-based IDS for Industrial Cyber-Physical Systems, called DeepFed. Then, to preserve the security and privacy of model parameters during the training process, the encryption-based algorithm has been used. Although the good performance of such algorithms, they have some drawbacks when applying directly to IDS based on the FL model. First, encryption-based techniques are computationally expensive because the users have to store the set of encryption keys and run the encryption process, which requires more time and CPU usage. Second, using DP with the FL model may add more noise to the model parameters and in turn decrease the performance of the whole system. Third, the clients can have different amounts of data, and using the same noise with all clients can be unfair and inefficient. In contrast to these techniques, as the meta-classifier used with F-BIDS consists of only a few layers, it requires less computation. Moreover, the use of a meta-classifier corrects the errors that occur during the learning process of the base classifiers and in turn improves the classification performance.

Table 1

Comparison of related works and our proposition.

Ref.

Ensemble leaning Federated approach Privacy enhancing

[14] ✓ x x [15] ✓ x x [11] ✓ x x [16] ✓ x
x DÏoT [START_REF] Nguyen | Dïot: A federated self-learning anomaly detection system for iot[END_REF] x ✓ x FLIDS [START_REF] Friha | Felids: Federated learning-based intrusion detection system for agricultural internet of things[END_REF] x ✓ x FLUIDS [START_REF] Aouedi | Federated semi-supervised learning for attack detection in industrial internet of things[END_REF] x ✓ x [START_REF] Mothukuri | Federated learning-based anomaly detection for iot security attacks[END_REF] x ✓ x MV-FLID [START_REF] Attota | An ensemble multi-view Federated Learning Intrusion Detection for IoT[END_REF] x ✓ x [START_REF] Al-Marri | Federated mimic learning for privacy preserving intrusion detection[END_REF] x ✓ ✓ F-BIDS(our proposition) ✓ ✓ ✓

F-BIDS methodology

This section presents our federated blending model for IDS. We will describe the data pre-processing step and learning process of the proposed model.

Data pre-processing

In this subsection, we detail a discussion of feature pre-processing steps used with our model.

• Feature mapping and normalization

As the network traffic often contains categorical features, feature mapping needs to be used to transform these features. To do so, we have used one-hot encoding to encode the categorical features as a one-hot numeric array. Also, as the dataset consists of different features with values on different scales, it needs to be normalized. This can be done by Min-Max normalization to perform feature scaling. It is a technique that scales every feature of our dataset between 0 and 1 as expressed by equation ( 2), the maximum value of that feature gets transformed to 1 and the minimum value gets transformed to 0.

𝑋 ′ = 𝑋 -𝑋 𝑚𝑖𝑛 𝑋 𝑚𝑎𝑥 -𝑋 𝑚𝑖𝑛 (2)
where 𝑋 is the feature to be scaled down, 𝑋 𝑚𝑎𝑥 is the maximum value, and 𝑋 𝑚𝑖𝑛 is the minimum value for this feature.

• Feature selection

To improve the performance of the proposed model as well as reduce its training and classification time, we have used the feature selection method. The feature selection method tries to identify the most relevant features and discard the irrelevant ones. In the proposed model, Recursive Feature Elimination (RFE) has been used. It is a wrapper method that recursively evaluates the performance of a specific model with a different set of features. In other words, starting from all the feature sets, RFE recursively removes features in order to maximize accuracy. Then it ranks the features based on the order of their elimination.

Learning Process

In the proposed detection system, the Federated blending model is used for designing security mechanisms. The proposed model is mainly composed of two levels, which are base classifiers (level-1) and meta-models (level-2). As shown in Figure 2, two simple and well know ML-based models (DT and RF) have been used as base classifiers and local models that generate the meta-data (step 1). We select DT-based models because they are considered one of the most suitable learning algorithms for network traffic classification [START_REF] Nguyen | A survey of techniques for internet traffic classification using machine learning[END_REF]. Also, the main advantage of DT and RF compared to other models (e.g., XGBoost) is that they are easy to train and require fewer hyper-parameters tuning [START_REF] Aouedi | Performance evaluation of feature selection and tree-based algorithms for traffic classification[END_REF]. The number of clients selected at each round

Experimental study and results analysis

In this section, we first describe the datasets, and the experimental parameters, and then evaluate our proposed model.

Dataset description

To evaluate the performance of the proposed model, we have chosen two of the most recent datasets. Specifically, the first dataset is Edge-IIoTset published in 2022 [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF]. This dataset consists of 157,800 observations, 61 features, and 1 label, the label contains 15 possible values, benign and seven different types of attacks 2 . The statistics of the selected dataset are summarized in Table 3. The second dataset is InSDN published in 2020 [START_REF] Elsayed | Insdn: A novel sdn intrusion dataset[END_REF]. It consists of 343890

observations and 84 features. The label contains 8 possible values, benign and seven different types of attacks. We also chose this dataset because it contains a large amount of network traffic including both malicious and benign traffic.

Summarized descriptions of both datasets are presented in Table 3 and Table 4 respectively. In this experiment, we drop unnecessary flow features as done with its original paper [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF]. Then, we separated the dataset into 80% for training, 10% for validation, and 10% for testing.

Experimental setup

We conducted our experiments with Python 3 as a programming language, Scikit-learn for the conventional models, PyTorch for the federated blending model. Also, all experiments were run using four core Intel Core i7-6700 CPU@3.40GHz processor, and 32.00 GB of RAM.

Classification performance

Our experiments objectives are the following: 1) Evaluate the performance of the proposed ensemble blending model trained in a centralized way, where the training data are located in a central entity; 2) Evaluate the performance 2 https://www.kaggle.com/mohamedamineferrag/edgeiiotset-cyber-security-dataset-of-iot-iiot of F-BIDS model, trained in a federated way; and 3) Comparing F-BIDS against the centralized model, all these in terms of several evaluation metrics.

Centralized Blending performance evaluation

In this subsection, we compare the performance of different centralized models. Figure 3 and Figure 4 present the centralized blending model performance against support vector machines (SVM), Multi-layer Perceptron (MLP), the proposed model by Ferrag et al. [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] (the original paper of Edge-IIoT dataset), as well as the model proposed by

Friha et al. [START_REF] Friha | Felids: Federated learning-based intrusion detection system for agricultural internet of things[END_REF] in terms Precision, Recall, and F1-score under multi-class classification (6 and 15 class). To note here, Ferrag et al. [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] and Friha et al. [START_REF] Friha | Felids: Federated learning-based intrusion detection system for agricultural internet of things[END_REF] used fully connected layers for IDS using the Edge-IIoT dataset. They evaluated the performance of the fully connected layers in both centralized and federated learning modes.

It is worth noting that the centralized blending outperforms all the other models for 6-class and 15-Class in terms of all the evaluation metrics. For example, using Edge_IIoT dataset the F1-score is increased by 8.17 (3.23%), 12.15% (7.58%), and 15.19% (5.36%) for MLP, Ferrag et al. [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] model, and SVM, respectively. These results illustrate the high performance of our model, especially the 15-class classification scenario. Moreover, as shown in Figure 4 using InSDN dataset, the F1-score of our model is 9.71%, 14.29%, and 51.15% better than MLP, Friha et al. [START_REF] Friha | Felids: Federated learning-based intrusion detection system for agricultural internet of things[END_REF], and SVM, respectively. This may be attributed to the fact that the combination of DT, RF, and NN-based models helps to yield far superior results compared to other models. In order to further validate the effectiveness of the centralized blending model, we evaluate its performance by attack classification. Table 5 and Table 6 present the obtained results of the centralized models including SVM, MLP, the model proposed by Ferrag et al. [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF], and our blending ensemble model, in terms of Precision (Pr), Recall (Rc), F1-score (F1), under multi-class classification (6 and 15 class). It can be seen from these Tables that our model has a good performance in detecting different attacks as well as in detecting benign network traffic. More specifically, as shown in Table 5, our centralized blending model has better or equal results to other models but is never less effective.

For example, our model gives the highest F1-score for Normal traffic 100%, Injection attacks 84%, Scanning attacks

Communication overhead

Further, in this subsection, we compare the communication overhead of F-BIDS against different schemes, which are a centralized learning process, Ferrag et al. [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] and Friha et al. [START_REF] Friha | Felids: Federated learning-based intrusion detection system for agricultural internet of things[END_REF]. In particular, for the centralized model, the raw data need to be communicated to a central entity for the training process. On the other hand, we simulated the Ferrag et al. [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] and Friha et al. [START_REF] Friha | Felids: Federated learning-based intrusion detection system for agricultural internet of things[END_REF] in a federated way. As shown in Figure 5, the FL-based models (F-BIDS, FL (Ferrag et al. [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] and Friha et al. [START_REF] Friha | Felids: Federated learning-based intrusion detection system for agricultural internet of things[END_REF])), reduce the communication overhead in comparison to the centralized model.

This advantage becomes even more significant in the case of larger training data like InSDN dataset. This is mainly due to the fact that FL avoids transferring raw data samples to the central entity and sends only model parameters.

In addition, we can observe that F-BIDS performs better than the Federated version of Ferrag et al. [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] and Friha et al. [START_REF] Friha | Felids: Federated learning-based intrusion detection system for agricultural internet of things[END_REF]. This is attributed to the fact that with F-BIDS, the federated meta-model (i.e. NN layers) trained on the meta-data generated by the base classifiers whereas the other models used the Federated version of Ferrag et al. [START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] and Friha et al. [START_REF] Friha | Felids: Federated learning-based intrusion detection system for agricultural internet of things[END_REF] raw data, which are larger than the meta-data as well as more complicated to train.

Conclusion

In this paper, we propose a federated blending model-driven IDS framework to improve the classification performance as well as reduce privacy risk against some attacks, e.g., membership inference attacks, as maximum as possible. Using two different and recent datasets, the results demonstrate that by taking advantage of different models, centralized blending and F-BIDS are shown to be accurate and efficient for traffic classification tasks. Also, the presented results also confirm that F-BIDS achieves competitive results, compared to the state-of-the-art model.

In addition, the FL server benefits from the blending learning process in order to reduce privacy risks brought by centralized learning and the classical FL process. Finally, F-BIDS helps to reduce the communication overhead and hence reduce the network congestion if all traffic has to be sent to the FL server.

For future works, we plan to implement the model, study its network performance, and quantify the privacy risk by using some recent software like ML-Doctor. Also, the black-box nature of F-BIDS may raise an issue of trust; hence, an explainable solution is required for our proposed IDS system. In this context, we will extend F-BIDS models by adding an explainability module such as SHapley Additive exPlanations (SHAP) to further explain the model.

2 .Figure 1 :

 21 Figure 1: Training process (left) and Test process (right)

  [START_REF] Mothukuri | Federated learning-based anomaly detection for iot security attacks[END_REF] proposed an ensemble FL model for IDS in an IoT environment. More specifically, after the GRU model has been trained locally on the client for different window sizes, the FL server calculates the global model at a central server. Then, in the FL server, it applies an ensemble model (i.e., RF) to improve the classification performance. Similarly, Attota et al.[START_REF] Attota | An ensemble multi-view Federated Learning Intrusion Detection for IoT[END_REF] proposed an ensemble FL-based intrusion detection, called MV-FLID. Specifically, the authors have developed three Feedforward Neural Network (FNN) models for three views (i.e., Biflow View, Packet View, and Uniflow View), and the outcomes of these models are sent to an ensemble model (RF), which combines the predictions of these models and classifies the instances. The results show that the FL approach can outperform the non-FL one. Although the proposed models have improved the IDS through the use of an FL model and the combination of different models, they can leak sensitive data through the communication of model parameters directly. Therefore, the FL-based model still needs further protection

Figure 2 :

 2 Figure 2: F-BIDS learning process

  Then, NN layers (meta-model) are used as meta-classifier and a global model in order to learn the nonlinear relationship among the base-classifiers (step 2). Next, the client sends the meta-model to the FL sever for the global aggregation (step 3).The FL server aggregates the weights of the meta-model from the different client (step 4). Finally, the FL server sends back the aggregated meta-model to the clients (step 5). Consequently, F-BIDS takes advantage of both ensemble learning and FL, and their relationship is win-win. In particular, F-BIDS uses FL to enhance the privacy concerns for the blending model by sending the model parameters instead of row data and the blending model, whereas the blending model can reduce the membership inference attacks performance on the FL model because, during the FL communication round, the clients and the FL server exchange the parameters of the meta-classifier instead of the base classifiers. In other words, this is due to the fact, that the FL meta-classifiers are trained on the meta-data that describe prior learning tasks and previously learned DT and RF models. Algorithm 1 describes the steps involved in designing a blending-based ensemble design, and

Figure 3 :

 3 Figure 3: Centralized models performance for 15-class (left) and for 6-class (right) with Edge-IIoTset dataset

Figure 4 :

 4 Figure 4: Centralized model performance with InSDN dataset

Figure 5 :

 5 Figure 5: Communication overhead with Edge_IIoT dataset (left) and for InSDN dataset (right)

  This was the first system that deployed FL for IDS. It consists of two components, which are security gateways and IoT security services. Security Gateways use the local data to train the local models with Gated Recurrent Unit (GRU) and IoT security service aggregates the local models into a global model. Another solution proposed by Friha et al. [18] uses federated DL-based IDS for the cybersecurity of agricultural-IoT networks, called FLIDS. It uses three DL-based models, namely, Deep Neural Network, Convolutional Neural Network, and Recurrent Neural Network; and the experimental results show that it achieved a competitive performance compared to the centralized model.As each DL model has its own strengths and weaknesses, the researchers started to use the combination of several models in order to overcome their individual shortcomings and in turn improve the classification performance. In such context, Aouedi et al.[START_REF] Aouedi | Federated semi-supervised learning for attack detection in industrial internet of things[END_REF] proposed a federated Semi-Supervised Learning for Attack Detection in Industrial IoT, called FLUIDS. An AutoEncoder (AE) model has been used for feature representation learning and dimensionality

introduced an FL system for detecting compromised IoT devices, called DÏoT. reduction. After the AE global aggregation, the global encoder is directly linked to a NN layer for fine-tuning and supervised learning. The experiments conducted on a real industrial dataset demonstrate the performance of FL against centralized versions of the DL model (non-federated learning). Moreover, Mothukuri et al.

Table 2

 2

describes the notations used in Algorithm 1. Algorithm 1: Learning step of the proposed F-BIDS model 1: Input: Training Dataset 𝐷𝑇 = {𝑥 𝑖 , 𝑦 𝑖 } (𝑥 𝑖 ∈ 𝑋, 𝑦 𝑖 ∈ 𝑌 ); 2: Output: Prediction of Ensemble Algorithm 𝐻(𝑋); /* --Train the base classifiers used in the level 1 --*/ 3: for 𝑗=1 to 2

do in parallel

	4:	Train 𝑀 𝑗 from 𝐷_𝑡𝑟𝑎𝑖𝑛;
	5: end for
		/* --Construct meta-data --	*/
	6

:

  𝐷 ′ ={𝑃 , 𝑌 }, where 𝑃 = Concatenate 𝑀 1 _𝑝𝑟𝑒𝑑𝑖𝑐𝑡𝑖𝑜𝑛, 𝑀 2 _𝑝𝑟𝑒𝑑𝑖𝑐𝑡𝑖𝑜𝑛;

		/* --Train the meta-classifier 𝑀𝐶 in federated way --	*/
	7: for 𝑖=1 to R do
	8:	𝑛= 𝑟 𝑘 * 𝐾
	9:	for c=1 to n do
	10:	for e=1 to E do
	11:	train 𝑀𝐶 parameters 𝜃 𝑐 using 𝐷 𝑐
	12:	end for
	13:	Send 𝜃 𝑐 to the FL server
	14:	end for
	15:	Aggregate {𝜃} 𝑐=1…𝑛 with FedAvg into 𝜃
	16:	Send meta global model 𝜃 to the clients
	17: end for

18:

return 𝐻(𝑋) = 𝑀𝐶(𝑀 1 (𝑋), 𝑀 2 (𝑋))

Table 2

 2 List of notations used in F-BIDS model.

	List of notations Meaning
	𝑋	Set of features
	𝑌	Class label set
	𝑀	Base classifier
	𝐻	Ensemble classifier
	𝑀𝐶	Meta classifier
	𝐷_𝑡𝑟𝑎𝑖𝑛	training set of the base classifier (level-1)
	𝑃	Base classifier prediction
	𝐷 ′	meta-data used to train the meta-classifier (level-2)
	𝜃	meta classifier parameters
	𝑅	Total number of rounds
	𝐸	meta classifier training epochs
	𝐾	Total number of clients
	𝑛

Table 3

 3 Edge-IIoTset description.

	Label	Total
	Normal	24,301
	DDoS_UDP attack	14,498
	DDoS_ICMP attack	14,090
	Ransomware attack	10,925
	DDoS_HTTP attack	10,561
	SQL_injection attack	10,311
	Uploading attack	10,269
	DDoS_TCP attack	10,247
	Backdoor attack	10,195
	Vulnerability_scanner attack	10,076
	Port_Scanning attack	10,071
	XSS attack	10,052
	Password attack	9,989
	MITM attack	1,214
	Fingerprinting attack	1,001

Table 4

 4 InSDN description.

	Label	Total
	Normal	68,424
	DDoS	121,942
	DoS	53,616
	Probe	98,129
	BFA	1,405
	Web-attack	192
	Botnet	164
	U2R	17

Table 5

 5 Classification performance for 6 classes of simple models centralized blending vs Ferrag et al.[START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] with Edge-IIoTset dataset (Centralized model performance)

	Model	Metrics Normal DDoS attacks Injection attacks MITM attacks Malware attacks Scanning attacks
		Pr	1.0	0.86	0.64	1.0	0.96	0.93
	SVM	Rc	1.0	0.89	0.84	1.0	0.65	0.85
		F1	1.0	0.88	0.73	1.0	0.78	0.89
		Pr	1.0	0.94	0.65	1.0	0.96	0.96
	Neural Networks	Rc	1.0	0.87	0.94	1.0	0.69	0.88
		F1	1.0	0.90	0.77	1.0	0.81	0.92
		Pr	1.0	0.92	0.66	1.00	0.97	0.96
	Ferrag et al. [26]	Rc	1.0	0.99	0.90	0.94	0.48	0.74
		F1	1.0	0.95	0.76	0.97	0.64	0.84
		Pr	1.0	0.94	0.86	1.0	0.84	0.93
	Centralized Blending	Rc	1.0	0.89	0.83	1.0	0.95	0.96
		F1	1.0	0.91	0.84	1.0	0.88	0.95

Table 6

 6 Classification performance for 15 classes of centralized blending vs simple models and Ferrag et al.[START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] with Edge-IIoTset dataset (Centralized model performance) MITM attacks 100%, and Malware attacks 88%, while for DDoS attacks the highest F1-score is given by Ferrag et al.[START_REF] Ferrag | Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning[END_REF] with 95%. On the other hand, it can be seen from Table6that our model obtained the highest F1-score in 14 out of 15 classes. In particular, our centralized blending model gives the highest F1-score for Normal, Backdoor attacks, ICMP DDoS attacks, TCP DDoS attacks, UDP DDoS attacks, OS Fingerprinting, MITM attacks, Password attacks, Port Scanning attacks, Ransomware attacks, SQL Injection, Upload attacks, Vulnerability scanning attack, and

	Model	Metrics Normal Back HTTP ICMP TCP UDP Fing MITM Pwd Port Rans SQL Upload Scan XSS
		Pr	1.00	0.99	0.41	1.00	0.88	0.96	1.00 1.00	0.05 0.92 0.92	0.29 0.80	0.76	0.98
	SVM	Rc	0.99	0.92	0.26	0.96	0.97	1.00	0.52 1.00	0.00 0.90 0.96	0.88 0.17	0.98	0.75
		F1	0.99	0.93	0.32	0.98	0.92	0.97	0.68 1.00	0.01 0.91 0.94	0.43 0.28	0.86	0.81
		Pr	1.00	0.99	0.57	1.00	0.92	0.99	1.00 1.00	0.43 0.95 0.96	0.41 0.76	0.98	0.87
	MLP	Rc	1.00	0.95	0.59	0.99	0.99	1.00	0.59 1.00	0.36 0.94 0.97	0.57 0.29	0.85	0.99
		F1	1.00	0.97	0.58	0.99	0.96	0.99	0.74 1.00	0.30 0.94 0.96	0.43 0.42	0.91	0.92
		Pr	1.00	0.95	0.76	1.00	0.82	1.00	0.59 1.00	0.55 1.00 0.73	0.47 0.67	0.96	0.53
	Ferrag et al. [26]	Rc	1.00	0.86	0.92	0.99	1.00	1.00	0.64 1.00	0.38 0.50 0.85	0.71 0.48	0.85	0.37
		F1	1.00	0.90	0.83	0.99	0.90	1.00	0.61 1.00	0.45 0.66 0.79	0.57 0.56	0.90	0.43
		Pr	1.00	0.95	0.82	1.00	1.00	1.00	0.64 1.00	0.63 0.95 0.97	0.67 0.63	0.96	0.99
	Centralized Blending	Rc	1.00	0.99	0.56	1.00	0.93	1.00	1.00 1.00	0.76 0.95 0.97	0.81 0.91	0.99	0.96
		F1	1.00	0.97	0.65	1.00	0.96	1.00	0.78 1.00	0.66 0.95 0.97	0.72 0.74	0.97	0.98
	95%, XSS attack are 100%, 97%, 100%, 96%, 100%, 78%, 100%, 66%, 95%, 97%, 92%, 74%, 97%, 98%, respectively.
	In addition, it can be seen from Table 7 that our model obtained the highest F1-score for the Normal traffic 100%,
	DDoS attack 100%, DoS 100%, Probe attack 99%, Brute Force Attack 94%, Web Attack 100%, Botnet attack 100%, and
	U2R attack 100%. Consequently, these results can validate that our blending model is a promising model and can better

differentiate the applications. Although the competitive performance of the proposed blending model raises privacy issues as confidential data might need to be shared in the process. As mentioned in the introduction, we proposed F-BIDS in order to ensure the privacy of the data as maximum as possible.

Table 8

 8

	F-BIDS performance evaluation with Edge-IIoTset
		client		1 𝑠𝑡 round			10 𝑡ℎ round
			B	W	G	B	W	G
		K=5	90.18	86.25 89.56	90.91 88.66	89.91
	15-class	K=10	89.03	87.01 88.15	89.69 85.87	88.45
		K=15	88.69	82.18 85.18	89.05 85.24	87.82
		K=5	90.91	90.27 90.86	90.93 90.67	90.91
	6-class	K=10	90.15	86.71 89.07	89.93 88.53	89.87
		K=15	90.06	87.83 89.57	90.07 88.72	89.94
	(B): Best client accuracy; (W): Worst client accuracy; (G): Global model accuracy

Table 9

 9

	F-BIDS performance evaluation with InSDN dataset
	client		1 𝑠𝑡 round			50 𝑡ℎ round
		B	W	G	B	W	G
	K=5	99.89	99.54	99.86 99.93	99.66 99.90
	K=10	99.83	99.48	99.74 99.92	99.70 99.91
	K=15	99.65	99.48	99.50 99.52	99.43 99.49

(B): Best client accuracy; (W): Worst client accuracy; (G): Global model accuracy

F-BIDS performance evaluation

By taking advantage of the blending model and the FL, a federated blending model-driven IDS framework (F-BIDS) has been proposed. As a continuation from the previous subsection, using the same two different datasets (Edge_IIoT and InSDN) we also evaluated the performance of F-BIDS. The evaluation results are presented in Table 8 and Table 9, respectively, whereas the worst client accuracy is more than 86% and 88% in the first and 10 𝑡ℎ rounds. Furthermore, using InSDN dataset, the best global model results in the first and 50 𝑡ℎ round of F-BIDS achieved when the number of clients 𝐾 = 5, where the best client accuracy achieves 99.89% and 90.92% in the first and 50 𝑡ℎ rounds, respectively, whereas the worst client accuracy is more than 99% and 88% in the first and 50 𝑡ℎ rounds.

From these results, we can notice that accuracy decreases as the number of clients increases. This is because, with a larger number of clients, the diversity of the models across different users increases significantly [START_REF] Zhang | Benchmarking semi-supervised federated learning[END_REF]. Also, we can notice that F-BIDS converges quickly since the first round has relatively good accuracy. This is due to the federated meta-classifier (NN layers) that uses the new features generated by the base classifiers. Consequently, the features deployed by the meta-classifier are relevant features and can help to converge fast and better than the original features.

Moreover, the experimental results show that the global performance of F-BIDS is competitive with the centralized blending model.


Anne-Sophie Dubarry

John C Mosher

Sarang S Dalal
email: sarang@cfin.au.dk

Christian G Bénar

What are the promises and challenges of simultaneous MEG and intracranial recordings?

Intracranial electroencephalography (iEEG) invasively measures brain activity from neurosurgical patients with higher fidelity and spatial precision than noninvasive electroencephalography (EEG) or magnetoencephalography (MEG) alone. For planning neurosurgical resection, iEEG more robustly detects lower amplitude signals that may distinguish pathological from healthy brain tissue. On the other hand, iEEG can only sample the immediate brain regions implanted for clinical reasons, while MEG synoptically measures the entire brain, albeit with lower fidelity. Relative to scalp EEG, signals recorded by MEG are less distorted by the poorly conducting skull, craniotomies, and neurosurgical hardware. By combining iEEG with simultaneous MEG recordings, we supplement the limited spatial sampling of iEEG with the superior source localization ability of MEG, yielding a combined interesting technique at two different measurement scales that can cross-validate findings from either.

Setting up such simultaneous MEG-iEEG measurements involves specific considerations, and we review patient selection, patient preparation, and equipment. We then review published studies related to cognition, with emphasis on the sensitivity of MEG to source depth as well as functional connectivity between iEEG and MEG. We end with future directions opened by the unique possibility to record brain signals at different scales simultaneously.

Introduction and motivation

Magnetoencephalography (MEG) is a powerful neurophysiological tool for the noninvasive investigation of brain activity at millisecond temporal precision. Clinically, however, electrodes may need to be placed intracranially for higher specificity to assist planning of neurosurgical resection, such as in the presurgical evaluation of epilepsy using electrocorticography (ECoG) and stereo-EEG (sEEG). In other cases, electrodes are chronically implanted in subcortical structures for the purpose of deep brain stimulation (DBS); these same electrodes can be alternatively used to measure local field potentials. DBS is performed most commonly in the basal ganglia for movement disorders such as Parkinson's disease, though increasingly, other applications of DBS are being investigated, such as the thalamus for essential tremor and certain forms of epilepsy.

These invasive procedures, done on purely clinical grounds, provide a unique opportunity to compare the global scale of MEG with the local scale of a ground truth recorded directly above the brain and below the dura (ECoG) or directly within the brain tissues (sEEG, DBS). The simultaneous acquisition of MEG and intracranial EEG (iEEG) represents a significant burden in terms of patient management, acquisition of signals, and data processing. Yet the recording signals of the exact same activity at different scales -local and global -provides key advantages, such as in epilepsy, where interictal discharges are spontaneous and show large variations from one event to another. Similarly, in complex cognitive protocols investigating aspects of memory or different mental strategies, the brain response cannot be assumed to be similar across repetitions of the paradigm. In either case, recording the two modalities at distinctly separate times makes it infeasible to align and average the signals in post-processing. More generally, the simultaneous recording of MEG and iEEG ensures that the brain is in the same state (vigilance, attention, etc.) at both scales.

In methodological terms, simultaneous recordings bring possibilities that are out of reach with separate recordings. In order to understand the links between depth and surface, one can quantify which intracranially observed signals are likely to be measurable extracranially by MEG. This can be detected by identifying signals with no lag between the iEEG and MEG [START_REF] Dalal | Simultaneous MEG and intracranial EEG recordings during attentive reading[END_REF][START_REF] Pizzo | Deep brain activities can be detected with magnetoencephalography[END_REF], implying propagation via volume conduction rather than neural connectivity (which would generally involve a lag or phase delay). Another approach is to measure trial-to-trial correlation of amplitude in the time domain (e.g., the inter-trial correlation, ITCOR introduced in [START_REF] Dubarry | Simultaneous recording of MEG, EEG and intracerebral EEG during visual stimulation: From feasibility to single-trial analysis[END_REF]) or in the time-frequency domain [START_REF] Barborica | Extracting seizure onset from surface EEG with independent component analysis: Insights from simultaneous scalp and intracerebral EEG[END_REF]. Apart from these validation-oriented techniques, simultaneous measurements allow the computation of connectivity index between signals seen intracranially with high spatial specificity and MEG signals [START_REF] Crespo-García | Slow-theta power decreases during item-place encoding predict spatial accuracy of subsequent context recall[END_REF], providing a powerful means of multi-scale network analysis.

Therefore, in order to compare the exact same brain sources in the same brain states, and to take full advantage of trial-to-trial fluctuations, the invasive and non-invasive signals need to be recorded simultaneously. In this chapter, we review the technical challenges, methods, and findings of simultaneous MEG and intracranial recordings, as well as discuss future venues, with emphasis on cognitive research.

Setting up a simultaneous recording

In the last few years, several publications have provided detailed guidelines for the collection of MEG data [START_REF] Gross | Good practice for conducting and reporting MEG research[END_REF][START_REF] Hari | IFCN-endorsed practical guidelines for clinical magnetoencephalography (MEG)[END_REF]. Clinical context involves additional challenges and simultaneous recordings require further considerations. Although simultaneous recordings of MEG and iEEG share some aspects of the context and recording procedure with clinical MEG routine [START_REF] Mosher | Towards Best Practices in Clinical Magnetoencephalography: Patient Preparation and Data Acquisition[END_REF] and iEEG procedure [START_REF] Mercier | Advances in human intracranial electroencephalography research, guidelines and good practices[END_REF], some characteristics, which we detail here, are very specific to simultaneous recordings.

The present section describes the specific steps required to perform a simultaneous MEG-iEEG recording, including MEG site preparation, patient selection, patient preparation, and we review some of the experimental protocols found in the simultaneous MEG-iEEG literature.

General considerations

One of the first considerations when deciding to perform a simultaneous recording is the accessibility of the MEG lab, particularly for inpatients in the epilepsy monitoring unit. The proximity of the MEG system facilitates the setup and the preparation of the recording session. Minimal emergency preparation is required for an MEG facility to host a simultaneous MEG-iEEG recording. Depending on the patient safety risk areas, various potential emergency situations may arise and call for best patient safety practices, including specific equipment (e.g. oxygen, suction) and documented procedures (e.g. rescue procedure, crash charts) reviewed by the MEG Medical Director.

In this context, iEEG signals can either be collected from the built-in EEG amplifier of the MEG system [START_REF] Dubarry | Simultaneous recording of MEG, EEG and intracerebral EEG during visual stimulation: From feasibility to single-trial analysis[END_REF] or an external one [e.g. 10]. Both configurations have advantages and limitations. The built-in EEG system may have a limited number of channels (e.g. 64, 128) and the amplitude range may be adapted to record microvolts, whereas the iEEG signals range in the order of millivolts, requiring adjustments to the EEG gain. The built-in EEG system, usually designed for measuring scalp EEG, may need to be certified and approved by the MEG Medical Director and the Institutional Review Board for research using invasive electrodes. Nevertheless, this built-in configuration offers two main advantages: 1) reducing potential noise introduced by an external device (containing metallic parts) within the MEG environment, and 2) reducing post-recording processing, since the EEG data are digitized in the identical MEG environment. Thus a single dataset encapsulates both the MEG and iEEG signals in a single time-aligned dataset.

In other instances, however, an external EEG amplifier may be desirable. In the monitoring unit, for example, the acquisition system is typically certified for invasive clinical applications, which simplifies the procedure for obtaining institutional approval for research. The external unit may also have better gain, noise shielding, jack connectors, and channel count than that offered by the MEG system. In some instances, the analog or digital output of the EEG system can be integrated directly into the MEG system's acquisition. More often, however, the two separate acquisition systems record to two separate files, and the data need to be time-synchronised, typically by providing a periodic timing pulse into a channel of each system. As reviewed in [START_REF] Badier | Technical solutions for simultaneous MEG and SEEG recordings: towards routine clinical use[END_REF], in post processing, the data need to be resampled and aligned to the same time base and filter settings, then merged into a common dataset to ease the simultaneous review of both modalities. As discussed below, the external system must also be arranged to introduce minimal additional noise into the MEG recording.

Planning the stimulation procedure involves preparing the adapted equipment in the MEG facility (e.g. headphones, speakers, relevant display, electrical stimulator). The presentation of the sequence of stimuli must be controlled by a procedure or delivered by a research software package which ensures sub millisecond precision and allows the recording of response time. The MEG facility must validate all timing with calibration measurements for the specific stimulus and computer configuration [START_REF] Bridges | The timing megastudy: comparing a range of experiment generators, both lab-based and online[END_REF].

Simultaneous recordings involve placing a large amount of recording apparatus (electrodes, wires, connectors), within close reach of the MEG sensors. The presence of metal inside the MEG magnetic shielded room and nearby the sensors may thus result in higher noise levels. SEEG electrodes are usually made of platinum, while ECoG grids may be made of either platinum or nonmagnetic stainless steel. As such, the electrodes themselves, cables, and surgical hardware are typically MRI-compatible, but may nevertheless result in added MEG noise and artifacts arising from electrically conductive materials moving together with the patient's head. An example of this is shown in Figure 1b of [START_REF] Dubarry | Simultaneous recording of MEG, EEG and intracerebral EEG during visual stimulation: From feasibility to single-trial analysis[END_REF], where slow oscillatory artifacts arise from the connector placed on the patient's shoulder due to its displacement from breathing. Another source of noise comes from the amplification system that may not be perfectly isolated, and may be transmitted through the wires to the vicinity of the MEG. An example of this effect is shown in Figure 1d of [START_REF] Dubarry | Simultaneous recording of MEG, EEG and intracerebral EEG during visual stimulation: From feasibility to single-trial analysis[END_REF]. Thus, connectors need to be immobilized and removed from the patient body, and the EEG amplifier may need to be isolated from the environment (e.g., powered by battery rather than mains) [START_REF] Badier | Technical solutions for simultaneous MEG and SEEG recordings: towards routine clinical use[END_REF].

Patient selection

Once the hardware and MEG facility feasibility (as described in previous section) have been established, another constraint in the design of any research study is the likely selection bias of a relatively small number of patients due to their limited availability. Deep brain stimulation studies typically involve the placement of only one or two electrodes with only one pair of contacts activated, and the DBS device may or may not be capable of recording on the other remaining contacts. Thus only a small region of the brain may be available for individual or group studies, depending on the application of DBS used in the patient cohort (e.g., Parkinson's disease, essential tremor, epilepsy, depression, obsessive compulsive disorder, pain).

In contrast, ECoG and sEEG clinical studies generally span wider regions of the brain. ECoG is often performed using a silastic electrode grid placed on the cortical surface and/or sEEG depth electrodes to common targets like the hippocampus and amygdala; when used in epilepsy monitoring, ECoG surface grids can involve more than 100 electrodes spanning entire lobes. sEEG studies typically use between eight and twenty stereotactic depth probes, with five to twenty electrode contacts along each probe [START_REF] Mercier | Advances in human intracranial electroencephalography research, guidelines and good practices[END_REF] such that simultaneous recordings of roughly 200 iEEG channels are common. Unlike DBS patients, however, these are almost always patients with epilepsy that are monitored exclusively in a hospital monitoring unit, with sensitive surgical sites, post-surgery irritability, and reduced medication level to facilitate capturing epileptiform activity. As discussed in the next section, the apparatus of sEEG channels protruding from the head makes it further difficult to find patients that will literally fit inside the rigid MEG helmet. On the other hand, the large craniotomy needed for the implantation of ECoG grids may leave the patient too vulnerable to place inside the rigid MEG helmet.

Another selection bias consideration is the medication level of the patient. The clinical examination of the iEEG patient usually involves the halting/reduction of antiseizure medication, in order to record as many typical seizures (i.e. with typical semiology) as possible during the monitoring unit stay. Once the patient management team is satisfied that an adequate exam has been completed, the patient is returned to their medications, and explantation surgery is scheduled. Research examinations in the MEG are therefore possible in this limited time window, but with an uncertain titration of medication levels in the patient, who may also be tired and subject to brain atypical activities resulting from a series of prior seizures.

The above constraints result in a patient cohort with smaller heads (typically leading to inclusion of more females than males) or a younger pediatric cohort, with various levels of fatigue or alertness on changing medication levels, which can complicate general findings in a group study. Nonetheless, as we review below, these patients provide valuable cross-validation of studies at local and global scales of measurement, from focused invasive studies to synoptic non-invasive measurements, and the possibility to bridge the non-invasive measurements to the much broader class of non-invasive measurements of control research subjects. Put more simply, control studies with electrodes implanted in normal brains are not ethically possible, so these patient studies are invaluable, despite their unavoidable selection bias.

Patient preparation at the time of the MEG examination

Patients with a DBS implanted may be examined in an outpatient setting, such that the procedure for preparing the patient is nearly identical to the procedures outlined in [START_REF] Mosher | Towards Best Practices in Clinical Magnetoencephalography: Patient Preparation and Data Acquisition[END_REF]. If the DBS generator is embedded in the skull, then special care may be necessary regarding any degaussing (i.e. procedure to remove minor magnetic contaminants) of the generator, and the Medical Director for the MEG site must be consulted. If the generator is considered MRI-safe, or if the generator is in the chest, then no other special handling of the patient may be necessary outside of routine preparation for a MEG exam.

Patients with either embedded depth (sEEG) electrodes or a craniotomy with cortical (ECoG) electrodes are being monitored as inpatients in a monitoring unit and therefore require special considerations and handling on the day of the MEG exam. As discussed above in Patient Selection, the opportunity to perform the MEG exam typically comes at the end of the monitoring stay, after adequate clinical data have been gathered to perform the diagnosis and/or the treatment strategy for the patient (see also Chapter 28 on practical issues with recordings in presurgical epilepsy patients). Typically, medications are being resumed, and surgical explantation has been scheduled. We lay out the basic steps that should be considered, with an overall goal to ensure patient safety and comfort by performing many of the tasks bedside in the monitoring unit, before transport to the MEG.

First, the patient should be reconsented to ensure their continuing agreement with any research to be conducted (see also Chapter 9 on Ethical issues). Surgical nursing is then consulted to remove the surgical head dressing, which may have been in place for many days or weeks. With the original headdress removed, the leads of the electrodes can be gathered into a bundle that drapes away from the surgical site and down the neck. The connectors should be arranged such that they land in the nape of the neck and/or outside the MEG helmet. The head can then be rewrapped in a light surgical wrapping, as shown in the figure (Fig. 1A and1B). The nape of the neck provides a suitable place to arrange the connectors, such that they nest inside the helmet or extend just below the helmet, depending on the length of the specific brand of electrodes. (C) An exact replica of the MEG helmet is highly useful bedside to ensure that sEEG apparatus and headdress have not made it impossible for the patient to fit, as shown here.

At this point it is imperative to ensure that the patient and their apparatus will fit in the MEG, by using a replica helmet (provided by the MEG manufacturer) at the bedside, as shown in Fig. 1C. Adjustments can be made to the arrangement of the wire bundle and connectors, or it may be determined that the patient cannot fit in the MEG.

Assuming the patient fits the helmet, the MEG technician can begin the bedside process of replacing any heart or muscle (ECG or EMG) electrodes that may not be MEG compatible, then disconnecting the patient from the monitoring room system and connecting the electrodes into the jackbox compatible with the MEG. Since the built-in EEG system of the MEG may have fewer EEG channels than the separate monitoring unit EEG system, selection of a subset of relevant electrodes has to be coordinated with the researcher, and a careful record of which contacts are retained for the MEG recording must be maintained.

Hospital transport then moves the patient to the MEG suite, with a monitoring unit nurse in attendance, where the usual patient preparation continues [START_REF] Mosher | Towards Best Practices in Clinical Magnetoencephalography: Patient Preparation and Data Acquisition[END_REF], albeit under masked (sterile) conditions. Unlike DBS outpatients, however, degaussing may not be approved by the Medical Director, since the introduction of dozens of electrodes into the brain may present unknown coupling considerations. The patient is then placed either supine or upright in the MEG, taking into account the protocols to be run, and taking into account any pressure points of the helmet with the patient's surgical sites.

Immediately after the MEG recording is completed, the patient is directly returned to the monitoring unit for resumed care by the unit staff. Bedside, the MEG jacks and electrodes are removed, and the surgical nurse prepares a final headdress prior to explantation surgery. Depending on the timing before the explantation surgery, reconnection to the recording system in the monitoring unit may not be required.

Protocols with the iEEG patient in the MEG

In this book, a wide range of possible experimental protocols are discussed, and with the general consideration laid out above, many of them could be run simultaneously with MEG. In this section, we restrict ourselves to citing a few of the published instances that have been used in simultaneous MEG-iEEG, including spontaneous recordings and evoked responses for the study of cognitive functions.

The recording of spontaneous simultaneous MEG-iEEG activity has mainly been focused on the analysis of interictal spikes in epilepsy [2, e.g. 12-14]. Because of the relatively short time of the MEG session, particularly for an sEEG patient, capturing a spontaneous seizure simultaneously with the MEG and sEEG system has not been reported to our knowledge. However, one unique study analyzed a reflexive musicogenic seizure, triggered during the recording by the playing of vocal music [START_REF] Wang | Interconnections in superior temporal cortex revealed by musicogenic seizure propagation[END_REF]. In contrast, studies that measured MEG simultaneously with subcortical LFPs from electrodes implanted for the purpose of DBS often investigate motor movements or associated pathology, which may be expected since DBS is most common in patients with movement disorders such as Parkinson's disease, essential tremor, and dystonia. Similar methods have also been used to examine subcortical-cortical connectivity in resting state networks. For a review, see [START_REF] Litvak | EEG and MEG primers for tracking DBS network effects[END_REF].

As opposed to passive LFP recordings from deep brain electrodes, several more studies have implemented protocols measuring MEG during DBS stimulation, introducing the additional challenge of recording and analyzing the signals despite the presence of high amplitude artefact evoked by the DBS [17, 18][19].

Less commonly, but of particular interest in this book, protocols have been designed to capture the neural activity elicited by various experimental conditions underlying specific cognitive processes, typically using protocols that were originally inspired by earlier experiments from either MEG alone or intracranial EEG alone. We will discuss these studies in greater detail in Section 3.4.

What do simultaneous recordings reveal?

Methodological approaches

Classical MEG and intracranial EEG (iEEG) analyses techniques, such as evoked fields/potentials and time-frequency analysis, can be performed at the level of individual sensors. However, to explore the overall spatial information provided by the multi-sensor recordings source reconstruction techniques are required e.g. spatial filtering technique [START_REF] Velmurugan | Virtual MEG sensors based on beamformer and independent component analysis can reconstruct epileptic activity as measured on simultaneous intracerebral recordings[END_REF], independent component analysis followed by source localization [START_REF] Vj | Magnetoencephalography can reveal deep brain network activities linked to memory processes[END_REF].

Several goals can be pursued with simultaneous recordings. One goal is to assess whether the activity measured with iEEG can be retrieved from MEG signals, either for epileptic discharges [START_REF] Pizzo | Deep brain activities can be detected with magnetoencephalography[END_REF], evoked fields [START_REF] Dubarry | Simultaneous recording of MEG, EEG and intracerebral EEG during visual stimulation: From feasibility to single-trial analysis[END_REF] or time-frequency modulations [START_REF] Dalal | Simultaneous MEG and intracranial EEG recordings during attentive reading[END_REF].

When performing correlation analysis, this boils down to finding zero-lag correlation in order to assess whether the same activity is retrieved on MEG in sEEG. Such correlation can be measured across time [START_REF] Pizzo | Deep brain activities can be detected with magnetoencephalography[END_REF][START_REF] Dalal | Simultaneous MEG-intracranial EEG: new insights into the ability of MEG to capture oscillatory modulations in the neocortex and the hippocampus[END_REF] or across trials [START_REF] Dubarry | Simultaneous recording of MEG, EEG and intracerebral EEG during visual stimulation: From feasibility to single-trial analysis[END_REF]. In seminal work, Dalal and colleagues [START_REF] Dalal | Simultaneous MEG-intracranial EEG: new insights into the ability of MEG to capture oscillatory modulations in the neocortex and the hippocampus[END_REF] computed and presented the topographic maps of correlation of each sensor data with sEEG electrode in the hippocampus, showing a largefield topography that is compatible with a deep origin of the signals. Another goal is to measure delayed connectivity between an iEEG sensor and MEG signals, in order to retrieve large-scale networks and benefit from the local view of sEEG and large-scale view of MEG. This was performed by [START_REF] Crespo-García | Slow-theta power decreases during item-place encoding predict spatial accuracy of subsequent context recall[END_REF] using directed phase-lag index, with a seed point in the hippocampus.

Precision of localization

The first tests of source localization took advantage of measuring fields generated by small currents injected in intracerebral electrodes, thus creating artificial dipoles within the head volume. The great advantage of this technique is to generate a known and well-characterized source, both in terms of location and extent, albeit with a higher amplitude and lesser spatial complexity relative to natural brain activity. Cohen and colleagues [START_REF] Cohen | MEG versus EEG localization test using implanted sources in the human brain[END_REF] injected currents in intracranial EEG electrodes while simultaneously measuring scalp EEG and MEG. No major differences in localization error were found, in contradiction with the hypothesis that MEG would yield better source localization performance. As noted in [START_REF] Mosher | Error bounds for EEG and MEG dipole source localization[END_REF], the study was initially criticized on methodological grounds [START_REF] Hari | MEG versus EEG localization test[END_REF][START_REF] Williamson | MEG versus EEG localization test[END_REF]. The spatial sampling was low with only 16 channels each for MEG and EEG, which inadvertently prevented the MEG source localization from reaching its full potential; as the skull blurs MEG signals to a far lesser degree than EEG signals, MEG scalp topographies contain more nuances at higher spatial frequencies that can increase the performance of source reconstruction when sensor coverage is optimal. The exclusively radial nature of the implanted sources (due to the electrode implantation scheme) presented a strong bias favoring EEG, since MEG is much less sensitive to radial sources [START_REF] Hillebrand | A Quantitative Assessment of the Sensitivity of Whole-Head MEG to Activity in the Adult Human Cortex[END_REF].

In [28] and [START_REF] Anoglanakls | A consensus statement on relative merits of EEG and MEG[END_REF], the call was for a careful consideration of the absolute accuracies of either modality under conditions that are fair to both modalities. As noted in (Cohen and Cuffin 1983) and repeated in [START_REF] Anoglanakls | A consensus statement on relative merits of EEG and MEG[END_REF], EEG and MEG provide complementary data, and the use of both modalities can contribute to overall improved accuracy, as confirmed over a large number of theoretical cases [START_REF] Mosher | Error bounds for EEG and MEG dipole source localization[END_REF]. A similar experimental study was conducted by Leahy and colleagues [START_REF] Leahy | A study of dipole localization accuracy for MEG and EEG using a human skull phantom[END_REF] using a human skull phantom implanted with 32 current dipoles and 64 scalp electrodes. A CT scan was used to determine ground truth, and MEG measurements were made.

The results yielded a smaller error for MEG (3 mm versus 7-8 mm for EEG) which was attributed to the difficulty of accurately modelling the complexity of the human skull in EEG.

More recently, in a resting state study on patients with epilepsy, [START_REF] Velmurugan | Virtual MEG sensors based on beamformer and independent component analysis can reconstruct epileptic activity as measured on simultaneous intracerebral recordings[END_REF] measured the distance between 1) the sources found at the peak of the ICA components computed from MEG signals, and 2) the sEEG contact showing maximal correlation with component, and report a mean distance of 20±12.25 mm. Two additional studies used the same localization technique on ICA components putatively corresponding to deep mesial activity, both on epileptic spikes [START_REF] Pizzo | Deep brain activities can be detected with magnetoencephalography[END_REF] and event related responses [START_REF] Vj | Magnetoencephalography can reveal deep brain network activities linked to memory processes[END_REF].

In both cases, the confidence interval of one or two dipole scans included the mesial regions.

Epileptic discharges

The first report of epileptic discharges in simultaneous MEG-sEEG from [START_REF] Santiuste | Simultaneous Magnetoencephalography and Intracranial EEG Registration: Technical and Clinical Aspects[END_REF], compared the epileptic spikes detected on MEG recordings with the ones detected on sEEG signals in terms of detectability, amplitude and localization. The capacity of interictal MEG to detect and localize the epileptogenic zone was found to be comparable with that of sEEG when targeting convexity foci. However, the epileptiform discharges required a higher amplitude and a wider distribution to be detected and localized with only MEG signals.

Shortly after this first report, [START_REF] Nowak | Toward a definition of MEG spike: Parametric description of spikes recorded simultaneously by MEG and depth electrodes[END_REF] provided a parametric description of MEG spikes detected thanks to sEEG, aiming at increasing the objectivity of MEG epileptiform events selection.

With a similar strategy, [START_REF] Gavaret | Simultaneous SEEG-MEG-EEG recordings Overcome the SEEG limited spatial sampling[END_REF] marked the epileptic spikes on sEEG signals, and localized the sources from averaged MEG data (locked on the sEEG events). The resulting early activity was located in a plausible region, not sampled by sEEG because of physical constraints (a very posterior region where orthogonal electrodes cannot be implanted), confirming clinical hypotheses on this patient.

To investigate the visibility of high gamma oscillations on MEG, [START_REF] Rampp | MEG correlates of epileptic high gamma oscillations in invasive EEG: MEG Correlates of Epileptic Oscillations[END_REF] performed a time-frequency analysis on the MEG signals locked to epileptic spikes that were detected from sEEG signals. The high gamma oscillations which they observed on the MEG signals were temporally aligned to the ones observed within the same frequency band on the iEEG signals [33 Supp. Fig 2]. The oscillations formed well isolated islands in the time-frequency plane and thus do not correspond to filtered spikes, i.e. 'false ripples' [START_REF] Bénar | Pitfalls of high-pass filtering for detecting epileptic oscillations: A technical note on "false" ripples[END_REF]. In a more recent study, [START_REF] Migliorelli | Automated detection of epileptic ripples in MEG using beamformer-based virtual sensors[END_REF] have used a beamformer analysis (i.e. a spatial filter applied to the sensor data) in order to detect and localize epileptic ripples (80-120 Hz oscillations) from MEG data. The ripples detected in MEG were validated using sEEG as a gold standard.

Finally, [START_REF] Pizzo | Deep brain activities can be detected with magnetoencephalography[END_REF] have shown that deep epileptic discharges originating from deep mesial sources can be detected by the MEG sensors. In a first step, independent component analysis was computed on epileptic spikes measured on deep sEEG electrodes (within amygdala and hippocampus). This approach enabled separating focal deep activity from large scale (propagated) networks, whereas the analysis of the MEG signals alone showed only the propagated activity. In a second step, they have shown that in a large proportion of patients the ICA ran on the whole dataset can also extract activity from deep sources, without the prior information arising from sEEG.

Cognitive potentials and oscillations 3.4.1. Cortical measurements

The first "trimodal" EEG-MEG-sEEG recording reported in a single case study by [START_REF] Dubarry | Simultaneous recording of MEG, EEG and intracerebral EEG during visual stimulation: From feasibility to single-trial analysis[END_REF] showed that evoked activity in response to visual presentation of a checkerboard is detected on the three recording modalities, both on average (evoked potentials/fields) and at the single trial level. The simultaneous recording enabled tracking the correlation between depth and surface fluctuations. A source analysis confirmed the consistency between the MEEG sources and the sEEG potentials. In addition, time-frequency analysis could retrieve early beta/gamma band activity (likely evoked) and alpha desynchronization. Induced gamma activations were more scarce, possibly because of the small extent of the sources activated by the experimental task.

With MEG, [START_REF] Crespo-García | Slow-theta power decreases during item-place encoding predict spatial accuracy of subsequent context recall[END_REF] found that decreases in theta power during spatial encoding predict greater accuracy during subsequent recall. An epilepsy patient with electrodes implanted in temporal regions allowed further investigation of this effect. By simultaneously measuring MEG and intracranial EEG, they further discovered that these theta oscillations in right anterior hippocampus and left inferior frontal phase-led the left temporal cortex (see Fig. 2).

Fig. 2. Simultaneous MEG-iEEG analysis from a single patient to investigate connectivity between MEG sources and left temporal locations sampled directly with intracranial electrodes during a spatial encoding task, and to validate independent MEG findings. A) directed phase lag index analysis (see Chapter 36) with MEG beamformer results revealed that task performance was superior when the right hippocampus phase-led the left inferior temporal gyrus. B) A corresponding analysis between intracranial EEG from the left temporal cortex and the right hippocampus from MEG yielded similar findings, validating the MEG results. C) Task performance was also better when left inferior frontal gyrus, reconstructed with MEG, phase-led the anterior temporal lobe, as sampled by intracranial EEG. D) Subsequently using the left inferior frontal gyrus as a seed for the MEG-based analyses showed that it also exhibited connectivity with the left inferior temporal gyrus, the same area found in (A) that exhibited connectivity with the right hippocampus. These studies demonstrate different ways in which simultaneous MEG with intracranial EEG can be leveraged to validate MEG-only findings, identify novel connections that may not have been evident with either method alone, and further identify regions of interest for subsequent analyses with MEG alone. Reproduced with permission from [START_REF] Crespo-García | Slow-theta power decreases during item-place encoding predict spatial accuracy of subsequent context recall[END_REF].

[21] recorded 6 patients with simultaneous MEG-sEEG during a memory task. Patients were instructed to recognize images that they previously memorized ('old/new' paradigm). A blind source separation technique (Second Order Blind Identification, SOBI) revealed MEG components sensitive to the protocol (i.e. showing evoked activity). These components showed consistent topographies across patients and were confirmed in control subjects, presenting a "large" pattern (i.e. topographies with distant positive and negative poles), suggesting the activation of a source originating from a deep origin. The source localization and the correlation analysis of the simultaneous sEEG signals revealed a highest correlation with contacts located in the hippocampus and rhinal cortex, confirming the previous findings.

MEG-LFP of basal ganglia / STN via DBS electrodes

DBS electrodes are most commonly implanted in the basal ganglia of patients with movement disorders such as Parkinson's disease. Naturally, the effects of DBS itself on cortical activity and cognition have been investigated in several studies [e.g. [START_REF] Bahners | Deep Brain Stimulation Does Not Modulate Auditory-Motor Integration of Speech in Parkinson's Disease[END_REF][START_REF] Hyder | STN-DBS affects language processing differentially in Parkinson's disease: Multiple-case MEG study[END_REF] and reviews [START_REF] Litvak | EEG and MEG primers for tracking DBS network effects[END_REF][START_REF] Harmsen | Characterizing the effects of deep brain stimulation with magnetoencephalography: A review[END_REF]. Before permanent connection to the stimulator, however, DBS electrodes can be alternatively used to measure local field potentials from the implanted structure; a few groups have managed to combine such measurements with MEG. Most such simultaneous measurements have investigated pathological oscillations or aspects of motor control. However, evidence is mounting that the basal ganglia and other DBS targets such as the thalamus are indeed involved in several other brain functions, including various aspects of cognition. The first cognitive study employing simultaneous MEG-STN measurements came out recently. [START_REF] Patai | Conflict detection in a sequential decision task is associated with increased cortico-subthalamic coherence and prolonged subthalamic oscillatory response in the beta band[END_REF] employed an expanded judgement task in which participants needed to accumulate multiple observations of a cue with two possibilities, before deciding which of the two possibilities was the accurate choice. The study primarily aimed to investigate whether the STN was involved with "global conflict" -when a cue conflicts with several preceding ones -but did not find evidence to support that role. They found that beta oscillations in both the STN and frontal cortex instead encoded "local conflict" -i.e., when the presented cue differed from the immediately preceding one -but the beta activity in the STN persisted until the next cue, while the cortical activity subsided more quickly. They also specifically found alpha and beta band connectivity between the right dorsal premotor cortex and right STN for these conflicts. Although they could not reliably determine directionality of this relationship, the cortical activity peaked earlier and is in line with other studies which suggest that the cortical activity drives STN activity.

MEG-LFP of thalamus via DBS electrodes

In a pioneering study, [39] combined MEG with thalamic iEEG measurements to investigate corticothalamic circuits mediating visual perception. They found that the phase of low-frequency oscillations in the mediodorsal thalamus (7 -9 Hz) predicts whether threshold-level visual stimuli were perceived. Leveraging MEG, they furthermore discovered that prefrontal cortex activity precedes these thalamic responses, as assessed by directed connectivity measures, suggesting that corticothalamic interactions ultimately mediate perceptual performance. They also found some evidence that visual cortex activity follows the thalamic responses, though did not have adequate occipital MEG coverage in enough patients to make stronger conclusions. As direct investigations of the human thalamus are rare, this provides important insights into the role of corticothalamic interactions into perceptual cognition, and an impetus for further investigations integrating both thalamic measurements with MEG.

Discussion and future avenues

Most effort so far in simultaneous MEG and intracranial recordings has been directed towards epileptic activity, where the spontaneous aspect of the discharges requires simultaneity in order to ensure capturing the exact same brain activity at the two levels. In cognition, the added value of simultaneous recordings may not be so obvious at a first glance. Many studies have performed cognitive protocols in intracerebral EEG alone, and may serve as a basis for assessing MEG results [e.g. 40 -43]. Still, simultaneous recordings have distinct qualities that may justify the (significant) added difficulty during acquisition. Firstly, as for epilepsy, they ensure the exact same patient state (vigilance, arousal, level of medication, etc.), which can be important for subtle activity or in protocols where repetition of the same stimuli may result in different brain responses. Secondly, simultaneous recordings allow performing correlation between surface and depth at a single-trial level, which gives a stronger confirmation (in contrast to average across trials) that MEG and iEEG are indeed recording the same brain source. Finally, simultaneous recordings may allow in the future to build a 'meta modality' that combines the local view from iEEG and the global view from MEG, thus improving our knowledge of brain function across spatial scales. Of course, simultaneous recordings can only be performed in patients, thus presenting pathological activity intermingled with physiological one, and potentially reorganized brain networks. Hence the importance of combining the results from multiple patients with varying epileptic sources [START_REF] Dubarry | An open-source toolbox for Multi-patient Intracranial EEG Analysis (MIA)[END_REF] and confirming the simultaneous MEG results with activity measured in control subjects with MEG only [START_REF] Vj | Magnetoencephalography can reveal deep brain network activities linked to memory processes[END_REF].

MEG technology is now rapidly evolving, with next-generation MEG systems employing optically pumped magnetometers (OPM) that operate without liquid helium and allow closer positioning on the head (Brookes et al., 2022). As OPMs can be placed on the head in any desired configuration rather than a rigid unisize helmet, this will relieve some of the challenges with obtaining measurements simultaneously with iEEG. Indeed, the first simultaneous measurements of OPM-MEG and iEEG for detection of interictal spikes were recently presented [START_REF] Badier | Evidence of interictal spikes recording by Helium OPM validated by simultaneous intracerebral EEG[END_REF]. The impending proliferation of OPM-MEG systems will surely provide more such opportunities, with the aims of characterizing their sensitivity and source localization accuracy as well as providing further insights into functional connectivity mediating cognitive processes.

Fig. 1 :

 1 Fig. 1 : (A)The original head dressing is removed and replaced with a light dressing, with the leads and connectors bundled together and draped away from the implantation site. (B) The nape of the neck provides a suitable place to arrange the connectors, such that they nest inside the helmet or extend just below the helmet, depending on the length of the specific brand of electrodes. (C) An exact replica of the MEG helmet is highly useful bedside to ensure that sEEG apparatus and headdress have not made it impossible for the patient to fit, as shown here.

Fig. 3 :

 3 Fig. 3 : Relation between MEG signals and simultaneously recorded intracerebral recordings in one patient [21]. (a) Topography of the deep component obtained with blind source separation (BSS) on MEG signals (BSS-MEG). This topography corresponds to the contribution of the BSS-MEG component to each MEG sensor; its broad distribution is indicative of a deep source. (b) Event-related potential (ERP) on BSS-MEG. Solid and dotted traces are the averaged ERP for old (recognition) and new pictures, respectively. Stars indicate statistically significant differences in amplitude between old and new trials. There is a clear memory-related effect, consistent with what is expected from previous intracerebral studies. (c) Source localization of the BSS-MEG topography with two symmetric dipoles, which confirms the deep origin of the signals (GoF: Goodness of Fit of the two dipoles). (d) Distribution of the correlation of BSS-MEG signals with intracerebral EEG. The highest correlation is visible on the TB (temporo-basal) electrode that targets deep mesial structures, with the peak of correlation located in the rhinal cortex. (Figure courtesy of Victor López-Madrona).