Myriam Mikhayel

O Leclercq

Dolla Karam Sarkis

Dolla Karam

Occurrence of the Colistin Resistance Gene mcr-1 and Additional Antibiotic Resistance Genes in ESBL/AmpC-Producing Escherichia coli from Poultry in Lebanon: A Nationwide Survey

The objective of the present study was to determine genomic characteristics of expanded-spectrum cephalosporin (ESC)-resistant Escherichia coli spreading in healthy broilers in Lebanon in 2018. Rectal swabs (n = 280) from 56 farms were screened for the presence of ESC-resistant E. coli isolates. Antimicrobial susceptibility and extended-spectrum b-lactamase (ESBL)/AmpC production were determined by the disk diffusion method. Whole-genome sequencing (WGS) of 102 representative isolates of E. coli was performed to determine their phylogenetic diversity, serotypes, sequence types (ST), acquired resistance genes, and virulence-associated genes. Fifty-two out of 56 farms housed broilers carrying ESC-resistant E. coli isolates. These farms had large and recurrent antimicrobial practices, using, for some of them, critically important antibiotics for prophylactic and therapeutic purposes. Among the 102 sequenced multidrug-resistant (MDR) E. coli isolates, the proportion of ESBL, plasmid-mediated AmpC b-lactamase (pAmpC) producers, and ESBL/pAmpC coproducers was 60%, 27.6%, and 12.4%, respectively. The most prevalent ESBL/ pAmpC genes were bla CMY-2 , bla CTX-M-3 , bla CTX-M-15 , bla CTX-M-27 , and bla CTX-M-14b (n = 42, n = 31, n =15, n = 9, and n = 7, respectively). These ESBL/pAmpC producers were distributed in different STs, most being well-known avian-associated and sometimes pathogenic STs (ST-10, ST-48, ST-93, ST-115, ST-117, and ST-457). Phylogenetic single nucleotide polymorphism (SNP) analysis confirmed their genetic diversity and wide dispersion across the Lebanese territory. Most isolates were also resistant to ciprofloxacin (101/102 with 3 QRDR mutations), and 19/102 isolates from 11 unrelated STs also carried the mobile resistance gene mcr-1. This survey illustrates the alarming prevalence of MDR E. coli resistant to medically important antibiotics in broilers in Lebanon. This advocates the need for surveillance programs of antimicrobial resistance in Lebanon and the reduction of excessive use of antibiotics to limit the spread of MDR E. coli in food-producing animals.

IMPORTANCE Poultry production is a main contributor of the global trend of antimicrobial resistance arising from food-producing animals worldwide. In Lebanon, inappropriate use of antibiotics is frequent in chickens for prophylactic reasons and to improve productivity, resulting in an alarming prevalence of extended-spectrum b-lactamase (ESBL)/AmpC-producing Escherichia coli, also resistant to other medically important antibiotics (i.e., colistin and ciprofloxacin). Their complex genomic epidemiology highlighted by an important genetic diversity suggests that these resistance determinants are largely spreading in enteric bacteria in Lebanese poultry. Further molecular surveillance is needed to understand the country-specific epidemiology of ESBL/AmpC

and mcr-1 genes in Lebanese poultry production. In addition, decisive interventions are urgently needed in order to ban the use of critically important antibiotics for human medicine in food-producing animals and limit the spread of antibiotic resistance in Lebanon.

KEYWORDS multidrug resistance, CTX-M-3, poultry, CMY-2, antibiotic usage A ntimicrobial resistance (AMR) is a serious public health problem worldwide in both humans and animals. The main driver for the evolution of bacterial resistance is the excessive usage of antibiotics in human and veterinary medicine. In some countries, antibiotics remain heavily administered for therapeutic and prophylactic purposes in veterinary medicine. Moreover, there is an increasing public health concern about zoonotic transmission of resistance to critically important antimicrobial classes, such as expanded-spectrum cephalosporins (ESC), carbapenems, fluoroquinolones, and colistin [START_REF]The European Union summary report on antimicrobial resistance in zoonotic and indicator bacteria from humans, animals and food in 2017/2018[END_REF]. Although the extent to which food of animal origin contributes to the zoonotic transmission of multidrug-resistant (MDR) bacteria remains an ongoing debate, the transfer of enteric resistant strains from livestock to humans through the handling and consumption of undercooked animal meats is known to occur [START_REF] Osman | Epidemiology of antimicrobial resistance in Lebanese extra-hospital settings: an overview[END_REF]. During the two last decades, the prevalence of extended-spectrum b-lactamase (ESBL)-and plasmid-mediated AmpC b-lactamase (pAmpC)-producing Gram-negative bacteria has become extensively reported in food-producing animals [START_REF] Livermore | CTX-M: changing the face of ESBLs in Europe[END_REF][START_REF] Bevan | Global epidemiology of CTX-M b-lactamases: temporal and geographical shifts in genotype[END_REF]. Of particular concern is the high prevalence of ESBL/pAmpC-producing Enterobacterales in intensive broiler production around the world [START_REF] Dame-Korevaar | Transmission routes of ESBL/pAmpC producing bacteria in the broiler production pyramid, a literature review[END_REF]. The intestinal microbiome of these animals might serve as a reservoir for ESBL/pAmpC-producing strains capable of being transmitted to humans. The epidemiology of ESBL/AmpC-encoding genes is rather complex, since a huge variety of different bla ESBL/AmpC genes and gene families exist and spread on various mobile genetic elements such as plasmids and integrative conjugative elements that are able to transfer horizontally between bacterial strains and species. Furthermore, plasmids carrying bla ESBL/AmpC genes may also persist in bacterial clones of defined sequence types (ST), spreading geographically and in different hosts [START_REF] Bevan | Global epidemiology of CTX-M b-lactamases: temporal and geographical shifts in genotype[END_REF].

Since the discovery of plasmid-mediated colistin resistance by the mcr-1 gene in human and animal isolates in China in 2015, several studies have reported an increasing trend of coexistence of mcr genes and ESBL/AmpC genes in the same bacterial isolates [START_REF] Dandachi | Prevalence and emergence of extended-spectrum cephalosporin-, carbapenem-and colistinresistant Gram negative bacteria of animal origin in the Mediterranean Basin[END_REF]. Worldwide, there are more reports of mcr-mediated colistin resistance in food-producing animals, notably in poultry, than in humans, which suggests that farm animals are a reservoir of multiple critically important resistances [START_REF] Dandachi | Prevalence and emergence of extended-spectrum cephalosporin-, carbapenem-and colistinresistant Gram negative bacteria of animal origin in the Mediterranean Basin[END_REF]. Moreover, mcr-1positive and/or ESBL/pAmpC-producing Escherichia coli from healthy broilers were usually classified as commensal strains, but recent investigations found that among these resistant strains, some also harbor several of the genetic virulence factors of avian pathogenic E. coli (APEC) or extraintestinal pathogenic E. coli-like (ExPEC) strains and, therefore, have the ability for an enhanced colonization of the gut [START_REF] Cordoni | Comparative genomics of European avian pathogenic E. coli (APEC)[END_REF].

Lebanon is a country with developing antimicrobial stewardship and AMR surveillance programs, in which several studies have been conducted to address the occurrence of AMR in clinical human settings at the phenotypic level [START_REF] Chamoun | Surveillance of antimicrobial resistance in Lebanese hospitals: retrospective nationwide compiled data[END_REF]. However, largescale genomic studies addressing AMR in humans or in food-producing animals remain scarce [START_REF] Osman | Epidemiology of antimicrobial resistance in Lebanese extra-hospital settings: an overview[END_REF]. Different studies have recently described the occurrence of ESBL-producing or mcr-1-positive Enterobacteriaceae in livestock or in environmental water sources, but none of them have performed a nationwide genomic analysis of resistant bacteria (for review, see reference 2 and references [START_REF] Dandachi | Prevalence of extended-spectrum beta-lactamase-producing Gram-negative bacilli and emergence of mcr-1 colistin resistance gene in Lebanese swine farms[END_REF][START_REF] Dandachi | Prevalence and characterization of multi-drug-resistant Gramnegative bacilli isolated from Lebanese poultry: a nationwide study[END_REF][START_REF] Al-Mir | Emergence of clinical mcr-1 positive Escherichia coli in Lebanon[END_REF][START_REF] Hmede | The colistin resistance gene mcr-1 is prevalent in commensal Escherichia coli from preharvest poultry in Lebanon[END_REF][START_REF] Hassan | The mobile colistin resistance gene, mcr1.1, is carried on IncX4 plasmids in multidrug resistant E. coli from rainbow trout aquaculture[END_REF][START_REF] Diab | Extended-spectrum beta-lactamase (ESBL)-and carbapenemase-producing Enterobacteriaceae in water sources in Lebanon[END_REF][START_REF] Hmede | Emergence of plasmidborne colistin resistance gene mcr-1 in multidrug-resistant Escherichia coli isolated from irrigation water in Lebanon[END_REF].

The aim of the present study was to assess the occurrence of ESBL/AmpC-producing Enterobacterales in different Lebanese broiler farms. In addition, a questionnaire was directed to the veterinarians and farmers to record rearing practices and antibiotic usage at the farm level. Then, the objective was to characterize ESBL/AmpC E. coli isolates at the phenotypic level and by whole-genome sequencing to analyze their genetic diversity, resistance and virulence gene content, epidemiology, and dissemination in the Lebanese poultry production.

RESULTS

Sampling and antibiotic usage. A total of 280 individual fecal samples were collected from healthy broiler flocks (5 birds/flock; birds from 12 to 45 days old) during summer and fall 2018 in 56 selected farms representing the main regions of poultry production in Lebanon. Farm rearing practices were collected through a questionnaire, and answers are summarized in Table S1 in the supplemental material. Antimicrobial treatment data revealed that all farms except 4 located in South (n = 3) and Mount Lebanon (n = 1) are systemically using antibiotics for prophylactic purposes. Depending on farms, antimicrobial treatments were applied at the chick's arrival but differed in duration from 3 to 30 days and in the number of antibiotics administered, from doxycycline alone to up to 8 different antibiotics (Table 1). Antimicrobial usage was summarized by an overall treatment incidence at the region level, which indicates that the highest usage of antibiotics is in the farms of the region of Baalbeck, followed by the farms of the southern area of Lebanon (Fig. 1). Several critically important antibiotics of the top-priority list of WHO are used in broilers, such as colistin and ciprofloxacin in 62.5% and 50% of sampled farms, respectively, as well as enrofloxacin, cefpodoxime, and several large-spectrum macrolides (Table 1; Fig. S1). Other antibiotic families were also largely used, such as tetracyclines (doxycycline) and aminoglycosides (gentamicin) (Fig. S1).

Selection of ESC-resistant isolates and their antimicrobial susceptibility. A total of 323 ESC-resistant isolates were selected from 220 fecal samples originating from 52 farms. No ESC-resistant isolate was found in the 4 farms that did not use antimicrobials for the sampled broiler flocks. One hundred and ninety-two and 131 isolates were selected on cefotaxime and cefepime, respectively. The Escherichia coli species was largely dominant, representing more than 87% (n = 283) of the isolates (Table 2; Table S2). Few isolates belonged to the genera Klebsiella, Enterobacter, and Proteus (Table 2). Nonsusceptibility was observed for several antibiotics among the 323 isolates of this ESC-resistant collection (Fig. 2). Indeed, almost all isolates were nonsusceptible to cefotaxime, ciprofloxacin, gentamicin, and tetracyclines. In addition, .89% of these isolates were resistant to amoxicillin-clavulanate and folate inhibitors (trimethoprim-sulfamethoxazole) (Table 2; Fig. 2). All isolates were multidrug resistant ($3 antimicrobial classes), but all remained susceptible to carbapenems and amikacin. Based on the double disk synergy test and resistance to cefoxitin, 71%, 11%, and 18% of these isolates were suspected to produce ESBL, AmpC cephalosporinases, or both, respectively. None of the breeding practices collected through the questionnaire during sample collection could have been linked to the phenotypic resistance profile by our multiple component analysis (MCA), suggesting that farm-level breeding practice variations have little impact on the resistance profile of circulating Enterobacterales.

Whole-genome sequencing analysis. The E. coli species was largely dominant (88%) among this collection of ESC-resistant isolates, and a set of 102 E. coli isolates was selected to be representative of the initial sampling. The 102 assembled draft genomes ranged from 122 to 936 contigs, with sequencing depth ranging from 81Â to 235Â, a completeness level of .97.5% (mean of 99.5%), and an estimated contamination level of ,2.5% (mean of 0.4%). These 102 draft genomes were further analyzed for their phylogenetic diversity, their acquired resistome, and their virulence gene content, as described in the sections below.

Phylogroup, multilocus sequence typing, and serotyping. Most of the ESC-resistant E. coli isolates belonged to phylogroup A (46%; n = 48), followed by groups E, F, and G (n = 14, 12, and 13, respectively). Fewer isolates belonged to phylogroups B1 (n = 8), C (n = 1), D (n = 6), and clade I (n = 2), thus confirming the phenotypic identification of these 102 ESC-resistant isolates corresponding as the new species E. coli sensu lato (clade I and E. coli being considered two subspecies of a single species) [START_REF] Denamur | The population genetics of pathogenic Escherichia coli[END_REF].

Based on multilocus sequence typing (MLST) analysis using the Achtman sequence typing scheme, 29 unique STs were identified among the 102 ESC-resistant E. coli isolates (Fig. 3; Table S3). The most frequently found STs were from the ST10 complex (ST-10 and ST-48 [12.5%; n = 13 each] and few other single-locus variants) corresponding to the phylogroup A, which are distributed in 16 farms of all regions. ST-117 was also prevalent and corresponded to all isolates of the phylogroup G (12.5%; n = 13). Other relevant STs known to be poultry associated (ST-93, ST-115, ST-189, ST-354, ST-457, and ST-1011) were represented by 4 to 8 isolates (Fig. 3; Table S3).

In silico serotyping analysis returned 40 different serotypes among 88 isolates. The O serotype was nontypeable for the 16 remaining isolates. The most predominant serotypes were O21:H16 (n = 8) and O11:H25 (n = 7). In this collection, isolates from the same serotype were found clustered in the phylogenetic single nucleotide polymorphism (SNP) analysis; however, there was no strict link between serotypes and phylogroups/ST except for the serogroup O11:H25 corresponding to all ST-457 isolates. Interestingly, the flagellar antigens H4, H9, H16, and H32 were more frequent than the others. The predominant poultry-associated ST-115 and ST-117 isolates were O-serotype diverse, but all harbored the flagellar antigens H9 and H4, respectively. Ten isolates belonged to known avian pathogenic-associated serotypes (O2, O5, O8, and O78; n = 2, 5, 2, and 1, respectively).

Phylogenetic SNP analysis. A phylogenetic tree was inferred from the core 176,818 SNP positions shared between all isolates. The phylogenetic tree grouped the 102 E. coli sensu lato isolates into 7 well-supported clusters consistent with their phylogroup distribution (Fig. 3). The two isolates S5CTX and S10CTX belonging to clade I clearly branched together and outside the 6 other groups corresponding to phylogroups A, B1, D, E, F, and G. Isolates exhibiting the same STs or ST complexes grouped closely in the phylogenetic SNP tree (Fig. 3).

In several STs, few highly related clonal groups of isolates showed a very small number of SNP differences (,40 SNPs in clusters of 9, 8, 5 and 5 isolates of ST-10, ST-48, ST-93, and ST-457, respectively). Although some isolates within these clonal groups originate from the same farm, consistent with strain diffusion in broiler flocks, all groups contained isolates from distinct farms, sometimes from distant regions (i.e., ST-10, ST-93, and ST-457 clonal groups). Such scattered distribution indicates that these well-known and poultry-associated clonal populations are spreading in the entire Lebanese poultry production. Beyond these clonal spreads, the geographic origin of the isolates at the regional and farm levels is distributed in the entire phylogenetic tree, indicating a wide spread of genetically diverse ESC-resistant isolates across the Lebanese territory.

Acquired resistome analysis. Acquired resistance genes and point mutations were detected using the tool ResFinder v2.1. Among the 102 ESC-resistant E. coli draft genomes, the detection of ESBL/AmpC and other b-lactamase genes was in agreement with the b-lactam resistance phenotypes (Table S2 (n = 7) (Fig. 3; Table S2 and Table S3). All the isolates with an AmpC phenotype alone (n = 28) or in combination with an ESBL phenotype (n = 14) contained the AmpC cephalosporinase gene bla CMY-2 . In addition, the narrow-spectrum b-lactamase bla TEM-1 variants were largely distributed and were found in 71 isolates (Table S3). The main ESBL genes were bla CTX-M-3 (31/102), bla CTX-M-14/14b (9/102), bla CTX-M-15 (15/102), and bla CTX-M-27 (9/102). In addition, 8 isolates contained a couple of ESBL genes (bla CTX-M-15 /bla TEM-57 or bla CTX-M-3 /bla TEM-57 or bla SHV-12 /bla TEM-176 ). Only one isolate carried the bla CTX-M-1 gene known to be livestock associated. It is noteworthy that one isolate, S4CTX, harbored 4 different b-lactam resistance genes (i.e., the ESBL genes bla SHV-12 and bla TEM-176 , the AmpC cephalosporinase bla CMY-2 , and the narrow-spectrum bla TEM-1B ).

Overall, these 102 ESC-resistant E. coli isolates were multidrug-resistant (MDR), harboring different additional non-b-lactam resistance genes against aminoglycosides, phenicols, sulfonamides, trimethoprim, tetracycline, colistin, and fluoroquinolones (Table S3). A high diversity of non-b-lactam resistance gene patterns was observed among isolates that shared the same ESBL/AmpC resistance genes. The most predominant non-b-lactam resistance genes were the sulfonamide resistance genes (sul1, sul2, and sul3), the tetracycline resistance gene tetA, the florfenicol/chloramphenicol resistance gene floR, and the aminoglycoside resistance genes [aadA1, aadA2, aac(3)-IId, aph (39)-Ia, and strAB]. (Continued on next page) resistance genes qnrB19, qnrD, and qnrS1 were found in 11, 1, and 10 isolates, respectively (Fig. 3). Another critically important resistance gene detected was the mobile colistin resistance gene mcr-1 (Table S3). Nineteen ESBL/AmpC-producing E. coli isolates were positive for mcr-1 (Fig. 3; Table S3). No specific cooccurrence of the mcr-1 gene was found with any ESBL/AmpC gene nor with any phylogroup/ST/serotype or other non-b-lactam resistance gene. The analysis of the plasmidic replicon content revealed a large diversity of replicon types among the 102 ESC-resistant E. coli isolates (Table S3). The isolates carried from only one up to seven replicon families (i.e., strain M40FEP was only IncF positive, and strain B23CTX was positive for Col, IncF, IncB/O/K/Z, IncHI, IncI, IncN, and IncX). IncF and Col replicons, which are well-known to be associated with E. coli, were present in nearly all isolates. Other Inc replicon groups, such as IncK, IncHI2, IncI2, and IncX4, were also detected among these ESC-resistant isolates. No specific cooccurrence of the main ESBL/AmpC genes (e.g., bla CTX-M-3 ) was found with any Inc groups. In addition, the repetitive nature of flanking regions of AMR genes and short-read assemblies did not allow for colocalization of the ESBL/AmpC genes and Inc replicons on identical contigs. On the other hand, the mcr-1 gene was found located on IncI2 or IncX4 contigs in some isolates (data not shown). Further work is needed to determine precisely the genetic supports of these AMR genes.

Phylogeographic distribution of E. coli carrying the main ESBL/AmpC and mcr-1 genes. Here, the Lebanese territory was divided in 3 geographical areas based on similar sampled farm numbers, that is, the North (20 farms; North, Akkar, and Baalbeck administrative districts), the center (17 farms; Mount Lebanon and Beqaa), and the South (19 farms; South and Nabatieh) (Fig. 4). The North and the South showed the highest and lowest numbers of ESC-resistant E. coli (n = 129 and 55; Table S2), respectively.

Interestingly, the distribution of the ESBL/AmpC genes and the mcr-1 gene displayed some specificities between these 3 geographical regions (Fig. 4). The ESBL gene bla CTX-M-3 was predominant in the North and the center, representing around half of the ESBL genes detected, while the South displayed primarily the bla CTX-M-14/14b gene absent from the above regions. Whereas bla CTX-M-15 represented one-third of the ESBL gene in the North region, it is absent in the center. Interestingly, the geographic predominance of bla CTX-M-14/14b and bla CTX-M-15 in the South and North is mainly driven by the spread of clonal groups of ST-48 (,30 SNPs) and ST-10 (,23 SNPs) in different farms of these regions, respectively. Other ESBL/AmpC genes are punctually distributed across the phylogenetic tree, farms, and regions, suggesting that they are probably not widely disseminated in the poultry E. coli population (Fig. 3).

The presence of the colistin resistance gene mcr-1 in ESBL/AmpC-producing E. coli is mainly found in center and South Lebanon but in different unrelated clusters of isolates distributed in the phylogenetic tree and in different farms (Fig. 3 and4). Among the 19 mcr-1-positive ESBL/AmpC-producing E. coli, the occurrence of mcr-1 appeared also independent of a specific ESBL/AmpC gene. Together, all these results strongly suggest that these critically important resistance genes are likely located on different mobile genetic supports that can be acquired independently by different isolates and that participated in their dissemination at various geographic scales. In some cases (i.e., bla CTX-M-14/14b ST-48 and bla CTX-M-15 ST-10), the regional spread of clonal populations also participates in the diffusion of these resistances. Finally, the multiple component analysis (MCA) of these E. coli genomic data regarding farm information did not return

FIG 3 Legend (Continued)
Values of 1, indicating maximum support, are not displayed. The tree was rooted according to the known relationships between E. coli phylogroups. For each strain, the sequence type, serotype, identifier, region, and farm of origin are indicated in columns 1 to 5 on the right side of the tree. Presence of bla CMY-2 , bla ESBL genes, mcr-1, and qnr resistance genes detected using ResFinder 2.1 are indicated with a filled box. The strain identifier code includes the region initial followed by a unique sampled animal number per region, the abbreviation of the selection antibiotic, and an isolate number if needed (e.g., S10CTX: isolate selected on cefotaxim from animal number 10 in the region South).

any relevant explicative factor for the selection or dissemination of these resistances relative to breeding practices.

Virulence-associated gene content of the main poultry-associated STs. Fifty-two genes encoding virulence factors were detected among the 102 E. coli collection using the Virulence Finder tool v2.0 (Table S3). APEC strains are known to harbor different associations of virulence-associated genes (VAGs), constituting a heterogeneous group of extraintestinal pathogenic E. coli in terms of virulence factors. Isolates belonging to phylogroups A, B1, and E harbored less VAGs than other phylogroups D, F, and G (Fig. S2 andS3A; P , 0.0001). ST-93 isolates belonging to phylogroup A harbored 13 to 14 VAGs, including different agglutinins/adhesion factors, iron acquisition systems, and capsule and colicin biosynthesis. Among the phylogroup A isolates, closely related isolates of the clonal group ST-10 (n = 9, ,23 SNPs) as well as two ST-189 isolates harbor the intimin Eae and the type III secretion system and its effectors (EspABFJ, NleB, and Tir), which are implicated in adhesion and enterocyte effacement, respectively. In phylogroups D, F, and G, which gathered the typical poultry-associated STs (ST-115, ST-117, ST-354, and ST-457), numerous isolates harbored VAGs encoding adhesion factors, in particular type P fimbriae or long polar fimbriae, several siderophores (yersiniabactin, salmochelin, and aerobactin), capsule biosynthesis, and colicin/microcin biosynthesis. In this regard, ST-115 and ST-117 isolates harbored the highest VAG content compared to other major STs (mean of .18 VAGs; Fig. S3B). All these VAGs are common in APEC and other extraintestinal pathogenic E. coli lineages and play an important role in colonization of different niches.

DISCUSSION

Despite the implementation of interventional measures to prevent the spread of antibiotic resistance in developed countries, this issue is still a growing problem worldwide. In developing countries such as Lebanon, the resistance crisis is more complex, since numerous factors concerning the dissemination of antibiotic resistance remain uncontrollable. In the one health context of antibiotic resistance, livestock is now considered a major reservoir of multidrug-resistant bacteria and antibiotic resistance genes. While numerous studies have targeted antibiotic resistance in human clinical settings in Lebanon, the epidemiological situation in food-producing animals remains unclear [START_REF] Chamoun | Surveillance of antimicrobial resistance in Lebanese hospitals: retrospective nationwide compiled data[END_REF]. In the present study, we report an alarming intestinal carriage of ESC-resistant Enterobacterales in broilers farms at the national level. ESC-resistant isolates were detected in 78.5% of the collected samples. Fifty-two of 56 farms (93%) housed broilers carrying ESC-resistant isolates that are also resistant to many other antibiotics. In a previous study conducted in 2015, Dandachi et al. reported only 20.6% of broiler fecal samples carrying ESC-resistant Enterobacterales, and 77.5% of the visited farms had at least one positive animals [START_REF] Dandachi | Prevalence and characterization of multi-drug-resistant Gramnegative bacilli isolated from Lebanese poultry: a nationwide study[END_REF]. Taken together, these results suggest an increase of ESC-resistant isolate carriage in poultry in Lebanon during the last few years. The prevalence found in the present study is among the highest described in comparable epidemiological studies of resistance in poultry worldwide [START_REF] Nhung | Antimicrobial resistance in bacterial poultry pathogens: a review[END_REF].

ESC-resistant Escherichia coli was the most common ESC-resistant species isolated, representing more than 87% (Table 2; see also Table S2 in the supplemental material). Moreover, all ESC-resistant E. coli isolates were considered multidrug resistant ($3 antimicrobial classes) but remained susceptible to carbapenems. These isolates showed mainly ESBL (71%), AmpC (11%), or both phenotypes. During the sample collection, we collected only generic data of antibiotic administration (used antibiotics, treatment duration, and causes of administration) as it was impossible for most farms to obtain precise information on the amount of antibiotics, the frequency of administration, and effective reasons of usage (treatment or prevention of infections and growth enhancement). Depending on the farm, sampled flocks were treated with a variety of antibiotic regimens, ranging from one antibiotic to a large cocktail of antibiotics (Table 1). Doxycycline, colistin, gentamicin, and ciprofloxacin were the most used antibiotics in the sampled flocks, indicating that they are frequently used in poultry farms in Lebanon (Fig. S1). Last-generation cephalosporins were only used in 8.9% of farms, but other b-lactam antibiotics, such as amoxicillin, ampicillin, and cephalexin, were more frequently administered and generated selection pressures favorable to ESC-resistant isolates. These antibiotic uses are in accordance with a recent evaluation of availability of colistin-containing drugs for poultry and antibiotic residues in chicken meat in Lebanon [START_REF] Jammoul | Evaluation of antibiotic residues in chicken meat samples in Lebanon[END_REF][START_REF] Kassem | On a colistin course: the availability and use of colistin -containing drugs in human therapeutics and food-animal farming in Lebanon[END_REF].

Genomic analysis of these ESBL/AmpC-producing E. coli revealed a high diversity of isolates in poultry farms across the Lebanese territory. Only a few highly related clonal groups (,40 SNPs) of known poultry-associated STs (ST-10, ST-48, and ST-93) are spreading in the entire Lebanese poultry production (Fig. 3). This current observation is slightly different from the previous similar nationwide study carried out in 2015 that described a regional spreading and the absence of known poultry-associated STs in Lebanese poultry production [START_REF] Dandachi | Prevalence and characterization of multi-drug-resistant Gramnegative bacilli isolated from Lebanese poultry: a nationwide study[END_REF]. While being isolated from healthy animals, some of these ESBL/AmpC-producing E. coli isolates belonged to avian pathogenic-associated STs (ST-115, ST-117, ST-354, and ST-457) and harbored a large content of virulenceassociated genes, suggesting a pathogenic potential [START_REF] Cordoni | Comparative genomics of European avian pathogenic E. coli (APEC)[END_REF][START_REF] Nesporova | Escherichia coli sequence type 457 is an emerging extended-spectrum-b-lactam-resistant lineage with reservoirs in wildlife and food-producing animals[END_REF].

In the present study, the plasmidic AmpC cephalosporinase gene bla CMY-2 was the most prevalent ESC resistance gene (40% positive E. coli isolates) and appears to be maintained at a high level in the Lebanese poultry production since 2015 [START_REF] Dandachi | Prevalence and characterization of multi-drug-resistant Gramnegative bacilli isolated from Lebanese poultry: a nationwide study[END_REF]. In addition, the most predominant ESBL enzymes were the CTX-M enzymes, consistent to what is described worldwide [START_REF] Livermore | CTX-M: changing the face of ESBLs in Europe[END_REF][START_REF] Bevan | Global epidemiology of CTX-M b-lactamases: temporal and geographical shifts in genotype[END_REF][START_REF] Kazmierczak | Longitudinal analysis of ESBL and carbapenemase carriage among Enterobacterales and Pseudomonas aeruginosa isolates collected in Europe as part of the international network for optimal resistance monitoring (INFORM) global surveillance programme, 2013-2017[END_REF]. Several studies showed that the predominant ESBL genotypes identified in broiler E. coli isolates were either the bla CTX-M-1 gene, which is usually related to animals, or the bla CTX-M-15 gene, which is also frequently reported in humans [START_REF] Bevan | Global epidemiology of CTX-M b-lactamases: temporal and geographical shifts in genotype[END_REF][START_REF] Kazmierczak | Longitudinal analysis of ESBL and carbapenemase carriage among Enterobacterales and Pseudomonas aeruginosa isolates collected in Europe as part of the international network for optimal resistance monitoring (INFORM) global surveillance programme, 2013-2017[END_REF]. Surprisingly, only one isolate in our survey contained the bla CTX-M-1 gene, and the majority of bla CTX-M-15 -positive isolates corresponded to a unique highly related clonal ST10 group. The dominant ESBL gene was bla CTX-M-3 , which is spreading in genetically diverse E. coli in the entire Lebanese poultry production. To our knowledge, this represents the first description of the bla CTX-M-3 gene in Lebanon. Moreover, it is worth noting that this gene has been rarely described in poultry. Since its first description in 1995, the bla CTX-M-3 gene has been dominant in humans in Poland in the early 2000s and sporadically disseminated on an IncM2 plasmid (pCTX-M-3) to southern Europe and Turkey [START_REF] Livermore | CTX-M: changing the face of ESBLs in Europe[END_REF][START_REF] Bevan | Global epidemiology of CTX-M b-lactamases: temporal and geographical shifts in genotype[END_REF][START_REF] Kazmierczak | Longitudinal analysis of ESBL and carbapenemase carriage among Enterobacterales and Pseudomonas aeruginosa isolates collected in Europe as part of the international network for optimal resistance monitoring (INFORM) global surveillance programme, 2013-2017[END_REF]. Nowadays, CTX-M-3 remains at an elevated proportion in Polish, Russian, and Greek populations [START_REF] Bevan | Global epidemiology of CTX-M b-lactamases: temporal and geographical shifts in genotype[END_REF][START_REF] Kazmierczak | Longitudinal analysis of ESBL and carbapenemase carriage among Enterobacterales and Pseudomonas aeruginosa isolates collected in Europe as part of the international network for optimal resistance monitoring (INFORM) global surveillance programme, 2013-2017[END_REF]. Recently, pCTX-M3 has also been described in different Salmonella enterica serovars and other Enterobacterales species of hospitalized horses in Israel, suggesting that the spread of this plasmid in this part of the Middle East may have regional specificity [START_REF] Dor | Emergence and spread of different ESBL-producing Salmonella enterica serovars in hospitalized horses sharing a highly transferable IncM2 CTX-M-3-encoding plasmid[END_REF]. Other CTX-M types (CTX-M-14, CTX-M-27, and CTX-M-55) were also significantly detected as previously described in various human, animal, and environmental settings in Lebanon [START_REF] Osman | Epidemiology of antimicrobial resistance in Lebanese extra-hospital settings: an overview[END_REF].

In addition, almost all ESC-resistant Enterobacterales isolates in this study were also ciprofloxacin resistant (Fig. 2). This result was confirmed by the genomic analysis of 102 E. coli isolates showing at least the 3 QRDR mutations in GyrA and ParC known to confer high-level resistance to fluoroquinolones. Finally, we report an important cooccurrence (.18%) of the mobile colistin resistance gene mcr-1 in ESBL/AmpC-producing E. coli in poultry. In Lebanon, the mcr-1 gene has been recently reported in poultry, swine, aquaculture, and humans but rarely in ESC-resistant isolates (11-13, 15, 23, 24). In a recently published study focusing on colistin-resistant E. coli from poultry at a slaughterhouse in Lebanon, the same cooccurrence of the mobile colistin resistance gene mcr-1 and ESBL/AmpC genes has been described [START_REF] Al-Mir | WGS analysis of clonal and plasmidic epidemiology of colistin-resistance mediated by mcr genes in the poultry sector in Lebanon[END_REF]. While common mcr-1-positive E. coli STs (i.e., ST1011, ST744, and ST48) have been isolated in their study and ours, different associations with ESBL/AmpC-encoding genes are found, strengthening the hypothesis of the dissemination of these critical resistance genes by different plasmids. All together, these results highlight the occurrence of extremely drug resistant (XDR) E. coli isolates (i.e., resistant to last-generation cephalosporins, fluoroquinolone, and colistin) in Lebanese broiler production. Such XDR isolates, some of them belonging to E. coli STs known to be zoonotic (ST-48, ST-93) or harboring important virulenceassociated genes (Fig. S2), sometimes are associated with extraintestinal human infections and may pose therapeutic challenges if transmission to humans occurs.

In conclusion, the present study illustrates the current genomic epidemiology of multidrug-resistant Enterobacterales in Lebanese broiler farms. ESBL and AmpC producers are highly prevalent across the territory. In addition, these ESBL/AmpC isolates are also resistant to other medically important antibiotics (i.e., colistin and ciprofloxacin). Their complex genomic epidemiology highlighted by an important genetic diversity suggests that diverse mobile genetic elements, probably conjugative plasmids carrying these resistance genes, are largely spreading in enteric bacteria in the Lebanese poultry production. Further studies are needed in order to characterize precisely AMR plasmids to understand their specific epidemiology. The real purposes (treatment, prophylaxis, or growth promotion) and precise levels of antibiotic use remain unclear and difficult to get from poultry farm owners and veterinarians, which may have hindered our capacity to link the antibiotic resistance level to antibiotic usage at the farm level. Further surveillance programs and decisive interventions are urgently needed in order to ban the use of critically important antibiotics for human medicine in food-producing animals and limit the spread of antibiotic resistance in Lebanon.

MATERIALS AND METHODS

Sampling, bacterial isolates, and antimicrobial susceptibility testing. Cloacal swabs were collected from 280 individual broilers during summer and fall 2018 in 56 fattening farms (5 broilers per farm) in the seven main regions of Lebanon (South, Nabatieh, North, Akkar, Beqaa, Baalbeck, and Mount Lebanon; see Table S1 in the supplemental material). A questionnaire has been completed by the veterinarian of each farm regarding the chickens' diet, intake of food supplements such as vitamins, and antibiotics administration (classes of antibiotics, quantity, and causes of administration). Swabs were incubated in peptone water broth at 37°C overnight. ESC-resistant Enterobacterales isolates were selected on MacConkey agar plates supplemented with either cefotaxime (2 mg/liter) or cefepime (4 mg/liter). Species identification was done using the API 20E assay (bioMérieux, Marcy-l' Etoile, France). To avoid strain redundancy, only one strain of each species per selection was conserved at 280°C in 15% glycerol brain heart infusion (BHI) broth for further analysis. Each isolate was tested for antimicrobial susceptibility by the disk diffusion method on Mueller-Hinton agar as recommended by EUCAST 2018 (http://www.eucast.org/). Susceptibility to a panel of 13 antibiotics and the production of ESBL using the double disk synergy test were determined using disks containing the following antibiotics in accordance with EUCAST 2018 clinical breakpoint: amoxicillin/clavulanate (20/10 mg), cefoxitin (30 mg), cefotaxime (5 mg), ceftazidime (10 mg), cefepime (30 mg), imipenem (10 mg), ertapenem (10 mg), aztreonam (30 mg), gentamicin (10 mg), amikacin (30 mg), ciprofloxacin (5 mg), tetracycline (30 mg), and trimethoprim-sulfamethoxazole (1.25/23.75 mg).

Whole-genome sequence analysis. A set of 102 E. coli isolates representative of the diversity of antimicrobial resistance profiles and origins was subjected to whole-genome sequencing. Briefly, DNA extraction was performed using a NucleoSpin 8 tissue kit (Macherey-Nagel, Düren, Germany), and DNA samples were sent to Novogene Co., Ltd., for library preparation using the New England BioLabs Next Ultra DNA library prep kit and whole-genome sequencing on NovaSeq (Illumina) using 2 Â 150-bp paired-end sequencing (Novogene, Beijing, China).

The paired-end, 150-bp-long raw reads were quality filtered, and Illumina adapters were removed by Novogene before data delivery, resulting in read quality above 30 at all positions. After a second quality checking using fastQC v0.11.7 (https://www.bioinformatics.babraham.ac.uk/projects/fastqc/), reads were assembled using SPAdes v3.13.0 with the -only assembler option [START_REF] Bankevich | SPAdes: a new genome assembly algorithm and its applications to single-cell sequencing[END_REF]. Since expected read coverage was 60Â to 100Â, assembled scaffolds with an estimated coverage at least twice as low (,30Â) were discarded as well as those shorter than 200 bp. Sample contamination control was finally achieved using CheckM with the genus Escherichia and the -skip_pseudogene_correction options [START_REF] Parks | CheckM: assessing the quality of microbial genome recovered from isolates, single cells, and metagenomes[END_REF].

All 102 genomes were submitted to the Bacterial Analysis Pipeline v1.1 for in silico sequence type analysis with the MLST tool v1.6 for antibiotic resistance gene detection with the ResFinder tool v2.1 using default parameters and for replicon type detection with the PlasmidFinder tool v2.1 using default parameters. The genomes were then submitted individually to the SerotypeFinder tool v.2 and the VirulenceFinder tool v.2 using default parameters for serotype and virulence gene detection, respectively [START_REF] Thomsen | A bacterial analysis platform: an integrated system for analysing bacterial whole genome sequencing data for clinical diagnostics and surveillance[END_REF][START_REF] Carattoli | In silico detection and typing of plasmids using PlasmidFinder and plasmid multilocus sequence typing[END_REF][START_REF] Joensen | Rapid and easy in silico serotyping of Escherichia coli using whole genome sequencing (WGS) data[END_REF][START_REF] Joensen | Real-time whole-genome sequencing for routine typing, surveillance, and outbreak detection of verotoxigenic Escherichia coli[END_REF].

The phylogroup assignation was determined with Clermontyping v1.4.1 [START_REF] Beghain | ClermontTyping: an easy-to-use and accurate in silico method for Escherichia genus strain phylotyping[END_REF]. This tool uses two different algorithms to infer the phylogroup: an in silico PCR method based on the presence/absence of 5 loci and a method based on the whole-genome similarity to reference strains. In case of discordant assignation, the genome-based output was preferred, except for five genomes (A14FEP [CAJPVB000000000], ND35FEP [CAJPXD000000000], S24CTX [CAJPYG000000000], S31CTX [CAJPYK000000000], and S32CTX [CAJPYQ000000000]). These strains were all assigned to phylogroup G by the in silico PCR method and to phylogroup F with the whole-genome method due to a reference genome incorrectly assigned in this tool at the time of the study (E. coli 327_20; O. Clermont, personal communication).

A phylogenetic tree based on genome-wide single nucleotide polymorphisms (SNPs) was produced using the parSNP tool, which is based on FastTree 2 maximum likelihood phylogenetic reconstruction [START_REF] Treangen | The harvest suite for rapid core-genome alignment and visualization of thousands of intraspecific microbial genomes[END_REF][START_REF] Price | FastTree 2-approximately maximum-likelihood trees for large alignments[END_REF]. The software was run with the Escherichia coli K-12 MG1655 genome (GenBank accession U00096) as a reference for SNP calling and other parameters as default. The phylogenetic tree was visualized and annotated with the iTOL web interface tool v4 [START_REF] Letunic | Interactive Tree Of Life (iTOL) v4: recent updates and new developments[END_REF].

Statistical analysis. The analysis of the phenotypic and genomic data sets was conducted in Python using the Pandas 1.1.0 library for data analysis (https://pypi.org/project/pandas/) and the Prince 0.7 library for factor analysis (https://pypi.org/project/prince/): principal-component analysis (PCA) for numeric variables, multiple component analysis (MCA) for categorical variables, and factor analysis of mixed data (FAMD) for combinations of numeric and categorical variables. The "n_iter" parameter of Prince analyses was set to 3 as recommended as it converges quickly.

At the phenotypic level, the 341 isolates were studied for the association between their antibiotic resistance profiles and the explanatory variables of the questionnaire, including antibiotic administration, purpose of antibiotic usage, diet, nutrition supplements, region, and farm. Antibiotic resistance profiles were created as Pandas categorical data frames (resistant or susceptible) and fitted to MCA. At the genomic level, the 102 E. coli isolates were studied for the association between the resistance genes present in the genomes and the explanatory variables of the questionnaire as listed above plus their sequence type (ST).

Data availability. Genome assemblies can be accessed through the European Nucleotide Archive (ENA) database under project accession number PRJEB43674. Strain ENA accession numbers are listed in Table S3.

SUPPLEMENTAL MATERIAL

Supplemental material is available online only. SUPPLEMENTAL FILE 1, PDF file, 0.9 MB. SUPPLEMENTAL FILE 2, XLSX file, 0.1 MB.

FIG 1

 1 FIG 1 Antimicrobial treatment incidence in broiler farms for each administrative region in Lebanon. Antimicrobial usage was quantified using the number of active substances administered multiplied by treatment duration (days) divided by the number of farms as a proxy of treatment incidence for a region. The administrative regions are colored according to their treatment incidence value. Yellow circles represent farm locations.

FIG 3

 3 FIG 3 Phylogenetic relationships between the 102 sequenced ESC-resistant E. coli strains. The tree was inferred from the 176,818 SNPs present in genomic regions shared by all isolates. Local branching support values are based on the Shimodaira-Hasegawa test.

FIG 4

 4 FIG 4 Regional distribution of bla CMY-2 and the main ESBL genes and their cooccurrence with the mobile colistin resistance gene mcr-1. In this figure, the Lebanese was divided into 3 geographical areas based on (i) similar sampled farm numbers (i.e., the North: North, Akkar, and Baalbeck administrative districts [20 farms]; the center: Mount Lebanon and Beqaa [17 farms]; and the South: South and Nabatieh [19 farms]) and on (ii) the distribution area of the major suppliers of 1-day-old chicks in Lebanon. Diagrams are based on ESBL/AmpC/mcr-1 detection in the 102 E. coli draft genomes of this study. Diagrams of main ESBLs represent the subset of E. coli isolates carrying ESBLs alone or ESBLs and pAmpC CMY-2. Diagrams of mcr-1-positive isolates are based on all ESC-resistant E. coli for each region.

TABLE 1

 1 Antibiotic treatments in the sampled farms

				Antibiotic treatment
	Farm ID a	Region	Administered antibiotics	duration (days)	Reasons for antibiotic usage
	A1	Akkar	Amoxicillin, ampicillin, cephalexin, ciprofloxacin, colistin,	6	Prevention and cure
			doxycycline, gentamicin, trimethoprim/
			sulfamethoxazole
	A2	Akkar	Amoxicillin, ampicillin, cephalexin, ciprofloxacin, colistin,	6	Prevention and cure
			doxycycline, gentamicin
	A3	Akkar	Amoxicillin, ampicillin, cephalexin, ciprofloxacin, colistin,	3	Prevention and cure
			doxycycline, florfenicol, tilmicosin
	A4	Akkar	Ciprofloxacin, colistin, doxycycline, florfenicol, gentamicin	6	Prevention and cure
	A5	Akkar	Colistin, doxycycline, tilmicosin	6	Prevention and cure
	A6	Akkar	Ciprofloxacin, colistin, doxycycline, tilmicosin	5	Prevention and cure
	Bb1	Baalbeck	Colistin, doxycycline, florfenicol, gentamicin	10	Prevention and cure
	Bb2	Baalbeck	Colistin, doxycycline, florfenicol, gentamicin	10	Prevention and cure
	Bb3	Baalbeck	Ciprofloxacin, colistin, doxycycline, trimethoprim/	30	Prevention and cure
			sulfamethoxazole
	Bb4	Baalbeck	Ciprofloxacin, colistin, doxycycline, trimethoprim/	30	Prevention and cure
			sulfamethoxazole
	B1	Beqaa	Colistin, doxycycline, florfenicol, gentamicin, tilmicosin	10	Prevention and cure
	B2	Beqaa	Ciprofloxacin, doxycycline, gentamicin	10	Prevention and cure
	B3	Beqaa	Amoxicillin, doxycycline, gentamicin	5	Prevention and cure
	B4	Beqaa	Ciprofloxacin, doxycycline	10	Prevention and cure
	B5	Beqaa	Doxycycline	5	Prevention and cure
	B6	Beqaa	Amoxicillin, ampicillin, cephalexin, ciprofloxacin, colistin,	10	Prevention and cure
			doxycycline, gentamicin, trimethoprim/
			sulfamethoxazole
	B7	Beqaa	Ciprofloxacin, doxycycline, gentamicin, trimethoprim/	5	Prevention and cure
			sulfamethoxazole
	B8	Beqaa	Doxycycline	5	Prevention and cure
	M1	Mount Lebanon	Doxycycline, florfenicol, gentamicin, tetracycline,	5	Prevention and cure
			trimethoprim/sulfamethoxazole
	M2	Mount Lebanon	Ciprofloxacin, doxycycline, gentamicin	3	Prevention and cure
	M3	Mount Lebanon	Ciprofloxacin, doxycycline	5	Prevention and cure
	M4	Mount Lebanon	Ciprofloxacin, doxycycline, gentamicin	5	Prevention and cure
	M5	Mount Lebanon	Ciprofloxacin, tilmicosin	5	Prevention and cure
	M6	Mount Lebanon	Cephalexin, ciprofloxacin, colistin, doxycycline,	3	Prevention and cure
			gentamicin, trimethoprim/sulfamethoxazole
	M7 b	Mount Lebanon	NA c	NA c	Cure (only in case of infection)
	M8	Mount Lebanon	Ciprofloxacin, doxycycline, gentamicin, trimethoprim/	10	Prevention and cure
			sulfamethoxazole
	M9	Mount Lebanon	Ciprofloxacin, doxycycline, gentamicin, trimethoprim/	10	Prevention and cure
			sulfamethoxazole
	N1	Nabatieh	Amoxicillin, colistin, doxycycline, enrofloxacin,	10	Prevention and cure
			gentamicin, tilmicosin, trimethoprim/sulfamethoxazole
	N2	Nabatieh	Amoxicillin, colistin, doxycycline, enrofloxacin,	10	Prevention and cure
			gentamicin, tilmicosin, trimethoprim/sulfamethoxazole
	N3	Nabatieh	Amoxicillin, colistin, doxycycline, enrofloxacin,	15	Prevention and cure
			gentamicin, tilmicosin, trimethoprim/sulfamethoxazole
	ND1	North	Cephalexin, doxycycline, gentamicin	3	Prevention and cure
	ND2	North	Cephalexin, doxycycline, gentamicin	3	Prevention and cure
	ND3	North	Cephalexin, doxycycline, gentamicin	3	Prevention and cure
	ND4	North	Ciprofloxacin	3	Prevention and cure
	ND5	North	Doxycycline	5	Prevention and cure
	ND6	North	Doxycycline	5	Prevention and cure
	ND7	North	Doxycycline	5	Prevention and cure
	ND8	North	Ciprofloxacin, colistin, doxycycline, gentamicin	6	Prevention and cure
	ND9	North	Ciprofloxacin, colistin, doxycycline, gentamicin,	10	Prevention and cure
			trimethoprim/sulfamethoxazole
	ND10	North	Ciprofloxacin, colistin, doxycycline, gentamicin, tilmicosin	6	Prevention and cure
	S1	South	Amoxicillin, colistin	10	Prevention and cure
	S2	South	Amoxicillin, colistin	10	Prevention and cure
	S3	South	Amoxicillin, colistin, tilmicosin	30	Prevention and cure
	S4	South	Amoxicillin, colistin, erythromycin, neomycin	15	Prevention and cure

(Continued on next page)

TABLE 1 (

 1 Continued)

				Antibiotic treatment
	Farm ID a	Region	Administered antibiotics	duration (days)	Reasons for antibiotic usage
	S5	South	Amoxicillin, colistin, erythromycin, neomycin	15	Prevention and cure
	S6	South	Amoxicillin, colistin, erythromycin, neomycin	15	Prevention and cure
	S7	South	Colistin, enrofloxacin, gentamicin, sulfadiazine,	15	Prevention and cure
			trimethoprim/sulfamethoxazole
	S8	South	Amoxicillin, colistin, doxycycline, gentamicin	10	Prevention and cure
	S9 b	South	NA c	NA c	Cure (only in case of infection)
	S10	South	Amoxicillin, colistin, tylosin	30	Prevention and cure
	S11	South	Doxycycline, gentamicin	20	Prevention and cure
	S12	South	Amoxicillin, cefpodoxime, ciprofloxacin, colistin,	12	Prevention and cure
			doxycycline, gentamicin, spiramycin, tylosin
	S13	South	Amoxicillin, cefpodoxime, ciprofloxacin, colistin,	25	Prevention and cure
			doxycycline, gentamicin, spiramycin, tylosin
	S14 b	South	NA c	NA c	Cure (only in case of infection)
	S15 b	South	NA c	NA c	Cure (only in case of infection)
	S16	South	Amoxicillin, cefpodoxime, ciprofloxacin, colistin,	15	Prevention and cure
			doxycycline, gentamicin, spiramycin, tylosin

a N = 56. b Farms in which no ESC-resistant strains were isolated. c No antibiotic administration on the sampled flock.

TABLE 2

 2 Proportion of resistance among the 323 ESC-resistant Enterobacterales isolates

	Amoxicillin-clavulanate	253 (88.8%)	26 (93.1%)	7 (100%)	3 (60%)
	Cefoxitin	117 (41.1%)	7 (25%)	0 (0%)	0 (0%)
	Cefotaxime	283 (100%)	28 (100%)	7 (100%)	5 (100%)
	Ceftazidime	273 (95.8%)	26 (93.1%)	7 (100%)	3 (60%)
	Cefepime	201 (70.5%)	23 (79.3%)	6 (85.7%)	3 (60%)
	Aztreonam	239 (83.9%)	23 (79.3%)	7 (100%)	3 (60%)
	Imipenem	0 (0%)	0 (0%)	0 (0%)	0 (0%)
	Ertapenem	0 (0%)	0 (0%)	0 (0%)	0 (0%)
	Gentamicin	266 (93.3%)	28 (100%)	3 (42.8%)	5 (100%)
	Ciprofloxacin	280 (98.2%)	28 (100%)	7 (100%)	5 (100%)
	Trimethoprim Sulfamethoxazole	253 (88.8%)	28 (100%)	7 (100%)	5 (100%)
	Tetracyclines	283 (100%)	28 (100%)	7 (100%)	5 (100%)
	Amikacin	0 (0%)	0 (0%)	0 (0%)	0 (0%)

Antibiotics E. coli (n = 283) Klebsiella sp. (n = 28) Enterobacter cloacae (n = 7) Proteus mirabilis (n = 5) FIG 2 Susceptibility profiles of 323 ESC-resistant Enterobacterales isolates and phenotypic ESBL/AmpC detection. AMC, amoxicillin-clavulanate; FOX, cefoxitin; CTX, cefotaxime; CAZ, ceftazidime; FEP, cefepime; IMP, imipenem; ETP, ertapenem; ATM, aztreonam; GEN, gentamicin; AMK, amikacin; CIP, ciprofloxacin; SXT, trimethoprim-sulfamethoxazole; TET, tetracycline.

Volume 9 Issue 2 e00025-21 MicrobiolSpectrum.asm.org 2 Downloaded from https://journals.asm.org/journal/spectrum on 09 September 2021 by 147.100.179.233.

MicrobiolSpectrum.asm.org 3 Downloaded from https://journals.asm.org/journal/spectrum on 09 September 2021 by 147.100.179.233.

MicrobiolSpectrum.asm.org 4 Downloaded from https://journals.asm.org/journal/spectrum on 09 September 2021 by 147.100.179.233.

MicrobiolSpectrum.asm.org 6 Downloaded from https://journals.asm.org/journal/spectrum on 09 September 2021 by 147.100.179.233.

Downloaded from https://journals.asm.org/journal/spectrum on 09 September 2021 by 147.100.179.233.

MicrobiolSpectrum.asm.org 9 Downloaded from https://journals.asm.org/journal/spectrum on 09 September 2021 by 147.100.179.233.

MicrobiolSpectrum.asm.org 10 Downloaded from https://journals.asm.org/journal/spectrum on 09 September 2021 by 147.100.179.233.

MicrobiolSpectrum.asm.org 11 Downloaded from https://journals.asm.org/journal/spectrum on 09 September 2021 by 147.100.179.233.

ACKNOWLEDGMENTS

We thank Karine Praud and Isabelle Foubert for their technical assistance and Pierre Germon for discussions on E. coli virulence factors. We are grateful to the Ministry of Agriculture of Lebanon for the help in contact with the different broiler farms. Finally, we warmly thank all involved veterinarians and broiler farm owners who participated in this study. This work was supported by Saint Joseph University (USJ) of Beirut in Lebanon and the National Research Institute for Agriculture, Food and Environment (INRAE) in France. M.M. was funded by a USJ PhD studentship (grant number FP72/73), by the National Center for Scientific Research in Lebanon (CNRS-L), and by the Francophone University Agency (AUF) in Lebanon during her stay in France. The funders had no role in study design, data collection and interpretation, or the decision to submit the work for publication.


Ankica Barišić

Enlin Zhu

Frédéric Mallet

Model-driven approach for the design of multi-chain smart contracts

Keywords: multichain, smart contract, model-driven engineering, formal verification

Blockchain-based smart contracts provide transparent automation in a broad range of services, including finance, the Internet of Things, and autonomous systems. However, the implementation of such services may easily involve security risks and functional errors, especially for complex services composed of different blockchains. To help developers focus on their business model instead of diving into the blockchain architecture heterogeneity, we propose a framework to enable analysis and comparison of composed services before deployment. This is achieved through the intensive use of model-based engineering allowing reasoning on the model before generating concrete deployment artifacts, especially for the safe orchestration of contract calling transactions.

I. INTRODUCTION

As a piece of executable code residing at a specific address on a distributed ledger [START_REF] Wood | Ethereum: A secure decentralised generalised transaction ledger[END_REF], the blockchain-based smart contract permits irreversible executions of transparent transactions among entities with distrust. Taking the IoT scenario as an example, smart contracts can be used to automate data sharing, device ownership transfer, user registration, certificate deployment and revocation, etc. Smart contracts also enable the implementation of cryptocurrency as an incentive, which helps create a digital market to trade resources across multiple systems, such as smart grids, transport systems, and logistic networks.

The whole ecosystem includes stakeholders with different behavior guarantees. For the sake of the trade-off between the fault-tolerance capacity and the transaction speed, developers are encouraged to use different blockchains to address corresponding stakeholders. However, the outcome of their interactions is not as clearly defined as the transactions on one single chain. To provide additional guarantee to the composed service, Model Driven Engineering (MDE) is used. MDE provides explicit models, commonly called 'first-class artifacts', that are further translated to lower level models with more details. This approach is adopted to large-scale software engineering problems thanks to its rapid prototyping, simulation, validation and verification capabilities. Such models are expressed through different Domain-Specific Modeling Languages (DSMLs) [START_REF] Gray | Domain-specific modeling[END_REF].

MDE enables reasoning on the model before generating concrete artefacts for deployment, including the orchestration of services and the specification of blockchain technologies. By having appropriate DSMLs we can contribute to the creation of a service-level semantics of contracts running on given multichain back-ends, based on which some security and temporal properties could be formally verified by enabling simulation at appropriate levels of abstraction.

II. RELATED WORK

In single-chain scenarios, business model translation and smart contract verification have been explored separately. Taking financial application as an example, the Digital Asset Modeling Language (DAML)1 is used in asset management logic description by offering a solution at a higher level of abstraction. However, this approach lacks the integration of verification features. On the verification side, Tezos blockchain [START_REF] Bernardo | Mi-Cho-Coq, a framework for certifying Tezos Smart Contracts[END_REF] has already considered formal verification problems during the protocol design phase and code implementation. Properties are extracted from virtual machine code and fed to a theorem prover like Coq [START_REF] Bertot | Interactive theorem proving and program development: Coq'Art: the calculus of inductive constructions[END_REF]. For other blockchain projects without such a feature, additional formalization frameworks like the Kframework [START_REF] Roşu | An overview of the K semantic framework[END_REF] and state machine abstractions give the formal semantics.

There are research efforts devoted to generating Ethereumbased smart contracts using MDE [START_REF] Mülder | Model-Driven Smart Contract Development for Everyone[END_REF], even by generating code from natural language models [START_REF] Choudhury | Auto-Generation of Smart Contracts from Domain-Specific Ontologies and Semantic Rules[END_REF]. FSolidM is such a solution that provides formal definitions to address vulnerabilities like reentrancy and transaction ordering, as well as to support design patterns like time constraints and authorizations [START_REF] Mavridou | Designing Secure Ethereum Smart Contracts: A Finite State Machine Based Approach[END_REF]. It, therefore, gives the developers a new way to formulate their smart contracts by providing support for verification, but the business model is still tight to Solidity implementation.

On multi-chain scenarios, several frameworks of crossblockchain applications have been proposed, but their communication cost is not explicit [START_REF] Belchior | A survey on blockchain interoperability: Past, present, and future trends[END_REF]. BlockSY2 proposes a technology-agnostic web services to ease changing the underlying blockchain. While it deals with the syntactic adaptation, it does not explicitly define the expected semantics of transactions and tightly relies on the one of underlying blockchains.

III. DEVELOPMENT OF MULTI-CHAIN SMART CONTRACT

We assume that the entire business logic is based on a working flow. Each step of this working flow has a set of implementations in different blockchains in the form of libraries. The current cross-blockchain interaction model is simple message passing without state synchronization.

The objective of our approach is to wisely reuse existing libraries implemented in different blockchains and explicitly specify and analyze the behavior of the generated composed smart contracts. We need to orchestrate steps on different blockchains while ensuring that generated smart contracts satisfy expected properties. When several valid orchestrations are possible, we choose the one that optimizes a non-functional property, like the execution time or the gas consumption. Our approach is expressed by a three-layer framework with a synthesis phase. The top layer is about the service design, including three elements: the working flow of the business model, the specification of each step, and the specification of the business model. The bottom layer is a set of candidate blockchain platforms that host the libraries to implement each step of the working flow above. The middle layer is a configuration that maps each step to a corresponding function in a chosen library on one blockchain platform. We use three DSMLs to separately describe the abstract behavior (working flow), the properties (specification of the business model) and the configuration (step-function mapping). The whole service is based on a smart contract hosted by a chosen blockchain which invokes functions residing in libraries deployed on other blockchains. This smart contract is expected to be generated from the abstract behavior, the configuration and an accepted cross-blockchain context parsing rule.

Assuming that the chosen functions in the configuration are justified by the single chain verification methods, once the control logic of the working flow is formally justified, the generated artefacts of the whole service will satisfy the business model specification.

Our approach relies on the GeMoC studio [START_REF] Bousse | Execution Framework of the GEMOC Studio (Tool Demo)[END_REF], an Eclipsebased language and modeling workbench. The framework provides a generic interface to bring together multiple DSMLs and describe the semantics of their coordination. It allows plugging-in different execution engines for each of their specific metalanguages. We have developed several concrete syntaxes to specify model instances for smart contracts, libraries, and deployed configurations.

To analyze the synthesized service behavior, we can use the GeMoC tools for simulation, model checking, debugging, and run-time verification. GeMoC also has a support to generate a full semantic model from a set of patterns applied to each DSML. This semantic model is described using the Clock Constraint Specification Language (CCSL) that provides a formal support for conducting exhaustive verification [START_REF] Mallet | Correctness issues on MARTE/CCSL constraints[END_REF].

Our approach opens the possibility to introduce new functionalities on top of the smart contracts, which can be defined by third parties. One possible application is the addition of the specific language for defining the legal clauses which can be used to provide governance over the smart contract while in runtime. We can, for instance, introduce concepts like termination of contract or adding addendum to the existing clauses of contracts. On the other hand, having the contract behavior explicitly defined, it is then possible to provide a simulation environment for monitoring the contracts at run-time.

IV. CONCLUSION

This work provides a framework to address the reliability problem of multi-chain smart contract design. Although the code generation part is not finished, we build some automatic supports to describe the behavior of contracts and orchestrate the execution of transactions. The main contribution is the creation of the semantics of the service composition of a multi-chain interaction model using the model-driven approach, which could be transferred into existing verification tools.

Fig. 1 .

 1 Fig. 1. MDD approach for generating multi-chain smart contracts

https://daml.com/ (Accessed: 12.04.2021)

https://blocksy-wiki.symag.com/ (Accessed: 12.04.2021) 978-1-5386-4235-1/18/$31.00 ©2018 IEEE


Nicolas Pelissero
email: nicolas.pelissero@ecole-navale.fr

Pedro Merino Laso

John Puentes
email: john.puentes@imt-atlantique.fr

Impact assessment of anomaly propagation in a naval water distribution cyber-physical system

Keywords: Cyber-physical system, cybersecurity, propagation assessment, multilayer graph model, risk estimation

Cyber-Physical Systems (CPS) are composed by multiple subsystems that encompass numerous interdependencies. Although indispensable and highly performant from a functional perspective, complex interconnectivity constitutes paradoxically a significant vulnerability when an anomaly occurs. Anomalies could propagate and impact the entire CPS with irreversible consequences. This paper presents an approach to assess the anomaly propagation impact risk on a three layers oriented graph which represents the physical, digital, and system variables of a CPS components and interdependencies. Anomalies are detected applying information quality measures, while potential propagation paths are assessed computing the cumulated risk represented by weights assigned to the graph edges. To verify the cascading impact of different anomalies four cyber-attacks -denial of service, sensor offset alteration, false data injection, and replay attack -were implemented on a simulated naval water distribution CPS. The propagation impact of three anomalies was successfully assessed and the corresponding estimated propagation path, if applicable, confirmed.

I. I

Cyber-physical systems (CPS), essential in the naval domain, rely on numerous interdependencies and interactions of heterogeneous physical, digital, and communication components [START_REF] Jacq | Detecting and hunting cyberthreats in a maritime environment: Specification and experimentation of a maritime cybersecurity operations centre[END_REF]. Whereas such strong emergence of CPS is part of the current progress towards autonomous ships, it has also brought a major concern related to cybersecurity. Even if global guidelines of the International Maritime Organization have requested, among others, to address cybersecurity threats by 2021 [START_REF]Guidelines on maritime cyber risk management[END_REF], currently only partial assessments of some risks have been conceptualized in this domain. One of the reasons that explain this setback is the increasing complexity of data and information flow interdependencies, which hinder the identification, modeling, and analysis of interactions between connected components. Furthermore, conceptualizing the vessels' CPS as multilayer networks [START_REF] Boccaletti | The structure and dynamics of multilayer networks[END_REF], it is evident that a cyberattack or a system malfunction could cause cascading failures, engendering potential irreversible damage on board.

A crucial vessel system that could be the target of a cyberattack or break down because of an anomaly is the water supply, which ensures a sustainable life condition level for crew members and passengers. The water distribution CPS is commonly composed of several tanks to stock water, pumps to fill up the tanks, valves to control water circulation, consumption nodes, and the particular global control system. Water quality and distribution alterations could generate infectious disease transmission [START_REF] Rooney | A review of outbreaks of foodborne disease associated with passenger ships: evidence for risk management[END_REF] that may compromise a given mission. Other CPS like power generation, navigation, and propulsion will produce equivalent detrimental issues on board. Considering the consequences of cascading failures on naval CPS, the major aim of this work is to define a CPS-adapted model for the evaluation of how an altered subsystem could impact other subsystems it is connected to, when an anomaly occurs, to anticipate critical failures. This evaluation is based on a multilayer graph model and a specific propagation risk assessment. A naval water distribution study case is used to test the proposed approach. This paper is organized as follows.

Section II introduces previous works on CPS modelling and anomaly propagation. Section III describes the proposed graph modeling and anomaly propagation approach. Section IV presents the experimental setup of a simulated naval water supply. The main results are presented in section V. Section VI comments the conclusions and perspectives of the study.

II. R W

One of the most challenging aspects of CPS modeling is cyber-physical duality. Physical components operate mostly in continuous time, while cyber components run in a discretetime manner. Therefore, the connection between these two operations is essential to model any CPS behavior. Initiatives in the literature have reported about agent-based models to describe interactions between physical and cyber components within a CPS [START_REF] Zhu | Resilient Distributed Control of Multi-agent Cyber-Physical Systems[END_REF] and hybrid system behavior modeling of the communication infrastructure in a smart grid [START_REF] Li | Communication infrastructure design in cyber physical systems with applications in smart grids: A hybrid system framework[END_REF]. Another model [START_REF] Carreras Guzman | Conceptualizing the key features of cyber-physical systems in a multilayered representation for safety and security analysis[END_REF], focused on CPS representation to enable combined safety and security analyses, using a multilayered structure to conceptualize subsystems and their interactions. Although, without specifying subsystem interdependencies and covering partially the cyber-physical duality, a recent work proposed to weight interdependencies value, computed according to their amount and a predefined protection level, to determine the risk of anomaly propagation in an information technology network [START_REF] Malik | Quantitative risk modeling and analysis for large-scale cyber-physical systems[END_REF].

978-1-7281-5684-2/20/$31.00 ©2021 IEEE CPS's subsystem interdependencies encompass additional complexity and could have a tremendous impact on system performance, since a minor failure in a critical infrastructure could propagate through the entire system and trigger numerous other failures [START_REF] Pournaras | Cascading failures in interconnected power-to-water networks[END_REF]. However, a given CPS subsystem interconnected to a failed one may not be immediately impacted by that failure, and subsystems that do not interact directly with the physical world could still be impacted by an attack propagation. Because of these reasons, several analyses of CPS interdependencies are based on graph abstraction, even if the proposed CPS mathematical models do not reflect the operational specifications of the subsystems interdependencies. Graph modeling has been applied to optimize the recovery ability of interdependent networks after cascading failures [START_REF] Yang | Modelling cascading failure of a cps for topological resilience enhancement[END_REF], as well as to evaluate the propagation consequences of attacks by comparing the dynamic behavior of physical processes through their sensor measurements and control command outputs, in normal conditions and under attack [START_REF] Orojloo | A method for evaluating the consequence propagation of security attacks in cyber-physical systems[END_REF]. These modelling approaches integrate only to a certain degree part of the CPS specifications and application domains. Otherwise, graph theory abstraction was used to model anomaly propagation, matching critical infrastructures interactions and interdependencies, based on mixed holistic reductionism [START_REF] Foglietta | From detecting cyber-attacks to mitigating risk within a hybrid environment[END_REF], which is not adapted to CPS. Our work intends to further unify the CPS cyber space and physical world, with the perspective of a generic and comprehensive methodology [START_REF] Guan | A comprehensive overview of cyber-physical systems: from perspective of feedback system[END_REF], to cover the design, development, verification, and real-time analysis of CPS. We focus on anomaly propagation assessment to anticipate critical failures.

III. P

A. CPS graph generation model

In our previous work a simplified generic CPS-adapted graph model was proposed [START_REF] Pelissero | Naval cyber-physical anomaly propagation analysis based on a quality assessed graph[END_REF]. This model focused on a preliminary anomaly detection and propagation analysis, based on data and information quality measures on a simplified CPS. According to CPS specificities, each CPS subsystem node belongs to the digital or physical layer of the multilayered generated graph. A third layer groups the variables associated to subsystem nodes. The three layers of the generated graph model are illustrated in Fig. 1. Components of the layers are assigned as follows:

• Digital subsystems: Integrate networking and/or computing capacities (e.g. in Fig. 1 PLCs and SCADA). • Physical subsystems: Interact with a physical process, transmit measured data or receive control commands (e.g. in Fig. 1 PU10 and PU11 pumps, and T7 tank).

• System variables: Describe the CPS current state with measured and control variables (e.g. in Fig. 1 pump state , flow , and T7 tank level 7 ). The defined graph structure represents node dependencies for both CPS modeling and anomaly propagation assessment. These dependencies can be assembled in two major groups:

• Between subsystems of the digital and physical layers: Defined digital/physical communication dependencies, e.g sensor measurements transmission, PLC-to-actuator control command, pump activation and tank fill-up.

• Between system variables of the third layer: Statecorrelation model [START_REF] Wang | Srid: State relation based intrusion detection for false data injection attacks in scada[END_REF] of structural -a variable deviation can cause the variation of others -, or operationalsubject to the activation of a specific value in other variables -dependencies.

B. Anomaly detection

After the previous graph generation, anomalies in the CPS are detected on the system variables layer. To this end, information quality measures and parameters of concerned digital and physical subsystems nodes are associated to each one of the resulting CPS variables. The pertinence of these information quality measures was validated previously in the case of a static anomaly detection scenario [START_REF] Laso | Monitoring approach of cyber-physical systems by quality measures[END_REF]. An information quality measure vector -→ , composed by dimensions of information quality metrics, is defined as follows:

-→ ∈ { 1 , ..., } (1)
These information quality vectors are assigned as measure vectors -→ of the corresponding system variables (Fig. 1). Anomalies are detected when data flows of the CPS subsystem contradict expected agreement levels of the quality measures.

C. Impact assessment processes of an anomaly propagation

Two distinct anomaly propagation assessment processes are conducted on the proposed graph model. The first process is initiated once an anomaly has been detected at a time 1 . An evaluation of the propagation on system variables (PSV) starts to evaluate the potentially impacted variables. This propagation assessment process is conducted on the third layer of the graph model, based exclusively on the graph characteristics defined by the given system variables dependencies model. Whenever the same anomaly impacts another system variable at a time 2 , and if this variable was previously identified through the PSV evaluation at 1 , an impact time on the second system variable defined as Δ = 2 -1 , confirms the estimated propagation path.

The anomaly detection at 1 also initiates another anomaly propagation assessment process on the first and second layers of the graph model. It is based on weighting of dependencies through propagation risk assessment of CPS subsystems. To this end, four major metrics -that enhance anomaly propagation risks-and -that reduce these risks-are adapted to naval CPS features, taking into account subsystems interactions, functional specifications, and the possible impact on the whole system. Each and metric is subdivided in two submetrics, or , defined with a level value from 1 to 4, organized in pairs:

= ,1 , ,2 , = ,1 , ,2 , = [1, 2] ∈ N (2)
These metrics and associated submetrics, are defined as: of the given subsystem and its resiliency ( 2,2 ) in case of failure.

It is assumed that applying prior expert knowledge, from manufacturing to operational features, users estimate the risk of each CPS subsystem. To feed the model, initially each proposed submetric level must be associated to the given subsystem specifications. The submetrics ,1 and ,2 are paired in 4 counterbalance associations. From these associations, four propagation risk levels, , are deduced as:

1 = 1,1 1,1 2 = 1,2 1,2 3 = 2,1 2,1 4 = 2,2 2,2 (3)
The sum of these four levels provides a weight that reflects the subsystem disposition to propagate an anomaly. This estimation is repeated for each subsystem of the first and second layers of the graph model and defined nodes' edges weights:

= 4 =1 = [0, 25; 4] ; ℎ = [1; 16] (4)
For a given CPS, the propagation risk assessment is estimated for each one of its subsystems. As shown in Fig. 1, the values of are dependency weights assigned to the corresponding subsystems. A propagation impact score is calculated for each subsystem interconnection path in the physical and digital layers, starting with the subsystem node associated to the node variable where the anomaly was initially detected. This score is a sum of the traveled node weights and depicts the possible anomaly impact of one graph path.

= =1 ; > 0 (5)
IV. E

A. Naval water distribution CPS

The main purpose of a water distribution system is to satisfy consumers demand and ensure a proper quality of the delivered water. Various CPS components are needed to guarantee this purpose. On the other hand, a ship water supply network (Fig. 2) is designed as for a small village. For this reason, the Ctown water distribution network was adapted to our study case. It is composed by 388 nodes, 429 pipes, 7 tanks, 11 pumps, 4 valves (1 actionable), 9 PLC and 1 SCADA. Water storage and distribution depends on the water levels of 7 tanks that control when the 11 pumps should be activated. Each actuator, i.e. pumps and valves, and each sensor, are connected to one of 9 PLCs that control or monitor each of them. A SCADA system collects the PLCs readings and coordinates the process. PLCs that are controlling actuators, in accordance with sensor readings, mostly receive this information from other PLCs. To assess the anomaly propagation impact on physical and digital systems, an entire simulation of the adapted water distribution network physical and digital dimensions must be conducted.

B. Simulation of the water distribution network

The hydraulic simulation of the naval water distribution network was implemented on EPANET. This application allows performing extended-period simulations of a water distribution network and offers a large range of CPS components models like pumps, valves, storage tanks, reservoirs, pipes, and junctions. Required functions to design, run, and modify simulations by the effect of external parameters are also available. An external toolbox, EpanetCPA, broadens EPANET features to the cyber-physical domain, enabling to specify different kinds of attacks on both physical and digital dimensions of a water supply network [START_REF] Taormina | Characterizing cyber-physical attacks on water distribution systems[END_REF].

C. Graph of the naval water distribution CPS

Each system and subsystem variable of the naval water distribution network are defined by a node, with interdependencies between two nodes being represented by edges. The structural and operational variable dependencies, determined as part of the system design process, are built from the subsystems interdependencies described in a study that characterized cyber-physical attacks on water distribution systems [START_REF] Taormina | Characterizing cyber-physical attacks on water distribution systems[END_REF]. A Fig. 2. Representation of a simplified ship water distribution system simplified illustration of the resulting generated graph model is shown in Fig. 1. The modeled part of the water supply network is in charge of T7, the tank-level controlled when pumps PU10 and PU11 are activated by PLC 5, and transmitted from PLC 9 to PLC 5 for process control. All variable values of actuators and sensors are communicated through the PLCs-to-SCADA connections for process monitoring.

D. Quality analysis

Quality evaluation can be measured by using multiple dimensions depending on the studied CPS configuration [START_REF] Laso | Monitoring approach of cyber-physical systems by quality measures[END_REF]. For the study case, contextual information quality is evaluated according to the presence of erroneous information (

). This metric denotes if information is different from the expected one. Extrinsic information quality is estimated according to coherence ( ℎ ) to signify if information appears to be logic compared to other information.

An information quality vector

-→ is defined for each network's subsystem and its associated variables. Information quality of the pumps is evaluated through , to identify if pump state and flow values match, and ℎ to describe if the pump state value is coherent with the associated tank level. The tank information quality is calculated by using to measure if the given tank level is a viable value, bounded by the min and max tank-level thresholds. To follow any possible anomaly propagation in the network, each quality metric is associated as a parameter of the corresponding system variable node.

E. Anomaly propagation assessment

To perform an anomaly propagation assessment on the naval water distribution network, each subsystem of the generated graph is weighed according to several metrics based on propagation risk, which are weighted graph dependencies, as defined in III-C. The weighting approach for edges is illustrated hereof with the example of defining weights for PLC9 (Fig3). Each and submetric values are determined by the expert providing the prior propagation assessment knowledge. These values allow to calculate the 4 propagation risk levels (equation 3) and to define 9 : The assessment process is initiated by the anomaly detection on a node of a subsystem variable. Next, a list of associated subsystem variables that could be impacted by the identified anomaly is obtained from the graph analysis. As shown in Tab. II, the resulting PSV is calculated for each anomaly detection. Then, the propagation evaluation starts on the subsystem node associated to the node variable where the anomaly was detected applying a quality metric. The anomaly propagation is assessed for all paths of the given graph. A propagation impact rate is calculated for each edge of the first and second layers of the graph. This rate highlights the possible anomaly impact on a subsystem and its propagation likelihood.

9 = 4 =1 = 3 1 + 4 1 + 3 1 + 4 1 = 14 (6)
Fig. 3 depicts an application example of the described approach for the simplified study case. An anomaly is detected on the level node ( 7 ) of tank 7:

• On the system variables layer: no other variable is impacted. • On the digital and physical subsystem layers: the anomaly propagation is initiated from T7, the subsystem node associated with 7 . Therefore, each propagation path impact score needs to be calculated as defined in equation (5).

V. R

Four functional scenarios -denial of service (DoS), sensor offset alteration, false data injection, and replay attack-on which the water storage and distribution network is altered by an attacker, like overflow or low-level of a tank, were designed to evaluate the proposed anomaly propagation impact assessment model (Table I). Each scenario extends during 144 hours and corresponds to a specific type of cyber-attack initiated on the digital or physical layer. Anomaly triggering conditions are time-based (scenarios 1, 2, and 4) or depending on a particular value reading (scenario 3). Changes in the quality metrics at a given time , associated to system variable nodes detect anomalies. The main results of these four experiments are summarized in Table II.

In the first scenario, an adversary floods the PLC2-to-PLC1 communication link, until unavailability, with a denial of service (DoS) attack and impedes PLC1 to receive the T1 tank-level value ( 1 ) from PLC2. It causes an altered state change of PU1 and PU2 pumps, detected by the information coherence evaluation ℎ = (anomaly propagation step 1, and step 2) at = 57ℎ and = 79ℎ of PU1 and PU2. This initial anomaly detection on the system variable layer, points towards a possible impact on T1 tank level ( 1 ). A T1 overflow is detected later (propagation step 3) with T1 = , when T1 reaches its maximum level at = 79, 9ℎ. The ensuing anomaly verification impact time Δ is calculated as: Δ = 2 -1 = 79, 6 -57 = 22, 6ℎ. In this case, the proposed model estimation of the T1 tank overflow is confirmed 22,6 hours later. Table III shows the most critical propagation impact scores for each step of scenario 1.

In the second scenario, an attacker impacts the 7 tank-level integrity by adding a constant offset. As shown in Fig. 3, the 7 value is transmitted from PLC9 to PLC5 for T7 level control through the PU10 and PU11 pumps. This integrity alteration generates a wrong pump state switch and has a critical impact on the T7 tank level. As a consequence, T7 overflow is detected through its associated erroneous information evaluation at = 30ℎ. This anomaly has no impact on any other subsystems.

In the third scenario, the PU4 and PU5 pumps are forced to an improper state with a false data injection. Their integrity is impacted with a constrained state that differs from the process control needs, based on T3 tank level ( 3 ). A first anomaly detection at PU4 ℎ = enables the propagation assessment on the system variables layer, leading to a potential impact on the T3 tank level ( 3 ). Another anomaly is detected at PU5 ℎ = . A low condition level is later detected with T3 = . As a result the estimated propagation path is confirmed Δ = 9, 8 hours later.

In the fourth scenario, the attacker snoops the communication link between PLC4-to-SCADA, then analyzes the data, and stores the T3 tank level ( 3 ) during the first five hours. Next, the attacker channels again these readings with a random added value until the end of the simulation. This replay attack is too complex to be identified with the applied information quality analysis. To detect this kind of attack, a more elaborated quality metric should be implemented.

Obtained results show similar weights for various subsystems of the studied CPS because of several factors. On the one hand, an equivalent security criterion is applied homogeneously on the whole CPS system. On the other hand, given the simulated experimentation conditions and the ensuing lack of operational knowledge about the tested subsystems, several assumptions were adopted to define the risk assessment. Finally, although the approach was globally defined for the whole water supply network, it could have been specifically defined for each subsystem of the network, in accordance with the respective operational constraints. It is important to note that a comparison of the results with other approaches is far from evident, since the examined components, dependencies, and metrics differ considerably. For instance besides system variables, our approach considers both the digital and physical system layers, as well as all the concerned CPS subsystems and interdependencies, instead of focusing only on the wellknown CPS physical behavior [START_REF] Orojloo | A method for evaluating the consequence propagation of security attacks in cyber-physical systems[END_REF]. For the same reason, the applied propagation risk assessment metrics differ with respect to recently published works [START_REF] Malik | Quantitative risk modeling and analysis for large-scale cyber-physical systems[END_REF].

VI. C

Modern ships are defined as highly interconnected complex systems and due to domain specificities, modelling of these interconnections to evaluate anomaly propagation through the multiple CPS components is very demanding. Yet, automatic anomaly propagation impact assessment in CPS is fundamental to identify evaluate, and anticipate the possible impact of an anomalous event in a highly interconnected multilayer network. In the case of a naval water distribution CPS, in some cases such propagation can affect the entire system with irreversible consequences. The proposed approach evaluates anomaly propagation risk according to naval water distribution CPS specificities, namely the abstraction of physical and digital components, related to the corresponding system variables, modeled in a three layers directed graph. Whereas anomalies are detected by means of information quality evaluations, the propagation risk assessment is achieved applying the prior knowledge-based weights that represent the likelihood of different components interdependencies to propagate an anomaly.

Three out of four anomalies propagation were assessed, with the confirmation of estimated propagation path when applicable. Even though the proposed representation model facilitates the implementation of diverse anomaly propagation scenarios, it is somewhat limited by the demanding task of verifying the exhaustiveness of CPS dependencies, particularly when those dependencies are not explicitly provided by the CPS manufacturer. Otherwise, risk assessment depends on expert knowledge, implying that anomaly propagation assessment results may differ from one expert to another. Nevertheless, the weighting process could be improved by the definition of complementary dynamic intrinsic information quality metrics depending on the trust granted to a given subsystem and its interdependencies. Also a unified knowledge base of risk assessment will reduce the possible variability of results. R

Fig. 1 .

 1 Fig. 1. Graph modeling of a simplified water distribution CPS

Fig. 3 .

 3 Fig. 3. Impact assessment of the anomaly propagation initiated by 7

3 9

 3