Je voudrais tout d'abord remercier mes directeurs et encadrants de thèse, Dominique Pastor, Frédéric Cuppens et Nora Cuppens, pour m'avoir donné cette opportunité et pour leur support, leur aide et leurs conseils tout au long de cette thèse.

Je remercie aussi le jury, Michel Barbeau, Philippe Forster, Abdourrahmane Atto et Jérôme Idier pour avoir accepté de prendre le temps de lire mes travaux et pour leurs retours.

Je voudrais également remercier tout le monde au département SC d'IMT Atlantique pour m'avoir accueilli et pour leur support pendant toutes ces années, avant et pendant ma thèse. En particulier Christophe, pour m'avoir permis de travailler avec lui et sans qui je n'aurais probablement pas pu suivre ce parcours. Thierry, pour ses conseils de méthodologie et d'organisation.

Introduction

Avec la croissance rapide des réseaux informatiques et des infrastructures connectées, la cybersécurité est devenue un enjeu majeur des systèmes informatiques modernes, afin de protéger aussi bien les données personnelles de chacun que les infrastructures critiques dont nous dépendons. Le développement récent des villes intelligentes et de l'industrie 4.0 a encore fortement accru la nécessité de sécuriser ces infrastructures, car ces développements s'appuient sur une forte augmentation du nombre de systèmes connectés. Ces développements sont accompagnés d'une augmentation du nombre de vulnérabilités pouvant être exploitées pour attaquer ces infrastructures. Il y a donc un besoin croissant de nouvelles méthodes de détection d'attaques, capables de détecter ces nouvelles attaques rapidement.

La plupart des méthodes actuelles sont basées sur le principe de misuse detection, qui consiste à caractériser les attaques, et qui utilisent une base de données de signatures d'attaques. Ces approches nécessitent d'abord de découvrir et d'analyser manuellement les attaques. Il y a donc un délai entre l'apparition d'une nouvelle attaque et la possibilité de la détecter, délai durant lequel ces systèmes sont vulnérables. Nous allons donc nous intéresser dans cette thèse à des méthodes de type détection d'anomalies, permettant de détecter des anomalies comme étant des déviations du fonctionnement normal, donc potentiellement de détecter ces nouvelles attaques plus rapidement, puisqu'elles ne nécessitent pas de caractériser les attaques à détecter.

Pour cette thèse, nous avons décidé de travailler sur des systèmes industriels, type SCADA (Supervisory Control And Data Acquisition). Ce sont des systèmes critiques, parmi lesquels on peut trouver des systèmes comme des chaînes de production, des systèmes de production et de distribution d'énergie, d'eau, de gaz, etc. Il s'agit de systèmes dits cyber-physiques, qui interagissent avec un processus physique via des capteurs et des actionneurs, pilotés par des automates programmables. Tous ces composants sont en réseau et peuvent être surveillés par des opérateurs depuis un système de contrôle. Comme ces composants sont en réseau, on y retrouve des composants typiques pour la détection d'attaques tels que des NIDS (Networkbased Intrusion Detection System) qui surveillent le trafic réseau. Par contre, ces types de systèmes de détection prennent rarement en compte la partie physique de ces systèmes, et ne sont pas forcément capables de surveiller les capteurs et les actionneurs du processus physique. Par exemple, ces systèmes Résumé long seraient incapables de détecter une attaque purement physique, où une personne agirait directement avec le processus, sans aucune interaction via le réseau.

Pour essayer de combler ce manque, nous allons nous intéresser dans cette thèse à des méthodes de type détection d'anomalies en surveillant les signaux physiques de ces systèmes industriels. Pour développer de telles méthodes, nous allons procéder en deux temps.

1. Tout d'abord, nous allons commencer par le développement d'un cadre théorique approprié pour l'apprentissage et la détection d'anomalies. Ce cadre théorique permettra ensuite de justifier les choix effectués pour le développement de méthodes de détection et expliquer les performances obtenues. Un aspect important de ce cadre théorique est qu'il doit être robuste, c'est-à-dire nécessiter peu d'hypothèses, et aussi maintenir des performances proches des performances théoriques, même si ces hypothèses ne sont pas tout à fait respectées. Un autre point essentiel est qu'il doit permettre de contrôler le taux de fausses alarmes, un point important en pratique qui influe fortement sur l'utilisabilité des méthodes développées.

2. Puis dans un deuxième temps, sur la base de ce cadre théorique, nous allons développer des méthodes de détection d'anomalies, c'est-à-dire des méthodes permettant d'apprendre le comportement normal du système, et ensuite de détecter des anomalies comme des déviations par rapport à ce comportement appris.

Pour cette thèse, nous avons choisi de nous appuyer sur l'approche RDT (Random Distortion Testing) [START_REF] Pastor | Random Distortion Testing and Optimality of Thresholding Tests[END_REF], basée sur un problème de tests d'hypothèses, et qui nous semble approprié pour le développement de méthodes de détections robustes. Cette approche est présentée dans la section 2.

Les sections 3 et 4 présentent deux extensions de l'approche RDT développées durant cette thèse, respectivement le RDT Généralisé et le RDT Asymptotique. Le but de ces deux extensions est de lever certaines limitations de l'approche RDT par rapport aux propriétés du bruit considéré dans le problème RDT.

Enfin, la section 5 présente des applications de cette théorie sur des signaux réels issus du jeu de données SWaT (Secure Water Treatment) [2], un jeu de données enregistré sur un système de traitement des eaux, comportant des enregistrements durant deux semaines de l'ensemble des capteurs et des actionneurs du système. Ce jeu de données comporte également des attaques, nous permettant ainsi de tester les performances des méthodes développées. Nous présentons dans cette section deux méthodes de détection basées sur l'approche RDT : une première méthode de détection de discontinuités, puis une deuxième méthode de détection de changements de moyenne permettant de segmenter des signaux physiques, qui pourra potentiellement servir de base pour une méthode complète d'apprentissage et de détection d'anomalies.

Random Distortion Testing

L'approche RDT définit le problème de test d'hypothèses suivant :

⎧ { { { { { ⎨ { { { { { ⎩ Observation : ⎧ { { ⎨ { { ⎩
𝑌 (𝜔) = Θ(𝜔) + 𝑋(𝜔) 𝑋 ∼ 𝒩(0, 𝐶) Θ et 𝑋 indépendants Hypothèse nulle ℋ 0 ∶ 𝜈 𝐶 (Θ(𝜔) -𝜃 0 ) ≤ 𝜏 Hypothèse alternative ℋ 1 ∶ 𝜈 𝐶 (Θ(𝜔) -𝜃 0 ) > 𝜏 (1) On dispose d'une observation 𝑌, qui est la somme d'une variable aléatoire Θ, représentant un phénomène d'intérêt, et de bruit Gaussien 𝑋. Cette modélisation est un modèle typique d'observation d'un phénomène physique à l'aide d'un capteur qui vient bruiter l'observation. À partir de cette observation, on veut déterminer si la réalisation Θ(𝜔) est suffisamment proche ou non d'un certain modèle déterministe

Résumé long

On dispose donc d'un test optimal pour ce problème, mais cette optimalité n'est valide que si les conditions du problème sont bien respectées. Il est notamment nécessaire de connaître parfaitement les propriétés du bruit 𝑋, et celui-ci doit être Gaussien, ce qui n'est pas nécessairement le cas en pratique. Il est notamment courant d'avoir besoin d'estimer la matrice de covariance du bruit, ce qui peut dégrader les performances du test. Pour cette raison, nous avons développé deux extension de la théorie RDT prenant ces aspects en compte. La première, le RDT généralisé, étend l'approche pour des distributions de bruit non Gaussiennes, mais présentant des propriétés d'invariance. La seconde, le RDT asymptotique, permet de prendre en compte l'estimation de la variance du bruit 𝜎 0 2 et du modèle 𝜃 0 .

Invariance et RDT Généralisé

L'approche RDT s'applique uniquement au cas d'une observation 𝑌 = Θ + 𝑋 où le bruit 𝑋 a une distribution Gaussienne. Le but du RDT généralisé est d'étendre cette approche à d'autres distributions de bruit. Nous n'allons pas travailler ici avec une distribution quelconque pour le bruit, mais avec des distributions présentant des propriétés d'invariance. En effet, il s'avère que dans les développements théoriques du RDT, cette notion d'invariance est centrale afin d'obtenir la structure du test et en déduire l'optimalité [START_REF] Pastor | Random Distortion Testing and Optimality of Thresholding Tests[END_REF]. Par exemple, dans le cas du problème RDT, la distribution Gaussienne du bruit est invariante par rotation, c'est-à-dire que si 𝑋 ∼ 𝒩(0, 𝜎 2 𝐼 𝑑 ) est une variable aléatoire Gaussienne, et 𝑔 est une rotation de ℝ 𝑑 , alors 𝑋 et 𝑔(𝑋) ont la même distribution de probabilité.

Pour poser le problème GRDT, on considère maintenant une distribution de probabilité 𝑃, invariante sous l'action d'un groupe 𝐺 de transformations linéaires de ℝ 𝑑 , et on considère également un maximal invariant 𝑀 ∶ ℝ 𝑑 → ℝ de 𝐺. Le problème GRDT est défini de la façon suivante :

⎧ { { { { { ⎨ { { { { { ⎩ Observation : ⎧ { { ⎨ { { ⎩
𝑌 (𝜔) = Θ(𝜔) + 𝑋(𝜔) 𝑋 ∼ 𝑃 Θ et 𝑋 indépendants Hypothèse nulle ℋ 0 ∶ 𝑀(Θ(𝜔)) ≤ 𝜏 Hypothèse alternative ℋ 1 ∶ 𝑀(Θ(𝜔)) > 𝜏 [START_REF] Morris | Industrial Control System (ICS) Cyber Attack Datasets[END_REF] Pour ce problème, la question est maintenant de savoir s'il est possible de trouver un test optimal, au sens du critère 𝛾-MCCP présenté précédemment. Nous avons pu identifier deux résultats théoriques qui peuvent aider à trouver un tel test. Le premier résultat, énoncé dans le Théorème 2.2.12, donne une condition suffisante pour qu'un test soit 𝛾-MCCP dans le cas général.

Le deuxième résultat, énoncé dans le Théorème 2.2.16, donne un test optimal dans le cas spécifique où le bruit 𝑋 est sphériquement invariant, ce qui signifie que le maximal invariant est la norme euclidienne (ceci inclut par exemple le cas du bruit Gaussien), et si la famille de distributions {‖𝜃 + 𝑋‖ 2 , 𝜃 ∈ ℝ 𝑑 } a un rapport de vraisemblance monotone. Dans ce cas, on peut trouver un seuil 𝜆 𝛾 (𝜏) tel que le test 𝒯 𝜆 𝛾 (𝜏) est 𝛾-MCCP.

On peut donc trouver un test optimal sous ces conditions, mais il reste maintenant le problème de trouver des distributions de probabilités pour le bruit vérifiant ces contraintes. En effet, la propriété de rapport de vraisemblance monotone est très contraignante, car elle concerne une famille de distributions très particulière qui est intégralement définie par le choix de le distribution de 𝑋. On ne peut donc pas se contenter de partir d'une famille de distributions ayant rapport de vraisemblance monotone : il faut choisir une distribution de probabilité pour 𝑋, et vérifier si la famille résultante a rapport de vraisemblance monotone ou non. Pour le moment, à l'exception de la distribution Gaussienne, nous n'avons pas encore pu déterminer d'autres distributions vérifiant cette propriété. Il est également important de noter que nous avons principalement étudié le cas d'une distribution présentant une invariance sphérique, il faudrait également étudier d'autres maximaux invariants afin de voir s'il est possible d'établir des résultats similaires au Théorème 2.2.16 dans ces cas.

RDT Asymptotique

Après avoir étudié les propriétés d'invariance du bruit pour étendre l'approche RDT, nous allons maintenant considérer le problème de l'estimation des paramètres du modèle, et voir comment l'estimation de ces paramètres influe sur les performances. Dans beaucoup d'applications, il est courant de devoir estimer les propriétés du bruit car elles ne sont pas parfaitement connues. On peut alors se demander comment ceci affecte les performances du test 𝒯 𝜆 𝛾 (𝜏) et si on conserve l'optimalité dans ces conditions. Le but ici est de vérifier ces points, en considérant une estimation de la variance du bruit 𝜎 0 , ainsi que du modèle 𝜃 0 .

Cette étude est effectuée en deux temps. Nous commencerons par étudier le comportement asymptotique du test, lorsque les estimées de ces valeurs convergent vers les vraies valeurs de 𝜃 0 et 𝜎 0 . Puis nous étudierons le comportement non-asymptotique de ce test à travers des simulations.

Le problème ARDT est défini de la façon suivante :

⎧ { { { { { ⎨ { { { { { ⎩ Observation : ⎧ { { ⎨ { { ⎩ 𝑌 (𝜔) = Θ(𝜔) + 𝑋(𝜔) 𝑋 ∼ 𝒩(0, 𝜎 0 2 𝐼 𝑑 )
Θ et 𝑋 indépendants Hypothèse nulle ℋ 0 ∶ ‖Θ(𝜔) -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏 Hypothèse alternative ℋ 1 ∶ ‖Θ(𝜔) -𝜃 0 ‖ 2 > 𝜎 0 𝜏 [START_REF] David | Survey and New Directions for Physics-Based Attack Detection in Control Systems[END_REF] avec 𝜃 0 et 𝜎 0 inconnus, et θ 𝑛 et σ𝑛 des estimateurs consistants de ces valeurs. Afin de simplifier l'étude, nous considérons ici uniquement le cas de bruit blanc Gaussien de variance 𝜎 0 2 , et non pas le cas général d'une matrice de covariance 𝐶 quelconque. On a donc pour tout vecteur 𝑦 ∈ ℝ 𝑑 , 𝜈 𝐶 (𝜎 0 2 𝐼 𝑑 )𝑦 = ‖𝑦‖ 2 /𝜎 0 2 . On suppose donc 𝜃 0 et 𝜎 0 inconnus, mais on dispose d'estimateurs consistants θ 𝑛 et σ𝑛 de ces deux valeurs, c'est-à-dire qu'ils convergent en probabilité vers 𝜃 0 et 𝜎 0 respectivement.

Étant donné que le test RDT 𝒯 𝜆 𝛾 (𝜏) est optimal lorsque 𝜃 0 et 𝜎 0 sont connus, il est naturel d'étudier le test obtenu lorsque l'on remplace ces valeurs par leurs estimées. Nous allons donc étudier le test T 𝜆 𝛾 (𝜏) défini par :

T 𝜆 𝛾 (𝜏) ∶ ℝ 𝑑 × ℝ 𝑑 × (0, ∞) ⟶ {0, 1} (𝑦, 𝜃, 𝜎) ⟼ ⎧ { ⎨ { ⎩
ℙ[ T 𝜆 𝛾 (𝜏) (Θ + 𝑋, θ 𝑛 , σ𝑛 ) = 1 | ‖Θ -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏] ≤ 𝛾 (9)
Le deuxième résultat, énoncé dans le Théorème 3.2.4, donne l'optimalité asymptotique de ce test. Pour tout test T avec niveau 𝛾 si 𝜃 0 et 𝜎 0 sont supposés connus, avec puissance conditionnelle constante pour tout 𝜌 > 𝜏, et dont la région critique est un ℙ (𝑌 ,𝜃 0 ,𝜎 0 ) -continuity set, le test T 𝜆 𝛾 (𝜏) est asymptotiquement plus puissant que T :

lim sup 𝑛 (ℙ[ T 𝜆 𝛾 (𝜏) (Θ + 𝑋, θ 𝑛 , σ𝑛 ) = 1 | ‖Θ -𝜃 0 ‖ 2 = 𝜎 0 𝜌] -ℙ[ T(Θ + 𝑋, θ 𝑛 , σ𝑛 ) = 1 | ‖Θ -𝜃 0 ‖ 2 = 𝜎 0 𝜌]) ≥ 0 (10)

Résumé long

Après ces résultats théoriques, nous avons étudié le comportement non-asymptotique du test T 𝜆 𝛾 (𝜏) par simulations. Ces simulations, présentées dans la Section 3.3, ont permis d'étudier plus en détail le comportement de ce test. Les premières simulations ont consisté à mesurer le taux de fausse alarme effectif du test, afin de vérifier le Théorème 3.2.2. Les résultats présentés sur la Figure 3.2 montre que d'une part, l'estimation de 𝜎 augmente le taux de fausse alarme effectif au dessus de 𝛾, de façon très significative dans certains cas, et d'autre part ce taux de fausse alarme décroît lorsque l'estimation de 𝜎 0 s'améliore, et semble bien tendre vers 𝛾, ce qui confirme ce résultat théorique.

Après avoir vérifié ce résultat, nous avons développé une méthode permettant de retrouver le niveau 𝛾 lorsque 𝜎 0 est estimé, en ajustant la tolérance 𝜏. Cette tolérance vient alors compenser à la fois une déviation potentielle du signal par rapport au modèle et l'effet de l'estimation de 𝜎 0 . Ceci ne dégrade pas les performances globales du test 𝒯 𝜆 𝛾 (𝜏) , et on retrouve les mêmes courbes ROC (Receiver Operating Characteristic) lorsque l'on applique ce test à un problème de détection.

Apprentissage de comportements et détection d'anomalies sur signaux réels

Après ces aspects théoriques, nous pouvons maintenant voir comment s'appuyer sur ces résultats théoriques pour l'apprentissage et la détection sur signaux réels.

La première méthode développée à partir de ces outils permet de détecter des discontinuités sur des signaux qui sont supposés être continus. Nous avons effectivement constaté qu'un certain nombre d'attaques menées engendrent des discontinuités sur certains signaux, alors qu'en temps normal, ces signaux présentent des variations lentes, et sont donc continus.

Afin de détecter ces discontinuités, nous avons développé une méthode de détection s'appuyant sur une transformation en ondelettes, et effectuant la détection sur les coefficients de détail utilisant le test RDT T 𝜆 𝛾 (𝜏) . La variance du bruit est estimée sur ces mêmes coefficients en utilisant l'estimateur MAD (Median Absolute Deviation), afin d'avoir une estimation robuste face aux pics pouvant être causés par ces discontinuités. Les paramètres 𝛾 et 𝜏 du test RDT peuvent être ajustés en s'appuyant sur un enregistrement normal du signal de façon à obtenir le taux de fausse alarme voulu. Avec cette méthode, nous avons pu détecter les neufs discontinuités présentes sur le signal testé, avec une seule fausse alarme sur un total de 224 965 échantillons testés.

La seconde méthode développée est une méthode de détection de changements. L'idée est que les composants d'un système industriel ont tendance à avoir un comportement régulier, avec quelques phases de fonctionnements qui sont répétées au cours d'un cycle. On voudrait donc détecter ces transitions d'une phase à la suivante, afin de caractériser le comportement normal du système. Pour cela, nous avons développé une méthode de détection de changements basée sur le test RDT, permettant de détecter des changements dans la moyenne d'un signal. Cette méthode consiste à estimer sur le signal la moyenne de la phase courante, puis tester par blocs d'échantillons si la moyenne du signal a changé significativement ou non par rapport à la valeur mesurée. Si oui, on considère que l'on a détecté une nouvelle phase du signal, et on estime alors la moyenne de la nouvelle phase. La détection est effectuée en utilisant le test RDT, dont la tolérance permet d'indiquer l'amplitude minimale des changements que l'on souhaite détecter. Le RDT asymptotique est utilisé ici afin de prendre en compte l'estimation de la moyenne actuelle du signal et de la variance du bruit. On obtient alors une segmentation du signal selon ses différentes phases de fonctionnement.

Sur la base de cette méthode de segmentation, nous envisageons de développer une méthode complète d'apprentissage et de détection d'anomalies. L'idée de cette méthode est d'identifier dans un premier temps les phases des différents signaux d'un système, et ensuite de caractériser ces phases (durée, valeur moyenne, variance, phases précédentes et suivantes…) sur la base de données enregistrées en fonctionnement normal. Ceci nous donne alors un modèle du comportement normal des différents composants du système. Sur la base de ce modèle, on peut alors détecter des anomalies en mesurant les caractéristiques du système, et en les comparant au modèle appris.

Conclusion

Cette thèse a permis d'explorer l'utilisation de l'approche RDT pour la détection d'anomalies. Cette approche nous a donné une base pour développer des méthodes de détection robustes et applicables sur des signaux dont la connaissance à priori est potentiellement très limitée. Nous avons développé deux extensions de cette approche, le RDT Généralisé et le RDT Asymptotique afin d'étendre davantage son cadre d'application, et nous avons pu développer des méthodes de détection sur cette base, avec des résultats encourageants lors d'essais sur signaux réels. Sur la base de ces résultats, nous envisageons de développer une méthode complète d'apprentissage et de détection, permettant de caractériser le comportement normal de systèmes industriels et de

Learning behaviors and detecting anomalies on real signals

Conclusion and perspectives 111

Context

Since the advent of the first computer networks back in the sixties, cybersecurity went from being nearly inexistent to becoming a major component of every computer system. As these systems are now integral parts of our lives and are present in major critical infrastructures, securing them is more crucial than ever. From someone's personal computer to banks to the internal systems power plants, every computer system can potentially be targeted by hackers with different goals: some may simply want to annoy people, some others try to extort money of out them -e.g. ransomwares, which target individuals and companies alike -but some actively attack specific infrastructures for possibly political or strategic reasons, for instance accessing sensitive information or damaging critical infrastructures. One example of such an attack is Stuxnet [1], discovered in 2010 and believed to have been developed by the NSA to stop the Iranian nuclear program.

Nowadays, with the advent of 5G networks and IoT (Internet of Things), these threats are omnipresent as the number of connected devices is rapidly increasing. Despite that, manufacturers do not necessarily take security into account when designing their products. While these technologies provide many useful services that can notably improve quality of life -for example Smart Cities aim to improve transportation networks, power management or healthcare among other things -they can also cause many security issues that a malicious actor could use to cause significant damage to these infrastructures. It is not hard to imagine how much damage one could cause by messing with traffic signals or water supplies for example, let alone a power plant.

In the industrial field we can see a similar trend developing with Industry 4.0 and Smart Factories. These factories rely on a large number of sensors to monitor every part of the production chain and make decisions autonomously to optimize the process, monitor anomalies, and help making decisions. These industrial systems are often referred to as ICSs (Industrial Control Systems). They build upon similar technologies to IoT, and as such inherit some of its vulnerabilities, as increased connectivity leads to more potentially exploitable vulnerabilities (zero-days).

Overall, despite many efforts to secure these systems, they are increasingly vulnerable to cyberattacks, especially new kinds of attacks that make use of these connected devices as an attack vector. Therefore it is more important than ever to develop new attack detection methods that can reliably detect these novel attacks in time before any damage occurs. For these reasons, we have chosen to work on developing new detection methods focusing mainly on industrial systems.

A short primer on industrial systems and cybersecurity

Industrial Control Systems

ICSs are cyber-physical systems, i.e. systems composed of physical components -such as sensors and actuators -that interact with a physical process and are networked together and controlled by computer systems. In these systems, the sensors and actuators that are part of the industrial process are connected to PLCs (Programmable Logic Controllers), which are industrial computers programmed to control the process. Multiple PLCs are used to control different parts of the system and ensure redundancy. These components are networked together and connected to control systems which are used by operators to manage and operate the process. Several network architectures exists for these systems, such as SCADAs (Supervisory Control And Data Acquisitions) or DCSs (Distributed Control Systems). An example of SCADA architecture in a water treatment process is shown in Fig. 1. ICSs can be found in many industrial sectors, including for example power grids, water distribution, telecommunication networks and manufacturing. Previously, most industrial systems used to be air-gapped, i.e. their components were on a separate network which was completely disconnected from any other network. Nowadays with the development of communication technologies, it is common to have these systems connected in some way to other networks. For example, the factory network can be connected to the corporate network of the company, so that managers have a view of the current state of the systems (productivity, required maintenance, etc.) to help their decision-making processes. However, that also means that they could be accessed from the Internet. An attacker could then potentially access the control systems and affect for example the control signals and disrupt the system. Wireless technologies are also increasingly used to help connect remote components. If someone can get in range of these connections, and if they are not properly secured, this can be used as an entry point to access the system. Another aspect of these systems is that some industries still use old components that were not designed to be networked in this way: older systems may not offer ways to validate integrity of the transmitted data or may not require authentication to perform critical operations. This would make them be easy targets in a modern network.

PLC

Detection schemes: misuse detection vs. anomaly detection

Most attack detection methods in cybersecurity fall into two main categories: Misuse detection and Anomaly detection.

Misuse detection, also referred to as Signature-based detection, refers to methods that detect attacks by defining what the attacks are. Everything else is then considered to be normal. The attacks to be detected are characterized using signatures, which are created by experts analyzing existing threats and integrated into signature databases. The detection system then attempts to recognize these signatures and raises an alarm whenever it finds a match. For example, for malware detection, these signatures contain part of the instructions present in the malware. For network intrusion detection, the signatures can contain sequences of packets or specific sequences of bytes in packets that have been determined to be malicious. However it is important to note that these detection mechanisms are reactive: they are unable to detect new forms of attacks for which no signature exists. This means that to detect a new threat, we have to wait until a new signature for this threat is made available, which means that experts first have to discover and analyze it. This analysis can take some time, and all systems remain vulnerable to this threat until new signatures are available.

Anomaly detection [3] is the opposite principle: instead of defining the attacks to be detected, we instead define what is normal, and everything else is considered an anomaly. This approach would allow detecting new attacks as long as they do not match any known normal behavior. However the main issue with this approach is learning the normal behavior of the system. With multiple users on a network, each one will have different habits and behaviors which all need to be learned accurately, while also considering that they can change over time. In addition to these human behaviors we also have to take into account all the automated and autonomous processes that might exist. As some of these are automated, they tend to be more regular, which makes discovering and learning them easier. However they still evolve over time: components may get replaced, or software may get upgraded which can change their behaviors. Because of this complexity, anomaly detection methods tend to present a high false alarm rate, making them difficult to use as many false alarms require a lot of time to manually confirm or infirm.

While learning the normal behavior of a system remains a daunting task, a shift to usable anomaly detection methods is required in order to detect new threats as soon as possible and minimize the damage they could cause. This is the focus of this work: developing methods to learn the normal behavior of a system while controlling false alarms rates. That is not to say that current signature-based methods should not be employed as well: detecting existing and known threats remains important so that they do not come back in the future. One way of achieving this is to combine both approaches in a hybrid detection method. Such work is beyond the scope of this study, but is a potential perspective to improve performances of the developed methods.

Data

As mentioned in the previous section, we will be working on anomaly detection methods which require learning the normal behavior of the studied system. As with every learning-based approach, we need to work on data captured on a system to learn its behavior. This section will discuss what kind of data is available in a cybersecurity context and the specific constraints that exist in this field.

Most attacks targeting a system are conducted remotely through a network. Therefore monitoring the network traffic is a very important part of cyberattack detection. This analysis is usually performed by IDSs (Intrusion Detection Systems), which scan all network packets that transit through them and raise an alarm whenever they detect suspicious activity. For industrial systems specifically, we also have access to the state of the physical process through the measurements of the sensors and the state of the actuators.

A major issue for cybersecurity research is data availability. As this field deals with sensitive information, releasing realistic datasets is difficult without compromising the security of actual systems. For general IDSs, a few datasets exist, such as DARPA [4] and NSL-KDD [START_REF] Tavallaee | A Detailed Analysis of the KDD CUP 99 Data Set[END_REF], which are network traffic captures in simulated environments and are commonly used to train and evaluate machine-learning-based approaches. For industrial systems specifically, very few datasets are publicly available, which significantly hampers the research efforts to develop new adequate detection methods. Existing datasets for industrial systems include several datasets developed by the Mississippi State university for power, water and gas systems [START_REF] Morris | Industrial Control System (ICS) Cyber Attack Datasets[END_REF], and the SWaT dataset [2], which is described in more details in the next section.

An additional problem is that existing datasets can quickly become outdated because of technology development. For example, the previously mentioned DARPA and NSL-KDD were made from data captured in 1999. Since then, both technologies used in networks and existing threats have significantly evolved and thus the benefits from using these datasets today are very minor. It is also very important to have a properly labelled dataset: one can easily imagine what sort of problems could emerge if some attacks were mis-characterized as normal data for example.

The SWaT testbed

In the following, we will be using the SWaT (Secure Water Treatment) dataset [2] to conduct experiments and test our methods. The SWaT system is a testbed developed by Singapore University of Technology and Design. The goal of this testbed is to offer a platform that replicates a modern industrial system that is accessible to researchers, so that they can test new security systems under realistic conditions and conduct attacks on a real system. The physical state of the system is recorded as well as all network traffic between its components. This testbed replicates the different processes that compose a water treatment system, including water collection, quality assessment, and filtration. Figure 2 details the different steps of this process, which can be decomposed in six different sub-processes named from P1 to P6. This system is composed of 26 actuators and 25 sensors, among which we can find pumps, valves, flow meters, water level sensors, etc. The state of each actuator and the measurement of each sensor is recorded once per second. In the available dataset, the system has been recorded continuously over a period of 11 days. The system was first left running under normal operating conditions for 6 days. Then during the next 5 days, a total of 36 attacks were conducted on the system in an attempt to disrupt the process. As an example, three sensors and three actuators of this system are displayed in Figs. 3 and4. The three sensors respectively measure the water level (LIT101) in a tank of the first subprocess P1, the inflow rate (FIT101) to and the outflow rate (FIT201) from this tank. The inflow is controlled my a motorized valve (MV101) and the outflow is controlled by two pumps (P101 and P102). The second pump P102 is a backup pump which is only supposed to run if the main one fails.

Figure 3 displays the measurements of these sensors and the state of these actuators under normal operating conditions. We can observe here a regular cycle in each of these signals which is characteristic of the normal behavior of the system, with occasional variations: here for example we have a regular cycle that takes approximately one hour, with one notable exception between 35,000 s and 40,000 s where we can observe an instance of a much shorter cycle.

Figure 4 shows the same sensors and actuators, this time with three attacks conducted during the displayed time period. The areas marked with a red background indicate the instants during which attacks were conducted, as labelled in the dataset. As an aside, it is important to remember that while this red background displays the timestamps during which an attack was conducted, it does not mean that this attack affected all of or only the displayed sensors and actuators. It may affect a single sensor, or even none of the displayed ones, and it could also affect directly or indirectly other components of the system. It is difficult to describe the exact effects of an attack on the system as they can remain localized or propagate to other components depending on the nature of the attack. The description of the attacks given by the authors of the dataset state the intent of each attack and how it was conducted, but only give a short description of its consequences on the system, mainly whether the attack was successful or not, and sometimes a brief description of some of its side-effects.

To give an example of attacks that were conducted on this system, we give a brief description of the three attacks visible in Fig. 4: 1. The first attack (from 1,800 s to 2,700 s) consisted in forcing the inflow valve MV101 open, in an attempt to overfill the water tank.

2. The second attack (from 3,000 s to 3,500 s) consisted in forcing both pumps P101 and P102 to be on at the same time. This could cause excessive flow in the pipes and may damage both the pumps and the pipes.

3. This third attack (around 5,000 s) consisted in spoofing the sensor LIT101: instead of observing the real value of this sensor, the PLC receives a value of the attacker's choice, who in this case simulates a rapid increase in the water level.

This example displays two kinds of attack that can be conducted on such a system:

• Manipulating an actuator directly, causing it to potentially put the system in a dangerous state.

• Spoofing the value of a sensor, causing the system to have an erroneous view of the system and react wrongly.

In more complex scenarios, an attacker could combine these approaches in order to maximize damage or remain stealthy over a long period of time.

Objectives and contributions

Our initial ambition when we started this thesis was to develop a complete anomaly-based detection method, which would be able to learn the normal behavior of a system from a database of signals, and then use this knowledge to detect attacks by comparing the current state of the system to what we would expect from the learned model. This is the basic principle of physics-based attack detection, a survey of which can be found in [START_REF] David | Survey and New Directions for Physics-Based Attack Detection in Control Systems[END_REF].

One of the main issues when developing such a method is how to obtain an accurate model of the monitored system. Indeed, the detection performance of these methods will depend highly on the quality of the model. An inaccurate model may lead to a high number of false-alarms, making it unusable in practice, or it could also leave some attacks undetected. Since we are looking at physical systems, one option to build a model would be to use the underlying equations of physics that regulate the studied phenomenons. However, this can quickly become intractable with many components, as their interactions become increasingly complex for larger systems. This renders this approach unusable beyond very small systems with few components.

An alternative approach consists in considering some mathematical model that uses a certain number of parameters, and fitting this model to data collected on the system to estimate these parameters. This is how system identification methods operate [START_REF] Åström | System Identification-A Survey[END_REF][START_REF] Ljung | System Identification: Theory for the User[END_REF], which can offer Auto-Regressive or State-Space representations of a system, among others. These methods usually rely on the ability to conduct dedicated experiments on the studied system, as they do not simply rely on data recorded during the operation of the system, but rather study how the system reacts to specific inputs to model its behavior. This might be conceivable for a system that is being designed and not yet operational, but it may not be possible to interrupt a currently operational process to conduct such experiments.

Yet another approach that can be considered is learning-based, i.e. using only data to build a model, without any prior knowledge of the system. Neural networks are a commonly encountered example of this principle, using a sufficiently large database to learn a model of some phenomenon through a training phase. A few examples of neural networks used to learn the normal behavior of industrial systems can be found in [START_REF] Nanduri | Anomaly Detection in Aircraft Data Using Recurrent Neural Networks (RNN)[END_REF][START_REF] Filonov | Multivariate Industrial Time Series with Cyber-Attack Simulation: Fault Detection Using an LSTM-Based Predictive Data Model[END_REF][START_REF] Filonov | RNN-Based Early Cyber-Attack Detection for the Tennessee Eastman Process[END_REF][START_REF] Shalyga | Anomaly Detection for Water Treatment System Based on Neural Network with Automatic Architecture Optimization[END_REF]. While neural networks have proven to be a powerful tool in some fields (e.g. image classification, pattern recognition, among many others), they also present several downsides that can make their use problematic in some situations. A first important issue is that they require a large enough, properly labelled dataset to train. Indeed, the model obtained after training depends highly on the training dataset, and if this dataset is not exhaustive, the resulting model would be limited to the situations encountered during that training, without any guarantee of what may happen in other cases. A second important issue is explainability, which is not specific to neural networks, but applies to the entire field of artificial intelligence [14,[START_REF] Barredo | Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI[END_REF]. Explainability refers to the possibility of understanding why a certain system gives a specific output for some input. For example, taking the examples of attacks shown on Fig. 4, a system trained to detect attacks might simply indicate that there is an attack occurring at a given timestamp without any other context. Without any explanation, it is up to the operator to figure out first whether the system is actually under attack, and then figure out what the attack is in order to take appropriate action. An explainable system could give more insight about the nature of the attack: it may pinpoint some sensors that are affected by the attack (for example sensor LIT101 in the case of the first attack), or even offer an interpretation of the attack (for example describing that the value of the sensor LIT101 exceeds its nominal value). Such explanations can therefore lead to faster and more appropriate responses to attacks, which can help minimize damage and downtime. Having these explanations may also help understand the cause of potential errors, which then indicate how to improve the system, whether through modifying its design or improving the dataset used for training. Several approaches have been proposed to attempt to extract explanations from different machine learning methods, which are summarized in [START_REF] Barredo | Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI[END_REF]. However, deep neural networks remain challenging in that regard because of the large number of parameters and layers that make finding relevant features difficult.

Overall, obtaining an accurate and understandable model of a given system remains a complex problem that is still largely unsolved. As such, we have to keep in mind that any model that we can obtain of a given system is a simplified representation of a complex physical system. In addition, "even if the model is reasonably good, our knowledge of the parameters in it, e.g., covariance functions, time constants, etc., may not be enough to justify a direct numerical evaluation of formulas derived from the model" [START_REF] Kailath | Detection of Stochastic Processes[END_REF]. To mitigate this mismatch between model and reality, we will be relying on the RDT (Random Distortion Testing) approach [START_REF] Pastor | Random Distortion Testing and Optimality of Thresholding Tests[END_REF], which was designed with this issue in mind. The approach stems from statistical decision theory, and incorporates model mismatch in the problem statement itself, while also offering an optimality and the ability to control the false-alarm rate. More precisely, this approach consists in deciding whether some noisy signal drifts by too much from a certain deterministic model, without requiring any prior knowledge of the probability distribution of the signal. The only assumption made is that the observation results from some unknown signal in presence of additive and independent Gaussian noise, with perfectly known covariance matrix. However, having perfect knowledge of the noise properties is questionable in practice. Indeed, there are many cases where the noise covariance matrix is not known, but estimated instead using real data. In addition, while assuming that the noise is Gaussian is common practice, this is not always the case and may lead to losing the optimality and robustness properties of this approach. In our attempts to use the RDT approach on industrial signals, we have encountered both of these situations, which are not covered by the RDT approach [START_REF] Pastor | Random Distortion Testing and Optimality of Thresholding Tests[END_REF] or its currently existing extensions [START_REF] Pastor | Random Distortion Testing with Linear Measurements[END_REF][START_REF] Khanduri | Sequential Random Distortion Testing of Non-Stationary Processes[END_REF][START_REF] Khanduri | Truncated Sequential Non-Parametric Hypothesis Testing Based on Random Distortion Testing[END_REF]. We have therefore developed two extensions of the RDT approach, one designed to account for other noise distributions, leveraging the invariance properties on which the RDT framework is based on, and the other to take the noise variance estimation into account for Gaussian noise, when the noise components are independent and identically distributed. We will then make use of the RDT framework and of these newly developed extensions to develop the basis for an anomaly detection method, applicable to the physical signals of an industrial system. This method consists in first learning the characteristics of the different phases of any given signal, and then detecting whenever the signal properties no longer match what was previously learned. Our main contribution in this regard is the development of a change-in-mean detection method, allowing one to segment a signal to find the different regime changes that are present. We will present this method and demonstrate it on signals from the SWaT dataset we presented earlier, then we will discuss some potential ideas for a complete anomaly detection method based on this change-detection algorithm.

The performance evaluation that will be presented on real signals will be limited to qualitative observations on the results yielded by our methods. Indeed, when performing our tests on real signals, we found that we were very limited by the dataset. This dataset only contains 36 attacks, which is not sufficient to get a good idea of the detection performance of our methods. In addition, we found that only having labels indicating whether an attack was in progress or not was quite limiting, notably to evaluate the quality of our segmentation obtained with our change detection method. Changes on the signals occur regardless of the presence of an attack, and the dataset does not provide any ground truth regarding these changes, making it difficult to evaluate the quality of the resulting segmentation. As such, we could only conduct limited experiments on real data, and we instead decided to focus more on the theoretical aspects of the RDT approach.

Thesis structure

Prior to the first chapter, a brief chapter will introduce some of the main notations that will be used throughout this thesis, and also recall a few important mathematical notions.

The first chapter will introduce the RDT approach, and compare it to usual hypothesis testing approaches to highlight the differences that exist between them, in terms of the problem structure and of the optimality criterion used in either case. We will also briefly discuss the robustness of tests and explain what makes the RDT approach a good candidate to find tests that are robust to model mismatches.

The second chapter will present our first extension of the RDT approach, which we named Generalized RDT, in which we attempt to make the RDT approach applicable to a wider class of noise distributions Thesis structure beyond the usual Gaussian distribution. We will start this chapter with a discussion on invariance, to reintroduce this notion in the context of hypothesis testing, and then leverage it to redevelop the RDT approach assuming that the noise distribution is not necessary Gaussian, but invariant with respect to some group of transformations of the space ℝ 𝑑 .

The third chapter will then introduce Asymptotic RDT, our second extension of the RDT approach, which consists in accounting for the estimation of the parameters of the RDT test, namely the noise variance 𝜎 and the deterministic model 𝜃 0 . We will present this extension in two steps. First we present theoretical results in the asymptotic case, showing that we can asymptotic reach the theoretical performance of the test as the estimators converge. Then we will present simulation results to study the behavior of the RDT test in the non-asymptotic case, in order to help quantify the performance loss incurred by the use of estimates instead of perfectly known values.

Finally, the fourth and final chapter will present applications of this work to cybersecurity on real signals from the SWaT dataset. We will present two detection methods based on the RDT framework that we developed and test them on the SWaT dataset. The first method consists in detecting discontinuities on physical signals that are supposed to be continuous, and offers a way to learn the appropriate parameters using a clean dataset. The second method is a change-in-mean detection method, allowing segmentation of signals to identify the different phases that are present. We will then discuss some ideas based on this method to build a complete learning-based anomaly detection method.

The conclusion will recapitulate the different results that we presented, and will also evoke some perspectives for our work. We will present some ideas to further extend the RDT approach, as well as possibilities for a full anomaly detection method based on the detection methods presented in the fourth chapter.

Several appendices are present after the conclusion. They include additional details on some aspects presented throughout this thesis.

Preliminary: mathematical notions and notations

This preliminary chapter gathers the notations that will be used throughout this thesis, and also contains a few reminders regarding some important mathematical notions.

Throughout this thesis, we consider a probability space (Ω, Σ, ℙ) with respect to which all random variables and vectors are defined. For some set 𝐸, ℳ(Ω, 𝐸) designates the set of all measurable applications (i.e. random variables) defined on (Ω, Σ, ℙ) that take their values in 𝐸.

For any integer 𝑑 ≥ 1, we denote by ℛ 𝑑 the Borel 𝜎-algebra of ℝ 𝑑 .

Continuity set. For a random variable 𝑋 ∈ ℳ(Ω, ℝ 𝑑 ), a Borel set 𝐵 ∈ ℛ 𝑑 is said to be a ℙ𝑋 -1continuity set if:

ℙ[𝑋 ∈ 𝜕𝐵] = 0
where 𝜕𝐵 is the boundary of 𝐵: 𝜕𝐵 = 𝐵 ∖ B , where 𝐵 is the closure of 𝐵, and B is the interior of 𝐵.

Convergence of sequences of random variables. We recall below the three common modes of convergences for sequences of random variables. Let 𝑋 ∈ ℳ(Ω, ℝ 𝑑 ) be a random vector (𝑋 𝑛 ) 𝑛∈ℕ ∈ ℳ(Ω, ℝ 𝑑 ) ℕ be a sequence of random vectors.

• The sequence (𝑋 𝑛 ) converges in distribution to 𝑋 if for every ℙ𝑋 -1 -continuity set 𝐴 of ℛ 𝑑 we have:

ℙ[𝑋 𝑛 ∈ 𝐴] → ℙ[𝑋 ∈ 𝐴]
Convergence in distribution will be denoted as 𝑋 𝑛 𝒟 --→ 𝑋.

• The sequence (𝑋 𝑛 ) converges in probability to 𝑋 with respect to the probability measure ℙ if:

∀𝜖 > 0, ℙ[‖𝑋 𝑛 -𝑋‖ 2 ≥ 𝜖] → 0
Convergence in probability with respect to ℙ will be denoted as 𝑋 𝑛 ℙ -→ 𝑋.

• The sequence (𝑋 𝑛 ) converges almost surely to 𝑋 if:

ℙ[ lim 𝑛→∞ 𝑋 𝑛 = 𝑋] = 1
or equivalently:

ℙ({𝜔 ∈ Ω ∶ 𝑋 𝑛 (𝜔) → 𝑋(𝜔)}) = 1
Almost sure convergence will be denoted as 𝑋 𝑛 a.s.

--→ 𝑋.

We also remind that almost-sure convergence implies both convergence in probability and in distribution, and that convergence in probability implies convergence in distribution.

Preliminary: mathematical notions and notations Conditional probability. Given an event 𝐴 ∈ Σ and a random variable 𝑋 ∈ ℳ(Ω, ℝ 𝑑 ), the conditional probability ℙ(𝐴 | 𝑋 = 𝑥) is the only element of 𝐿 1 (ℝ 𝑑 , ℛ 𝑑 , ℙ𝑋 -1 ) that satisfies:

∀𝐵 ∈ ℛ 𝑑 , ℙ(𝐴 ∩ [𝑋 ∈ 𝐵]) = ∫ 𝐵 ℙ(𝐴 | 𝑋 = 𝑥)ℙ𝑋 -1 (𝑑𝑥) (11)
Pushforward measure (or image measure). Given two measurable sets (𝑋, 𝒳) and (𝑌 , 𝒴), a measure 𝜇 defined on (𝑋, 𝒳) and a measurable function 𝑓 ∶ (𝑋, 𝒳) → (𝑌 , 𝒴), the pushforward measure (or image measure) 𝜇𝑓 -1 is the measure on (𝑌 , 𝒴) defined by:

𝜇𝑓 -1 ∶ 𝒴 ⟶ [0, +∞) 𝐵 ⟼ 𝜇𝑓 -1 (𝐵) = 𝜇(𝑓 -1 (𝐵)) (12)
We also recall that 𝑓 is a measurable function from (𝑋, 𝒳) to (𝑌 , 𝒴) if: In this first chapter, we introduce the RDT (Random Distortion Testing) theory on which the rest of this thesis is based. In short, the RDT approach considers the problem of testing whether a signal observed in presence of noise lies within a given ball or not. As such, this problem can be seen more as a topological testing problem, rather than a usual hypothesis testing problem. To explain this difference in more details, we will start by going through some basics of non-Bayesian hypothesis testing. We have chosen to restrict our study to non-Bayesian approaches, as these approaches do not require as much prior knowledge on the problem as Bayesian approaches do. For example, if we consider a problem that would consist in testing whether there is an attack or not on a system, a Bayesian approach would need to know the a priori probability that the system is under attack, which is pretty much impossible to reasonably quantify. Following this, we will then present the main elements of the RDT theory, as they were first introduced in [START_REF] Pastor | Random Distortion Testing and Optimality of Thresholding Tests[END_REF]. We will explain why we think this is an interesting approach that can be used to build robust methods, as an approach that requires few parameters to set and few assumptions on the signal of interest. Since robustness is an important aspect to consider in the cybersecurity field, we will also take a look at Huber's approach to robust hypothesis testing [START_REF] Bernard | Principles of Signal Detection and Parameter Estimation[END_REF] and compare that to the RDT approach.

∀𝐵 ∈ 𝒴, 𝑓 -1 (𝐵) ∈ 𝒳 (13

Traditional hypothesis testing approaches 1.Non-Bayesian binary classification

An hypothesis testing problem can be formulated as follows: given an observation 𝑦 (scalar or vector) which is a realization of some random variable 𝑌, we want to get some information on the probability distribution 𝑃 of 𝑌. The information we get is whether this probability distribution belongs to some set of probability distributions. Here we only consider binary classification. We can formalize a non-bayesian decision problem as follows (𝒫: set of all probability distributions):

Chapter 1 -Hypothesis Testing and Random Distortion Testing Non-bayesian decision problem

⎧ { { { { { { { { { { { ⎨ { { { { { { { { { { { ⎩ Data model: ∃ℱ ⊂ 𝒫, ∃𝑃 ∈ ℱ, ∃𝑌 ∈ ℳ(Ω, ℝ 𝑑 ), ⎧ { ⎨ { ⎩ (𝑌 ∼ 𝑃) ∧ (∀𝑦 ∈ ℝ 𝑑 , ∃𝜔 ∈ Ω, 𝑦 = 𝑌 (𝜔))
Testing problem:

Given one realization 𝑦 = 𝑌 (𝜔), determine whether:

⎧ { ⎨ { ⎩ ℋ 0 ∶ 𝑃 ∈ ℱ 0 or ℋ 1 ∶ 𝑃 ∈ ℱ 1 with ℱ 0 ∪ ℱ 1 = ℱ and ℱ 0 ∩ ℱ 1 = ∅ (1.1)
ℱ, ℱ 0 and ℱ 1 are known sets of probability distributions, while 𝑃 ∈ ℱ is an unknown probability distribution. ℋ 0 is called the null hypothesis and ℋ 1 the alternative hypothesis. If either of the sets ℱ 0 or ℱ 1 contains only a single probability distribution, the associated hypothesis is said to be a simple hypothesis. Otherwise it is said to be a composite hypothesis.

Instead of working directly with distributions, it is common to work with a parameter 𝜃 (either scalar or vector) associated to each possible distribution and define the problem using that parameter. For example, we could consider a problem where we consider all 1-dimensional Gaussian distributions with variance 1 and mean 𝜃 ∈ ℝ, and we want to test whether 𝜃 ≤ 0 or 𝜃 > 0.

Given such a problem, the issue is to figure out how to decide whether 𝑃 ∈ ℱ 0 or 𝑃 ∈ ℱ 1 . This is done using a test function, which associates to any possible observation 𝑦 ∈ ℝ 𝑑 a decision. Definition 1.1.1: Test and critical region A test is any function defined on ℝ 𝑑 that can take the values 0 or 1:

𝒯 ∶ ℝ 𝑑 ⟶ {0, 1} 𝑦 ⟼ ⎧ { ⎨ { ⎩ 0 if ℋ 0 is accepted 1 if ℋ 0 is rejected (1.2)
For any test 𝒯, the set 𝐾 𝒯 = 𝒯 -1 ({1}) is called the critical region of 𝒯.

Here we are actually considering a slightly simplified definition of tests, which does not apply to randomized tests. While randomized tests are important from a theoretical viewpoint -notably for the Neyman-Pearson lemma that will be presented in the following -, we will not introduce them here to simplify this brief presentation of non-bayesian hypothesis testing.

It is common to consider the null hypothesis ℋ 0 as a nominal situation, whereas the alternative hypothesis ℋ 1 tends to be a rare case that we want to detect. With this interpretation, we should keep in mind that the problem is asymmetrical: the order of the hypotheses is important and swapping them around can change the meaning of the problem, as well as the resulting tests depending on the criterion used to choose them.

For any given problem, there are four possible outcomes:

1. Accept ℋ 0 and ℋ 0 is true (true negative) These metrics help characterize the behavior of any given test. The power function simply defines for a given test the probability to reject the null hypothesis ℋ 0 ., for each probability distribution of interest. The size of a test can be interpreted as its maximum false-alarm rate, i.e. the maximal probability to wrongly reject the null hypothesis ℋ 0 . Ideally, we would want a test that can perfectly reject ℋ 0 with no false alarm whatsoever. Of course, finding such a test is not possible in the vast majority of cases. Instead, we have to balance the false-alarm and detection rates in order to find an appropriate equilibrium. This is usually done by defining an optimality criterion, and then finding an optimal test with regards to this criterion.

Optimality

A widely used criterion to find an optimal test for a given testing problem is the UMP (Uniformly Most Powerful) criterion.

∀𝑃 ∈ ℱ 1 , 𝛽 𝒯 * (𝑃) ≥ 𝛽 𝒯 (𝑃)
UMP tests are desirable for two reasons:

1. First, it has a given level 𝛾, which means it ensures that its false alarm-rate is controlled and will not exceed this value. This is important in contexts where false-alarms can be costly to deal with.

To get back to the cybersecurity context we presented in the introduction, false alarms will usually require manual investigation to diagnose the source of the alarm and verify whether it is real or not. This manual intervention can be costly, in terms of both money and time, and having the ability to control the maximum false-alarm rate also means keeping these costs under control.

2. Second, it maximizes the detection rate for every possible distribution under ℋ 1 , meaning that no other test with level 𝛾 can offer a higher detection rate for any distribution under ℋ 1 .

In this sense, UMP tests are the best tests when one is willing to accept a false-alarm rate up to 𝛾. However, while UMP tests are desirable, they are rare in practice. In fact, for most problems, no such test exists, and we therefore have to rely on suboptimal tests. Note that a suboptimal test does not mean that it is bad, but depending on the circumstances, it may not perform as well as another one.

Nonetheless, there are two important cases where a UMP test exists. These cases are covered by the Neyman-Pearson lemma [START_REF] Neyman | On the Problem of the Most Efficient Tests of Statistical Hypotheses[END_REF] and the Karlin-Rubin theorem [START_REF] Karlin | The Theory of Decision Procedures for Distributions with Monotone Likelihood Ratio[END_REF]. We will start by presenting the Neyman-Pearson lemma, which gives a most powerful test for any binary hypothesis testing problem composed of two simple hypotheses. As a reminder, we do not consider randomized tests in this presentation, hence the expression of the test given here will be slightly simplified. Theorem 1.1.4: Neyman-Pearson Lemma Let 𝑃 0 and 𝑃 1 be two probability distributions with respective probability density functions 𝑓 0 and 𝑓 1 . Let 𝑌 ∈ ℳ(Ω, ℝ 𝑑 ) be a random variable with unknown probability distribution 𝑃 ∈ {𝑃 0 , 𝑃 1 }. Let 𝛾 ∈ (0, 1). Consider the following hypothesis problem:

⎧ { ⎨ { ⎩ ℋ 0 ∶ 𝑃 = 𝑃 0 ℋ 1 ∶ 𝑃 = 𝑃 1 (1.3)
Let 𝒯 NP be the test defined by:

𝒯 NP ∶ ℝ 𝑑 ⟶ {0, 1} 𝑦 ⟼ ⎧ { ⎨ { ⎩ 1 if 𝑓 1 (𝑦) > 𝜆 NP 𝑓 0 (𝑦) 0 otherwise (1.4)
where

𝜆 NP ≥ 0 is a threshold chosen such that ℙ[𝒯 NP (𝑌 ) = 1] = 𝛾 when 𝑌 ∼ 𝑃 0 . The test 𝒯 NP is most powerful with level 𝛾 for testing ℋ 0 ∶ 𝑃 = 𝑃 0 against ℋ 1 ∶ 𝑃 = 𝑃 1 .
As a short note, in the statement of the Neyman-Pearson lemma, we mentioned that the test 𝒯 NP is "most powerful" instead of UMP. This is completely equivalent, as the term "uniformly" signify that the test is most powerful for every possible distribution under ℋ 1 . Since both hypotheses are simple, the term "uniformly" is commonly dropped as it does not add anything in this particular case.

For composite hypotheses, the Karlin-Rubin theorem presents one particular case where it is possible to find a UMP test. Before stating this theorem, we first need to define the notion of Monotone likelihood ratio, which plays a key role. Definition 1.1.5: Monotone Likelihood Ratio Let ℱ = {𝑃 𝜃 , 𝜃 ∈ Θ} be a family of probability distributions defined on ℝ, indexed by 𝑖 ∈ Θ ⊂ ℝ, each distribution 𝑃 𝜃 having probability density function 𝑓 𝜃 . Let 𝑇 ∶ ℝ → ℝ be a function. The family ℱ is said to have a monotone likelihood ratio in 𝑇 if for any pair (𝜃, 𝜃 ′ ) ∈ Θ 2 such that 𝜃 < 𝜃 ′ , the function 𝑓 𝜃 ′ /𝑓 𝜃 is a strictly increasing function of 𝑇:

∀(𝜃, 𝜃 ′ ) ∈ Θ 2 , 𝜃 < 𝜃 ′ ⇒ (∃𝑔 ∶ ℝ → ℝ, (𝑔 is increasing) ∧ (𝑓 𝜃 ′ /𝑓 𝜃 = 𝑔 ∘ 𝑇 )) (1.5)
which we can rewrite as:

∀(𝜃, 𝜃 ′ ) ∈ Θ 2 , ∀(𝑥, 𝑥 ′ ) ∈ ℝ 2 , (𝜃 < 𝜃 ′ ∧ 𝑇 (𝑥) < 𝑇 (𝑥 ′ )) ⇒ 𝑓 𝜃 ′ (𝑥) 𝑓 𝜃 (𝑥) ≤ 𝑓 𝜃 ′ (𝑥 ′ ) 𝑓 𝜃 (𝑥 ′ ) (1.6)
An interpretation of this property is that as 𝑇 (𝑥) increases, higher values of the parameter 𝜃 ∈ Θ become increasingly likely in terms of the likelihood ratio.

The monotone likelihood ratio property can also be found under the name total positivity of order 2 (TP-2) when applied to functions of two parameters, which are not necessarily probability density functions [24]. For a strictly positive function 𝑘 ∶ ℝ × ℝ → ℝ of two parameters, 𝑘 is TP-2 if it verifies:

∀(𝑥 1 , 𝑥 2 , 𝑦 1 , 𝑦 2 ) ∈ ℝ 4 , (𝑥 1 < 𝑥 2 ∧ 𝑦 1 < 𝑦 2 ) ⇒ 𝑘(𝑥 1 , 𝑦 1 )𝑘(𝑥 2 .𝑦 2 ) ≥ 𝑘(𝑥 1 , 𝑦 2 )𝑘(𝑥 2 , 𝑦 1 ) (1.7)
We can see that this is a particular case of Eq. (1.6) with the two parameters being 𝜃 and 𝑥, and using the identity function for 𝑇.

Here are a few examples of families of distribution with monotone likelihood ratio, parametrized by 𝜃:

• The family of 1-dimensional Gaussian distributions 𝒩(𝜃, 𝜎 2 ) with known variance 𝜎 2 , for 𝜃 ∈ ℝ.

• The family of 1-dimensional Gaussian distributions 𝒩(𝜇 0 , 𝜃 2 ) with known mean 𝜇 0 , for 𝜃 > 0.

• The family of non-central Chi-squared distributions 𝜒 2 𝑑,𝜃 with 𝑑 degrees of freedom and noncentrality parameter 𝜃 ≥ 0

• The one-parameter exponential families of distributions [START_REF] Lehmann | Testing Statistical Hypotheses[END_REF]Corollary 3.4.1], which are families of distribution having a density 𝑝 𝜃 of the form:

𝑝 𝜃 (𝑥) = 𝐶(𝜃)𝑒 𝑄(𝜃)𝑇 (𝑥) ℎ(𝑥) (1.8)
where 𝑄 is a non-decreasing function. These families of distributions have a monotone likelihood ratio in 𝑇.

With this definition, we can now state the Karlin-Rubin theorem, which presents another case where we can find a UMP test, this time for composite hypotheses. Theorem 1.1.6: Karlin-Rubin Theorem Let ℱ = {𝑃 𝜃 , 𝜃 ∈ Θ} be a family of probability distributions defined on ℝ, indexed by 𝜃 ∈ Θ ⊂ ℝ. Assume that the family ℱ has monotone likelihood ratio in a function 𝑇 ∶ ℝ → ℝ. Let 𝑌 ∈ ℳ(Ω, ℝ) be a random variable with unknown probability distribution 𝑃 𝜃 ∈ ℱ. Let 𝜃 0 ∈ Θ and 𝛾 ∈ (0, 1). Consider the following hypothesis testing problem:

⎧ { ⎨ { ⎩ ℋ 0 ∶ 𝜃 ≤ 𝜃 0 ℋ 1 ∶ 𝜃 > 𝜃 0 (1.9)
Let 𝒯 KR be the test defined by:

𝒯 KR ∶ ℝ ⟶ {0, 1} 𝑦 ⟼ ⎧ { ⎨ { ⎩ 1 if 𝑇 (𝑦) > 𝜆 KR 0 otherwise (1.10)
where 𝜆 KR ∈ ℝ is a threshold chosen such that ℙ[𝒯 KR (𝑌 ) = 1] = 𝛾 when 𝑌 ∼ 𝑃 𝜃 0 .

1. The test 𝒯 KR is UMP with level 𝛾 for testing ℋ 0 ∶ 𝜃 ≤ 𝜃 0 against ℋ 1 ∶ 𝜃 > 𝜃 0 .

2. Its power function 𝛽 𝒯 KR is strictly increasing for any 𝜃 ∈ Θ such that 𝛽 𝒯 KR (𝜃) ∉ {0, 1}.

In most other cases however, it is impossible to find a UMP test. One way to find tests is to restrict the search to a subset of all sets. Taking invariance properties of the problem into account is one way to do so, resulting in a UMPI (Uniformly Most Powerful Invariant) test. Invariance will be discussed in more details in the next chapter.

If invariance is not sufficient to find an optimal test, then we may have to rely on suboptimal tests. In that case, the choice of test is highly dependent on the problem at hand and the desired properties of the test. It is important to remember that a suboptimal test is not necessarily a poorly performing test. The two notions are actually disconnected from one another. Indeed, a test being suboptimal only means that it is not optimal for a given criterion. For the UMP optimality criterion, a suboptimal test can still have level 𝛾 and offer adequate performance. We just have to keep in mind that in some circumstances, other tests may perform better with the same level.

A common problem that does not not necessarily have a UMP test consists in testing ℋ 0 ∶ 𝜃 = 𝜃 0 against ℋ 1 ∶ 𝜃 ≠ 𝜃 0 for a given 𝜃 0 . Whether a UMP test exists or not depends on the probability distributions associated to each value of 𝜃. In a large number of cases, no such test exists. However, there exists a family of three commonly used test for this particular problem, commonly referred to as the "holy trinity". These three tests are the Wald test [START_REF] Wald | Tests of Statistical Hypotheses Concerning Several Parameters When the Number of Observations Is Large[END_REF], the Rao test [START_REF] Rao | Large Sample Tests of Statistical Hypotheses Concerning Several Parameters with Applications to Problems of Estimation[END_REF] and the GLRT (Generalized Likelihood Ratio Test). In short, these three tests rely in some way on the maximum-likelihood estimation of the parameter 𝜃. The Wald and Rao tests rely on asymptotic properties of these estimators, related to the Fisher information matrix. They slightly differ from one another in that the Wald test requires computing the maximum-likelihood estimate θ of 𝜃 under ℋ 1 , whereas this is not necessary for the Rao test. The GLRT reuses the principle of the likelihood ratio test used in the Neyman-Pearson lemma, and simply replaces the densities used to compute the likelihood ratio by the densities that maximize the likelihood under each hypothesis. An interesting property of these three tests is that they are asymptotically equivalent, meaning that as the number of available observations increases and approaches infinity, the three tests will take the same decision with probability 1 [START_REF] Robert | Chapter 13 Wald, Likelihood Ratio, and Lagrange Multiplier Tests in Econometrics[END_REF].

The RDT approach 1.2.1 Problem statement

After presenting some general notions regarding typical binary hypothesis testing problems, we will now introduce the RDT approach. This approach differs in its objective. As we have seen previously, most hypothesis testing problems consist in testing whether the distribution that generated an observation belongs to one set or the other. In the RDT approach, we do not want to determine whether the distribution that generated the observation belong to one set or the other, but whether the phenomenon of interest lies close enough to some model.

In order to present the RDT problem, we first need to introduce the Mahalanobis norm, which is an integral part of this problem.

Definition 1.2.1: Mahalanobis norm

Let 𝐶 be a 𝑑 × 𝑑 definite positive symmetric matrix. The Mahalanobis norm with matrix 𝐶 is defined by:

∀𝑦 ∈ ℝ 𝑑 , 𝜈 𝐶 (𝑦) = √ 𝑦 𝑇 𝐶 -1 𝑦 (1.11)
We now introduce the RDT problem [START_REF] Pastor | Random Distortion Testing and Optimality of Thresholding Tests[END_REF]:

Definition 1.2.2: RDT problem statement ⎧ { { { { { { { { { { { { { { ⎨ { { { { { { { { { { { { { { ⎩ Data model: ∃𝑌 ∈ ℳ(Ω, ℝ 𝑑 ), ∃Θ ∈ ℳ(Ω, ℝ 𝑑 ), ∃𝑋 ∈ ℳ(Ω, ℝ 𝑑 ), ⎧ { { { ⎨ { { { ⎩ (𝑋 ∼ 𝒩(0, 𝐶) with 𝐶 a 𝑑 × 𝑑 definite positive matrix) ∧ (Θ and 𝑋 are independent) ∧ (𝑌 = Θ + 𝑋) ∧ (∀𝑦 ∈ ℝ 𝑑 , ∃𝜔 ∈ Ω, 𝑦 = 𝑌 (𝜔))
Testing problem:

Given one realization 𝑦 = 𝑌 (𝜔) = Θ(𝜔) + 𝑋(𝜔), determine whether:

⎧ { ⎨ { ⎩ ℋ 0 ∶ 𝜈 𝐶 (Θ(𝜔) -𝜃 0 ) ≤ 𝜏 or ℋ 1 ∶ 𝜈 𝐶 (Θ(𝜔) -𝜃 0 ) > 𝜏 with 𝜏 > 0 and 𝜃 0 ∈ ℝ 𝑑 (1.12)
Let us compare this problem to the general decision problem stated in Eq. (1.1). The data model is an application of what we presented before, with the set of distributions of interest being the set of distributed obtained when convolving any probability distribution with a Gaussian distribution. If we define ℱ = {𝜇 * 𝑓 𝑋 , 𝜇 ∈ 𝒫}, we can rephrase the data model like this:

∃𝑃 ∈ ℱ, ∃𝑌 ∈ ℳ(Ω, ℝ 𝑑 ), ⎧ { ⎨ { ⎩ (𝑌 ∼ 𝑃) ∧ (∀𝑦 ∈ ℝ 𝑑 , ∃𝜔 ∈ Ω, 𝑦 = 𝑌 (𝜔)) (1.13)
The difference between these problems appears in the testing problem: we do not want to know whether the distribution that generated the observation belongs to one set or another. In fact, we do not even define these subsets of ℱ. Instead, what we want to determine is whether the realization of the signal lies close enough to some model 𝜃 0 or not. An important consequence of this is that for the same distribution, either hypothesis may be true depending on 𝜔, whereas with traditional hypothesis testing problems, each distribution is associated to exactly one hypothesis.

The noise structure plays an important role in the definition of the RDT problem: it is taken into account through the Mahalanobis norm using the noise covariance matrix 𝐶. We give more details about this in the next chapter regarding invariance.

Many approaches to conventional testing problems rely on likelihood, whether it is through the likelihood ratio for the Neyman-Pearson lemma, the Karlin-Rubin theorem or the Generalized Likelihood Ratio test for example, or through the properties of the likelihood function as in the Wald and Rao tests for example. Using the likelihood function requires having a family of probability distributions that can be parameterized by some scalar or vector parameter 𝜃, which has always been the case so far in the shown examples prior to this section. For the RDT problem however, the family of distributions that we consider is very large and cannot be parametrized appropriately. Consequently, the likelihood is not an relevant approach to solve the RDT problem.

Optimality: 𝛾-MCCP tests

After introducing the RDT problem and how it differs from usual hypothesis testing problems, we now present the main theoretical results in order to introduce an optimal test. Finding an optimal test requires of first defining an optimality criterion, which in this case is the 𝛾-MCCP (Maximum Constant Conditional Power) criterion, defined in Definition 1.2.7. This optimality criterion relies on notions of size and power which are similar to the ones defined previously, but adapted to the problem at hand.

In the following, we will rely on the notion of orbits, which are closely linked to the invariance properties of the RDT problem. We will give a simple definition of these orbits here, a more thorough study will be conducted in Chapter 2. Definition 1.2.3: Orbits Υ 𝜌 and set of orbits 𝔉 For every 𝜌 ≥ 0, we define the orbit Υ 𝜌 as the set

Υ 𝜌 = {𝑦 ∈ ℝ 𝑑 ∶ 𝜈 𝐶 (𝑦 -𝜃 0 ) = 𝜌}.
We denote by 𝔉 the set of all orbits Υ 𝜌 : 𝔉 = {Υ 𝜌 , 𝜌 ≥ 0}.

We can now define the relevant notions of size and power for the RDT problem, which we refer to as conditional size and conditional power.

Definition 1.2.4: Conditional size and power

Let 𝒯 ∶ ℝ 𝑑 → {0, 1} be a test, Θ ∈ ℳ(Ω, ℝ 𝑑 ) a random variable and 𝜌 > 0. We define the conditional power and conditional size of 𝒯 as:

Conditional power: ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ]
Conditional size: sup

Θ∈ℳ(Ω,ℝ 𝑑 ) ∶ ℙ[𝜈 𝐶 (Θ-𝜃 0 )≤𝜏]≠0 ℙ[𝒯(Θ + 𝑋) = 1 | 𝜈 𝐶 (Θ -𝜃 0 ) ≤ 𝜏] (1.14)
Similarly to the definitions of size and power given in Definition 1.1.2, the conditional size and power are probabilities of rejecting the null hypothesis based on the received observation. Notably, the conditional size still represents the maximum false-alarm rate of a given test for the RDT problem. The main difference with the usual definition of size and power function is the use of conditional probabilities. Remember that, in the RDT problem, choosing a certain probability distribution for Θ does not preclude either hypothesis from being true. Conditional probabilities are therefore used to distinguish between the two hypotheses. Since we are using conditional probabilities to study the behavior of tests, it means we are looking at local properties of these tests on each orbit Υ 𝜌 , whereas the power function used in regular testing problems only considers the global behavior of the test for each distribution of interest. Nonetheless, we still define a power function 𝛽 𝒯 and a size 𝛼 𝒯 for each test 𝒯 in the sense of Definition 1.1.2, as it will prove to be useful and convenient later:

Power function: ∀𝜃 ∈ ℝ 𝑑 , 𝛽 𝒯 (𝜃) = ℙ[𝒯(𝜃 + 𝑋) = 1]
Size:

𝛼 𝒯 = sup 𝜃∈ℝ 𝑑 ∶ 𝜈 𝐶 (𝜃-𝜃 0 )≤𝜏 𝛽 𝒯 (𝜃) (1.15)
These notions of size and power are natural if we consider the problem of testing 𝜈 𝐶 (𝜃 -𝜃 0 ) ≤ 𝜏 against 𝜈 𝐶 (𝜃 -𝜃 0 ) > 𝜏, where 𝜃 ∈ ℝ 𝑑 is a deterministic value. The next result shows that this notion of size is relevant to control the conditional size in the RDT problem, and therefore the false-alarm rate.

Lemma 1.2.5: Size and conditional size

For any test 𝒯 ∶ ℝ 𝑑 → {0, 1}, we have:

sup Θ∈ℳ(Ω,ℝ 𝑑 ) ∶ ℙ[𝜈 𝐶 (Θ-𝜃 0 )≤𝜏]≠0 ℙ[𝒯(Θ + 𝑋) = 1 | 𝜈 𝐶 (Θ -𝜃 0 ) ≤ 𝜏] = 𝛼 𝒯
Just as previously, we will then say that a test has level 𝛾 for any 𝛾 ∈ (0, 1) if 𝛼 𝒯 ≤ 𝛾. Similarly, we can also link the notions of power and conditional power. This is done through the notion of constant conditional power function, which will then be used to define our optimality criterion. Definition 1.2.6: Constant conditional power function given Θ ∈ Υ 𝜌 Let Θ ∈ ℳ(Ω, ℝ 𝑑 ) be a random variable independent of 𝑋 ∼ 𝒩(0, 𝐶) and 𝜌 ≥ 0. A test 𝒯 is said to have constant conditional power function given Θ ∈ Υ 𝜌 if:

∀𝜃 ∈ Υ 𝜌 , ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] = 𝛽 𝒯 (𝜃)
With this definition, we can now present the 𝛾-MCCP optimality criterion: Definition 1.2.7: 𝛾-MCCP (Maximum Constant Conditional Power) test Let 𝒯 * ∶ ℝ 𝑑 → {0, 1} be a test, and let 𝛾 ∈ (0, 1). The test 𝒯 * is said to have level 𝛾 and Maximum Constant Conditional Power over 𝔉 -and we simply say that 𝒯 * is 𝛾-MCCP -if:

(i) 𝒯 * has level 𝛾.

(ii) For any random variable Θ ∈ ℳ(Ω, ℝ 𝑑 ) and for ℙ(𝜈 𝐶 (Θ -𝜃 0 )) -1 -almost every 𝜌 > 𝜏, 𝒯 * has constant conditional power function given Θ ∈ Υ 𝜌 .

(iii) For any random variable Θ ∈ ℳ(Ω, ℝ 𝑑 ), for ℙ(𝜈 𝐶 (Θ -𝜃 0 )) -1 -almost every 𝜌 > 𝜏 and for any test 𝒯 with level 𝛾 and constant conditional power function given Θ ∈ Υ 𝜌 , we have:

ℙ[𝒯 * (Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] ≥ ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] (1.16)
At first glance, this criterion might seem very daunting, but in fact, it is actually similar to the UMPI criterion. Indeed, a UMPI test has to fulfill three criterions: it needs to have level 𝛾, be invariant, and be more powerful than any other invariant test with level 𝛾. These three criterions match the three points described in Definition 1.2.7:

1. The first point regarding the level is straightforward.

2. The second point can be interpreted as a notion of invariance of the power function of the test, instead of the test itself.

3. The third point describes the "most powerful" aspect of the test. Here, we consider the class of tests that have constant conditional power function given Θ ∈ Υ 𝜌 , for at least one random vector Θ ∈ ℳ(Ω, ℝ 𝑑 ) and at least one 𝜌 > 𝜏. For each test 𝒯 that satisfies these conditions, a 𝛾-MCCP test has greater conditional power on the orbits Υ 𝜌 on which 𝒯 has constant conditional power function.

Thresholding tests and optimality

Now that we have introduced the relevant optimality criterion, we will introduce an optimal test in that sense. The tests we consider here are thresholding tests on the Mahalanobis norm 𝜈 𝐶 .

Definition 1.2.8: Thresholding tests

For any 𝑡 ≥ 0, we define the thresholding test 𝒯 𝑡 by:

𝒯 𝑡 ∶ ℝ 𝑑 ⟶ {0, 1} 𝑦 ⟼ ⎧ { ⎨ { ⎩ 1 if 𝜈 𝐶 (𝑦 -𝜃 0 ) > 𝑡 0 otherwise (1.17)
The reason we are choosing to look at these tests in particular is because of the structure of the RDT problem. Indeed, this problem is invariant through the use of the Mahalanobis norm. We will go more in depth regarding the subject of invariance in the next chapter, but as a brief example, consider the case where we have white Gaussian noise, i.e. 𝐶 = 𝜎𝐼 𝑑 with 𝜎 > 0. In this case, the distribution of the noise is spherically invariant, and the Mahalanobis norm -which is then simply the euclidean norm, up to a multiplicative factor -is also invariant by rotation. Since the RDT problem consists in detecting whether the Mahalanobis distance between Θ(𝜔) and the model 𝜃 0 exceeds a certain threshold, it is not unreasonable to consider tests where we put a threshold on the Mahalanobis distance between the observation 𝑦 and 𝜃 0 .

Of course, we need to choose the threshold 𝑡 appropriately, and then verify whether the resulting test 𝒯 𝑡 is indeed 𝛾-MCCP. The choice of that threshold is directed by the desired level 𝛾 and the distribution of the noise 𝑋, and more accurately by the distribution of 𝜈 𝐶 (𝑋). To find the optimal threshold that can offer a level 𝛾, we will use the generalized Marcum function [START_REF] Sun | On the Monotonicity, Log-Concavity, and Tight Bounds of the Generalized Marcum and Nuttall Q-Functions[END_REF], which is defined by:

𝑄 𝑑/2 ∶ [0, ∞) × [0, ∞) ⟶ ℝ (𝜌, 𝜂) ⟼ 1 -𝔽 𝜒 2 𝑑 (𝜌 2 ) (𝜂 2 ) (1.18)
where 𝔽 𝜒 2 𝑑 (𝜌 2 ) is the cumulative distribution function of the non-central 𝜒 2 distribution with 𝑑 degrees of freedom and non-centrality parameter 𝜌 2 . An important consequence of the definition of this function is that for any 𝜃 ∈ ℝ 𝑑 , and for any random variable 𝑋 ∈ ℳ(Ω, ℝ 𝑑 ) that follows the Gaussian distribution 𝒩(𝜃, 𝐼 𝑑 ), we have:

∀𝜆 ≥ 0, ℙ[‖𝑋‖ 2 ≥ 𝜆] = 𝑄 𝑑/2 (‖𝜃‖ 2 , 𝜆) (1.19)
The following lemma defines the threshold 𝜆 𝛾 (𝜏) using this function 𝑄 𝑑/2 . This is the threshold of interest that will allow us to find a 𝛾-MCCP test for the RDT problem. This lemma also describes a few properties of this threshold with regards to the parameters 𝛾 and 𝜏. Lemma 1.2.9: Threshold 𝜆 𝛾 (𝜏)

• For any 𝛾 ∈ (0, 1), there exists a single positive real 𝜆 𝛾 (𝜏) ≥ 0 that verifies the equation 𝑄(𝜏, 𝜆 𝛾 (𝜏)) = 1 -𝛾.

• For any 𝛾 ∈ (0, 1), the function

𝜆 𝛾 ∶ 𝜏 ∈ [0, ∞) ↦ 𝜆 𝛾 (𝜏) ∈ [0, ∞
) is continuous everywhere and strictly increasing, and we have lim

𝜏→+∞ 𝜆 𝛾 (𝜏) = +∞ • For any 𝜏 ∈ [0, ∞), the function 𝛾 ∈ (0, 1) ↦ 𝜆 𝛾 (𝜏) ∈ [0, ∞
) is continuous everywhere and strictly decreasing, and we have lim

𝛾→1 𝜆 𝛾 (𝜏) = 0 and lim 𝛾→0 𝜆 𝛾 (𝜏) = +∞
To give an idea of how the parameters 𝛾 and 𝜏 affect the threshold 𝜆 𝛾 (𝜏), Figure 1.1 shows 𝜆 𝛾 (𝜏) as a function of 𝛾 and 𝜏, using 𝑑 = 2 as an example. The thresholding test 𝒯 𝜆 𝛾 (𝜏) has size 𝛾 and is 𝛾-MCCP.

Robustness and hypothesis testing

When applying hypothesis testing methods to a real problem, we need an accurate model of reality. In the case of traditional testing methods that we presented in Section 1.1, this means having perfect knowledge of all the potential probability distributions that our observation may follow. In practice however, assuming that we can have such knowledge of all involved distributions is questionable. Indeed, "mathematical models are often significant simplifications/idealizations of complex physical problems" [START_REF] Kailath | Detection of Stochastic Processes[END_REF], and mismatches between these models and reality may have adverse effects on the performance of the test used if they are not accounted for. Therefore, it is important to consider approaches able to take these potential mismatches into account, so that we have robust methods that can guarantee a certain level of performance in real scenarios.

Huber [START_REF] Peter | Robust Statistics[END_REF][START_REF] Bernard | Principles of Signal Detection and Parameter Estimation[END_REF] presents such an approach, which consists in determining whether the probability distribution that generated a given observation is close enough or not to given models. We will first explain 1.3 -Robustness and hypothesis testing this approach, then we will consider the RDT problem and see how this approach is well-suited for robust hypothesis testing.

Huber's approach to robust hypothesis testing

Following Levy [START_REF] Bernard | Principles of Signal Detection and Parameter Estimation[END_REF], to explain Huber's approach to robust hypothesis testing, we will consider a testing problem as an example: consider that, given an observation 𝑦 of a random variable 𝑌 with unknown probability distribution 𝑃, we want to test ℋ 0 ∶ 𝑃 = 𝑃 0 against ℋ 1 ∶ 𝑃 = 𝑃 1 , where both 𝑃 0 and 𝑃 1 are known. This a typical problem where both hypotheses are simple. In such a problem, we would derive the Neyman-Pearson test 𝒯 NP based on the likelihood ratio of 𝑃 0 and 𝑃 1 , and this test is known to be optimal with a given level 𝛾 in this case. Now imagine that both probability distributions 𝑃 0 and 𝑃 1 are approximations of the real probability distributions that may be encountered in practice, obtained, for example, after observation of a sufficiently large number of samples from each real distribution. This means that 𝑃 0 and 𝑃 1 are not the actual possible probability distributions of 𝑌, but only approximations of the real distributions. Therefore, the Neyman-Pearson test of level 𝛾 computed using 𝑃 0 and 𝑃 1 is not actually optimal in this scenario, and it also may not actually have level 𝛾 in practice.

However, if the distributions 𝑃 0 and 𝑃 1 are decent approximations of the real distributions, we can hope that the actual distributions we will encounter are close enough to these. If this is indeed the case, and we want to find a test with level 𝛾, one solution consists in testing

ℋ 0 ∶ 𝑃 ≈ 𝑃 0 against ℋ 1 ∶ 𝑃 ≈ 𝑃 1 .
Of course, we have to define the meaning of 𝑃 ≈ 𝑃 0 and 𝑃 ≈ 𝑃 1 : what does it mean for a probability distribution to be "close enough" to another one? Defining this notion of closeness means defining a neighborhood of each distribution 𝑃 0 and 𝑃 1 , i.e. two sets ℱ 0 and ℱ 1 , that contain 𝑃 0 and 𝑃 1 respectively. These two sets represent all of the possible real probability distributions that we may encounter in practice, that are close enough to 𝑃 0 and 𝑃 1 .

How do we choose these neighborhoods? Or in other words, how do we define that two distributions are close enough? There are several answers to this question, of which we give a couple examples. In the following, we consider that we want to define a neighborhood ℱ for some probability distribution 𝑃 0 that admits a probability density function 𝑓 0 . To define ℱ, we can consider for example the following approaches:

Contamination model. Let 𝜀 ∈ (0, 1). A contamination model consists in assuming that the observation is drawn either with probability 1 -𝜀 from 𝑃 0 , or with probability 𝜀 from some other unknown probability distribution. The set ℱ is here defined by:

ℱ = {(1 -𝜀)𝑃 0 + 𝜀𝑃, 𝑃 ∈ 𝒫} (1.20)
Distance-based approaches. Several distances can be defined between probability distributions. For two probability distributions 𝑃 1 and 𝑃 2 , we can for example use the following distances:

• The Kolmogorov distance is defined as the maximum distance between the cumulative distribution functions 𝐹 1 and 𝐹 2 of 𝑃 1 and 𝑃 2 respectively:

𝑑 𝐾 (𝑃 1 , 𝑃 2 ) = sup 𝑦∈ℝ 𝑑 |𝐹 1 (𝑦) -𝐹 2 (𝑦)| (1.21)
• The Total variation distance, defined by

𝑑 TV (𝑃 1 , 𝑃 2 ) = ∫ | 𝑓 1 (𝑦) -𝑓 2 (𝑦)|d𝑦 (1.22)
where 𝑓 1 and 𝑓 2 are the respective probability density functions of 𝑃 1 and 𝑃 2 .

• The Kullback-Leibler divergence, which is not actually a distance, but is nonetheless used as a metric to measure mismatches between distributions. It is defined by:

𝐷(𝑃 2 | 𝑃 1 ) = ∫ ln( 𝑓 2 (𝑦) 𝑓 1 (𝑦) )𝑓 2 (𝑦)d𝑦 (1.23)
Using any of these distances 𝑑 (or pseudo-distances), we can then define a neighborhood ℱ of 𝑃 0 by:

ℱ = {𝑃 ∈ 𝒫 | 𝑑(𝑃, 𝑃 0 ) ≤ 𝜀} (1.24)
for some chosen real 𝜀. Now let us return to the problem of testing ℋ 0 ∶ 𝑃 ≈ 𝑃 0 against ℋ 1 ∶ 𝑃 ≈ 𝑃 1 . Using any of the previously presented methods we can define two neighborhoods ℱ 0 and ℱ 1 of 𝑃 0 and 𝑃 1 respectively, which we assume to be disjoint. Using these neighborhoods, our problem becomes testing ℋ 0 ∶ 𝑃 ∈ ℱ 0 against ℋ 1 ∶ 𝑃 ∈ ℱ 1 . We now need a criterion to choose a test for this problem.

Before doing so, we introduce the following notations:

• Probability of false alarm: for any test 𝒯 and any probability distribution 𝑃 ∈ ℱ 0 under ℋ 0 , we define ℙ FA by:

ℙ FA (𝒯, 𝑃) = ∫ 𝒯(𝑦)𝑃(d𝑦) (1.25)
• Probability of missed detection: for any test 𝒯 and any probability distribution 𝑃 ∈ ℱ 1 under ℋ 1 , we define ℙ MD by:

ℙ MD (𝒯, 𝑃) = ∫(1 -𝒯(𝑦))𝑃(d𝑦) (1.26)
Huber defines the robust Neyman-Pearson testing problem, which uses the following criterion to choose a test:

𝒯 RNP = arg min 𝒯∈𝐾 𝛾 max 𝑃∈ℱ 1 ℙ MD (𝒯, 𝑃) (1.27)
where 𝐾 𝛾 designates the set of all tests 𝒯 that have level 𝛾:

𝐾 𝛾 = {𝒯 | sup 𝑃∈ℱ 0 ℙ FA (𝒯, 𝑃) ≤ 𝛾} (1.28)
This test 𝒯 RNP is a test with level 𝛾, that minimizes the maximum missed-detection rate for all distributions of ℱ 1 . This test is not necessarily optimal in the UMP sense, as it does not seek to maximize the detection rate for every distribution of ℱ 1 .

From this criterion, how can we find this test 𝒯 RNP ? One known result [21, Sec 6.3.1, p.240] is that the test 𝒯 RNP is a likelihood ratio test using two distributions 𝑔 0 ∈ ℱ 0 and 𝑔 1 ∈ ℱ 1 :

∀𝑦 ∈ ℝ 𝑑 , 𝒯 RNP (𝑦) = ⎧ { ⎨ { ⎩ 1 if 𝑔 1 (𝑦) 𝑔 0 (𝑦) > 𝜆 1 otherwise (1.29)
where 𝜆 is chosen such that ℙ FA (𝒯 RNP , 𝑔 0 ) = 𝛾. In addition, both of these distributions can be considered as the least-favorable distributions, in the sense that we have the following inequalities:

∀𝑃 ∈ ℱ 0 , ℙ FA (𝒯 RNP , 𝑃) ≤ ℙ FA (𝒯 RNP , 𝑔 0 ) (1.30) ∀𝑃 ∈ ℱ 1 , ℙ MD (𝒯 RNP , 𝑃) ≤ ℙ MD (𝒯 RNP , 𝑔 1 ) (1.31)
Beyond these inequalities however, there is no real method available to identify the test 𝒯 RNP : "the most effective approach is often to guess the solution and then verify that it works" [21, p.241]. This means having to rely on a trial-and-error approach, where we pick two distributions 𝑔 0 ∈ ℱ 0 and 𝑔 1 ∈ ℱ 1 , compute the appropriate likelihood ratio test, and verify if Eqs. (1.30) and (1.31) are verified for a certain number of distributions of ℱ 0 and ℱ 1 . This approach is therefore quite impractical to use, as there is no general way to find the test that satisfies the robust Neyman-Pearson testing problem (Eq. (1.27)), and can also be highly affected by the choices made to defined the neighborhoods ℱ 0 and ℱ 1 . In addition, the definition of these neighborhoods is not very intuitive. Indeed, it is fairly difficult to represent these notions of closeness between probability distributions, which means that we cannot easily represent what kinds of differences we are taking into account between our nominal models (𝑃 0 and 𝑃 1 ) and reality when designing the robust test 𝒯 RNP .

RDT and robust hypothesis testing

We will now explain how the RDT approach is an appropriate choice for robust hypothesis testing. The robustness of the RDT approach comes from the problem statement, which incorporates the notion of model mismatch. As a reminder, the RDT problem consists in deciding whether a realization of some signal Θ is close enough to a model 𝜃 0 , using a noisy observation 𝑌 of Θ. In a sense, we can interpret this problem as wanting to know whether 𝜃 0 is a reasonable model of the signal Θ(𝜔) or not. This is done by determining whether we have 𝜈 𝐶 (Θ(𝜔) -𝜃 0 ) ≤ 𝜏 or 𝜈 𝐶 (Θ(𝜔) -𝜃 0 ) > 𝜏, which is more robust than wanting to test Θ(𝜔) = 𝜃 0 against Θ(𝜔) ≠ 𝜃 0 . Indeed, in many cases, it does not make much sense to test whether Θ(𝜔) = 𝜃 0 , as this is often impossible in practice, and not necessarily relevant. It may not make much sense to attempt to detect every deviation of Θ from 𝜃 0 , including very minor ones. The use of the tolerance 𝜏 therefore gives this approach a certain robustness to these minor changes, and also allows the user to define the amplitude of the deviations that should be detected.

In addition, the signal model used in the RDT problem makes very few assumptions on the observation 𝑌. The model used assumes that the observation 𝑌 consists of the signal Θ, whose distribution is completely unknown, in presence of some additive independent Gaussian noise 𝑋. Because of this, there is no possible model mismatch regarding the signal Θ, since it does not require any knowledge. As such, the only possible source of mismatches has to do with the noise, whose distribution needs to be known perfectly. However, we will see in Chapter 3 that the parameters of this Gaussian noise can be estimated, and that we still retain an asymptotic optimality by doing so.

Overall, these different aspects make the RDT approach a good candidate to build robust detection methods: the nature of the problem itself deals with robustness, and the few assumptions made on the signal model allow it to be used regardless of the distribution of the signal of interest. We mentioned several times so far that the RDT approach is closely related to the notion of invariance, regarding the properties of the Gaussian noise which is part of the problem statement. The article which introduced RDT [START_REF] Pastor | Random Distortion Testing and Optimality of Thresholding Tests[END_REF] already made this connection back in 2013, but did not make use of it. Indeed, it was not needed for any theoretical development, as we could instead work directly with the well-known properties of the Gaussian noise. In this chapter, we will revisit the work that was done back in 2013 using the invariance point of view. The goal here is to explicit the role of invariance in this approach, and attempt to generalize it to other forms of noise that also present invariance properties.

The notion of invariance has been studied for hypothesis testing, as a method to find an optimal test among a restricted class of tests. For example, we may be able to find a UMPI test when a UMP test does not exist. Invariance is notably presented by Lehmann in [START_REF] Lehmann | Testing Statistical Hypotheses[END_REF]. However, we were unsatisfied with the presentations of invariance that we found in the literature for hypothesis testing. Indeed, we found these presentations do not clarify how invariance in hypothesis testing is related to the original notion of invariance found in group theory [START_REF] Lang | [END_REF]. As such, we would like to start by formalizing the notion of invariance and its application to statistical decision theory. After that, we will discuss our attempts to generalize the RDT approach using invariance. These attempts resulted in interesting theoretical results, but unfortunately did not allow us to discover any other applicable noise distributions so far.

In this chapter, we will provide proofs for most of the results presented here, even ones that are commonly found in the literature, especially in the first section regarding invariance. We have made this choice in order to have a presentation of invariance and of the Generalized RDT as self-contained as possible, and also to palliate some gaps that we found in the literature regarding the use of invariance in hypothesis testing. We notably found that Lehmann's presentation of invariance in [START_REF] Lehmann | Testing Statistical Hypotheses[END_REF] was sometimes lacking, with notably very unclear proofs. As such, we wanted to palliate some of these shortcomings, and present a hopefully clearer picture of some of these concepts.

Invariance in group theory

In this first section, we offer a formalized path from group theory to invariance for hypothesis testing. We will start by recalling some required notions of group theory, most notably the concept of group action, then show how invariance is defined. We will also properly introduce the notions of orbits and maximal invariant, which we will need in our generalization of the RDT approach. After this, we will see how we can connect these notions to what is commonly presented in the literature about hypothesis testing.

Group theory

We start this section by recalling a few basic notions of group theory which will be useful later. Definition 2.1.1: Group Let 𝐺 be a set and let * be a binary operation defined for every pair of elements of 𝐺. (𝐺, * ) is a group if it verifies the following properties:

1. Closure: ∀(𝑔 1 , 𝑔 2 ) ∈ 𝐺 2 , 𝑔 1 * 𝑔 2 ∈ 𝐺 2. Associativity: ∀(𝑔 1 , 𝑔 2 , 𝑔 3 ) ∈ 𝐺 3 , (𝑔 1 * 𝑔 2 ) * 𝑔 3 = 𝑔 1 * (𝑔 2 * 𝑔 3 ) 3. Neutral element: ∃!𝑒 ∈ 𝐺, ∀𝑔 ∈ 𝐺, 𝑒 * 𝑔 = 𝑔 * 𝑒 = 𝑔 4. Inverse element: ∀𝑔 ∈ 𝐺, ∃!𝑔 -1 ∈ 𝐺, 𝑔 * 𝑔 -1 = 𝑔 -1 * 𝑔 = 𝑒
∀(𝑔 1 , 𝑔 2 ) ∈ 𝐺 2 , 𝑓 (𝑔 1 * 𝑔 2 ) = 𝑓 (𝑔 1 ) • 𝑓 (𝑔 2 )
From these two definitions follow two immediate properties of a group homomorphism.

Lemma 2.1.3: Properties of group homomorphisms

Let 𝑓 be a group homomorphism from (𝐺, * ) to (𝐻, •). Then:

1. Neutral element compatibility: if 𝑒 𝐺 and 𝑒 𝐻 are the neutral elements of (𝐺, * ) and (𝐻, •) respectively, we have: 𝑓 (𝑒 𝐺 ) = 𝑒 𝐻 .

2. Inverse element compatibility: for any element 𝑔 ∈ 𝐺, we have:

𝑓 (𝑔 -1 ) = 𝑓 (𝑔) -1 .
Given a set 𝒳, we will denote by Perm(𝒳) the set of all permutations of 𝒳, i.e. the set of all 𝒳-valued bijections defined on 𝒳 (also known as transformations). The set Perm(𝒳) with the composition operation ∘ is a group. Definition 2.1.4: Group action [START_REF] Lang | [END_REF] Let (𝐺, * ) be a group and 𝒳 be a set. We say that a function Π ∶ (𝐺, * ) → (Perm(𝒳), ∘) is a group action of 𝐺 on 𝒳 if Π is a group homomorphism between (𝐺, * ) and (Perm(𝒳), ∘).

The idea of a group action is to associate to each element of the group 𝐺 a transformation of the set 𝒳, effectively transferring the group structure to a certain subset of transformations of 𝒳.

We now introduce an equivalent definition of a group action, used notably by Eaton in [24].

Lemma 2.1.5: Group action characterization

Let Π ∶ 𝐺 → 𝒳 𝒳 .
Π is a group action of 𝐺 on 𝒳 if and only if both following properties are true:

(i) ∀(𝑔, 𝑔 ′ ) ∈ 𝐺 × 𝐺, ∀𝑥 ∈ 𝒳, Π(𝑔)(Π(𝑔 ′ )(𝑥)) = Π(𝑔 * 𝑔 ′ )(𝑥) (ii) ∀𝑥 ∈ 𝒳, Π(𝑒)(𝑥) = 𝑥
where 𝑒 is the identity element of 𝐺. The second property can also be written Π(𝑒) = Id 𝒳 .

Proof. If Π is a group action, then Π verifies both (i) and (ii) since (i) is the definition of a group homomorphism and (ii) is the first property of Lemma 2.1.3. Conversely, assume that Π verifies (i) and (ii). Note that this does not assume that Π is a permutation of 𝒳, this is in fact what we need to prove. The fact that Π is a group homomorphism will then directly come as a consequence of (i).

Let 𝑔 ∈ 𝐺.

1. Injectivity:

Let (𝑥, 𝑥 ′ ) ∈ 𝒳 2 such that Π(𝑔)(𝑥) = Π(𝑔)(𝑥 ′ ).
By applying Π(𝑔 -1 ) we get:

Π(𝑔 -1 )(Π(𝑔)(𝑥)) = Π(𝑔 -1 )(Π(𝑔)(𝑥 ′ ))
We have:

Π(𝑔 -1 )(Π(𝑔)(𝑥)) = Π(𝑔 -1 * 𝑔)(𝑥) from (i) = Π(𝑒)(𝑥) = 𝑥 from (ii)
With the exact same reasoning, we can also prove that Π(𝑔 -1 )(Π(𝑔)(𝑥 ′ )) = 𝑥 ′ . Therefore 𝑥 = 𝑥 ′ , meaning that Π(𝑔) is injective.

Surjectivity:

Let 𝑦 ∈ 𝒳. We want to show that there exists 𝑥 ∈ 𝒳 such that Π(𝑔)(𝑥) = 𝑦.

Let 𝑥 = Π(𝑔 -1 )(𝑦). We have :

Π(𝑔)(𝑥) = Π(𝑔)(Π(𝑔 -1 )(𝑦)) = Π(𝑔 * 𝑔 -1 )(𝑦) from (i) = Π(𝑒)(𝑦) = 𝑦 from (ii) Therefore Π(𝑔) is surjective.
Π(𝑔) is thus bijective and Π(𝑔 -1 ) is its inverse function, hence: Π(𝑔) ∈ Perm(𝒳). Since Π also verifies (i), Π is a group homomorphism.

Invariance

We have now introduced the basic elements that are required to introduce the notion of invariance. This is done through the definition of invariant subsets of 𝒳, given a certain group action Π.

∀𝑔 ∈ 𝐺, Π(𝑔)(𝐸) = 𝐸 Proof. Π(𝑔)(𝐸) = 𝐸 ⇔ (Π(𝑔)(𝐸) ⊂ 𝐸 ∧ Π(𝑔)(𝐸) ⊃ 𝐸)
• If we have Π(𝑔)(𝐸) = 𝐸 for all 𝑔 ∈ 𝐺, then 𝐸 is trivially invariant under the action of Π.

• Conversely, assume that 𝐸 is invariant under the action of Π.

Let 𝑔 ∈ 𝐺. We know by definition of an invariant subset that Π(𝑔)(𝐸) ⊂ 𝐸. All we need to prove is that Π(𝑔)(𝐸) ⊃ 𝐸.

Let 𝑦 ∈ 𝐸. Since 𝐺 is a group, 𝑔 -1 ∈ 𝐺 exists. Let 𝑥 = Π(𝑔 -1 )(𝑦). We have:

Π(𝑔)(𝑥) = Π(𝑔)(Π(𝑔 -1 )(𝑦)) = Π(𝑔 * 𝑔 -1 )(𝑦) = Π(𝑒)(𝑦) = 𝑦
In addition to that, by definition of 𝑥, we have 𝑥 ∈ Π(𝑔 -1 )(𝐸), and since we assumed that 𝐸 is invariant under the action of Π, we have Π(𝑔 -1 )(𝐸) ⊂ 𝐸, meaning that 𝑥 ∈ 𝐸. Therefore we have found an element 𝑥 ∈ 𝐸 such that 𝑦 = Π(𝑔)(𝑥), meaning that 𝑦 ∈ Π(𝑔)(𝐸).

Hence Π(𝑔)(𝐸) = 𝐸.

Lemma 2.1.8: Group action on a subset

If 𝐸 is an invariant subset of 𝒳 under the action Π of 𝐺 on 𝒳, then Π 𝐸 defined by

Π 𝐸 ∶ (𝐺, * ) ⟶ (Perm(𝐸), ∘) 𝑔 ⟼ Π(𝑔) |𝐸
is a group action of 𝐺 on 𝐸, where Π(𝑔) |𝐸 is the restriction of Π(𝑔) to the set 𝐸:

Π(𝑔) |𝐸 ∶ 𝐸 ⟶ 𝐸 𝑥 ⟼ Π(𝑔)(𝑥)
Proof. Let 𝑔 ∈ 𝐺. First, Π(𝑔) |𝐸 is properly defined, since 𝐸 is invariant under the action of Π, and therefore for any 𝑥 ∈ 𝐸 we have Π(𝑔) |𝐸 (𝑥) = Π(𝑔)(𝑥) ∈ 𝐸.

We will show that Π(𝑔) |𝐸 ∈ Perm(𝐸).

• (Injectivity) Π(𝑔) |𝐸 is the restriction of Π(𝑔) which is an injective function. Therefore Π(𝑔) |𝐸 is injective.

• (Surjectivity) Let 𝑦 ∈ 𝐸. We want to find 𝑥 ∈ 𝐸 such that Π(𝑔) |𝐸 (𝑥) = 𝑦. Let 𝑥 = Π(𝑔 -1 )(𝑦).

Since 𝑦 ∈ 𝐸 and 𝑔 -1 ∈ 𝐺, 𝑥 ∈ 𝐸 because 𝐸 is invariant.

Π(𝑔) |𝐸 (𝑥) = Π(𝑔)(𝑥) = Π(𝑔)(Π(𝑔 -1 )(𝑦)) = Π(𝑔 * 𝑔 -1 )(𝑦) = Π(𝑒)(𝑦) = 𝑦 Therefore Π(𝑔) |𝐸 is surjective.
Hence Π(𝑔) |𝐸 ∈ Perm(𝐸). From its definition, Π 𝐸 trivially verifies the properties (i) and (ii), therefore it is a group action of 𝐺 on 𝐸.

One last important notion before moving on to applications to probability distributions is the notion of transfer of a group action from one set to another. Lemma 2.1.9: Transfer of a group action Let 𝒳 and 𝒴 be two sets, 𝑓 ∶ 𝒳 → 𝒴 a bijection between 𝒳 and 𝒴 and Π a group action of 𝐺 on 𝒳. Let 𝛾 be the application defined by:

𝛾 ∶ (𝐺, * ) ⟶ (Perm(𝒴), ∘) 𝑔 ⟼ 𝑓 ∘ Π(𝑔) ∘ 𝑓 -1
𝛾 is a group action of 𝐺 on 𝒴.

Proof. Let 𝜁 be the application defined for any ℎ ∈ 𝒳 by 𝜁(ℎ) = 𝑓 ∘ ℎ ∘ 𝑓 -1 . Note that with this definition of 𝜁, we have 𝛾 = 𝜁 ∘ Π.

We will now prove that 𝜁 is a group homomorphism between (Perm(𝒳), ∘) and (Perm(𝒴), ∘):

• For all ℎ ∈ Perm(𝒳), 𝜁(ℎ) is defined on 𝒴 and takes its values in 𝒴, therefore 𝜁(ℎ) ∈ 𝒴 𝒴

• For all ℎ ∈ Perm(𝒳), 𝜁(ℎ) is bijective since it is a composition of bijective functions, therefore 𝜁(ℎ) ∈ Perm(𝒴)

• ∀ℎ, ℎ ′ ∈ 𝒳 2 , 𝜁(ℎ) ∘ 𝜁(ℎ ′ ) = 𝑓 ∘ ℎ ∘ 𝑓 -1 ∘ 𝑓 ∘ ℎ ′ ∘ 𝑓 -1 = 𝑓 ∘ ℎ ∘ ℎ ′ ∘ 𝑓 -1 = 𝜁(ℎ ∘ ℎ ′ )
Therefore 𝜁 is a group homomorphism between (Perm(𝒳), ∘) and (Perm(𝒴), ∘). Hence we can deduce that 𝛾 = 𝜁 ∘ Π is a group homomorphism between (𝐺, * ) and (Perm(𝒴), ∘) as the composition of two group homomorphisms, which means that 𝛾 is a group action of 𝐺 on 𝒴.

Orbits and maximal invariant

We now introduce the notions of maximal invariant and orbits which play an important part to introduce invariance in hypothesis testing problems. In the following, we consider a group action Π of a group 𝐺 on a set 𝒳.

From this group action, we can define an equivalence relation between elements of 𝒳 by:

∀(𝑥, 𝑥 ′ ) ∈ 𝒳 2 , 𝑥 ≡ 𝑥 ′ if ∃𝑔 ∈ 𝐺, 𝑥 ′ = Π(𝑔)(𝑥) (2.1)
The fact that this is indeed an equivalence relation results directly from the properties of a group action.

For every 𝑥 ∈ 𝒳, the equivalence class of 𝑥 is the set {Π(𝑔)(𝑥), 𝑔 ∈ 𝐺} and is called the orbit of 𝑥.

(i) 𝑀 is invariant under Π (ii) ∀(𝑥, 𝑥 ′ ) ∈ 𝒳 2 , 𝑀(𝑥) = 𝑀(𝑥 ′ ) ⇒ ∃𝑔 ∈ 𝐺, 𝑥 ′ = Π(𝑔)(𝑥)
To put it simply, a maximal invariant is an invariant function defined on 𝒳 that also takes different values on different orbits. We can note that given a group action, it is always possible to find at least a maximal invariant. For example, we can always consider the function 𝑀 ∶ 𝑥 ∈ 𝒳 ↦ orb(𝑥) ∈ 2 𝒳 . This function 𝑀 is indeed a maximal invariant since the orbits are the equivalence classes of the relation defined in Eq. (2.1). For a more concrete example, consider 𝒳 = ℝ 𝑑 , 𝐺 = 𝑂(𝑑) the orthogonal group of ℝ 𝑑 with the composition operation, and Π the trivial group action defined for every 𝑔 ∈ 𝐺 by Π(𝑔) = 𝑔. A maximal invariant of this group action is the euclidean norm ‖ ⋅ ‖ 2 , and the orbits generated by this group action are the 𝑑 -1-spheres of ℝ 𝑑 . In ℝ 2 and ℝ 3 , the orthogonal group 𝑂(𝑑) contains notably the rotations around 0. It is fairly easy to see in this case that an element on a sphere remains on that same sphere after applying a rotation, and therefore that its norm is preserved. Let 𝑓 be a function defined on 𝒳 and let 𝑀 be a maximal invariant of Π. 𝑓 is invariant under Π if and only if it is a function of the maximal invariant 𝑀, i.e. there exists a function 𝑓 defined on 𝑀(𝒳) such that:

∀𝑥 ∈ 𝒳, 𝑓 (𝑥) = 𝑓 (𝑀(𝑥)) (2.3)
In the following, we will be using an alternate definition of the orbits, which uses a maximal invariant. This is done to simplify some notations throughout this thesis. Lemma 2.1.14: Equivalent definition of orbits using a maximal invariant Given a maximal invariant 𝑀 of Π, let Υ 𝜌 be the sets defined by:

∀𝜌 ∈ 𝑀(𝒳), Υ 𝜌 = {𝑥 ∈ 𝒳 ∶ 𝑀(𝑥) = 𝜌} = 𝑀 -1 ({𝜌}) (2.4)
We have:

∀𝑥 ∈ 𝒳, orb(𝑥) = Υ 𝑀(𝑥) (2.5)
which we can also write:

∀𝑥 ∈ 𝒳, ∀𝜌 ∈ 𝑀(𝒳), orb(𝑥) = Υ 𝜌 (2.6)
This lemma is simply a matter of notation, and its proof comes directly from the definition of a maximal invariant and of the orbits. We introduce here the notation Υ 𝜌 , which references each orbit by the value taken by a given maximal invariant 𝑀 on this orbit. The chosen maximal invariant is implicit, but we will only work with a single maximal invariant at a time in the following, so there should be no confusion.

Invariance applied to probability distributions

In the following, we consider 𝒳 = Meas + (ℝ 𝑑 ) the set of all positive measures defined on ℛ 𝑑 . This set includes of course the set of all probability distributions.

For every 𝑔 ∈ 𝐺, we define the function Π 𝑔 by:

Π 𝑔 ∶ Meas + (ℝ 𝑑 ) ⟶ Meas + (ℝ 𝑑 ) 𝜇 ⟼ 𝜇𝑔 -1
where 𝜇𝑔 -1 is the pushforward measure of 𝜇 by 𝑔. We also define the function Π by:

∀𝑔 ∈ 𝐺, Π(𝑔) = Π 𝑔 Lemma 2.

1.15: Group action on measures

Π is a group action of 𝐺 on Meas + (ℝ 𝑑 ).

Proof. We first need to prove that, for every 𝑔 ∈ 𝐺, Π 𝑔 is bijective, i.e. that it is both injective and surjective. Let 𝑔 ∈ 𝐺.

• Injectivity: Let 𝜇, 𝜈 ∈ Meas + (ℝ 𝑑 ) 2 be two measures. We have:

Π 𝑔 (𝜇) = Π 𝑔 (𝜈) ⇔ ∀𝐵 ∈ ℬ(ℝ 𝑑 ), 𝜇𝑔 -1 (𝐵) = 𝜈𝑔 -1 (𝐵) ⇔ ∀𝐵 ∈ ℬ(ℝ 𝑑 ), 𝜇(𝑔 -1 (𝐵)) = 𝜈(𝑔 -1 (𝐵)) ⇔ ∀𝐵 ∈ 𝑔 -1 (ℬ(ℝ 𝑑 )), 𝜇(𝐵) = 𝜈(𝐵) with 𝑔 -1 (ℬ(ℝ 𝑑 )) = {𝑔 -1 (𝐵), 𝐵 ∈ ℬ(ℝ 𝑑 )}. We will show that 𝑔 -1 (ℬ(ℝ 𝑑 )) = ℬ(ℝ 𝑑 ). -Let 𝐵 ∈ 𝑔 -1 (ℬ(ℝ 𝑑 )). There is 𝐵 ′ ∈ ℬ(ℝ 𝑑 ) such that 𝐵 = 𝑔 -1 (𝐵 ′ ). Since 𝑔 -1 ∈ 𝐺, 𝑔 -1 is a measurable transformation, therefore 𝐵 ∈ ℬ(𝑅 𝑑 ): 𝑔 -1 (ℬ(ℝ 𝑑 )) ⊂ ℬ(ℝ 𝑑 ).
-Let 𝐵 ∈ ℬ(ℝ 𝑑 ) and 𝐵 ′ = 𝑔(𝐵). We have

𝑔 -1 (𝐵 ′ ) = 𝑔 -1 (𝑔(𝐵)) = 𝐵. Therefore 𝐵 ∈ 𝑔 -1 (ℬ(ℝ 𝑑 )): 𝑔 -1 (ℬ(ℝ 𝑑 )) ⊃ ℬ(ℝ 𝑑 ).
Hence 𝑔 -1 (ℬ(ℝ 𝑑 )) = ℬ(ℝ 𝑑 ), which means:

Π 𝑔 (𝜇) = Π 𝑔 (𝜈) ⇔ ∀𝐵 ∈ 𝑔 -1 (ℬ(ℝ 𝑑 )), 𝜇(𝐵) = 𝜈(𝐵) ⇔ ∀𝐵 ∈ ℬ(ℝ 𝑑 ), 𝜇(𝐵) = 𝜈(𝐵) ⇔ 𝜇 = 𝜈
Therefore Π 𝑔 is injective.

• Surjectivity: Let 𝜇 ∈ Meas + (ℝ 𝑑 ) and 𝜈 = 𝜇𝑔 ∈ Meas + (ℝ 𝑑 ) the image measure of 𝜇 by 𝑔 -1 . We have:

∀𝐵 ∈ ℬ(ℝ 𝑑 ), Π 𝑔 (𝜈)(𝐵) = 𝜈𝑔 -1 (𝐵) = 𝜈(𝑔 -1 (𝐵)) = 𝜇𝑔(𝑔 -1 (𝐵)) = 𝜇(𝑔(𝑔 -1 (𝐵)))
= 𝜇(𝐵)

Therefore 𝜇 = Π 𝑔 (𝜈): Π 𝑔 is surjective.
Hence Π 𝑔 is bijective:

Π 𝑔 ∈ Perm(𝒳).
We can now verify that Π is a group action of 𝐺 on Meas + (ℝ 𝑑 ). Let 𝑔, ℎ ∈ 𝐺 2 . We have:

∀𝜇 ∈ Meas + (ℝ 𝑑 ), Π 𝑔 ∘ Π ℎ (𝜇) = Π 𝑔 (Π ℎ (𝜇)) = Π 𝑔 (𝜇ℎ -1 ) = 𝜇ℎ -1 𝑔 -1 = 𝜇(𝑔 ∘ ℎ) -1 = Π 𝑔∘ℎ (𝜇) Therefore Π 𝑔 ∘ Π ℎ = Π 𝑔∘ℎ : Π is a group action of 𝐺 on 𝒳.
Using the group action Π, we can now define what an invariant hypothesis testing problem is (for usual testing problems, not in the RDT case). Consider a family of probability distributions ℱ = {𝑃 𝜃 , 𝜃 ∈ Θ} indexed by a parameter 𝜃 ∈ Θ in some set Θ, such that no two values of 𝜃 ∈ 𝒟 refer to the same probability distribution:

∀(𝜃, 𝜃 ′ ) ∈ 𝒟 2 , 𝜃 ≠ 𝜃 ′ ⇒ 𝑃 𝜃 ≠ 𝑃 𝜃 ′
and let Θ 0 and Θ 1 be two disjoints subsets of Θ such that Θ 0 ∪ Θ 1 = Θ, and let ℱ 0 = {𝑃 𝜃 , 𝜃 ∈ Θ 0 } and ℱ 1 = {𝑃 𝜃 , 𝜃 ∈ Θ 1 } Given some observation 𝑌 that with probability distribution 𝑃, the problem of testing 𝑃 ∈ ℱ 0 against 𝑃 ∈ ℱ 1 is said to be invariant under Π if both families ℱ 0 and ℱ 1 are invariant under the action Π. In this case, the set ℱ is also invariant under the action Π.

As mentioned in Chapter 1, it may be easier to work with the parameter 𝜃 instead of working with the probability distribution 𝑃. Here, this means testing 𝜃 ∈ Θ 0 against 𝜃 ∈ Θ 1 . For this, we introduce the function 𝑓 defined by:

𝑓 ∶ ℱ ⟶ Θ 𝑃 𝜃 ⟼ 𝜃
Since each distribution of ℱ is uniquely indexed by a value of Θ, 𝑓 is bijective. Therefore, from Lemma 2.1.9, the application 𝛾 defined by:

𝛾 ∶ 𝐺 ⟶ Perm(𝒟) 𝑔 ⟼ 𝑓 ∘ Π(𝑔) ∘ 𝑓 -1
is a group action of 𝐺 on Θ. For 𝑖 ∈ {0, 1}, we have:

∀𝑔 ∈ 𝐺, ∀𝜃 ∈ Θ 𝑖 , 𝛾(𝑔)(𝜃) = 𝑓 (Π(𝑔)(𝑓 -1 (𝜃))) = 𝑓 (Π(𝑔)(𝑃 𝜃 )) = 𝑓 (𝑃 𝜃 𝑔 -1 ) = 𝑓 (𝑃 𝜃 𝑔 ) for some 𝜃 𝑔 ∈ Θ 𝑖 , because ℱ 𝑖 is invariant under Π = 𝜃 𝑔
We can therefore deduce that the sets Θ 0 and Θ 1 are also invariant under the action 𝛾, and therefore the problem of testing 𝜃 ∈ Θ 0 against 𝜃 ∈ Θ 1 is also invariant.

In the literature regarding invariance of hypothesis testing problems (see for example [START_REF] Lehmann | Testing Statistical Hypotheses[END_REF]), the function 𝛾(𝑔) is often referred to as ḡ , and the set of functions {𝛾(𝑔), 𝑔 ∈ 𝐺} is referred to as Ḡ . However, these functions ḡ are typically not defined through a group action transfer, but instead as the function that maps to any 𝜃 ∈ Θ the parameter 𝜃 𝑔 ∈ Θ, defined here in our calculation of 𝛾(𝑔)(𝜃), that result from the invariance of ℱ.

Before introducing the Generalized RDT problem, we will present the notion of invariant measure, and a few associated properties. One difference regarding invariance between usual testing problems and RDT is that instead of considering invariant sets of probability distributions, we will work with a single invariant measure. Definition 2.1.16: Invariant measure Let 𝜇 ∈ 𝒳 be a measure. We say that 𝜇 is an invariant measure if the set {𝜇} is invariant under the action of Π, i.e.:

∀𝑔 ∈ 𝐺, 𝜇𝑔 -1 = 𝜇
The following lemma is a direct consequence of this definition. Lemma 2.1.17: Invariant measure and random variables Let 𝑃 be an invariant probability distribution. If 𝑋 ∈ ℳ(Ω, ℝ 𝑑 ) is a random variable with distribution 𝑃, then for any 𝑔 ∈ 𝐺, 𝑋 and 𝑔(𝑋) have the same distribution:

∀𝑔 ∈ 𝐺, ℙ𝑋 -1 = ℙ𝑔(𝑋) -1 = 𝑃 (2.7)
Proof. We have:

∀𝐵 ∈ ℛ 𝑑 , ℙ𝑔(𝑋) -1 (𝐵) = ℙ[𝑔(𝑋) ∈ 𝐵] = ℙ[𝑋 ∈ 𝑔 -1 (𝐵)] = ℙ𝑋 -1 (𝑔 -1 (𝐵)) = 𝑃(𝑔 -1 (𝐵)) = 𝑃(𝐵) because 𝑃 is invariant = ℙ𝑋 -1 (𝐵)
Therefore ℙ𝑔(𝑋) -1 = ℙ𝑋 -1 , which means that 𝑋 and 𝑔(𝑋) share the same probability distribution.

If the probability distribution of a random variable 𝑋 ∈ ℳ(Ω, ℝ 𝑑 ) is invariant, we will also simply say that 𝑋 is invariant.

Generalization of the RDT approach

After explaining the notion of invariance, we will now see its application to the RDT problem. The main goal of this section is to offer a generalization of the RDT problem where the distribution of the noise 𝑋 is not necessarily Gaussian, but instead has an invariant distribution with respect to some group 𝐺, allowing us to offer an optimal test in more situations.

The work presented in this section was conducted in great part with the assistance of Sabrina Bourmani, who initiated the work on this generalization in her thesis [START_REF] Bourmani | Binary Decision for Observations with Unknown Distribution : An Optimal and Invariance-Based Framework[END_REF].

We will consider here a group (𝐺, ∘) of linear transformations defined on ℝ 𝑑 . The linearity of the functions 𝑔 ∈ 𝐺 is important to keep in mind, and is adapted to the problem we consider, which is linear in the sense that we consider an observation that is the sum of some independent signal Θ and noise 𝑋. We also consider an ℝ-valued maximal invariant 𝑀 ∶ ℝ 𝑑 → ℝ of 𝐺. For every 𝜌 ∈ ℝ, Υ 𝜌 is an orbit:

Υ 𝜌 = {𝑦 ∈ ℝ 𝑑 , 𝑀(𝑦) = 𝜌} (2.8)
We call 𝔉 the set of all these orbits: 𝔉 = {Υ 𝜌 , 𝜌 ∈ 𝑀(ℝ 𝑑 )}.

We start by stating the Generalized RDT problem, adapted from the RDT problem presented in Chapter 1, and explain the differences that exist between these two problems. We will then redefine the essential elements of the RDT problem (size, power, optimality, etc.) for the GRDT case. After that, we will present several results which are completely independent from the distribution of the noise 𝑋. Finally we will focus on the case where the maximal invariant is the euclidean norm ‖ ⋅ ‖ 2 , in which case we can derive a test 𝒯 𝜆 𝛾 (𝜏) similarly to the RDT case, and present results regarding its optimality.

Problem statement

We start by stating the GRDT (Generalized Random Distortion Testing) testing problem, and compare it to the RDT testing problem presented in Definition 1.2.2. The Generalized RDT problem is the following hypothesis testing problem:

Definition 2.2.1: Generalized RDT problem statement ⎧ { { { { { { { { { { { { { { { ⎨ { { { { { { { { { { { { { { { ⎩ Data model: ∃𝑌 ∈ ℳ(Ω, ℝ 𝑑 ), ∃Θ ∈ ℳ(Ω, ℝ 𝑑 ), ∃𝑋 ∈ ℳ(Ω, ℝ 𝑑 ), ∃𝑃 ∈ 𝒫, ⎧ { { { { { ⎨ { { { { { ⎩ (𝑋 ∼ 𝑃) ∧ (𝑃 is invariant under 𝐺) ∧ (Θ and 𝑋 are independent) ∧ (𝑌 = Θ + 𝑋) ∧ (∀𝑦 ∈ ℝ 𝑑 , ∃𝜔 ∈ Ω, 𝑦 = 𝑌 (𝜔))
Testing problem:

Given one realization 𝑦 = 𝑌 (𝜔) = Θ(𝜔) + 𝑋(𝜔), determine whether:

⎧ { ⎨ { ⎩ ℋ 0 ∶ 𝑀(Θ(𝜔)) ≤ 𝜏 or ℋ 1 ∶ 𝑀(Θ(𝜔)) > 𝜏 with 𝜏 ∈ ℝ (2.9)
For comparison, here is the RDT problem which was stated in Definition 1.2.2:

Definition 1.2.2: RDT problem statement ⎧ { { { { { { { { { { { { { { ⎨ { { { { { { { { { { { { { { ⎩ Data model: ∃𝑌 ∈ ℳ(Ω, ℝ 𝑑 ), ∃Θ ∈ ℳ(Ω, ℝ 𝑑 ), ∃𝑋 ∈ ℳ(Ω, ℝ 𝑑 ), ⎧ { { { ⎨ { { { ⎩ (𝑋 ∼ 𝒩(0, 𝐶) with 𝐶 a 𝑑 × 𝑑 definite positive matrix) ∧ (Θ and 𝑋 are independent) ∧ (𝑌 = Θ + 𝑋) ∧ (∀𝑦 ∈ ℝ 𝑑 , ∃𝜔 ∈ Ω, 𝑦 = 𝑌 (𝜔))
Testing problem:

Given one realization 𝑦 = 𝑌 (𝜔) = Θ(𝜔) + 𝑋(𝜔), determine whether:

⎧ { ⎨ { ⎩ ℋ 0 ∶ 𝜈 𝐶 (Θ(𝜔) -𝜃 0 ) ≤ 𝜏 or ℋ 1 ∶ 𝜈 𝐶 (Θ(𝜔) -𝜃 0 ) > 𝜏 with 𝜏 > 0 and 𝜃 0 ∈ ℝ 𝑑 (1.12)
The main difference between these two problems is the distribution of the noise 𝑋, which is no longer necessarily Gaussian, but still presents invariance properties with respect to a given group 𝐺.

The GRDT problem actually encompasses the RDT problem, where 𝑋 follows a Gaussian distribution with positive definite covariance matrix 𝐶. The maximal invariant 𝑀 is then the Mahalanobis norm using the matrix 𝐶, and the associated orbits are ellipsoids. To explicit the associated group 𝐺, we first need to do a little bit of work with the matrix 𝐶: consider an eigendecomposition of 𝐶 = 𝑈Δ𝑈 𝑇 , where Δ = diag(𝜉 1 , …, 𝜉 𝑑 ) is a diagonal matrix containing the eigenvalues of 𝐶, and 𝑈 is a 𝑑 × 𝑑 orthogonal matrix. Let Φ = Δ -1/2 𝑈 𝑇 where

Δ -1/2 = diag(𝜉 -1/2 1 , …, 𝜉 -1/2 𝑑
). The group 𝐺 of interest for the RDT problem is the group of linear transforms 𝑔 defined by:

∀𝑦 ∈ ℝ 𝑑 , 𝑔(𝑦) = Φ -1 𝑅Φ𝑦 (2.10)
where 𝑅 is any 𝑑 × 𝑑 orthogonal matrix. If we consider the case where 𝐶 = 𝐼 𝑑 , then we find that the maximal invariant is the euclidean norm, and the group 𝐺 is the orthogonal group 𝑂(𝑑) of ℝ 𝑑 . In the case of ℝ 2 and ℝ 3 , this group notably contains the rotations of the space centered on the origin. It is fairly easy in that case to see that a Gaussian distribution with mean 0 remains unaffected by such a rotation. We can also note that in the GRDT case, we decided to only consider the case where 𝜃 0 = 0. This is only to simplify calculations, and can be done without loss of generality. One can also notice that we now consider a tolerance 𝜏 ∈ ℝ which is not necessarily positive. Indeed, unlike the Mahalanobis norm, the maximal invariant is not necessarily positive.

Redefining notions for the GRDT problem

Before describing the main theoretical results, we first need to adapt several definitions given in Chapter 1 for the GRDT problem. These adaptations are all straightforward and should not require any additional explanations. The only differences are the use of the maximal invariant 𝑀 instead of the Mahalanobis norm 𝜈 𝐶 , the fact that we consider 𝜃 0 = 0, and the fact that the tolerance 𝜏 is not necessarily positive. Definition 2.2.2: Conditional power and size Let 𝒯 ∶ ℝ 𝑑 → {0, 1} be a test, Θ ∈ ℳ(Ω, ℝ 𝑑 ) a random variable and 𝜌 ∈ ℝ. We define the conditional power and conditional size of 𝒯 for the GRDT problem as:

Conditional power: ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] (2.11)
Conditional size: sup

Θ∈ℳ(Ω,ℝ 𝑑 ) ∶ ℙ[𝑀(Θ)≤𝜏]≠0 ℙ[𝒯(Θ + 𝑋) = 1 | 𝑀(Θ) ≤ 𝜏] (2.12)
We also define the size and power of 𝒯 as:

Power function:

∀𝜃 ∈ ℝ 𝑑 , 𝛽 𝒯 (𝜃) = ℙ[𝒯(𝜃 + 𝑋) = 1] (2.13)
Size:

𝛼 𝒯 = sup 𝜃∈ℝ 𝑑 ∶ 𝑀(𝜃)≤𝜏 𝛽 𝒯 (𝜃) (2.14)
Like previously, a test 𝒯 is said to have level 𝛾 ∈ (0, 1) for the GRDT problem if 𝛼 𝒯 ≤ 𝛾. We note 𝒦 𝛾 the set of all tests of level 𝛾.

Definition 2.2.3: Thresholding tests

For any 𝑡 ∈ ℝ, the thresholding test 𝒯 𝑡 is defined by:

𝒯 𝑡 ∶ ℝ 𝑑 ⟶ {0, 1} 𝑦 ⟼ ⎧ { ⎨ { ⎩ 1 if 𝑀(𝑦) > 𝑡 0 otherwise (2.15)
Note that these thresholding tests are invariant functions, as they depend on the observation 𝑦 only through 𝑀(𝑦).

Definition 2.2.4: Constant conditional power function given Θ ∈ Υ𝜌

Let 𝜌 ∈ ℝ. Let Θ ∈ ℳ(Ω, ℝ 𝑑 ) be a random variable independent of 𝑋 ∼ 𝒩(0, 𝐶). A test 𝒯 is said to have constant conditional power function given Θ ∈ Υ 𝜌 if: (ii) For any random variable Θ ∈ ℳ(Ω, ℝ 𝑑 ) and for ℙ(𝑀(Θ)) -1 -almost every 𝜌 > 𝜏, 𝒯 * has constant conditional power function given Θ ∈ Υ 𝜌 .

∀𝜃 ∈ Υ 𝜌 , ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] = 𝛽 𝒯 (𝜃)
(iii) For any random variable Θ ∈ ℳ(Ω, ℝ 𝑑 ), for ℙ(𝑀(Θ)) -1 -almost every 𝜌 > 𝜏 and for any test 𝒯 with level 𝛾 and constant conditional power function given Θ ∈ Υ 𝜌 , we have:

ℙ[𝒯 * (Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] ≥ ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] (2.16)
Now that we have defined the 𝛾-MCCP optimality criterion for the GRDT problem, the question is thus: do such tests exist?

Preliminary results

We start the study of the GRDT problem with several preliminary results that will be helpful in the following. The results presented in this section do not depend on the noise distribution 𝑋, and therefore do not depend on the group 𝐺 or the maximal invariant 𝑀. Proof of (i). Let (𝜃 1 , 𝜃 2 ) ∈ ℝ 𝑑 × ℝ 𝑑 such that 𝑀(𝜃 1 ) = 𝑀(𝜃 2 ). Since 𝑀 is a maximal invariant, there exists a linear transformation 𝑔 ∈ 𝐺 such that 𝜃 2 = 𝑔(𝜃 1 ). We have:

𝑀(𝜃 2 + 𝑋) = 𝑀(𝑔(𝜃 1 ) + 𝑋) = 𝑀(𝑔(𝜃 1 + 𝑔 -1 (𝑋))) by linearity of 𝑔 = 𝑀(𝜃 1 + 𝑔 -1 (𝑋))
because 𝑀 is a maximal invariant Therefore, we have:

∀𝐵 ∈ ℛ, ℙ𝑀(𝜃 2 + 𝑋) -1 (𝐵) = ℙ[𝑀(𝜃 2 + 𝑋) ∈ 𝐵] = ℙ[𝑀(𝜃 1 + 𝑔 -1 (𝑋)) ∈ 𝐵] = ℙ[𝑀(𝜃 1 + 𝑋) ∈ 𝐵] because 𝑋 is invariant under 𝐺 = ℙ𝑀(𝜃 1 + 𝑋) -1 (𝐵)
Therefore 𝑀(𝜃 1 + 𝑋) and 𝑀(𝜃 2 + 𝑋) have the same distribution.

Proof of (ii). Let 𝜌 ∈ ℝ and Ξ ∈ ℳ(Ω, ℝ 𝑑 ) such that Ξ ∈ Υ 𝜌 almost surely. We have:

∀𝐵 ∈ ℛ, ℙ𝑀(Ξ + 𝑋) -1 (𝐵) = ∫ ℙ[𝑀(Ξ + 𝑋) ∈ 𝐵 | Ξ = 𝜉]ℙΞ -1 (𝑑𝜉) = ∫ Υ 𝜌 ℙ[𝑀(𝜉 + 𝑋) ∈ 𝐵]ℙΞ -1 (𝑑𝜉) because Ξ ∈ Υ 𝜌 a-s From (i), 𝜉 ↦ ℙ[𝑀(𝜉 + 𝑋) ∈ 𝐵] is constant on Υ 𝜌 , hence for any 𝜃 ∈ Υ 𝜌 : ∀𝐵 ∈ ℛ, ℙ𝑀(Ξ + 𝑋) -1 (𝐵) = ℙ[𝑀(𝜃 + 𝑋) ∈ 𝐵] ∫ Υ 𝜌 ℙΞ -1 (𝑑𝜉) = ℙ[𝑀(𝜃 + 𝑋) ∈ 𝐵] Lemma 2.
∀𝜃 ∈ 𝐸, ℙ[𝒯(Ξ + 𝑋) = 1] = 𝛽 𝒯 (𝜃) (2.17)
Proof. If we have Eq. (2.17), then we can immediately deduce that 𝒯 has constant power function on 𝐸.

Conversely, note that for any random variable Ξ ∈ ℳ(Ω, ℝ 𝑑 ), by definition of a conditional probability, we have:

ℙ[𝒯(Ξ + 𝑋) = 1] = ∫ ℙ[𝒯(Ξ + 𝑋) = 1 | Ξ = 𝜉]ℙΞ -1 (d𝜉) = ∫ ℙ[𝒯(𝜉 + 𝑋) = 1]ℙΞ -1 (d𝜉) = ∫ 𝛽 𝒯 (𝜉)ℙΞ -1 (d𝜉)
Thus, if Ξ ∈ 𝐸 almost surely, we have:

ℙ[𝒯(Ξ + 𝑋) = 1] = ∫ 𝐸 𝛽 𝒯 (𝜉)ℙΞ -1 (d𝜉)
If 𝒯 has constant power function on 𝐸, then this equation becomes:

∀𝜃 ∈ 𝐸, ℙ[𝒯(Ξ + 𝑋) = 1] = 𝛽 𝒯 (𝜃) ∫ 𝐸 ℙΞ -1 (d𝜉) = 𝛽 𝒯 (𝜃) Lemma 2.

2.8: Power function of invariant tests

Any invariant test 𝒯 has constant power function on every orbit Υ 𝜌 ∈ 𝔉.

Proof. Let 𝒯 be an invariant test, 𝜌 ∈ ℝ and (𝜃 1 , 𝜃 2 ) ∈ Υ 𝜌 . Since 𝜃 1 and 𝜃 2 belong to the same orbit Υ 𝜌 , there exists 𝑔 ∈ 𝐺 such that 𝜃 2 = 𝑔(𝜃 1 ). We have:

𝛽 𝒯 (𝜃 2 ) = ℙ[𝒯(𝜃 2 + 𝑋) = 1] = ℙ[𝒯(𝑔(𝜃 1 ) + 𝑋) = 1] = ℙ[𝒯(𝑔(𝜃 1 + 𝑔 -1 (𝑋))) = 1] by linearity of 𝑔 = ℙ[𝒯(𝜃 1 + 𝑔 -1 (𝑋)) = 1] because 𝒯 is invariant = ℙ[𝒯(𝜃 1 + 𝑋) = 1] because 𝑋 is invariant = 𝛽 𝒯 (𝜃 1 )
Therefore 𝒯 has constant power function on every orbit Υ 𝜌 ∈ 𝔉.

A direct consequence of this is that any thresholding test 𝒯 𝜂 has constant power function on every orbit, since thresholding tests are invariant.

The following lemma is the equivalent of Lemma 1.2.5, expressing that the size and the conditional size of any test are identical for the GRDT problem. Lemma 2.2.9: Size and conditional size For any test 𝒯 ∶ ℝ 𝑑 → {0, 1}, we have:

sup Θ∈ℳ(Ω,ℝ 𝑑 ) ∶ ℙ[𝑀(Θ)≤𝜏]≠0 ℙ[𝒯(Θ + 𝑋) = 1 | 𝑀(Θ) ≤ 𝜏] = 𝛼 𝒯 (2.18)
Proof. Let 𝒯 be some test.

First, we recall the definition of 𝛼 𝒯 , given previously in Eq. (2.14):

𝛼 𝒯 = sup 𝜃∈ℝ 𝑑 ∶ 𝑀(𝜃)≤𝜏 𝛽 𝒯 (𝜃) (2.19)
Let 𝜃 ∈ ℝ 𝑑 such that 𝑀(𝜃) ≤ 𝜏. For any Θ ∈ ℳ(Ω, ℝ 𝑑 ) such that Θ = 𝜃 almost surely, we have ℙ[𝒯(Θ + 𝑋) = 1 | 𝑀(Θ) ≤ 𝜏] = 𝛽 𝒯 (𝜃). Since this is true for any 𝜃 such that 𝑀(𝜃) ≤ 𝜏, we have:

𝛼 𝒯 ≤ sup Θ∈ℳ(Ω,ℝ 𝑑 ) ∶ ℙ[𝑀(Θ)≤𝜏]≠0 ℙ[𝒯(Θ + 𝑋) = 1 | 𝑀(Θ) ≤ 𝜏]
Conversely, for any Θ ∈ ℳ(Ω, ℝ 𝑑 ) independent of 𝑋 ∼ 𝒩(0, 𝐶), any 𝜃 ∈ ℝ 𝑑 , and any borel set 𝐵 of ℝ, we have the following:

ℙ([𝒯(Θ + 𝑋) = 1] ∩ [𝑀(Θ) ∈ 𝐵] | Θ = 𝜃) = ℙ([𝒯(𝜃 + 𝑋) = 1] ∩ [𝑀(𝜃) ∈ 𝐵])
In the following, 𝟙 𝐵 is the indicator function of 𝐵, defined by:

𝟙 𝐵 ∶ ℝ ⟶ {0, 1} 𝑥 ⟼ ⎧ { ⎨ { ⎩ 1 if 𝑥 ∈ 𝐵 0 otherwise
There are two cases to consider:

• If 𝑀(𝜃) ∈ 𝐵, then 𝟙 𝐵 (𝑀(𝜃))𝛽 𝒯 (𝜃) = 𝛽 𝒯 (𝜃) and:

ℙ([𝒯(Θ + 𝑋) = 1] ∩ [𝑀(Θ) ∈ 𝐵] | Θ = 𝜃) = 𝛽 𝒯 (𝜃)
• Otherwise, if 𝑀(𝜃) ∉ 𝐵, then 𝟙 𝐵 (𝑀(𝜃))𝛽 𝒯 (𝜃) = 0 and:

ℙ([𝒯(Θ + 𝑋) = 1] ∩ [𝑀(Θ) ∈ 𝐵] | Θ = 𝜃) = 0
Combining these two cases yields:

ℙ([𝒯(Θ + 𝑋) = 1] ∩ [𝑀(Θ) ∈ 𝐵] | Θ = 𝜃) = 𝟙 𝐵 (𝑀(𝜃))𝛽 𝒯 (𝜃) (2.20)
In particular, if Θ is such that ℙ[𝑀(Θ) ≤ 𝜏] ≠ 0 and is independent of 𝑋, then it follows from the definition of a conditional probability and Eq. (2.20) with 𝐵 = (-∞, 𝜏] that:

ℙ([𝒯(Θ + 𝑋) = 1] ∩ [𝑀(Θ) ≤ 𝜏]) = ∫ {𝜃∈ℝ 𝑑 ,𝑀(𝜃)≤𝜏} 𝛽 𝒯 (𝜃)ℙ Θ (d𝜃)
The right hand side of this equality is less than or equal to 𝛼 𝒯 ℙ[𝑀(Θ) ≤ 𝜏]. From Bayes' rule, we get that: sup Proof. Let 𝒯 ∶ ℝ 𝑑 → {0, 1} be a test. We will start by proving statement (i).

Θ∈ℳ(Ω,ℝ 𝑑 ) ∶ ℙ[𝑀(Θ)≤𝜏]≠0 ℙ[𝒯(Θ + 𝑋) = 1 | 𝑀(Θ) ≤ 𝜏] ≤
• First, assume that 𝒯 has constant power function on every orbit Υ 𝜌 ∈ 𝔉. We can define the function 𝑄 * 𝒯 ∶ ℝ → [0, 1] such that:

∀𝜌 ∈ ℝ, ∀𝜃 ∈ Υ 𝜌 , 𝑄 * 𝒯 (𝜌) = 𝛽 𝒯 (𝜃)
Let Θ ∈ ℳ(Ω, ℝ 𝑑 ) be a random variable independent of 𝑋 ∼ 𝒩(0, 𝐶) and 𝐵 a Borel set of ℝ. From Eq. (2.20), we get that:

∀𝜃 ∈ ℝ 𝑑 , ℙ([𝒯(Θ + 𝑋) = 1] ∩ [𝑀(Θ) ∈ 𝐵] | Θ = 𝜃) = 𝟙 𝐵 (𝑀(𝜃))𝑄 * 𝒯 (𝑀(𝜃))
Using the standard change of variable formula [START_REF] Billingsley | Probability and Measure[END_REF]Theorem 16.13], we have:

∫ 𝟙 𝐵 (𝑀(𝜃))𝑄 * 𝒯 (𝑀(𝜃))ℙΘ -1 (d𝜃) = ∫ 𝐵 𝑄 * 𝒯 (𝜌)ℙ𝑀(Θ) -1 (d𝜌) Therefore: ℙ([𝒯(Θ + 𝑋) = 1] ∩ [𝑀(Θ) ∈ 𝐵]) = ∫ 𝐵 𝑄 * 𝒯 (𝜌)ℙ𝑀(Θ) -1 (d𝜌)
On the other hand, we have:

ℙ([𝒯(Θ + 𝑋) = 1] ∩ [𝑀(Θ) ∈ 𝐵]) = ∫ 𝐵 ℙ[𝒯(Θ + 𝑋) = 1 | 𝑀(Θ) = 𝜌]ℙ𝑀(Θ) -1 (d𝜌)
Since this is true for any Borel set 𝐵 of ℝ, from the definition of a conditional probability, we can deduce that for ℙ𝑀(Θ) -1 -almost every 𝜌 ∈ ℝ we have:

𝑄 * 𝒯 (𝜌) = ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ]
• Conversely, assume that there is a function 𝑄 * 𝒯 ∶ ℝ → [0, 1] which satisfies Eq. (2.21). Given any 𝜌 ∈ ℝ, any 𝜃 ∈ Υ 𝜌 and any random variable Θ ∈ ℳ(Ω, ℝ 𝑑 ) such that Θ = 𝜃 almost surely, we have:

𝛽 𝒯 (𝜃) = ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ]
Therefore we have: ∀𝜌 ∈ ℝ, ∀𝜃 ∈ Υ 𝜌 , 𝛽 𝒯 (𝜃) = 𝑄 * 𝒯 (𝜌) Hence 𝒯 has constant power function on every orbit Υ 𝜌 ∈ 𝔉. This also proves statement (ii).

Statement (iii) is a direct consequence of statements (i) and (ii).

The following theorem expresses a sufficient condition to have a 𝛾-MCCP test. Assuming that we can find a test that fulfills the first two criterions of Definition 2.2.5 -meaning that we have a test with level 𝛾 and constant conditional power function -, this theorem gives a sufficient condition for this test to be most powerful, and therefore 𝛾-MCCP.

Theorem 2.2.12: Sufficient condition for a 𝛾-MCCP test Let 𝒯 * be a test with level 𝛾 for the GRDT problem such that, for any Θ ∈ ℳ(Ω, ℝ 𝑑 ), 𝒯 * has constant conditional power function given Θ ∈ Υ 𝜌 for ℙ𝑀(Θ) -1 -almost every 𝜌 > 𝜏. If, given any 𝜌 > 𝜏, there exists two random variables Ξ 0 and Ξ 1 , with Ξ 0 ∈ Υ 𝜏 and Ξ 1 ∈ Υ 𝜌 almost surely, such that the test 𝒯 * is most powerful with level 𝛾 for testing ℋ 0 ∶ 𝑌 = Ξ 0 + 𝑋 against ℋ 1 ∶ 𝑌 = Ξ 1 + 𝑋, then 𝒯 * is 𝛾-MCCP for the GRDT problem.

Proof. Assume that for any 𝜌 > 𝜏 there exists two random variables Ξ 0 and Ξ 1 with Ξ 0 ∈ Υ 𝜏 and Ξ 1 ∈ Υ 𝜌 almost surely, such that the test 𝒯 * is most powerful with level 𝛾 for testing ℋ 0 against ℋ 1 . Let Θ ∈ ℳ(Ω, ℝ 𝑑 ). Let 𝜌 > 𝜏 and let 𝒯 be a test with level 𝛾 for the GRDT problem and constant conditional power function given Θ ∈ Υ 𝜌 . By hypothesis, there exists Ξ 0 and Ξ 1 such that 𝒯 * is most powerful with level 𝛾 for testing ℋ 0 against ℋ 1 . We have:

ℙ[𝒯(Ξ 0 + 𝑋) = 1] = ℙ[𝒯(Ξ 0 + 𝑋) = 1 | Ξ 0 ∈ Υ 𝜏 ] because Ξ 0 ∈ Υ 𝜏 almost surely ≤ sup Θ∈ℳ(Ω,ℝ 𝑑 ) ∶ ℙ[𝑀(Θ)≤𝜏]≠0 ℙ[𝒯(Θ + 𝑋) = 1 | 𝑀(Θ) ≤ 𝜏]
≤ 𝛼 𝒯 from Lemma 2.2.9

≤ 𝛾 because 𝒯 has level 𝛾 for GRDT Therefore 𝒯 has level 𝛾 for ℋ 0 against ℋ 1 . Since 𝒯 * is most powerful with level 𝛾 for testing ℋ 0 against ℋ 1 , we have:

ℙ[𝒯 * (Ξ 1 + 𝑋) = 1] ≥ ℙ[𝒯(Ξ 1 + 𝑋) = 1]
Since 𝒯 and 𝒯 * both have constant conditional power function given Θ ∈ Υ 𝜌 , we have:

∀𝜃 ∈ Υ 𝜌 , ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] = 𝛽 𝒯 (𝜃) and ∀𝜃 ∈ Υ 𝜌 , ℙ[𝒯 * (Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] = 𝛽 𝒯 * (𝜃)
From Lemma 2.2.10, since 𝒯 and 𝒯 * both have constant conditional power function given Θ ∈ Υ 𝜌 , they both have constant power function on Υ 𝜌 . From Lemma 2.2.7, since Ξ 1 ∈ Υ 𝜌 almost surely, we also have:

∀𝜃 ∈ Υ 𝜌 , ℙ[𝒯(Ξ 1 + 𝑋) = 1] = 𝛽 𝒯 (𝜃)
and

∀𝜃 ∈ Υ 𝜌 , ℙ[𝒯 * (Ξ 1 + 𝑋) = 1] = 𝛽 𝒯 * (𝜃)
Hence:

ℙ[𝒯(Ξ 1 + 𝑋) = 1] = ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ]
and

ℙ[𝒯 * (Ξ 1 + 𝑋) = 1] = ℙ[𝒯 * (Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] Therefore: ℙ[𝒯 * (Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] ≥ ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ]
This proves that 𝒯 * is 𝛾-MCCP.

Generalization when the maximal invariant is the euclidean norm

Until now, the only assumption we made on the noise 𝑋 is that the group 𝐺 is composed of linear transformations 𝑔. However, we were unable so far to find a 𝛾-MCCP test using only these very limited assumptions. Therefore, as a starting point, we decided to focus on using the euclidean norm ‖ ⋅ ‖ 2 as the maximal invariant, since we know that we can find a 𝛾-MCCP test in the Gaussian case. This generalization is not as broad as we originally intended, but would still let us consider other spherically invariant probability distributions, such as generalized Gaussian distributions.

The following lemma provides an important relation between the probability density function of a spherically invariant variable and of its norm. This is an important lemma, as it is what allows us to continue our reasoning using the euclidean norm. For other maximal invariants, we do not necessarily have a similar relation, which is likely why we have trouble working in the general case.

Lemma 2.2.13: Probability density function of spherically invariant random variables

For any spherically invariant random variable 𝑍 ∈ ℳ(Ω, ℝ 𝑑 ) that has a probability density function 𝑓 𝑍 , ‖𝑍‖ 2 also has a probability density function 𝑓 ‖𝑍‖ 2 and we have:

∀𝑧 ∈ ℝ 𝑑 , 𝑓 ‖𝑍‖ 2 (‖𝑧‖ 2 ) = 𝑚(𝑆 𝑑-1 )‖𝑧‖ 𝑑-1 2 𝑓 𝑍 (𝑧)
where 𝑚(𝑆 𝑑-1 ) is the surface measure of the unit sphere 𝑆 𝑑-1 in ℝ 𝑑 :

𝑚(𝑆 𝑑-1 ) = 2𝜋 𝑑/2 Γ(𝑑/2)
Proof. This is a consequence of [24,Proposition 7.15] From Lemma 2.2.6, for any 𝜃 ∈ ℝ 𝑑 the distribution of ‖𝜃 + 𝑋‖ 2 only depends on 𝜃 through ‖𝜃‖ 2 . We denote by 𝑃 𝜌 the probability distribution of ‖𝜃 + 𝑋‖ 2 with 𝜌 = ‖𝜃‖ 2 , and 𝑓 𝜌 the associated probability density function.

In order to find an optimal test, we need to make an additional assumption, which is that the family of densities {𝑓 𝜌 , 𝜌 ≥ 0} has a monotone likelihood ratio (cf. Definition 1.1.5), i.e.:

∀𝜌 1 > 𝜌 0 , ∀𝑥 1 > 𝑥 0 , 𝑓 𝜌 1 (𝑥 1 ) 𝑓 𝜌 0 (𝑥 1 ) ≥ 𝑓 𝜌 1 (𝑥 0 ) 𝑓 𝜌 0 (𝑥 0 )
For any 𝜌 > 0, let 𝜆 𝛾 (𝜌) be such that ℙ[‖𝜃 + 𝑋‖ 2 > 𝜆 𝛾 (𝜌)] = 𝛾 for any 𝜃 ∈ Υ 𝜌 .

Lemma 2.2.14: Size of 𝒯 𝜆 𝛾 (𝜏)

Under the assumption that the family of densities {𝑓 𝜌 , 𝜌 ≥ 0} has a monotone likelihood ratio, the thresholding test 𝒯 𝜆 𝛾 (𝜏) has size 𝛾 for the GRDT problem.

Proof. Consider the following hypothesis problem:

( * ) ⎧ { { ⎨ { { ⎩ Observation ∶ ∃𝜌 ≥ 0, 𝑍 ∼ 𝑃 𝜌 ℋ 0 ∶ 𝜌 ≤ 𝜏 ℋ 1 ∶ 𝜌 > 𝜏
From the Karlin-Rubin theorem (cf. Theorem 1.1.6), since the family of distributions {𝑓 𝜌 , 𝜌 ≥ 0} has monotone likelihood ratio, the test 𝒯 𝜆 𝛾 (𝜏) defined by

𝒯 𝜆 𝛾 (𝜏) ∶ ℝ ⟶ {0, 1} 𝑧 ⟼ ⎧ { ⎨ { ⎩ 0 if 𝑧 ≤ 𝜆 𝛾 (𝜏) 1 if 𝑧 > 𝜆 𝛾 (𝜏)
has size 𝛾 for ( * ):

sup 𝜌∈ℝ ∶ 𝜌≤𝜏 𝛽 𝒯 𝜆 𝛾 (𝜏) (𝜌) = 𝛾
By definition of 𝒯 𝜆 𝛾 (𝜏) , we have 𝒯 𝜆 𝛾 (𝜏) = 𝒯 𝜆 𝛾 (𝜏) ∘ ‖ ⋅ ‖ 2 , and:

∀𝜃 ∈ ℝ 𝑑 , 𝛽 𝒯 𝜆 𝛾 (𝜏) (𝜃) = ℙ[𝒯 𝜆 𝛾 (𝜏) (𝜃 + 𝑋) = 1] = ℙ[𝒯 𝜆 𝛾 (𝜏) (‖𝜃 + 𝑋‖ 2 ) = 1] = ℙ[𝒯 𝜆 𝛾 (𝜏) (𝑍) = 1] with 𝑍 ∼ 𝑃 ‖𝜃‖ 2 = 𝛽 𝒯 𝜆 𝛾 (𝜏) (‖𝜃‖ 2 )
Therefore:

𝛼 𝒯 𝜆 𝛾 (𝜏) = sup 𝜃∈ℝ 𝑑 ∶ ‖𝜃‖ 2 ≤𝜏 𝛽 𝒯 𝜆 𝛾 (𝜏) (𝜃) = sup 𝜃∈ℝ 𝑑 ∶ ‖𝜃‖ 2 ≤𝜏 𝛽 𝒯 𝜆 𝛾 (𝜏) (‖𝜃‖ 2 ) = sup 𝜌∈[0,𝜏] 𝛽 𝒯 𝜆 𝛾 (𝜏) (𝜌) = 𝛾
Hence the test 𝒯 𝜆 𝛾 (𝜏) has size 𝛾 for the RDT problem.

Lemma 2.2.15

Let 𝜌 1 > 𝜌 0 . Let Ξ 0 and Ξ 1 be two random variables uniformly distributed on 𝜌 0 𝑆 𝑑-1 and 𝜌 1 𝑆 𝑑-1 respectively. Given any 𝛾 ∈ (0, 1), the test 𝒯 𝜆 𝛾 (𝜌 0 ) is most powerful with size 𝛾 for testing

ℋ 0 ∶ 𝑌 = Ξ 0 + 𝑋 against ℋ 1 ∶ 𝑌 = Ξ 1 + 𝑋.
Proof. The Neyman-Pearson test 𝒯 NP of level 𝛾 for testing ℋ 0 ∶ 𝑌 = Ξ 0 + 𝑋 against ℋ 1 ∶ 𝑌 = Ξ 1 + 𝑋 is given by:

∀𝑥 ∈ ℝ 𝑑 , 𝒯 NP (𝑥) = ⎧ { { { ⎨ { { { ⎩ 0 if 𝑓 Ξ 1 +𝑋 (𝑥) 𝑓 Ξ 0 +𝑋 (𝑥) ≤ 𝜆 1 if 𝑓 Ξ 1 +𝑋 (𝑥) 𝑓 Ξ 0 +𝑋 (𝑥) > 𝜆
with 𝜆 determined by ℙ[

𝑓 Ξ 1 +𝑋 (Ξ 0 +𝑋) 𝑓 Ξ 0 +𝑋 (Ξ 0 +𝑋)
> 𝜆] = 𝛾. Since 𝑋, Ξ 0 and Ξ 1 are spherically invariant, Ξ 0 + 𝑋 and Ξ 1 + 𝑋 are also spherically invariant, and from Lemma 2.2.13 we have:

∀𝑥 ∈ ℝ 𝑑 , 𝑓 Ξ 1 +𝑋 (𝑥) 𝑓 Ξ 0 +𝑋 (𝑥) = 𝑓 ‖Ξ 1 +𝑋‖ 2 (‖𝑥‖ 2 ) 𝑓 ‖Ξ 0 +𝑋‖ 2 (‖𝑥‖ 2 )
From Lemma 2.2.6, the probability density functions of ‖Ξ 0 + 𝑋‖ 2 and ‖Ξ 1 + 𝑋‖ 2 are 𝑓 𝜌 0 and 𝑓 𝜌 1 respectively, hence:

∀𝑥 ∈ ℝ 𝑑 , 𝑓 Ξ 1 +𝑋 (𝑥) 𝑓 Ξ 0 +𝑋 (𝑥) = 𝑓 𝜌 1 (‖𝑥‖ 2 ) 𝑓 𝜌 0 (‖𝑥‖ 2 )
Since the family of densities {𝑓 𝜌 , 𝜌 > 0} has a monotone likelihood ratio, we can rewrite the test 𝒯 NP as: To summarize our findings, we are able to find a 𝛾-MCCP test under the following conditions:

∀𝑥 ∈ ℝ 𝑑 , 𝒯 NP (𝑥) = ⎧ { ⎨ { ⎩ 0 if ‖𝑥‖ 2 ≤ 𝜇 1 if ‖𝑥‖ 2 > 𝜇 with 𝜇 determined by ℙ[‖Ξ 0 + 𝑋‖ 2 > 𝜇] = 𝛾. Since Ξ 0 ∈ Υ 𝜌 0 , from Lemma 2.2.6, we have ℙ[‖Ξ 0 + 𝑋‖ 2 > 𝜇] = ℙ[‖𝜃 + 𝑋‖ 2 > 𝜇] for any 𝜃 ∈ Υ 𝜌 0 . By definition of 𝜆 𝛾 (𝜌 0 ), we then have ℙ[‖Ξ 0 + 𝑋‖ 2 > 𝜆 𝛾 (𝜌 0 )] = 𝛾 Therefore 𝒯 NP = 𝒯 𝜆 𝛾 (𝜌 0 ) . Hence 𝒯 𝜆 𝛾 (𝜌 0 ) is most powerful for testing ℋ 0 ∶ 𝑌 = Ξ 0 + 𝑋 against ℋ 1 ∶ 𝑌 = Ξ 1 + 𝑋.
1. The noise distribution is spherically invariant (i.e. the maximal invariant is the euclidean norm).

2. The family of densities {𝑓 𝜌 , 𝜌 > 0} of ‖𝜃 + 𝑋‖ 2 where 𝜃 ∈ Υ 𝜌 has a monotone likelihood ratio. These two constraints are actually quite restrictive, and make it very difficult to find applicable distributions other than the Gaussian one. The second requirement is particularly constraining, because we cannot simply pick a family of densities that has a monotone likelihood ratio, and work from there. Indeed, the densities of this family have to correspond to the densities of ‖𝜃 + 𝑋‖ 2 , which is completely determined by the distribution chosen for 𝑋. Therefore we have to first choose a distribution for 𝑋, and then verify whether the resulting family of distributions {𝑓 𝜌 , 𝜌 > 0} has a monotone likelihood ratio. We describe in Appendix B how the calculations unfold in the Gaussian case. Outside of the Gaussian case, we have not been able to find other distributions that fulfill both of these requirements.

It is not impossible that the Gaussian distribution is the only one that respects these conditions, which could possibly hint that the RDT approach is intrinsically linked to the Gaussian noise. However, we have to keep in mind that the results presented in this chapter only offer sufficient conditions to find an optimal test, and we have not established many necessary conditions for such a test. Therefore, there may exist an alternate reasoning that could lead to an optimal test for other distributions.

Conclusion and perspectives

While our generalization of the RDT approach was not as successful as we had hoped for, we still managed to present some interesting aspects in this chapter. First, we offer a more complete picture of invariance regarding its use in hypothesis testing, compared to what is commonly found in the literature, which we hope can help clarify its use and the notions involved. Then we attempted to generalize the RDT approach to other noise distributions. While we were not able to find other applicable distributions using the results presented here, we managed nonetheless to revisit the original RDT approach under the invariance viewpoint, minimizing the reliance on the properties of the Gaussian distribution. Doing so also allowed us to see which properties of this distribution are essential to find an optimal test, notably the important of the monotone likelihood ratio.

While the works presented here did not allow us to generalize the RDT to other distributions, there are a few other approaches we can consider to find other applicable distributions:

• We restricted the latter part of our study to spherically invariant distributions, meaning that the maximal invariant is the euclidean norm. We did so because in this case, we can express easily express the density of the norm using Lemma 2.2.13. For other maximal invariants, we would need to figure out if we can find a similar relation, and see if this could lead to an optimal test. Lemma 2.2.13 comes from [24, Proposition 7.15], which gives the density of the maximal invariant 𝑀(𝑋) depending on the density of 𝑋. However, this density is not given with respect to the usual Lebesgue measure of ℝ, but to the image measure of the Lebesgue measure of ℝ 𝑑 using 𝑀.

• Instead of finding other applicable distributions, an idea could be to use Gaussian densities, expressed with respect to a measure that is not the Lebesgue measure, but a different one.

In the following chapter, we will explore a different idea to extend the RDT approach, which consists in taking into account the effects of estimating the parameters of the RDT model. In the previous chapter, we attempted to generalize the RDT approach to more noise distributions by studying the role of invariance in the RDT problem. In this chapter, we study a different aspect which is the effect of parameter estimation on the RDT test 𝒯 𝜆 𝛾 (𝜏) . So far, we always assumed that the parameter of the problem are perfectly known. But in some scenarios, this hypothesis may be questionable. For example, in many concrete problems, we do not have perfect knowledge of the properties of the noise, and we may need to estimate its covariance matrix. Depending on the quality of this estimation, the effective performance of the test may be negatively affected, resulting in a potential loss of optimality: the test may no longer have the desired level 𝛾, or it may also no longer be most powerful.

With this in mind, we decided to study how estimating the model 𝜃 0 and the noise variance 𝜎 0 (assuming that the noise is Gaussian and white) affects the RDT test. The reason why we decided to focus on the estimation of these two parameters will become apparent in the next chapter, when we present one of the methods we developed to help detect anomalies on signals.

We will first study the asymptotic properties of the RDT test 𝒯 𝜆 𝛾 (𝜏) , assuming that we have consistent estimators of 𝜃 0 and 𝜎 0 . The goal here is to find out to what extent the optimality of the RDT test is preserved when we estimate these parameters. In doing so, we will exhibit an appropriate asymptotic optimality criterion. The results of this section make up what we refer to as ARDT (Asymptotic Random Distortion Testing).

After presenting these theoretical results, we will then conduct simulations to not only confirm these results, but also try to quantify the performance loss that occurs when using coarse estimates. We will also present simulations applying the RDT test to a detection problem, compare it to the Neyman-Pearson test, and show how both tests are affected when an unknown distortion is added to the model.

Preliminary results

We start this chapter by stating a few preliminary results, mainly related to properties of convergence of sequences of random variables. Lemma 3.1.1: Convergence in distribution to a deterministic constant Let (𝑋 𝑛 ) 𝑛∈ℕ ∈ ℳ(Ω, ℝ 𝑑 ) ℕ be a sequence of random vectors and 𝑐 ∈ ℝ 𝑑 a deterministic vector. If (𝑋 𝑛 ) converges in distribution to 𝑐, then (𝑋 𝑛 ) converges in probability to 𝑐.

While this result is stated in [34, Corollary 1.5.4 B, p.19], there is no associated proof, and we could not find any in the literature. Therefore we have chosen to present a proof of this result.

In other words, convergence in probability of a sequence of random vectors is equivalent to convergence in probability of each component.

While this result may appear fairly trivial, we were unable to find a proof of this lemma anywhere in the literature. Therefore we decided to present a proof here.

Proof.

• First, assume that 𝑋 𝑛 ℙ -→ 𝑋. Let 𝑖 ∈ {1, ..., 𝑑} and 𝜖 > 0. We have

|𝑋 𝑖 𝑛 -𝑋 𝑖 | ≤ ‖𝑋 𝑛 -𝑋‖ 2 . Therefore ℙ[|𝑋 𝑖 𝑛 -𝑋 𝑖 | ≥ 𝜖] ≤ ℙ[‖𝑋 𝑛 -𝑋‖ 2 ≥ 𝜖]. Hence ℙ[|𝑋 𝑖 𝑛 -𝑋 𝑖 | ≥ 𝜖] → 0.
• Conversely, assume that ∀𝑖 ∈ {1, ..., 𝑑}, 𝑋 𝑖 𝑛 ℙ -→ 𝑋 𝑖 . Let 𝜖 > 0. We have:

ℙ[‖𝑋 𝑛 -𝑋‖ 2 ≥ 𝜖] ≤ ℙ ⎛ ⎜ ⎝ 𝑑 ⋃ 𝑖=1 [|𝑋 𝑖 𝑛 -𝑋 𝑖 | ≥ 𝜖 𝑑 ] ⎞ ⎟ ⎠ (3.1)
Indeed, if for every 𝑖 ∈ {1, ..., 𝑑} we have

|𝑋 𝑖 𝑛 -𝑋 𝑖 | < 𝜖 𝑑
, then ‖𝑋 𝑛 -𝑋‖ 2 < 𝜖. Therefore by contraposition we get Eq. (3.1). From Eq. (3.1) we get:

ℙ[‖𝑋 𝑛 -𝑋‖ 2 ≥ 𝜖] ≤ 𝑑 ∑ 𝑖=1 ℙ [|𝑋 𝑖 𝑛 -𝑋 𝑖 | ≥ 𝜖 𝑑 ] → 0
Therefore 𝑋 𝑛 ℙ -→ 𝑋.

-Preliminary results

Lemma 3.1.3

Let Ω 0 ∈ Σ such that ℙ(Ω 0 ) ≠ 0, and let ℙ Ω 0 be the probability measure defined by:

ℙ Ω 0 ∶ Σ ⟶ [0, 1] 𝐴 ⟼ ℙ(𝐴 ∩ Ω 0 ) ℙ(Ω 0 )
We have:

𝑋 𝑛 ℙ Ω 0 ----→ 𝑋
Proof. Let 𝜖 > 0. We have:

∀𝑛 ∈ ℕ, ℙ Ω 0 ([‖𝑋 𝑛 -𝑋‖ 2 ≥ 𝜖]) = ℙ([‖𝑋 𝑛 -𝑋‖ 2 ≥ 𝜖] ∩ Ω 0 ) ℙ(Ω 0 ) ≤ ℙ([‖𝑋 𝑛 -𝑋‖ 2 ≥ 𝜖]) ℙ(Ω 0 ) Since 𝑋 𝑛 ℙ -→ 𝑋, we have ℙ([‖𝑋 𝑛 -𝑋‖ 2 ≥ 𝜖]) → 0. Therefore ℙ Ω 0 ([‖𝑋 𝑛 -𝑋‖ 2 ≥ 𝜖]) → 0. Hence 𝑋 𝑛 ℙ Ω 0 ----→ 𝑋. Lemma 3.
⎧ { { { { { { { { { { { { { { { ⎨ { { { { { { { { { { { { { { { ⎩ Data model: ∃𝑌 ∈ ℳ(Ω, ℝ 𝑑 ), ∃Θ ∈ ℳ(Ω, ℝ 𝑑 ), ∃𝑋 ∈ ℳ(Ω, ℝ 𝑑 ), ⎧ { { { ⎨ { { { ⎩ (𝑋 ∼ 𝒩(0, 𝜎𝐼 𝑑 ) with 𝜎 > 0 unknown) ∧ (Θ and 𝑋 are independent) ∧ (𝑌 = Θ + 𝑋) ∧ (∀𝑦 ∈ ℝ 𝑑 , ∃𝜔 ∈ Ω, 𝑦 = 𝑌 (𝜔))
Testing problem:

Given one realization 𝑦 = 𝑌 (𝜔) = Θ(𝜔) + 𝑋(𝜔), determine whether:

⎧ { ⎨ { ⎩ ℋ 0 ∶ ‖Θ(𝜔) -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏 or ℋ 1 ∶ ‖Θ(𝜔) -𝜃 0 ‖ 2 > 𝜎 0 𝜏 with 𝜏 > 0 known, 𝜃 0 ∈ ℝ 𝑑 unknown, given consistent estimators θ
𝑛 and σ𝑛 of 𝜃 0 and 𝜎 0 respectively

(3.4)
The main difference with the original RDT problem presented in Definition 1.2.2 is of course the fact that 𝜃 0 and 𝜎 0 are unknown. We instead assume that we have access to consistent estimators θ 𝑛 and σ𝑛 of these values. As a reminder, the fact that these estimators are consistent simply means that θ 𝑛 and σ𝑛 converge in probability to 𝜃 0 and 𝜎 0 respectively as 𝑛 increases.

Another important difference to notice is the fact that the noise 𝑋 is white, i.e. its covariance matrix is of the form 𝜎 0 2 𝐼 𝑑 . The reason why we are not considering any covariance matrix 𝐶 is related to the invariance properties of the noise. Indeed, first consider the family of Gaussian distributions with covariance matrix 𝜎 2 𝐼 𝑑 for all 𝜎 > 0. All of these distributions are spherically invariant. Therefore replacing 𝜎 0 with any estimate σ will not affect the invariance properties of the noise. Now consider the case of a family of Gaussian distributions with any covariance matrix 𝐶. In this case, while all of these probability distributions are invariant, it is not the same group that leaves every distribution invariant. The group depends on the covariance matrix 𝐶 (see Eq. (2.10) for the definition of this group), and therefore replacing 𝐶 with an estimate means we do not necessarily preserve the invariance structure of the noise.

With this in mind, we decided to only consider the case 𝐶 = 𝜎 0 2 𝐼 𝑑 for now, which will slightly simplify the study. While this is not exhaustive, it remains an interesting and useful case, notably in the 1-dimensional case. We can also easily extend this study to the case when the covariance matrix has the form 𝜎 0 2 𝐶 with 𝐶 known and 𝜎 0 estimated. Note that, as a consequence of this, the Mahalanobis norm 𝜈 𝐶 (𝑦) of any vector 𝑦 ∈ ℝ 𝑑 becomes ‖𝑦‖ 2 /𝜎 0 .

To study the behavior of a test taking into account the estimates θ and σ, we will consider a slightly modified definition of a test compared to the definition we gave in Definition 1.1.1. We will denote such test T, and they will be functions of three parameters (the observation, the model estimate and the noise standard deviation estimate) defined on ℝ 𝑑 ×ℝ 𝑑 ×(0, +∞) and taking their values in {0, 1}. As an example, 3.2 -Asymptotic RDT we can consider for any 𝑡 > 0 the thresholding test T 𝑡 defined by:

T 𝑡 ∶ ℝ 𝑑 × ℝ 𝑑 × (0, ∞) ⟶ {0, 1} (𝑦, 𝜃, 𝜎) ⟼ ⎧ { ⎨ { ⎩ 1 if ‖𝑦 -𝜃‖ 2 𝜎 > 𝑡 0 otherwise (3.5)
These test T 𝑡 are a direct adaptation of the thresholding tests defined in Definition 1.2.8, in which the model 𝜃 0 and the noise standard deviation 𝜎 0 were both assumed to be known. We simply substituted 𝜃 0 and 𝜎 0 with the parameters 𝜃 and 𝜎 respectively. In addition to this, for each test T, we also define its critical region 𝐾 T by:

𝐾 T = {(𝑦, 𝜃, 𝜎) ∈ ℝ 𝑑 × ℝ 𝑑 × (0, ∞) ∶ T(𝑦, 𝜃, 𝜎) = 1} (3.6)
Note that in the following, we may shorten ℝ 𝑑 × ℝ 𝑑 × (0, ∞) to ℝ 2𝑑+1 to simplify notation. With this notation, when we consider for example (𝑦, 𝜃, 𝜎) ∈ ℝ 2𝑑+1 , it is implied that 𝑦, 𝜃 and 𝜎 belong to ℝ 𝑑 , ℝ 𝑑 , and (0, ∞) respectively.

In the following, we consider two consistent estimators θ 𝑛 and σ𝑛 of 𝜃 0 and 𝜎 0 respectively, i.e. θ 𝑛 ℙ -→ 𝜃 0 and σ𝑛 ℙ -→ 𝜎 0 , with σ𝑛 > 0 for every 𝑛 ∈ ℕ.

Asymptotic size and power

In this section, we will now derive asymptotic results regarding the size and the power of the test T 𝜆 𝛾 (𝜏) , which is adapted from the test 𝒯 𝜆 𝛾 (𝜏) , known to be 𝛾-MCCP for the RDT problem. The thresholding test T 𝜆 𝛾 (𝜏) is defined by:

T 𝜆 𝛾 (𝜏) ∶ ℝ 𝑑 × ℝ 𝑑 × (0, ∞) ⟶ {0, 1} (𝑦, 𝜃, 𝜎) ⟼ ⎧ { ⎨ { ⎩ 1 if ‖𝑦 -𝜃‖ 2 𝜎 > 𝜆 𝛾 (𝜏) 0 otherwise (3.7)
with the threshold 𝜆 𝛾 (𝜏) defined in Lemma 1.2.9.

From Chapter 1, we know that the test 𝒯 𝜆 𝛾 (𝜏) is optimal for the RDT problem. Since θ 𝑛 and σ𝑛 converge to 𝜃 0 and 𝜎 0 respectively, we may expect that T 𝜆 𝛾 (𝜏) is asymptotically optimal, i.e. it should asymptotically have level 𝛾 and be asymptotically most powerful.

We start with the asymptotic level of T 𝜆 𝛾 (𝜏) .

Theorem 3.2.2: Asymptotic level of T 𝜆 𝛾 (𝜏)

Let 𝒮 = {Ξ ∈ ℳ(Ω, ℝ 𝑑 ) ∶ ∀𝑛 ∈ ℕ, Ξ and ( θ 𝑛 , σ𝑛 ) are independent}. We have:

lim sup 𝑛 sup Ξ∈𝒮 ∶ ℙ[‖Ξ-𝜃 0 ‖ 2 ≤𝜎 0 𝜏]≠0 ℙ[ T 𝜆 𝛾 (𝜏) (Ξ + 𝑋, θ 𝑛 , σ𝑛 ) = 1 | ‖Ξ -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏] ≤ 𝛾
A noteworthy difference compared to the RDT case is that while 𝒯 𝜆 𝛾 (𝜏) has exactly size 𝛾, as stated in Theorem 1.2.10, here in the ARDT case, we only know that the test T 𝜆 𝛾 (𝜏) has asymptotic level 𝛾, i.e. its asymptotic size is lower than or equal to 𝛾.

Proof. Let Ξ 0 ∈ 𝒮 such that ℙ[‖Ξ 0 -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏] ≠ 0. ℙ[ T 𝜆 𝛾 (𝜏) (Ξ 0 + 𝑋, θ 𝑛 , σ𝑛 ) = 1 | ‖Ξ 0 -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏] = ∫ ℙ[ T 𝜆 𝛾 (𝜏) (Ξ 0 + 𝑋, 𝜃, 𝜎) = 1 | ‖Ξ 0 -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏]ℙ( θ 𝑛 , σ𝑛 ) -1 (d𝜃, d𝜎) ≤ ∫ sup Ξ∈ℳ(Ω,ℝ 𝑑 ) ∶ ℙ[‖Ξ-𝜃 0 ‖ 2 ≤𝜎 0 𝜏]≠0 ℙ[ T 𝜆 𝛾 (𝜏) (Ξ + 𝑋, 𝜃, 𝜎) = 1 | ‖Ξ -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏]ℙ( θ 𝑛 , σ𝑛 ) -1 (d𝜃, d𝜎)
From Lemma 1.2.5, since T 𝜆 𝛾 (𝜏) (⋅, 𝜃, 𝜎) is a test for any 𝜃 ∈ ℝ 𝑑 and any 𝜎 > 0, we have:

sup Ξ∈ℳ(Ω,ℝ 𝑑 ) ∶ ℙ[‖Ξ-𝜃 0 ‖ 2 ≤𝜎 0 𝜏]≠0 ℙ[ T 𝜆 𝛾 (𝜏) (Ξ + 𝑋, 𝜃, 𝜎) = 1 | ‖Ξ -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏] = sup 𝜉∈ℝ 𝑑 ∶ ‖𝜉-𝜃 0 ‖ 2 ≤𝜎 0 𝜏 ℙ[ T 𝜆 𝛾 (𝜏) (𝜉 + 𝑋, 𝜃, 𝜎) = 1]
Therefore:

ℙ[ T 𝜆 𝛾 (𝜏) (Ξ 0 + 𝑋, θ 𝑛 , σ𝑛 ) = 1 | ‖Ξ 0 -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏] ≤ ∫ sup 𝜉∈ℝ 𝑑 ∶ ‖𝜉-𝜃 0 ‖ 2 ≤𝜎 0 𝜏 ℙ[ T 𝜆 𝛾 (𝜏) (𝜃 + 𝑋, 𝜃, 𝜎) = 1]ℙ( θ 𝑛 , σ𝑛 ) -1 (d𝜃, d𝜎) ≤ ∫ sup 𝜉∈ℝ 𝑑 ∶ ‖𝜉-𝜃 0 ‖ 2 ≤𝜎 0 𝜏 ℙ [ ‖𝜉 + 𝑋 -𝜃‖ 2 𝜎 > 𝜆 𝛾 (𝜏)] ℙ( θ 𝑛 , σ𝑛 ) -1 (d𝜃, d𝜎)
Let 𝑊 = 𝜉 + 𝑋 -𝜃 ∼ 𝒩(𝜉 -𝜃, 𝜎 2 0 𝐼 𝑑 ). Using Eq. (1.19), we get:

ℙ [ ‖𝑊 ‖ 2 𝜎 > 𝜆 𝛾 (𝜏)] = ℙ [ ‖𝑊 ‖ 2 𝜎 0 > 𝜎 𝜎 0 𝜆 𝛾 (𝜏)] = 𝑄 𝑑/2 ( ‖𝜉 -𝜃‖ 2 𝜎 0 , 𝜎 𝜎 0 𝜆 𝛾 (𝜏))
The function 𝑄 𝑑/2 is continuous and increases with its first argument, therefore:

sup 𝜉∈ℝ 𝑑 ∶ ‖𝜉-𝜃 0 ‖ 2 ≤𝜎 0 𝜏 𝑄 𝑑/2 ( ‖𝜉 -𝜃‖ 2 𝜎 0 , 𝜎 𝜎 0 𝜆 𝛾 (𝜏)) = 𝑄 𝑑/2 ⎛ ⎜ ⎝ sup 𝜉∈ℝ 𝑑 ∶ ‖𝜉-𝜃 0 ‖ 2 ≤𝜎 0 𝜏 ‖𝜉 -𝜃‖ 2 𝜎 0 , 𝜎 𝜎 0 𝜆 𝛾 (𝜏) ⎞ ⎟ ⎠ = 𝑄 𝑑/2 (𝜏 + ‖𝜃 -𝜃 0 ‖ 2 𝜎 0 , 𝜎 𝜎 0 𝜆 𝛾 (𝜏))
Hence:

ℙ[ T 𝜆 𝛾 (𝜏) (Ξ 0 + 𝑋, θ 𝑛 , σ𝑛 ) = 1 | ‖Ξ 0 -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏] ≤ ∫ 𝑄 𝑑/2 (𝜏 + ‖𝜃 -𝜃 0 ‖ 2 𝜎 0 , 𝜎 𝜎 0 𝜆 𝛾 (𝜏))ℙ( θ 𝑛 , σ𝑛 ) -1 (d𝜃, d𝜎)
This inequality is valid for any Ξ 0 ∈ 𝒮 such that ℙ[‖Ξ 0 -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏] ≠ 0, and the right-hand side does not depend on Ξ 0 . Therefore:

sup Ξ∈𝒮 ∶ ℙ[‖Ξ-𝜃 0 ‖ 2 ≤𝜎 0 𝜏]≠0 ℙ[ T 𝜆 𝛾 (𝜏) (Ξ + 𝑋, θ 𝑛 , σ𝑛 ) = 1 | ‖Ξ -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏] ≤ ∫ 𝑄 𝑑/2 (𝜏 + ‖𝜃 -𝜃 0 ‖ 2 𝜎 0 , 𝜎 𝜎 0 𝜆 𝛾 (𝜏))ℙ( θ 𝑛 , σ𝑛 ) -1 (d𝜃, d𝜎)
From Appendix C, the Generalized Marcum function 𝑄 𝑑/2 is uniformly continuous on [0, +∞)×[0, +∞).

It is also bounded by definition. Therefore, from the Portmanteau theorem [START_REF] Billingsley | Convergence of Probability Measures[END_REF], since ( θ 𝑛 ) 𝑛∈ℕ and (σ 𝑛 ) 𝑛∈ℕ converges in distribution to 𝜃 2 0 and 𝜎 2 0 respectively, and by definition of 𝜆 𝛾 (𝜏), we have:

lim 𝑛 ∫ 𝑄 𝑑/2 (𝜏 + ‖𝜃 -𝜃 0 ‖ 2 𝜎 0 , 𝜎 𝜎 0 𝜆 𝛾 (𝜏))ℙ( θ 𝑛 , σ𝑛 ) -1 (d𝜃, d𝜎) = 𝑄 𝑑/2 (𝜏, 𝜆 𝛾 (𝜏)) = 𝛾 Hence: lim sup 𝑛 sup Ξ∈𝒮 ∶ ℙ[‖Ξ-𝜃 0 ‖ 2 ≤𝜎 0 𝜏]≠0 ℙ[ T 𝜆 𝛾 (𝜏) (Ξ + 𝑋, θ 𝑛 , σ𝑛 ) = 1 | ‖Ξ -𝜃 0 ‖ 2 ≤ 𝜎 0 𝜏] ≤ 𝛾
which is the desired result.

Now that we have our result regarding the asymptotic level of the test T 𝜆 𝛾 (𝜏) , we can now study its asymptotic power.

Let 𝑍 = (𝑌 , 𝜃 0 , 𝜎 0 ) and for every 𝑛 ∈ ℕ, let 𝑍 𝑛 = (𝑌 , θ 𝑛 , σ𝑛 ). From Lemma 3.1.2, 𝑍 𝑛 converge in probability to 𝑍, since θ 𝑛 and σ𝑛 converge in probability to 𝜃 0 and 𝜎 0 respectively. For every 𝜌 ≥ 0, every 𝐴 ∈ ℛ 2𝑑+1 and every 𝑛 ∈ ℕ, let Π 𝑛 and Π be the functions defined by:

Π 𝑛 (𝜌, 𝐴) = ℙ[𝑍 𝑛 ∈ 𝐴 | ‖Θ -𝜃 0 ‖ 2 = 𝜌] (3.8) Π(𝜌, 𝐴) = ℙ[𝑍 ∈ 𝐴 | ‖Θ -𝜃 0 ‖ 2 = 𝜌] (3.9) Lemma 3.2.3
For any ℙ𝑍 -1 -continuity set 𝐴 ∈ ℛ 2𝑑+1 , we have:

∀𝐵 ∈ ℛ, ∫ 𝐵 Π 𝑛 (𝜌, 𝐴)ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌) -→ 𝑛 ∫ 𝐵 Π(𝜌, 𝐴)ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌)
Proof. Let 𝐵 ∈ ℛ. By definition of a conditional probability, we have:

ℙ([𝑍 𝑛 ∈ 𝐴] ∩ [‖Θ -𝜃 0 ‖ 2 ∈ 𝐵]) = ∫ 𝐵 Π 𝑛 (𝜌, 𝐴)ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌) (3.10)
as well as:

ℙ([𝑍 ∈ 𝐴] ∩ [‖Θ -𝜃 0 ‖ 2 ∈ 𝐵]) = ∫ 𝐵 Π(𝜌, 𝐴)ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌) (3.11)
There are two possibilities: either

ℙ[‖Θ -𝜃 0 ‖ 2 ∈ 𝐵] = 0 or ℙ[‖Θ -𝜃 0 ‖ 2 ∈ 𝐵] ≠ 0. • If ℙ[‖Θ -𝜃 0 ‖ 2 ∈ 𝐵] = 0, then ℙ([𝑍 𝑛 ∈ 𝐴] ∩ [‖Θ -𝜃 0 ‖ 2 ∈ 𝐵]) = ℙ([𝑍 ∈ 𝐴] ∩ [‖Θ -𝜃 0 ‖ 2 ∈ 𝐵]) = 0.
Therefore we trivially get:

∫ 𝐵 Π 𝑛 (𝜌, 𝐴)ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌) -→ 𝑛 ∫ 𝐵 Π(𝜌, 𝐴)ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌) • Otherwise, if ℙ[‖Θ -𝜃 0 ‖ 2 ∈ 𝐵] ≠ 0, we have from Bayes' rule: ℙ([𝑍 𝑛 ∈ 𝐴] ∩ [‖Θ -𝜃 0 ‖ 2 ∈ 𝐵]) = ℙ[𝑍 𝑛 ∈ 𝐴 | ‖Θ -𝜃 0 ‖ 2 ∈ 𝐵]ℙ[‖Θ -𝜃 0 ‖ 2 ∈ 𝐵]
Recall that we consider a probability space (Ω, Σ, ℙ) on which all random variables are defined.

Let Ω 0 = [‖Θ -𝜃 0 ‖ 2 ∈ 𝐵] ∈ Σ and let ℙ Ω 0 be the probability measure defined by:

ℙ Ω 0 ∶ Σ ⟶ [0, 1] 𝑀 ⟼ ℙ(𝑀 ∩ Ω 0 ) ℙ(Ω 0 ) From Lemma 3.1.3, since ℙ(Ω 0 ) ≠ 0, we have 𝑍 𝑛 ℙ Ω 0 ----→ 𝑍.
Since 𝐴 is a ℙ𝑍 -1 -continuity set, it is also a ℙ Ω 0 𝑍 -1 -continuity set. Indeed, we have:

ℙ Ω 0 [𝑍 ∈ 𝜕𝐴] = ℙ([𝑍 ∈ 𝜕𝐴] ∩ Ω 0 ) ℙ(Ω 0 ) ≤ ℙ[𝑍 ∈ 𝜕𝐴] ℙ(Ω 0 ) = 0
because 𝐴 is a ℙ𝑍 -1 -continuity set Therefore from the Portmanteau theorem [35, Theorem 2.1], we have:

ℙ Ω 0 [𝑍 𝑛 ∈ 𝐴] -→ 𝑛 ℙ Ω 0 [𝑍 ∈ 𝐴] Hence: ℙ([𝑍 𝑛 ∈ 𝐴] ∩ [‖Θ -𝜃 0 ‖ 2 ∈ 𝐵]) -→ 𝑛 ℙ([𝑍 ∈ 𝐴] ∩ [‖Θ -𝜃 0 ‖ 2 ∈ 𝐵]
) which yields the desired result using Eqs. (3.10) and (3.11).

We can now present the result regarding the asymptotic power of T 𝜆 𝛾 (𝜏) , which is our optimality criterion in the ARDT problem.

Theorem 3.2.4: Asymptotic optimality of T 𝜆 𝛾 (𝜏)

For any test T ∶ ℝ 2𝑑+1 → {0, 1} such that the test T(⋅, 𝜃 0 , 𝜎 0 ) has level 𝛾 for the RDT problem, and has constant conditional power function given ‖Θ -𝜃 0 ‖ 2 = 𝜌 for Pr ‖Θ -𝜃 0 ‖ -1 2 -almost every 𝜌, if 𝐾 T is a ℙ𝑍 -1 -continuity set, then we have:

lim sup 𝑛 (Π 𝑛 (𝜌, 𝐾 T 𝜆 𝛾 (𝜏) ) -Π 𝑛 (𝜌, 𝐾 T)) ≥ 0 (3.12)
Proof. As a reminder, 𝐾 𝒯 𝜆 𝛾 (𝜏) and 𝐾 T 𝜆 𝛾 (𝜏) , the respective critical regions of 𝒯 𝜆 𝛾 (𝜏) and T 𝜆 𝛾 (𝜏) , are defined by:

𝐾 𝒯 𝜆 𝛾 (𝜏) = {𝑦 ∈ ℝ 𝑑 ∶ ‖𝑦 -𝜃 0 ‖ 2 𝜎 0 > 𝜆 𝛾 (𝜏)} 𝐾 T 𝜆 𝛾 (𝜏) = {(𝑦, 𝜃, 𝜎) ∈ ℝ 2𝑑+1 ∶ ‖𝑦 -𝜃‖ 2 𝜎 > 𝜆 𝛾 (𝜏)}
Let T ∶ ℝ 2𝑑+1 → {0, 1} be a test such that the test 𝒯 defined by

𝒯 ∶ ℝ 𝑑 ⟶ {0, 1} 𝑦 ⟼ T(𝑦, 𝜃 0 , 𝜎 0 )
has level 𝛾 for the RDT problem and has constant conditional power function given ‖Θ -𝜃 0 ‖ 2 = 𝜌 for ℙ‖Θ -𝜃 0 ‖ -1 2 -almost every 𝜌. Since 𝒯 𝜆 𝛾 (𝜏) is 𝛾-MCCP, we have by definition for ℙ‖Θ -𝜃 0 ‖ -1 2 -almost every 𝜌 > 𝜏:

ℙ[𝒯 𝜆 𝛾 (𝜏) (𝑌 ) = 1 | ‖Θ -𝜃 0 ‖ 2 = 𝜌] ≥ ℙ[𝒯(𝑌 ) = 1 | ‖Θ -𝜃 0 ‖ 2 = 𝜌] (3.13)
We can equivalently write that for ℙ‖Θ -𝜃 0 ‖ -1 2 -almost every 𝜌 > 𝜏, we have:

ℙ[𝑌 ∈ 𝐾 𝒯 𝜆 𝛾 (𝜏) | ‖Θ -𝜃 0 ‖ 2 = 𝜌] ≥ ℙ[𝑌 ∈ 𝐾 𝒯 | ‖Θ -𝜃 0 ‖ 2 = 𝜌] (3.14)
By definition of 𝑍 (reminder: 𝑍 = (𝑌 , 𝜃 0 , 𝜎 0 )), we have:

𝑌 ∈ 𝐾 𝒯 𝜆 𝛾 (𝜏) ⇔ ‖𝑦 -𝜃 0 ‖ 2 𝜎 0 > 𝜆 𝛾 (𝜏) ⇔ 𝑍 ∈ 𝐾 T 𝜆 𝛾 (𝜏)
and 𝑌 ∈ 𝐾 𝒯 ⇔ 𝒯(𝑦) = 1 ⇔ T(𝑦, 𝜃 0 , 𝜎 0 ) = 1 ⇔ 𝑍 ∈ 𝐾 T Therefore, for ℙ‖Θ -𝜃 0 ‖ -1 2 -almost every 𝜌 > 𝜏:

ℙ[𝑍 ∈ 𝐾 T 𝜆 𝛾 (𝜏) | ‖Θ -𝜃 0 ‖ 2 = 𝜌] ≥ ℙ[𝑍 ∈ 𝐾 T | ‖Θ -𝜃 0 ‖ 2 = 𝜌] (3.15)
Equation (3.15) also means that for ℙ‖Θ -𝜃 0 ‖ -1 2 -almost every 𝜌 > 𝜏:

Π(𝜌, 𝐾 T 𝜆 𝛾 (𝜏) ) ≥ Π(𝜌, 𝐾 T) (3.16)
Therefore:

∀𝐵 ∈ ℬ((𝜏, ∞)), ∫ 𝐵 Π(𝜌, 𝐾 T 𝜆 𝛾 (𝜏) )ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌) ≥ ∫ 𝐵 Π(𝜌, 𝐾 T)ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌) (3.17)
If 𝐾 T 𝜆 𝛾 (𝜏) and 𝐾 T are ℙ𝑍 -1 -continuity sets, then from Lemma 3.2.3 we have:

∀𝐵 ∈ ℬ((𝜏, ∞)), lim 𝑛 ∫ 𝐵 Π 𝑛 (𝜌, 𝐾 T 𝜆 𝛾 (𝜏) )ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌) ≥ lim 𝑛 ∫ 𝐵 Π 𝑛 (𝜌, 𝐾 T)ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌) (3.18)
We can rewrite Eq. (3.18) as:

∀𝐵 ∈ ℬ((𝜏, ∞)), lim 𝑛 ∫ 𝐵 (Π 𝑛 (𝜌, 𝐾 T 𝜆 𝛾 (𝜏) ) -Π 𝑛 (𝜌, 𝐾 T))ℙ‖Θ -𝜃 0 ‖ -1 2 (d𝜌) ≥ 0 (3.19)
By applying Lemma 3.1.4, we get that for ℙ‖Θ -𝜃 0 ‖ -1 2 -almost every 𝜌 > 𝜏:

lim sup 𝑛 (Π 𝑛 (𝜌, 𝐾 T 𝜆 𝛾 (𝜏) ) -Π 𝑛 (𝜌, 𝐾 T)) ≥ 0 (3.20)
which is the sought result.

In this theorem, we specify that we consider the class of tests T whose critical region 𝐾 T is a ℙ𝑍 -1continuity set. We can wonder what this constraint implies on the test T. If we consider a Borel set 𝐴 ∈ ℛ 2𝑑+1 , what does 𝐴 ∈ ℛ 2𝑑+1 being a ℙ𝑍 -1 -continuity set mean? Going back to the definition of a continuity set, this means that ℙ[𝑍 ∈ 𝜕𝐴] = 0. Since 𝑍 = (𝑌 , 𝜃 0 , 𝜎 0 ), this means that ℙ[(𝑌 , 𝜃 0 , 𝜎 0 ) ∈ (𝜕𝐴)] = 0. In the following, for any set 𝐵 ∈ ℛ 2𝑑+1 , we will denote by 𝐵 𝜃 0 ,𝜎 0 its (𝜃 0 , 𝜎 0 )-section, which is defined by:

(𝜕𝐵) 𝜃 0 ,𝜎 0 = {𝑦 ∈ ℝ 𝑑 ∶ (𝑦, 𝜃 0 , 𝜎 0 ) ∈ 𝜕𝐵} (3.21)
With this notation, if 𝐴 is a ℙ𝑍 -1 -continuity set, then we have ℙ[𝑌 ∈ (𝜕𝐴) 𝜃 0 ,𝜎 0 ] = 0, where (𝜕𝐴) 𝜃 0 ,𝜎 0 denotes the (𝜃 0 , 𝜎 0 )-section of 𝜕𝐴, the boundary of 𝐴. For a test T, this means that we have ℙ[𝑌 ∈ (𝜕𝐾 T) 𝜃 0 ,𝜎 0 ] = 0.

One aspect that may be interesting to study is whether this constraint tells us anything on the set 𝜕(𝐾 T𝜃 0 ,𝜎 0 ). Indeed, let 𝒯 be the test T(⋅, 𝜃 0 , 𝜎 0 ). The set 𝐾 T𝜃 0 ,𝜎 0 is defined by:

𝐾 T𝜃 0 ,𝜎 0 = {𝑦 ∈ ℝ 𝑑 ∶ (𝑦, 𝜃 0 , 𝜎 0 ) ∈ 𝐾 T} = {𝑦 ∈ ℝ 𝑑 ∶ T(𝑦, 𝜃 0 , 𝜎 0 ) = 1} = {𝑦 ∈ ℝ 𝑑 ∶ 𝒯(𝑦) = 1} = 𝐾 𝒯 (3.22)
Therefore studying the boundary of 𝐾 T𝜃 0 ,𝜎 0 means studying the boundary of 𝐾 𝒯 , the critical region of a test defined on ℝ 𝑑 , which is potentially easier to work with.

In short, the question is whether, for some set 𝐴 ∈ ℛ 2𝑑+1 , we can link (𝜕𝐴) 𝜃 0 ,𝜎 0 and 𝜕(𝐴 𝜃 0 ,𝜎 0 ). We first present some useful relations between sets and sections in Lemma 3.2.5, and then Lemma 3.2.6 shows the result we obtained. Lemma 3.2.5

For two sets 𝐴 and 𝐵, we have:

(𝐴 ∩ 𝐵) 𝜃 0 ,𝜎 0 = 𝐴 𝜃 0 ,𝜎 0 ∩ 𝐵 𝜃 0 ,𝜎 0 (3.23) (𝐴 𝑐 ) 𝜃 0 ,𝜎 0 = (𝐴 𝜃 0 ,𝜎 0 ) 𝑐 (3.24) 𝐴 𝜃 0 ,𝜎 0 ⊂ 𝐴 𝜃 0 ,𝜎 0 (3.
𝑥 ∈ 𝐴 𝜃 0 ,𝜎 0 ⇔∃(𝑥 𝑛 ) 𝑛∈ℕ ∈ (𝐴 𝜃 0 ,𝜎 0 ) ℕ , 𝑥 𝑛 -→ 𝑛 𝑥 ⇔∃(𝑥 𝑛 ) 𝑛∈ℕ ∈ (𝐴 𝜃 0 ,𝜎 0 ) ℕ , (𝑥 𝑛 , 𝜃 0 , 𝜎 0 ) -→ 𝑛 (𝑥, 𝜃 0 , 𝜎 0 ) ⇒∃(𝑢 𝑛 ) 𝑛∈ℕ ∈ 𝐴 ℕ , 𝑢 𝑛 -→ 𝑛 (𝑥, 𝜃 0 , 𝜎 0 ) ⇒(𝑥, 𝜃 0 , 𝜎 0 ) ∈ 𝐴 ⇒𝑥 ∈ 𝐴 𝜃 0 ,𝜎 0 Lemma 3.2.6
For any set 𝐴 ∈ ℛ 2𝑑+1 , we have 𝜕(𝐴 𝜃 0 ,𝜎 0 ) ⊂ (𝜕𝐴) 𝜃 0 ,𝜎 0 .

Proof. Using the definition of the boundary of a set and the previous lemma, we have:

(𝜕𝐴) 𝜃 0 ,𝜎 0 = (𝐴 ∖ Å ) 𝜃 0 ,𝜎 0 = (𝐴 ∩ ( Å ) 𝑐 ) 𝜃 0 ,𝜎 0 = 𝐴 𝜃 0 ,𝜎 0 ∩ (( Å ) 𝑐 ) 𝜃 0 ,𝜎 0 = 𝐴 𝜃 0 ,𝜎 0 ∩ (( Å ) 𝜃 0 ,𝜎 0 ) 𝑐 𝜕(𝐴 𝜃 0 ,𝜎 0 ) = 𝐴 𝜃 0 ,𝜎 0 ∖ ⏜ 𝐴 𝜃 0 ,𝜎 0 = 𝐴 𝜃 0 ,𝜎 0 ∩ ⏜ 𝐴 𝜃 0 ,𝜎 0

𝑐

For any set 𝐵, by definition of the interior of a set, we have B = 𝐵 𝑐 𝑐 . Thus:

⏜ 𝐴 𝜃 0 ,𝜎 0 𝑐 = (𝐴 𝜃 0 ,𝜎 0 ) 𝑐 = (𝐴 𝑐 ) 𝜃 0 ,𝜎 0 (( Å ) 𝜃 0 ,𝜎 0 ) 𝑐 = ((𝐴 𝑐 𝑐 ) 𝜃 0 ,𝜎 0 ) 𝑐 = 𝐴 𝑐 𝜃 0 ,𝜎 0
By applying Eq. (3.25) to 𝐴 and 𝐴 𝑐 , we get:

𝐴 𝜃 0 ,𝜎 0 ⊂ 𝐴 𝜃 0 ,𝜎 0 ⏜ 𝐴 𝜃 0 ,𝜎 0 𝑐 ⊂ (( Å ) 𝜃 0 ,𝜎 0 ) 𝑐 Therefore 𝜕(𝐴 𝜃 0 ,𝜎 0 ) ⊂ (𝜕𝐴) 𝜃 0 ,𝜎 0 .
What can we conclude from this result? Applying Lemma 3.2.6 to 𝐾 T, the critical region of T, we obtain 𝜕𝐾 𝒯 ⊂ (𝜕𝐾 T) 𝜃 0 ,𝜎 0 . Therefore, if ℙ[𝑌 ∈ (𝜕𝐾 T) 𝜃 0 ,𝜎 0 ] = 0, then we necessarily have ℙ[𝑌 ∈ 𝜕𝐾 𝒯 ] = 0. From this, we know that the class of tests we consider in Theorem 3.2.4 is composed of tests whose border is a ℙ𝑌 -1 -continuity set when 𝜃 0 and 𝜎 0 are known.

Simulation experiments

After presenting our theoretical results regarding Asymptotic RDT in the previous section, we will now confirm some of them through simulations. As previously stated, being able to ensure a certain level 𝛾 is an important aspect to consider when designing a test for a given problem. Ensuring that we verify this property will be an integral part of these simulations.

Since these simulations are the first ones that we present in this thesis, we will also take this opportunity to see how the RDT test performs in a detection problem in order to demonstrate a realistic use case. We will compare it to the typical Neyman-Pearson test to exhibit differences between them, both in terms of performance and assumptions made.

Level

We start off by studying the level of the RDT test 𝒯 𝜆 𝛾 (𝜏) . The goal of this first section is twofold. On one hand, we will confirm the results described in Theorem 3.2.2 which, as a reminder, states that the test 𝒯 𝜆 𝛾 (𝜏) has asymptotic level 𝛾 as the estimates θ 𝑛 and σ𝑛 improve. On the other hand, we will also see how the RDT test 𝒯 𝜆 𝛾 (𝜏) behaves in the non-asymptotic case. This will allow us to measure the performance degradation caused by poor parameter estimation, and also to see at which point we approach the theoretical results.

We run Monte-Carlo simulations to estimate the effective false-alarm rate (which will be denoted as ℙ FA ) for given sets of parameters. The parameters that we have to choose for these simulations are: After identifying the parameters to set, the next question is how to set them, as to ensure that the results we get are relevant. Among all these parameters, the one that requires the most attention is most likely the distribution of Θ. Indeed, there are countless possible probability distributions, and so we have to be careful picking one that is representative of what we want to show.

We have already stated that we want to confirm results regarding the level of the test. This means that we want ‖Θ‖ 2 ≤ 𝜎 0 𝜏. For the sake of efficiency, it would be ideal to find a distribution for Θ that maximizes the false-alarm rate, which would then represent the worst-case scenario. From the properties of the power function of the RDT test, this is the case whenever we have ‖Θ‖ 2 = 𝜎 0 𝜏 almost surely, meaning that Θ is almost surely on the sphere of radius 𝜎 0 𝜏. This already significantly narrows down our choice of distribution, but there are still many left to choose from. We chose a uniform spherical distribution with radius 𝜎 0 𝜏, since it does not favor any particular situation, and also because generating samples from such a distribution can be done easily (see for example [START_REF] Muller | A Note on a Method for Generating Points Uniformly on N-Dimensional Spheres[END_REF]). Indeed, we can simply generate a spherical 𝑑-dimensional Gaussian vector and normalize it to get a uniformly distributed random vector on the unit sphere. With this choice, we expect the measured false-alarm rate to be equal to 𝛾 when the noise variance and the model are perfectly known, since the RDT test has exactly size 𝛾 in these circumstances. Now that we have explained our choice of probability distribution for Θ, we will go through the choices that we made for the other parameters:

• We arbitrarily chose a 2-dimensional problem (𝑑 = 2).

• The level 𝛾 was set to values spreading from 10 -6 to 1, which should cover a representative range of realistic cases. • The noise standard deviation 𝜎 0 was set to 1 for the sake of simplicity.

• For the same reason, we set the model 𝜃 0 to 0.

• To choose the tolerance 𝜏, we decided to express it relatively to the noise standard deviation 𝜎 0 using the DNR (Maximum-Distortion-to-Noise ratio), which is simply the ratio between 𝜏 and 𝜎 0 .

In the following, we will express it in decibels: DNR dB = 20 log(𝜏/𝜎 0 ). We chose a few values of DNR: -∞ dB (no distortion), -5 dB, 0 dB, and 5 dB. • The noise standard deviation estimate is generated using the typical unbiased standard deviation estimator applied to 𝑁 independent and identically distributed scalar Gaussian samples with mean 0 and variance 𝜎 0 2 . We then need to choose the parameter 𝑁, which will dictate the quality of the noise standard deviation estimate. We have decided to pick values ranging from 𝑁 = 10 samples to 𝑁 = 1000. We will also have cases when we assume 𝜎 0 to be known as reference.

• The model is assumed to be known: θ = 𝜃 0 .

With the parameters defined, we can now present the simulation procedure that we used for each set of parameters. The following steps detail one simulation iteration, this process is then repeated enough times to get a good estimate of the detection rate:

1. Generate a signal sample Θ ∼ ℙ Θ . 2. Generate a noise sample 𝑋 ∼ 𝒩(0, 𝜎 0 2 𝐼 𝑑 ). 3. From these samples, generate the observation 𝑌 = Θ + 𝑋. 4. Generate an estimate σ of 𝜎 0 (if needed, since some simulations assume 𝜎 0 to be known):

(a) Generate 𝑁 independent and identically distributed Gaussian scalar samples (𝑋 1 , …, 𝑋 𝑁 ) ∈ (ℳ(Ω, ℝ)) 𝑁 with mean 0 and variance 𝜎 0 2 .

(b) Compute the unbiased standard deviation estimate of the samples (𝑋 1 , …, 𝑋 𝑁 ) using the usual maximum-likelihood estimator:

σ𝑁 = √ √ √ ⎷ 1 𝑁 -1 𝑁 ∑ 𝑖=1 ⎛ ⎜ ⎜ ⎝ 𝑋 𝑖 - 𝑁 ∑ 𝑗=1 𝑋 𝑗 ⎞ ⎟ ⎟ ⎠ 2 (3.26)
5. Apply the test T 𝜆 𝛾 (𝜏) (𝑦, σ) and count a detection if T 𝜆 𝛾 (𝜏) (𝑦, σ) = 1.

The measured false alarm rate is then obtained by counting the number of detections and dividing it by the number of iterations.

Now that we have detailed our simulation procedure, we can finally start presenting some results. We claimed just before that if 𝜃 0 and 𝜎 0 are both known, then the measured false alarm rate should be equal to 𝛾 with these parameters, so let us start by verifying this claim. In Fig. 3.1, we plot the measured false alarm rate against the desired level 𝛾 for different values of DNR. As we can see on this figure, it seems that we indeed always have ℙ FA = 𝛾 regardless of the signal amplitude. Keep in mind that modifying the DNR means changing both the tolerance 𝜏 in the definition of the RDT problem and the amplitude of the generated signal Θ (since we chose Θ such that ‖Θ‖ 2 = 𝜎 0 𝜏), so that they are always equal. After verifying this first claim, we can now introduce the estimation of 𝜎 0 to see its effect of the false-alarm rate. These simulation results are shown in Fig. 3.2 for multiple values of DNR and 𝑁 which, as a reminder, stands for the number of samples used to estimate 𝜎 0 . On this figure, we can see that replacing 𝜎 0 with an estimate σ results in an increase of the false-alarm rate, such that the RDT test no longer has level 𝛾. The observed increase depends of course on the quality of the estimation. For example, this increase is barely noticeable for 𝑁 = 1000 which we could have expected since this is a fairly good estimate of 𝜎 0 , whereas with 𝑁 = 10, we only get a mediocre estimate and we can see that it is clearly insufficient, especially for low values of 𝛾. For instance, with 𝛾 = 10 -6 and 𝑁 = 10, we can observe a measured false alarm rate greater than 10 -3 , meaning that it would not be usable in this case since the effective false-alarm rate would be up to three orders of magnitude greater than expected in this case (up to, because remember that the signal distribution that we considered is the worst-case scenario, other distributions for Θ may result in a lower false-alarm rate).

Another aspect worth mentioning is the influence of the tolerance 𝜏. We can see that increasing the tolerance results in a higher false-alarm rate in the worst-case scenario. This increase appears to be accentuated by low values of 𝛾 and 𝑁. At the time of writing, we do not have an explanation for this phenomenon.

The results displayed in this figure are coherent with Theorem 3.2.2. Indeed, if we consider the evolution of ℙ FA as 𝑁 increases with fixed values of 𝛾 and DNR, we can see that ℙ FA decreases and approaches 𝛾. Asymptotically, it seems likely we would indeed have ℙ FA ≤ 𝛾, as stated in Theorem 3.2.2. In addition, it appears that we actually have ℙ FA = 𝛾 asymptotically in this case. This would indicate that the RDT test T 𝜆 𝛾 (𝜏) does not only have asymptotic level 𝛾 as we have proven in Theorem 3.2.2, but also asymptotic size 𝛾. We can observe the same behavior on Fig. 3.3, which presents the same simulation results, but this time plotting ℙ FA against 𝑁 for several values of 𝛾. We can also clearly see here that lower values of 𝛾 require a more accurate estimate of 𝜎 0 in order for the effective false alarm rate to approach 𝛾.

Application to a detection problem

Now that we have somewhat confirmed the results regarding the asymptotic level of the RDT test, we will now look at an application to a detection problem. The idea here is to try to detect a signal that is affected by some unknown distortion. We will see how the estimation of 𝜎 0 affects the performance of this test for such a problem, and we will also compare it to the Neyman-Pearson test. Of course, these two tests are very different, notably in terms of the knowledge of the problem required to use them. However we think this comparison is still useful to some extent in order to highlight these differences, see what assumptions are required to use them and find some of their limitations. The Neyman-Pearson test will be used sub-optimally here, since the test used here does not account for the distortion, which is assumed to be unknown. This is fairly common in practice, the Neyman-Pearson test is often used in circumstances where the models used under both hypotheses do not perfectly match reality. This of course affects the performance of test, but if the models are good enough, we can hope that the performance penalty remains small. Let us start by defining the detection problem of interest. We consider a problem in which we want to test the presence of a fixed signal 𝜉 ∈ ℝ 𝑑 in presence of white Gaussian noise 𝑋 ∼ 𝒩(0, 𝜎 0 2 𝐼 𝑑 ). This signal 𝜉 is affected by some unknown additive random distortion Δ ∈ ℳ(Ω, ℝ 𝑑 ), independent from 𝑋. This distortion is assumed to have a bounded amplitude such that ‖Δ‖ 2 ≤ 𝜎 0 𝜏, with 𝜏 > 0 being known. This detection problem can be summarized as follows:

Detection problem ⎧ { { { { { { { { { { { { { { { { ⎨ { { { { { { { { { { { { { { { { ⎩ Observation: 𝑌 = 𝜀𝜉 + Δ + 𝑋 where : ⎧ { { { { { ⎨ { { { { { ⎩ 𝜀 ∈ {0, 1} is unknown 𝜉 ∈ ℝ 𝑑 is known Δ ∈ ℳ(Ω, ℝ 𝑑 ) is unknown, with ‖Δ‖ 2 ≤ 𝜏 for a known 𝜏 ≥ 0 𝑋 ∼ 𝒩(0, 𝜎 0 2 𝐼 𝑑 )
Δ and 𝑋 are independent Testing problem:

Given one realization 𝑦 = 𝑌 (𝜔), determine whether:

⎧ { ⎨ { ⎩ ℋ 0 ∶ 𝜀 = 0 ℋ 1 ∶ 𝜀 = 1 (3.27)
The presence of an unknown and bounded distortion Δ means that the RDT test 𝒯 𝜆 𝛾 (𝜏) is likely a good candidate for this problem. Indeed, under ℋ 0 , the generated signal Δ + 𝑋 matches the kind of signal we consider in the RDT problem (see Definition 1.2.2) under ℋ 0 . Its performance will likely depend on the signal 𝜉 and the maximal distortion amplitude 𝜏 considered.

Similarly to what we did previously, the tolerance 𝜏 and the signal 𝜉 will be determined using the DNR (Maximum-Distortion-to-Noise ratio) and SNR (Signal-to-Noise ratio) respectively. These two values will be expressed in decibels and are defined by: DNR dB = 20 log(𝜏/𝜎 0 )

SNR dB = 20 log(‖𝜉‖ 2 /𝜎 0 ) (3.28)
If we ignored the distortion (Δ = 0), we could simply find and use the appropriate Neyman-Pearson test, since both hypotheses are simple. In this case, the Neyman-Pearson test of level 𝛾 is given by:

𝒯 NP ∶ ℝ 𝑑 ⟶ {0, 1} 𝑦 ⟼ ⎧ { { ⎨ { { ⎩ 1 if 𝑦 𝑇 𝜉 ‖𝜉‖ 2 > 𝜎 0 Φ -1 (𝛾) 0 otherwise (3.29)
where Φ stands for the cumulative distribution function of the standard Gaussian distribution. Since this problem also considers an additive distortion, this test 𝒯 NP is likely not optimal, and may not even have level 𝛾. In practice however, if the distortion is small enough, it is not uncommon to ignore it and use this test in hopes that the performance penalty is acceptable. We will take this simple approach for the upcoming simulations and see how this influences the results. We will be assessing the performances of each test using ROC (Receiver Operating Characteristic) curves. These curves show the estimated detection probability against the estimated false alarm probability. Each ROC curve will be obtained by running simulations with the parameter 𝛾 spanning the range from 10 -6 to 1 and every other parameter fixed. In addition to ROC curves we will also verify whether the desired level 𝛾 is respected, as this remains an important property to consider for a test to be usable in practice. We will also study how the estimation of 𝜎 0 affects the performance of each test. The Neyman-Pearson test T * NP taking the noise standard deviation estimation into account is simply obtained by replacing 𝜎 0 in its definition by the estimate σ:

T * NP ∶ ℝ 𝑑 × (0, ∞) ⟶ {0, 1} (𝑦, σ) ⟼ ⎧ { { ⎨ { { ⎩ 1 if 𝑦 𝑇 𝜉 ‖𝜉‖ 2 > σΦ -1 (𝛾) 0 otherwise (3.30)
The simulations will be presented in the following order:

1. First we will assess both tests with no distortion (Δ = 0) and 𝜎 0 perfectly known.

2. We will then introduce the distortion Δ, while 𝜎 0 remains known.

3. Finally, we will introduce the estimate σ𝑁 in addition to the distortion Δ.

Simulations with no distortion and known noise standard deviation 𝜎 0

First, we present simulation results in ideal conditions to set a baseline. There is no distortion (Δ = 0) and the noise standard deviation is perfectly known (σ = 𝜎 0 ). We compare the performance of the tests 𝒯 NP and 𝒯 𝜆 𝛾 (0) , since there is no distortion (𝜏 = 0). The ROC curves obtained for both tests through simulations are presented in Fig. 3.4. This figure shows that in these conditions, the NP test has better performance than the RDT test, meaning that it offers a better detection rate for the same false-alarm rate. This was expected since the NP test is known to be most powerful under these conditions (Theorem 1.1.4). Regarding the level of each tests, we can see on Fig. 3.5 that both tests have exactly size 𝛾, which is also expected from their respective properties. We now introduce the distortion Δ and see how it influences each test. As in the previous section, we use a uniformly distributed spherical distortion with radius 𝜎 0 𝜏. Remember that this distortion Δ is considered to be unknown; only its maximum amplitude 𝜎 0 𝜏 is assumed to be known. We will therefore now compare the tests 𝒯 NP and 𝒯 𝜆 𝛾 (𝜏) . We conserve the same Neyman-Pearson test, since it does not offer any way to take the distortion Δ into account. As such, we expect to observe some degradation in its performance, since it no longer matches the problem that we are considering.

Figure 3.6 shows the ROC curves obtained with a fixed SNR of 15 dB to see how increasing the DNR affects the performances of both tests. Judging from these curves, we can see that the Neyman-Pearson test seems to continue to outperform the RDT test as the distortion amplitude increases. Indeed, for the same measured false-alarm rate, the Neyman-Pearson test offers a higher detection rate. However, we can notice that as the DNR increases, the minimum false-alarm rate of the Neyman-Pearson test increases as well. For example, with a DNR of 5 dB, its false-alarm rate only goes as low as 2 × 10 -4 , when using 𝛾 = 10 -6 . What we notice here is that the Neyman-Pearson test no longer has level 𝛾 for this problem. We can confirm this by looking at Fig. 3.7, which shows the measured false-alarm rate against 𝛾 for both tests. We can see there that as soon as we introduce a distortion, the NP test no longer has level 𝛾, and that the effective false-alarm rate appears to increase with the distortion amplitude. This makes it troublesome to use it in real scenarios where controlling the false-alarm rate is crucial to maintain proper operation. In contrast, the RDT test maintains its level 𝛾 regardless of the distortion amplitude, as we have already seen in Fig. 3.1. This was expected, since the RDT test is designed to take this kind of distortion into account.

Looking closely at this figure, one can notice that our claim about the NP test no longer having level 𝛾 is not quite correct: for values of 𝛾 between approximately 0.5 and 1 (shown in the magnified area on Fig. 3.7) we can see that the effective false-alarm rate appears to decrease slightly as the distortion amplitude increases, such that it is actually inferior to 𝛾 in that range. We currently do not have any explanation for this behavior. However, this range of values for 𝛾 tends to not be commonly used in practice, as they correspond to very high false-alarm rates. Therefore we have chosen to ignore this We could consider modifying the Neyman-Pearson test to try to recover a test with level 𝛾. One way to do so would be to adjust the parameter 𝛾, and replace it with a value 𝛾 ′ such that the effective false-alarm rate is equal to 𝛾. We can always find such a value 𝛾 ′ for any given 𝛾, since the effective false-alarm rate decreases to 0 as 𝛾 tends to 0. For example, if the desired level is 10 -3 and we have a DNR of 5 dB, then we can see from Fig. 3.7 that this level is effectively attained when choosing 𝛾 ≈ 10 -5 . However, we have to keep in mind that these simulations were performed with one specific distortion distribution. From the problem statement, we want to find a test that has level 𝛾 for any bounded distortion Δ. For the RDT test, we know that any distortion Δ such that we have ‖Δ‖ 2 = 𝜎 0 𝜏 almost surely maximizes the false-alarm rate. However, we do not know whether this is the case for the NP test. Therefore, we would need further study to determine which distortion Δ would maximize the false-alarm rate, so that we can find the value of 𝛾 ′ that would yield a test with level 𝛾 for any distortion.

Simulations with distortion Δ and estimated noise standard deviation 𝜎 0

After seeing the impact of the distortion on the performance of each test, we will now study the effect of the estimation of the noise standard deviation σ, in addition to the distortion Δ. Figure 3.8 presents the ROC curves obtained for each test with SNR = 15 dB and DNR = 5 dB. We can see that, like previously, the NP test appears to outperform the RDT test, since it offers a higher detection rate at equal false-alarm rate. Comparing these curves to the ones where 𝜎 0 is known shows that the main effect of the estimation of 𝜎 0 is an increased false-alarm rate for both tests. This is particularly noticeable for low values of 𝑁. For example, with 𝑁 = 10, the minimum measured false-alarm rate is approximately 5 × 10 -4 for both NP and RDT tests, reached with 𝛾 = 10 -6 . Figures 3.9 and 3.10 show the measured false-alarm rate against 𝛾 for the NP and RDT tests respectively for different distortion amplitudes. We can clearly see on both of these figures the degradation on the false-rate rate caused by the estimation of 𝜎 0 . In these circumstances, neither test has level 𝛾. This was already the case for the NP test with only the distortion Δ, and the estimation the 𝜎 0 accentuates it. A noteworthy difference in the behavior of these tests is that as 𝑁 increases, the false-alarm rate of the RDT test approaches 𝛾, but this is not the case for the NP test. For the latter, its false-alarm rate can only reach the false-alarm rate that we measured in presence of the distortion Δ, which is greater than 𝛾. Therefore we do not have an asymptotic level guarantee for the NP test in presence of a distortion.

We can also use these figures to pinpoint how large 𝑁 needs to be so that we can assume that we have reached the asymptotic regime, i.e. the performance loss caused by the estimation of 𝜎 0 is negligible. Since the NP test cannot have level 𝛾 in presence of a distortion Δ, we will only consider the RDT test here. We can see on both Figs. 3.8 and 3.10 that the value of 𝑁 required to approach 𝛾 seems to depend on 𝛾. Indeed, it appears that we need a better estimate of 𝜎 0 as 𝛾 decreases. For example, for 𝛾 = 10 -3 , 𝑁 = 100 can be considered sufficiently close to the case with known 𝜎 0 . However, if we are targeting 𝛾 = 10 -6 , using 𝑁 = 100 can increase the false-alarm rate tenfold with a DNR of 5 dB, and therefore we would need to increase 𝑁 further. Looking at the ROC curves of Fig. 3.8, it appears that 𝑁 has little effect on the detection rate of the RDT test, and seems to mainly affect the false-alarm rate.

For information, we give in Table 3 For our approach to be valid, we also need to verify whether 𝜏 * depends on the noise standard deviation 𝜎 0 . Indeed, recall that in practice we only have access to an estimate of 𝜎 0 . If there is a dependency between 𝜎 0 and 𝜏 * , then simply replacing 𝜎 0 with an estimate to find the corresponding value of 𝜏 * may not necessarily result in a test with level 𝛾. To verify whether such a dependency exists, we ran additional simulations using 𝜎 0 = 2 and 𝜎 0 = 100, whereas all previous simulations used 𝜎 0 = 1. Figures 3.13 and 3.14 show the obtained values of 𝜏 * obtained for these two values of 𝜎 0 respectively. Comparing these results to the ones shown in Fig. 3.11 for 𝜎 0 = 1, we can observe that we always get the same values 𝜏 * regardless of the value of 𝜎 0 . Now that we know that the test T 𝜆 𝛾 (𝜏 * ) has level 𝛾, we will now compare it to the test T 𝜆 𝛾 (𝜏) in the detection problem that we studied in the previous section. Figure 3.15 shows the ROC curves obtained for each test, using a SNR of 15 dB and a DNR of 5 dB. We can see there that the ROC curves obtained using 𝜏 and 𝜏 * are identical: both tests offer the same detection rate for the same false-alarm rate. The only difference is that each point of the ROC curve is obtained using a different value for 𝛾 depending on whether we are using 𝜏 or 𝜏 * .

To understand this behavior, we first have to recall the definition of the tests we consider:

T 𝜆 𝛾 (𝜏) ∶ ℝ 𝑑 × (0, +∞) ⟶ {0, 1} (𝑦, σ) ⟼ ⎧ { ⎨ { ⎩ 1 if ‖𝑦‖ 2 σ > 𝜆 𝛾 (𝜏) 0 otherwise (3.31)
These are thresholding tests using the threshold 𝜆 𝛾 (𝜏), which is computed using the two parameters 𝛾 and 𝜏. The ROC curve is obtained by measuring the false-alarm rate and detection rate for a fixed tolerance 𝜏 and for 𝛾 spanning the range (0, 1). In other terms, a ROC curve characterizes a family of tests of the form { T 𝜆 𝛾 (𝜏) , 𝛾 ∈ (0, 1)}, for a given tolerance 𝜏.

What we need to study now is how the choice of 𝜏 affects this family of test, and therefore the ROC curve. First, let us consider a single test T 𝜆 𝛾 1 (𝜏 1 ) , which is characterized by the pair of values (𝛾 1 , 𝜏 1 ). Now consider a second tolerance 𝜏 2 . From Lemma 1.2.9, the function 𝛾 ↦ 𝜆 𝛾 (𝜏 2 ) is continuous and strictly decreasing from +∞ to 0. Therefore there exists a unique value 𝛾 2 ∈ (0, 1) such that 𝜆 𝛾 2 (𝜏 2 ) = 𝜆 𝛾 1 (𝜏 1 ). This means that the tests T 𝜆 𝛾 1 (𝜏 1 ) and T 𝜆 𝛾 2 (𝜏 2 ) are actually the same test, since they use the same threshold. Now consider the families of tests 𝒯 1 = { T 𝜆 𝛾 (𝜏 1 ) , 𝛾 ∈ (0, 1)} and 𝒯 2 = { T 𝜆 𝛾 (𝜏 2 ) , 𝛾 ∈ (0, 1)} With the same reasoning, for each 𝛾 ∈ (0, 1), we can find 𝛾 ′ ∈ (0, 1) such that 𝜆 𝛾 (𝜏 1 ) = 𝜆 𝛾 ′(𝜏 2 ). Therefore the families 𝒯 1 and 𝒯 2 are actually composed of the same tests, only indexed differently. Since these families are identical, the resulting ROC curves for the tolerances 𝜏 1 and 𝜏 2 are also identical, which means that the choice of tolerance does not affect the overall performance of the test. This is an interesting feature of the RDT test: the tolerance makes it possible to compensate both the distortion and the estimation of 𝜎 0 without affecting the overall performance of the test, in order to maintain the guarantee on the level.

Conclusion

In this chapter we developed an extension of the RDT approach which improves upon the base RDT theory by taking parameter estimation into account, namely the model and the noise variance. We showed that the RDT test T 𝜆 𝛾 (𝜏) is asymptotically optimal, with an appropriate optimality criterion derived from the 𝛾-MCCP criterion, and we then confirmed the results regarding its asymptotic level through simulations. We also performed some comparisons with the Neyman-Pearson test, allowing us to see notably how they compare and how this relates to their requirements to use them. We have also suggested a way to compensate the effect of the noise variance estimation on the level of the RDT test by adjusting the tolerance 𝜏, which can be used to compensate a lack of knowledge of the problem without affecting the performance of the test.

As we mentioned throughout this chapter, there are further aspects of this asymptotic test that could use further study. First, we restricted our study to the case of a covariance matrix of the form 𝜎 0 2 𝐼 𝑑 where 𝜎 0 is estimated. For a more general approach, we would need to consider the estimation of any covariance matrix 𝐶, and verify if we still have an asymptotic optimality in this case. Regarding our simulations, we only focused on the estimation of 𝜎 0 and the model 𝜃 0 remained known all throughout. We would need to conduct additional simulations to see the effect of the estimation of 𝜃 0 on the performance of the test. Finally, another aspect that would deserve further work is the adjustment of the tolerance 𝜏 to compensate the effect of the parameter estimation. We have shown that we can find a tolerance 𝜏 * to recover a test with level 𝛾 without affecting its performance, and described a procedure to estimate thîs adjusted tolerance 𝜏 * through simulations. However, this procedure is fairly slow, as it requires many iterations to get an accurate estimate of 𝜏 * , especially for low values of 𝛾. With more study of the behavior of 𝜏 * , we may be able to devise a more efficient method to estimate this parameter.

In the next chapter, we will be using the aspects we studied in this chapter to build detection methods using the RDT test, which we will then test on real signals from the SWaT dataset. Until now, we have been working on theoretical aspects of hypothesis testing and the RDT approach, and also performed a few simulations in artificial scenarios. In this chapter, we will now make use of what we studied so far in order to build methods capable of working on real signals. As discussed in the introduction, the end goal of this work is to propose learning-based methods capable of detecting cyberattacks in industrial systems using the sensors and actuators present to first learn their normal behavior, then detect anomalies. Unlike the previous chapters which were mostly theoretical, this chapter is focused mainly on describing methods and experimenting on real signals. We will mainly use the SWaT dataset that we presented in the introduction as a support for our experiments.

Using these signals, we will present two methods developed using the tools described before:

• A first method that can detect discontinuities on signals that are supposed to be continuous. This method is fairly simple, and uses normal operation data to configure the parameters of interest. Since there are quite a few attacks that cause discontinuities in our dataset, we found this approach to be worthwhile to develop and present here.

• A second, more complete method that consists in segmenting signals in order to discover their different phases, then learn the characteristics of each phase. Based on this model of a signal, the goal is to detect whenever the behavior of the observed signal deviates from this model. This method is based on a change detection method in order to discover the different phases of the signal.

In the following we will describe these two methods and test them out on signals from the SWaT dataset in order to illustrate how they work. Note that the methods presented here are mainly intended as proofs of concepts. They should not be considered ready for use in real-world scenarios as there are still many aspects that require further development. However, the results presented below should give an idea of what is realistically achievable.

Before presenting the methods we developed, we should briefly mention the issue of performance evaluation. In the following, we will make qualitative comments on the performance of the described methods, but we will not present any quantitative performance metrics, such as precision, recall or the F-score which are commonly found metrics for performance evaluation, especially on real data. We found that the SWaT dataset does not offer the required data to compute these metrics for our methods. The only labels present in this dataset indicate whether an attack is occurring at any given time, but our methods look at other aspects of the studied signals -such as transitions from one phase to another -which are not labeled here. Therefore we were not able to assess the performance of our methods quantitatively, and we had to resort to a limited qualitative evaluation.

Detecting discontinuities on continuous signals

In this first section we look at the issue of detecting discontinuities in signals that are supposed to be continuous. We observed that on some signals, numerous attacks that spoofed a sensor caused significant discontinuities at the beginning and at the end of the attack, i.e. a very large change between two consecutive samples. Two examples of such attacks are shown on Fig. 4.1, taken from the water level sensor LIT101 in the SWaT dataset. The two attacks around 361,000 s and 390,000 s create two discontinuities each, one at their start when the attacker starts spoofing the sensor, and one at the end when we can once again observe the true value of the sensor. In this case, the observed signal is supposed to be continuous. Indeed, the measured water level varies slowly over time, and the sampling rate of 1 Hz is high enough compared to these variations. Discontinuities on such a signal are therefore anomalies that we can try to detect. Of course, this is not applicable to every type of signal. For example, some electrical signals may require a much higher sampling rate to be considered continuous, since electrical phenomenons can be much faster than the mechanical ones that we measure here. As such, the detection method we propose here can only target specific signals that have slow variations compared to their sample rate. This method is an adaptation of a change-point detection method presented in [START_REF] Nguyen | Contributions to Statistical Signal Processing with Applications in Biomedical Engineering[END_REF], where it was used to segment respiratory signals.

This method uses a wavelet transform as a base to transform the signal into a representation where the discontinuities are easily detectable. In short, the wavelet transform is a tool that allows studying different scales of a signal by separating its low-frequency and high-frequency components. It operates by filtering the signal using two different filters, and downsampling each filter output by only keeping every other sample. Since discontinuities are very fast transitions, we should be able to detect them by analyzing the high frequencies of the signal. We can do so using a wavelet transform and looking for outliers in the detail coefficients. Figure 4.2 shows an example of this on the same signal LIT101 with a wavelet transform using the Daubechies 6 wavelet [START_REF] Daubechies | Ten Lectures on Wavelets[END_REF], with a single level of decomposition. We can see on this figure how each discontinuity creates a large spike in the detail coefficients. To detect these spikes, we can simply apply a threshold on the amplitude of the detail coefficients, and trigger a detection whenever this threshold is exceeded. Of course the question we have to address now is how to choose this threshold. For the experiments conducted here, we went for a fairly straightforward approach: we have been working with the RDT threshold 𝜆 𝛾 (𝜏) this entire time, so we also decided to use it to define our detection threshold, which leads us to the issue of choosing the parameters 𝛾 and 𝜏.

To choose these parameters properly, let us start by setting the problem. We model the detail coefficients (𝑦 1 , …, 𝑦 𝑁 ) as independent realizations of a random variable 𝑌, which we decompose as the sum of some random variable Θ ∈ ℳ(Ω, ℝ) and a Gaussian noise 𝑋 ∼ 𝒩(0, 𝜎 2 ), independent from each other. Now, recall that the RDT problem addresses the issue of testing ℋ 0 ∶ ‖𝑌 ‖ 2 /𝜎 ≤ 𝜏 against ℋ 1 ∶ ‖𝑌 ‖ 2 /𝜎 > 𝜏, and the test 𝒯 𝜆 𝛾 (𝜏) is the answer we gave to that problem. The idea is then to set the tolerance 𝜏 to define the maximum acceptable amplitude of the detail coefficients. By definition of our problem, this maximum amplitude is therefore 𝜎𝜏.

However, describing the problem this way can cause an issue: if the noise variance varies over time, then our definition of a discontinuity will also change, which may not be a desirable behavior. This is the case in Fig. 4.2, where the variance of the detail coefficients changes slightly over time, depending on the current phase. Some attacks may also affect it. For instance, during the two attacks that spoofed the sensor (around 361,000 s and 390,000 s), there is no noise whatsoever between the two spikes: the detail coefficients are all equal to 0, since the base signal LIT101 is constant during that time.

It might be more practical to set this maximum amplitude directly, meaning that our problem becomes testing ℋ 0 ∶ ‖𝑌 ‖ 2 ≤ 𝜏 ′ against ℋ 1 ∶ ‖𝑌 ‖ 2 > 𝜏 ′ where 𝜏 ′ is the desired maximum amplitude. Adjusting the test for this problem is easy: we simply have to consider the threshold 𝜆 𝛾 (𝜏 ′ /𝜎), resulting in the thresholding test 𝒯 𝜆 𝛾 (𝜏 ′ /𝜎) defined as:

𝒯 𝜆 𝛾 (𝜏 ′ /𝜎) ∶ ℝ ⟶ {0, 1} 𝑦 ⟼ ⎧ { ⎨ { ⎩ 1 if 𝑦 ≥ 𝜎𝜆 𝛾 (𝜏 ′ /𝜎) 0 otherwise (4.1)
By defining the tolerance 𝜏 ′ , we now have a constant definition of the discontinuities that we want to detect, regardless of the noise variance. This test takes the variations of the noise variance into account by adjusting the threshold appropriately. This noise variance is estimated on the detail coefficients using a robust estimator. We cannot use the usual ML variance estimator because of the spikes that are present when discontinuities occur, since this estimator is not robust to such outliers, and would yield absurd results when used in these conditions. Instead, we have chosen to use the MAD (Median Absolute Deviation) estimator [START_REF] Pham-Gia | The Mean and Median Absolute Deviations[END_REF] which is defined for 𝑁 samples (𝑦 1 , …, 𝑦 𝑁 ) ∈ ℝ 𝑁 by:

MAD(𝑦 1 , …, 𝑦 𝑁 ) = 1.4826 × median(|𝑦 1 -ȳ |, …, |𝑦 𝑁 -ȳ |) (4.2)
with ȳ = median(𝑦 1 , …, 𝑦 𝑁 ), assuming that the samples (𝑦 1 , …, 𝑦 𝑁 ) follow a Gaussian distribution. For simplicity, we decided to ignore the fact that the noise variance changes slightly over time and simply used a single estimate of 𝜎 using all samples, giving us a single threshold used for the entire signal. While the noise variance varies over time depending on the current state of the system, these variations are small, and using a single noise variance estimate computed using the entire signal is sufficient for demonstration purposes.

In order to use this test, we have to choose the parameters 𝛾 and 𝜏 ′ . As a reminder, the level 𝛾 represents the maximal desired false-alarm rate, and 𝜏 ′ the maximal acceptable amplitude of the detail coefficients. We can set 𝛾 with some considerations regarding an acceptable time between false alarms. For example, choosing 𝛾 = 10 -4 means that we can tolerate a false alarm every 10,000 tested samples on average. With a sample rate of 0.5 Hz1 , this would translate to one false-alarm every 5.5 h on average.

Choosing the tolerance 𝜏 ′ is trickier, since we need some knowledge of the system in order to determine a normal range for the detail coefficients. An alternative that we will use here is using normal operation data to define this normal range. In addition to the data that contains attacks, we also have access to a one-week-long continuous recording of the same signal LIT101 under normal conditions. Using this recording, and performing the same wavelet transform, we can determine what the normal range of these detail coefficients should be. We are then effectively learning the parameter 𝜏 ′ , using normal observations of the signal only. The result of this wavelet transform on normal data is shown on Fig. 4.3. From the detail coefficients shown on this figure, we now want to determine a tolerance 𝜏 ′ . Since every data point here is normal, we want to choose a tolerance large enough so that all these samples are considered normal when using the test 𝒯 𝜆 𝛾 (𝜏 ′ /𝜎) . On the other hand, this tolerance should remain as small as possible, because the samples observed here are the basis of our definition of normal behavior: samples with higher amplitude than the ones observed here should be treated as anomalies. Therefore we should choose the smallest possible tolerance 𝜏 ′ such that testing all samples of the normal signal yields no false alarm. We also have to consider the fact that we are willing to accept a false-alarm rate up to 𝛾. Hence it may actually be more appropriate to choose a tolerance such that we get an effective false-alarm rate of 𝛾 on our training dataset.

Using a value of 𝛾 = 10 -4 , and estimating the noise variance with the MAD estimator, we obtained on this training dataset a tolerance 𝜏 ′ = 0.358. Now we can use these parameters to detect discontinuities on the signal with attacks, after re-estimating the noise variance 𝜎 on this signal. Detection is simply performed by applying the test 𝒯 𝜆 𝛾 (𝜏 ′ /𝜎) to each detail coefficient, which simply consists in comparing the amplitude of each sample to the threshold 𝜎𝜆 𝛾 (𝜏 ′ /𝜎). Figure 4.4 shows the threshold applied on the detail coefficients of the signal LIT101 with attacks. Using this approach, we were able to detect all nine discontinuities present in this signal. These nine discontinuities are caused by five different attacks. Of these five attacks, four of them create a discontinuity at the start and at the end of the attack. We can therefore consider that each of these four attacks can be detected in real time at their start, which should be early enough to react. However, the fifth attack creates a discontinuity only when it ends, once the sensor is no longer spoofed, as can be seen in Fig. 4.5. In this case, the discontinuity is indeed detected, but that means we can only detect this attack once it is over, which is too late for a proper real-time response.

We also need to look at the effective false-alarm rate, which we expect to be lower than the level 𝛾 = 10 -4 . In this case, a single sample triggered a false alarm among the 224,965 tested samples, yielding an effective false-alarm rate of approximately 5 × 10 -6 . This false-alarm rate is therefore acceptable with regard to the set level.

We demonstrated the use of this method on a recorded signal, but adapting it to be usable in real time should be straightforward. Indeed, the wavelet transform should not cause any problem, since it simply consists in filtering the signal with a FIR (Finite Impulse Response) filter and downsampling its output. These two operations can be carried out in real time without any problem. Estimating the noise variance 𝜎 in real time should also not pose any problem, since we can adapt the MAD estimator to use a finite rolling window on the signal. Overall, this is a simple method to detect discontinuities in signals which can be used with little preliminary setup. The two parameters 𝛾 and 𝜏 ′ can be easily configured with a reference dataset containing only normal data, and testing this method on real data shows that we get good detection performance while properly controlling the false-alarm rate. The limited testing on real data could be completed with tests on artificial signal, which would allow a finer evaluation of the performance of this method. For example we could measure the influence of the amplitude of a discontinuity on the detection rate. It would also be interesting from a theoretical viewpoint to link the amplitude of a discontinuity on the signal to the amplitude of the spike created in the detail coefficient for a given wavelet. This would allow defining a tolerance based directly on a specification, without necessarily requiring normal operation data.

Segmenting and learning phases, and detecting anomalies

We now present in this section our second approach, which consists in learning the different phases present in a physical signal. For example, going back to the LIT101 signal that we have been using as an example so far, we can identify a succession of four phases, depending on the state of the actuators that are directly related, in this case the pumps and valves that control the inflow and outflow connected to the water tank in which the water level sensor LIT101 is located. Based on this observation, we decided to develop a method to discover these phases using normal operation data, then characterize these discovered phases in order to get a model of the system under normal conditions. Using this model, we then want to verify whether the current state of the system matches one of these discovered phases or not. If not, we can then consider that we detected an anomaly and raise an alarm. We can summarize this process in the following four steps:

1. Segmentation: using clean data without any anomalies or attacks, segment the signal according to the state changes of the system.

2. Feature extraction: for each segment, extract relevant characteristics that can be used to identify each phase.

3.

Training: group the different segments using the extracted features to identify the existing phases, and define normal ranges of the features of interest for each phase. The output of this training phase constitutes our model of the system.

4. Anomaly detection: Using the model defined in the previous step, analyze the current state of the system and verify whether it matches any of the previously learned states.

We will focus on presenting the first part of this process, which is supported by the theoretical work presented in the previous chapters. As the rest of the learning and detection process will rely on this first step, it seemed important to us to offer a proper presentation and justification for the choices made to develop this segmentation method. Afterwards, we will briefly touch on ways to build a model based on this segmentation and how to perform detection.

Change-detection in time series

As we mentioned back in the introduction, components in an industrial systems are often characterized by a succession of phases. For example, let us consider the LIT101 sensor signal along with the directly related actuators MV101 and P101, which are represented on Fig. 4.6 in normal operating conditions. As we can see there, the LIT101 signal is piecewise linear with four different slopes, matching the four possible combinations of states of the actuators regulating the inflow and outflow. These relations are summarized in the following Using the information from these actuators, we can easily segment the LIT101 signal into its different phases: a new segment simply starts whenever the state of one of the actuators changes. However, it would be useful to be able to do this using the LIT101 signal on its own. For example, an attack could try to stealthily manipulate one of the actuators, forcing it into one state and also spoofing it so that this change is not visible on the transmitted actuator signals. Working on the LIT101 signal would in this case allow detecting discrepancies between this signal and the observed state of the actuators. As such, we want to use a method that would allow us to detect phase transitions, based solely on the signal LIT101.

Finding such transitions in signals is nothing new: the problem of detecting changes in time series can be found in many fields, such as quality control in manufacturing, fault detection, telecommunications, etc. The literature on this topic is vast (see for example [START_REF] Basseville | Detection of Abrupt Changes: Theory and Application[END_REF][START_REF] Truong | A Review of Change Point Detection Methods[END_REF][START_REF] Aminikhanghahi | A Survey of Methods for Time Series Change Point Detection[END_REF]). We will present it only briefly.

In short, we can formalize the change detection problem as follows: consider a time series (𝑌 𝑛 ) 𝑛∈ℕ , where each sample 𝑌 𝑛 has probability distribution 𝑃 𝑌 𝑛 . This time series is assumed to be piecewise stationary, meaning that the distribution of these samples remains constant for a certain duration and only changes at certain rupture points 𝑛 𝑖 ∈ ℕ, such that 𝑃 𝑌 𝑛 𝑖 ≠ 𝑃 𝑌 𝑛 𝑖 +1 . The goal of change detection methods is to find these rupture points and estimate them as well as possible from a realization of the time series.

However, detecting any change in the probability distribution of the series is a complex task, and may also lead to detecting a very large number of irrelevant changes. We instead usually consider detecting changes in some of its interesting properties. The most widely addressed problem is detecting changes in the mean, for which many solutions have been proposed. The Shewhart chart [START_REF] Shewhart | Economic Control of Quality of Manufactured Product[END_REF] and the CUSUM (Cumulative Sum) [START_REF] Page | Continuous Inspection Schemes[END_REF] are two of the most well-known approaches proposed to address it. The Shewart chart was first introduced for quality control in manufacturing in order to verify that produced components were within specifications. In short, the Shewhart chart operates on blocks of 𝑁 samples of the time series and assumes that all samples in each block are independent and identically distributed, sharing a common expectation 𝜇, and also that we know the distribution of the samples both before and after a change occurs. For each block, it tests whether this mean 𝜇 is equal to a known nominal value 𝜇 0 , meaning that there was no change, or whether the mean 𝜇 is now equal to another known value 𝜇 1 , signifying that the mean of the process has changed. This test is simply performed using the appropriate Neyman-Pearson test since both hypotheses are simple by definition of this problem. The CUSUM is another change-detection method which can be seen as an adaptation of the SPRT (Sequential Probability Ratio Test) [START_REF] Wald | Sequential Tests of Statistical Hypotheses[END_REF]. Unlike the Shewart chart, this method does not operate on blocks of samples but processes the signal one sample at a time. Despite this difference, it relies on very similar hypotheses and also requires perfect knowledge of the distribution of the samples before and after change.

This distribution knowledge requirement can be found in many change detection approaches, and can severely limit their applicability to real-world scenarios where good data models are often not available. This observation in hypothesis testing is what led to the development of the RDT approach in the first place, and we therefore decided to develop our own change-detection method based on it in an attempt to inherit its properties. The goal here is then to develop a change-in-mean detection method that is applicable to real signals and makes as few assumptions as possible on the nature of the observed signals. As a reminder, the RDT approach only assumes that the observed signal 𝑌 is the result of the observation of some unknown phenomenon Θ in presence of additive and independent Gaussian noise 𝑋.

One may wonder if the wavelet-based method we developed in the previous section could be applied here to detect changes in the signal. Indeed, we are looking to detect changes in the slope of the signal, which are irregularities in its derivative, and wavelets are well-known to be an appropriate tool to detect such irregularities. However, after trying it out, we found that it was not actually applicable in this specific context. We will explain why this is the case later, when we start applying the method we are about to present to real signals.

An RDT-based change-in-mean detection method

The method that we developed is inspired from the Block-RDT control chart presented in [START_REF] Pastor | Robust Statistical Process Control in Block-RDT Framework[END_REF], which is a block-based method that detects changes-in-mean in time series using the RDT test. However this method assumes that both the current mean of the signal and the noise variance are perfectly known. This is not applicable in our case since the goal of this segmentation is to then be able to learn these values depending on the state of the system. We address this in our method by estimating both the current mean and the noise variance, and then improving these estimates as the current phase continues. This is where our study of the Asymptotic RDT extension in Chapter 3 comes into play, ensuring that we will asymptotically reach the performance we would get without estimation. Our method requires choosing the following parameters:

• The processing block size 𝑁 • The tolerance 𝜏 • The desired false-alarm rate 𝛾 In addition to these parameters, one can choose which estimators to use for the mean and the noise variance. For the mean, we will simply use the classic empirical mean of the samples, and for the noise variance we will use the MAD estimator (see Eq. (4.2)). We will explain why we chose the MAD estimator over the usual maximum-likelihood estimator in Section 4.2.3, where we apply this change-detection method to real signals. Note that both estimators are consistent (see [START_REF] Rousseeuw | Alternatives to the Median Absolute Deviation[END_REF] for the MAD), which is a requirement for the Asymptotic RDT to be applicable.

As previously, we assume that each sample 𝑌 𝑛 of the time series can be written 𝑌 𝑛 = Θ 𝑛 + 𝑋 𝑛 where Θ 𝑛 ∈ ℳ(Ω, ℝ) is a signal with unknown distribution and 𝑋 ∼ 𝒩(0, 𝜎 𝑛 2 ) is the Gaussian noise independent from Θ 𝑛 . Our method processes the signal in fixed-size blocks of 𝑁 samples, and consists in testing block after block whether the empirical mean of the signal Θ within a block of 𝑁 samples has changed significantly or not compared to that of the current phase.

In the following, for a time series (𝐴) 𝑛∈ℕ , we will denote by ⟨𝐴⟩ 𝑝 𝑚 its empirical mean between samples 𝑚 ∈ ℕ and 𝑝 ∈ ℕ:

⟨𝐴⟩ 𝑝 𝑚 = 1 𝑝 -𝑚 + 1 𝑝 ∑ 𝑖=𝑚 𝐴 𝑖 (4.3)
If the start and end samples 𝑚 and 𝑝 are not mentioned, we are implicitly talking about the samples contained in the currently processed block: if we are working on the 𝑘-th block (with 𝑘 starting from 1), then 𝑚 = (𝑘 -1)𝑁 + 1 and 𝑝 = 𝑘𝑁. Before we present our change-detection method, we have to mention several points regarding the RDT test we will be using:

• Just like we did in the previous section with the wavelet-based method, we will define the tolerance relatively to the signal norm, without normalizing it by the noise standard deviation. As a reminder, this means that we use a tolerance 𝜏 ′ to test whether ‖Θ(𝜔) -𝜃 0 ‖ 2 ≤ 𝜏 ′ or ‖Θ(𝜔) -𝜃 0 ‖ 2 > 𝜏 ′ , and instead of the regular test 𝒯 𝜆 𝛾 (𝜏) , we use the test 𝒯 𝜆 𝛾 (𝜏 ′ /𝜎 0 ) .

• Since we are working on the mean of a block of 𝑁 samples, the threshold to be used for a given tolerance 𝜏 and level 𝛾 is not 𝜆 𝛾 (𝜏), but 𝜆 𝛾 (𝜏 √ 𝑁)/ √ 𝑁 instead [START_REF] Pastor | Robust Statistical Process Control in Block-RDT Framework[END_REF], with the test being applied to the empirical mean of the observations. The factor √ 𝑁 present here translates the decrease in noise variance that occurs when averaging 𝑁 independent samples.

• Of course, we will also be considering estimates of the model 𝜃 0 and the noise variance 𝜎 0 , and as such we will be using a test of the form T 𝜆 𝛾 (𝜏) that takes these estimates into consideration, as defined in Chapter 3 (see Eq. (3.5) for the definition of these tests).

Putting all this together, the test that we will use is a test of the form T 𝜆 𝛾 (𝜏 ′√ 𝑁/σ)/ √ 𝑁 (⟨𝑌 ⟩, θ , σ). Now we have everything we need to present our change-detection method. It can be summarized in the following steps:

1. First we get an initial estimate ( θ , σ) of the initial signal parameters (𝜃 0 , 𝜎 0 ) using the first 𝑁 samples.

2. Then, using the 𝑁 next samples, we want to test whether the empirical mean of the signal Θ has changed significantly or not, meaning that we want to test whether ‖⟨Θ(𝜔)⟩ -𝜃 0 ‖ 2 ≤ 𝜏 ′ or ‖⟨Θ(𝜔)⟩ -𝜃 0 ‖ 2 > 𝜏 ′ . We do this by using the estimates θ and σ as substitutes for 𝜃 0 and 𝜎 0 respectively and applying the test T 𝜆 𝛾 (𝜏 ′√ 𝑁/σ)/ √ 𝑁 (⟨𝑌 (𝜔)⟩, θ , σ).

3. What we do next depends on the result of the test:

• If T 𝜆 𝛾 (𝜏 ′√ 𝑁/σ)/ √ 𝑁 (⟨𝑌 (𝜔)⟩, θ , σ) = 0, then there has not been any significant change and we consider that the current block is part of the same phase of the signal. In that case, we update our estimates of the mean and of the noise variance using the tested samples, and then go back to step 2 with the next block of 𝑁 samples.

• Otherwise, if T 𝜆 𝛾 (𝜏 ′√ 𝑁/σ)/ √ 𝑁 (⟨𝑌 (𝜔)⟩, θ , σ) = 1, then we decide that a significant enough change has occurred and that the signal has entered a new phase. In that case, we can report that a change has been detected within this block, and restart from step 1 using the next block of 𝑁 samples to initialize the next phase. Note that we do not use the current block to initialize the next phase since we consider that there is a change within this block, which would compromise the initial parameter estimation. This process is also described in algorithmic form in Fig. 4 Before moving on to application examples of this method, we should address the problem of setting the three required parameters that we mentioned, which as a reminder are the block size 𝑁, the tolerance 𝜏 and the desired false alarm rate 𝛾:

• The tolerance 𝜏 represents the amplitude of changes that should be detected. Therefore setting it appropriately requires some prior knowledge of the system in order to choose a sensible value, taking into account the amplitude of the transitions that may occur.

• The block size 𝑁 has to be carefully chosen by considering several aspects, including notably the duration of the phases in the signal, the sample rate of the signal, the desired resolution for estimating the change instants, and the overall performance of the method (detection and false-alarm rates).

Working with large blocks means that we quickly get good estimates of the model and of the noise variance. Since we use the mean of the signal over a block, it also yields a better SNR and therefore better performance. However, this also means that we assume that the signal changes slowly enough, otherwise we would easily miss short segments. In addition, we also get less precision in estimating the change instants, since we only know that they occur within a block of 𝑁 samples.

We could work with faster signals by lowering the block size 𝑁, but this also means we would not get as much of an SNR increase from averaging samples, and therefore the overall performance of the method would be negatively affected. This effect is compounded by the coarser initial estimate of the model and noise variance, which is also performed on one block of 𝑁 samples at the beginning of each detected phase.

• The level 𝛾 will usually be set last, and used to adjust the threshold based on initial results.

Application to real signals

After describing our proposed method, we will now show the results yielded by applying this method on real signals, using once again the LIT101 water level signal that we used previously, under both normal and attack conditions. We have seen that this signal is piecewise linear and as we discussed earlier, its slope is an information of interest. Therefore, instead of applying this algorithm directly to our signal, we will apply it to its derivative, which we expect to be piecewise constant with added noise.

We can see this on Fig. 4.8 where we show both the signal in normal conditions and its derivative, which is obtained simply by computing the difference between consecutive samples. The derivative may appear surprisingly noisy compared to the original signal. This is due to the fact that the variations of the original signal are very slow and we are observing it here over a very long period of time (a little over 8 hours). Therefore the steps in the derivative caused by the slope changes are actually fairly small compared to the noise level. This is why our wavelet-based detection method that we presented earlier does not work here to detect these discontinuities: unlike the ones we tried to detect earlier, these discontinuities are very small and end up being completely hidden in the surrounding noise, making them very difficult to detect in this manner. Water level (LIT101) 31 segments were found by our method using these parameters, and they seem to visually match up with the different phases present on the original signal. In this example, we can consider that we were able to detect all changes without any false-alarm. Of course, this is only a qualitative evaluation on a portion of this signal, and does not necessarily reflect the actual performance of this method. Quantitative performance evaluation is tricky, since we do not have access to the exact change instants in this dataset. We would need to manually label the changes in this dataset, which would require manually identifying every change point in the entire signal with good accuracy, which is not easy considering the very slow variations of the signal. An alternative could be relying on actuator data, but the issue with using this data here is that we have to account for potential delays between a change happening on the actuators, and their effects being visible on the sensor, which would skew the performance evaluation.

We can also see gaps between each discovered segment, which correspond to the blocks of 𝑁 samples in which changes were detected. As a reminder, this is by design since this method cannot find the change instant more accurately within each of these gaps, and we do not want to risk having a compromised initial estimate by using samples from two different phases. Since this signal has a sample rate of 1 Hz, this means that there is an uncertainty of up to 40 s in the location of each change point, and we also have to account for potential detection delays, for example a change occurring late in the previous block which was not detected at that time, but only in the next block.

We could improve this resolution by reducing the block size 𝑁, but this may cause other issues. An example of this is shown in Fig. 4.10, where we set the block size 𝑁 to 10 samples. Comparing this result to the previous one, the changes of interest are still detected, but we also have in addition to these a considerable number of very short segments: from 31 segments found in the previous figure, we now have 206 segments, many of which do not match any change of interest.

We can attempt to circumvent this issue by lowering the parameter 𝛾, which should make the method less sensitive to noise and therefore lower the number of false-alarms. We can see the result of this on Fig. 4.11, where we reduced 𝛾 from 10 -3 to 10 -6 , while keeping the other parameters unchanged. While this does significantly reduce the false-alarm rate, there are still a few left: we indeed have 43 segments instead of the expected 31. In addition to these remaining false-alarms, we can also see that some changes were also missed. For example, changes around 24,000 s and 28,000 s were missed, and in each of these two instances, two expected segments were merged into a single one. Water level (LIT101) One potential way to improve the resolution without compromising performance would consist in using a sequential test. This is fairly analogous to what is done in the CUSUM method, based on the SPRT sequential test. The basic idea of a sequential test is to process samples one by one, until a decision can be taken. For each tested sample, there are three possible outcomes:

1. We consider that a change has been detected.

2. We consider that there is no change.

3. There is not yet enough information to decide whether there was a change or not, and we continue with the next sample.

The advantage of this approach is a finer detection of the change-points by working one sample at a time instead of processing entire blocks of samples. An RDT-based sequential test exists ( [START_REF] Khanduri | Sequential Random Distortion Testing of Non-Stationary Processes[END_REF][START_REF] Khanduri | Truncated Sequential Non-Parametric Hypothesis Testing Based on Random Distortion Testing[END_REF]) and could be considered here as a replacement for the block-based test used. However there has not yet been any study of this sequential test when used with estimates of the model and of the noise variance, and therefore we cannot yet offer the same performance guarantees that we have here with the block approach. We can also see how this change-detection method behaves in presence of attacks on Fig. • In the first attack (around 2,000 s), we can see that we properly detect the two changes that occur at the beginning of the attack. These steps have comparable amplitudes to the ones we observed previously under normal conditions, therefore we expected to be able to detect these.

• In the second attack, there is a very slight change in the slope of the signal, which goes undetected with the parameters used here. We can detect it by lowering the threshold used (by either increase 𝛾 or decreasing 𝜏 ′ ), but this will also result in a higher false-alarm rate. An example of this is shown on Fig. 4.13, where we lowered the detection threshold by increasing 𝛾 and lowering 𝜏 ′ .

• The third attack, which consists in spoofing the sensor, causes very unnatural behavior on the sensor derivative. Indeed, during this attack, there are very few different values observed, as if the signal was very coarsely quantized, and there is no noise whatsoever. This notably means that during this time, our model of a signal observed in independent Gaussian noise does not hold. We can detect a change at the beginning of the attack, but not at its end, as we have one segment extending from the start of the attack to the end of the following normal phase.

The behavior encountered in that third attack is the main reason why we are using the MAD as the noise variance estimator instead of the more commonly found maximum-likelihood estimator (see Eq. (3.26)). Indeed, looking at the end of this attack, where the spoofed signal suddenly goes back to normal, we can see that the derivative has a sudden negative spike. This spike is composed of a single sample with value -176, whereas all other samples shown here are contained in the range [-2, 2]. If this sample ends up being used to estimate the noise variance, then using ML-estimator would result in a extremely large estimate for σ, since that estimator is not robust to outliers. Using this estimation of the noise standard deviation would then lead to being completely incapable of detecting any more changes afterwards, because the threshold computed using this estimate also becomes very large. Replacing the ML-estimator with the MAD prevents such samples from significantly affecting the estimation of 𝜎, and therefore allows the change-detection method to continue working as expected.

An issue that currently remains open is evaluating the performance of this segmentation. We have assessed the resulting segmentation qualitatively on a few examples, but we did not provide any actual metric that could be used to evaluate this segmentation quantitatively. The main issue here is that we do not have a ground truth to which we could compare the change points that we found. Indeed, the only labels available in the SWaT dataset indicate whether there is an attack happening at a given time, but no information is given regarding the normal operation of the system. We could try to estimate the real change points ourselves with the help of the actuator signals, but we found that this task would be very error-prone, and such labels may be considered dubious, since we are labelling the dataset ourselves after seeing the segmentation yielded by our own algorithm. We also noticed that they is a variable delay between a change in the state of an actuator, and its effect on the monitored sensor, making it very difficult to automate this task without manual adjustments. For all these reasons, we could not provide any performance measurements that would allow us to compare our method to others.

Perspectives: towards learning a model and detecting anomalies

After a fairly detailed presentation of our change-in-mean detection method, we will now present some in-progress ideas to use the previously performed segmentation as a base to learn characteristics of the signal of interest, and then detect anomalies from this basis. This section will be fairly short, as we were only able to conduct very limited testing using the signals at our disposal given the time constraints. We will start by considering a clustering approach to identify the phases of the signal and show how a basic K-means approach can perform as an example, reusing the segmentation shown in Fig. 4.9. We will then discuss some methods we considered to detect anomalies from this basis.

Using the previously defined change-detection method, we now want to build a model that will characterize the normal operation of the system. To do so, we will start by applying this method to clean data, without any attack, such as the example shown in Fig. 4.9, which is a clean signal recorded during normal operation of the system. Each yielded segment should then approximately correspond to one phase of the signal. The idea is to compute some relevant features on each segment, then use these features in a clustering algorithm in order to find clusters that represent each normal state of the signal.

Based on the segmentation performed on this signal, we can extract some features of interest. Here for simplicity, we will be using only a single feature, calculated as the mean of each segment, which is the estimated slope on the original signal. Other features of interest that could be considered on a real signal are the length of each phase, the estimated noise variance, the start and end value of each phase since we are working on linear segments, etc. For the clustering algorithm, we will use the simple K-means method, as we think it should perform well enough for a first proof of concept. While it requires knowing the number of clusters ahead of time, this is not necessarily an unreasonable assumption to make depending on the system of interest. However we could consider other algorithms if we want to discover the number of clusters, such as DBSCAN [START_REF] Ester | A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise[END_REF] or OPTICS [START_REF] Ankerst | OPTICS: Ordering Points To Identify the Clustering Structure[END_REF].

Figure 4.14 shows the result of K-means clustering on the signal LIT101 after using the segmentation shown in Fig. 4.9, assuming that we know there are 4 classes. For this, we used the segmentation performed on the entire signal, which yielded a total of 469 segments. At first sight, it may seem like we detected 4 reasonable classes. However, the yellow class centered around -0.2 is actually composed of two data points only, and therefore does not constitute a class of interest. Indeed, from what we could see on the signal, we would expect to have four classes comprised of similar numbers of points, since we can observe all four phases regularly in a cycle. These two yellow points, as well as other the other visible outliers, are actually segmentation artifacts caused by several very short segments, which tend to occur during fast transitions, and therefore do not match any actual phase of the signal. An example of such behavior is shown on Fig. 4.15, where we can see five very short segments detected during some brief peaks of the signal. The class detected around 0 is actually composed of two classes that were grouped together:

• A class centered on 0 that corresponds to the phases during which the water level is constant, whenever the inflow valve is closed and the outflow pump is off.

• A class centered around 0.15 that corresponds to the slow water level increase, which occurs whenever the inflow valve is open and the outflow pump is on.

These two classes can be seen more clearly on Fig. Of course, the K-means clustering result can vary significantly based on the initialization method used. The result shown here was obtained using K-means++ seeding [START_REF] Arthur | K-Means++: The Advantages of Careful Seeding[END_REF][START_REF] Pedregosa | Scikit-Learn: Machine Learning in Python[END_REF], and consistently yields this result with repeated runs. Through manual seeding with carefully selected starting points, we were able to recover the clusters we were expecting in the first place. We can see this on Fig. 4.17. Here we get a reasonable classification of our points, barring the few outliers that remain. Since our intention is to use this result as a basis to build a model of the normal operation conditions of the system, we can also take a look at the distribution of the slopes in presence of attacks. For this, we show on Fig. 4.18 the distribution of the slopes measured both in normal conditions and with attacks. For the normal data, we reused the clustering result shown in Fig. 4.17 as a reference point. For the attack data, we used the segmentation performed in Fig. 4.12, and colored these points according to which of the normal clusters they would belong to. How do these two segmentations compare? First, we can see that most of the slopes in the attack dataset are concentrated around the same centers as the normal data. This is normal, because the attack dataset is mainly composed of normal data using the same slopes as the normal dataset. Outside of the normal clusters, we can see many additional slopes, similar to the artifacts we mentioned earlier. From this figure, it is difficult to say whether some of these slopes also match some attacks or if these slopes are all due to segmentation artifacts. This shows that there are still improvements required to get usable data out of our change-detection method.

Assuming that we are able to improve the method to get rid of these artifacts, let us discuss briefly what we could do using the clustering output to define the normal ranges for the slopes. We know that under normal conditions, the measured slopes should remain close to the centers that we discovered. Of course, we need to define what "close" means here. An idea we can consider is estimating the probability density function of these slopes, and then we could use these densities to define the normal regions, for example by using a threshold. We could estimate these densities by using a kernel-based approach for example, or we could also assume that these clusters are Gaussian and model the overall density of these slopes as a Gaussian mixture. Of course many other possibilities could also be considered here.

Once we have a definition of the normal operation ranges, we could then attempt to detect anomalies on unknown signals. To do this, what we envision is performing the same segmentation as previously and then for each segment verify if the slope falls within any of the previously defined normal regions. This process can be performed on streaming data for real time detection, with only a slight delay due to the block-based processing of the segmentation method.

Conclusion

This chapter has presented a first "proof-of-concept" for a completely autonomous machine learning system aimed at learning the nominal behavior of a signal and detecting anomalies with respect to this learned model. The calculation of the normal behavior is performed via a segmentation tool based on Asymptotic RDT; the segments are then used to extract the slopes representing the various possible phases in the nominal behavior; the slopes are clustered by K-means.

Empirically, the segmentation of the signal before calculating the various slopes pertaining to the nominal behavior seems relevant in that, visually, the segments exhibited by the statistical detection of changes match those that the observers could pinpoint themselves. However, a quantitative assessment of this segmentation is hardly feasible for the following reasons: 1. We do not have any ground truth, provided by either a model of the behavior of the system (for instance, an automaton or some software describing the various actions performed during the running of the system), or an expert that would have observed, segmented and labeled the different segments constituting the dataset.

2. We cannot provide ourselves this ground truth by either modeling the whole system as an automaton (this requires expertise beyond the scope of this thesis) or segmenting the dataset ourselves. In fact, a manual segmentation of this data set would be dubious because of our lack of expertise in this field, and could also be biased if not carried out before running our algorithms. In addition, it can be difficult to decide visually whether a change actually occurred or not in some time intervals, or even possibly multiple changes or only a single one.

Regarding the clustering, the results raise the same kind of questions, in addition with the usual limitations of K-means. Even when the initialization is correct so as to find the four expected clusters, the segmentation artifacts that we highlighted in the analysis make it difficult to properly evaluate the performance of this approach. This also means that we cannot develop, and even less assess, any anomaly/attack detection method at this point, as we saw when comparing the clustering results between the normal and attack datasets.

It is also worth emphasizing that even if we had the means to properly and quantitatively evaluate the approach, as a whole but also at each step, this evaluation would have remained very limited because of the very small number of attacks (9 discontinuities and 36 attacks in total in this dataset).

Although the segmentation is promising, especially because it relies on a mathematical framework that has been duly analysed in the foregoing chapters and even it is tempting to design an autonomous learning system, the discussion above emphasizes two issues in machine learning for cybersecurity: one directly connected to the signals considered above and the other from a more general stance.

We have highlighted the lack of expertise and labeled segments to assess our algorithms. In fact, the information that experts could provide is somewhat contained in the signals provided by the actuators. The direct use of these signals to assess our method can hardly be considered without a preliminary assessment of these same signals by an expert. Indeed, for instance, possible delays pinpointed by an expert should be taken into account to achieve an accurate segmentation. However, the signals provided by the actuators could perhaps be harnessed to detect anomalies and attacks by comparison with the outcome of the segmentation, to find incoherencies or even unacceptable deviations. For instance, could a simple correlation between these signals and the segmentation results be used to realign both in time and exhibit abnormal behaviors if the correlation coefficient is not large enough?

From a more general point of view, data is crucial in such studies. It turns out that obtaining relevant data in cybersecurity is very difficult. This is also the case for other very sensitive fields, such as financial data for example. Relevant and realistic data is very hard to produce synthetically, without compromising security and privacy of the systems/people involved, and thus can hardly be released publicly. Depending on the system of interest, it may be possible to record real data and then purge sensitive information (for example financial data can be anonymised to some extent), but this is very demanding and requires extreme thoroughness in order to not risk compromising any critical information. Also, depending on the data that was purged, some important information could be lost in the process, which can limit the scope of the research as well as the relevancy of the results. In addition, it is unlikely that any given dataset is sufficient for any given research work, unless this research work is specifically dedicated to this database, which would probably lead to limited results. Indeed, the outcome of research can be unpredictable and may yield solutions, algorithms or even principles that rely on information not available in the database. The best approach to conduct such research is to have one's own testbed, or to work closely with an industrial partner that can provide relevant data on demand, either from real systems or simulated systems (especially when real data is sensitive) that represent the real systems accurately enough.

Conclusion and perspectives

We started off this thesis with the objective of developing methods for cybersecurity that would allow learning behaviors and detect anomalies and attacks based off these learned behaviors. For this, we focused mainly on the RDT framework, which gave us a good basis to build methods that are applicable to a large number of signals by requiring very little knowledge. A large part of this thesis consisted in extending this framework, allowing us to work on one hand with non-Gaussian noise (Chapter 2), and on the other hand with parameter estimates that can then be incorporated in the RDT model (Chapter 3). Using these tools, we then introduced two methods (Chapter 4) and demonstrated their use on some real signals: first a fairly simple wavelet-based discontinuity detection methods, and then a change-in-mean detection approach, that allows segmenting time series in order to find the phases that compose a given signal. A noteworthy aspect of these methods is that they require few parameters to set up, and these parameters are easily understandable, and therefore fairly easily adjustable in the sense that one can tell how modifying one parameter will affect the performances.

Of course, these methods still remain fairly limited and require more work to build a proper detection system, but we think that they are nonetheless promising proofs of concept, which may lead to usable methods with further work. We notably need to implement a complete anomaly detection system using our change-in-mean detection method, since we only presented some ideas on how to use it for that purpose.

One critical aspect which absolutely requires more work is performance evaluation. We only demonstrated some interesting results visually, but we could never offer proper metrics that would allow comparing our approaches with others. As mentioned several times in Chapter 4, a large part of that is due to the inherent problems that come with working on real data, notably regarding labeling the phenomenons of interest. For instance, the SWaT dataset used throughout this thesis only labels timestamps during which attacks were conducted. However, our methods looked at other aspects of the signals (e.g.: phase changes) which are not necessarily labeled, and therefore we do not have a ground truth that we could use to evaluate any performance metrics. One possibility to circumvent this problem is evaluating it using artificially generated signals, which we could more easily control and therefore giving us the required information.

Another important aspect is moving from anomaly detection to attack detection. So far, we only presented ways to detect anomalies, which may or may not be attacks. For example, incidents such as a natural sensor failure would not be distinguishable from intentional damage caused by an attacker. Such classification would be helpful to allow better responses to incidents and cut down on potential costs due to misattribution of the source of an alarm.

In addition to all this, we also need to keep in mind that the methods developed here only apply to the physical signals of the system. For cyberphysical systems, it is also important to take the cyber part into account, notably through network traffic monitoring. However, the nature of network data is very different from physical signals, and attempting to apply similar methods to what we presented seems very difficult, any may very well not be possible. However, there are already existing intrusion detection systems for network data (e.g.: NIDS). One option to associate both of these detection aspects could be to correlate alarms from different systems in order to improve their detection performances, as increasing the diversity of detection systems may lead to a more resilient system overall, as long as no extra vulnerabilities are introduced.

Regarding the theoretical aspects presented in Chapters 2 and 3, there are also several points that need addressing. For the Generalized RDT (Chapter 2), we were able to prove that for any noise distribution that presents some invariance, we are able to exhibit a test with a given level 𝛾. We were then able to find a sufficient property for this test to be optimal. However we were unable to find any distribution satisfying this property. While this test might not be optimal depending on the distribution at hand, this result is nonetheless interesting, as ensuring a given level is an important property (see for example the GLRT test, which is not necessarily optimal, but still widely used). Our search for noise distributions for which we might have optimality was also focused on distributions invariant by rotation and using the 𝐿 2 -norm as the maximal invariant of choice. It would be worth looking at other groups, and seeing if we can get interesting results for other types of noise distributions.

The computation of the distribution of a maximal invariant [24,Chapter 7,Proposition 7.15] gives some hints to extend the theoretical framework of Chapter 2. Indeed, a non-degenerated normal distribution, which is invariant with respect to the orthogonal group, is generally defined via its density with respect to the Lebesgue measure. The Lebesgue measure is nothing else but the Haar measure associated with the translation group. Mathematically speaking -and that is exactly what Eaton does in [24, Chapter 7, Proposition 7.15] -nothing prevents us from considering random vectors that have normal densities with respect to a Haar measure other than the Lebesgue measure. This gives a hint to go beyond the standard Gaussian case and we can thus wonder to what extent the framework of Chapter 2 can be adapted to Haar measures other than Lebesgue's when defining the noise probability distribution. The questions that raise at this stage are: how the probability distribution of a random vector that has normal density with respect to a given Haar measure actually looks like; how the invariance properties of both the Gaussian density and the Haar mesure combine; how relevant in practice are the invariance properties of such a random vector.

For the Asymptotic RDT (Chapter 3), we were able to take into account the estimation of parameters of the RDT model, namely the noise variance and the reference model, which is something that is commonly done in practice. We then presented some simulation results demonstrating how the estimation of the noise variance affects the performance of this test on a detection problem, and also suggest a method to adjust the tolerance to account for this estimation. A notable improvement that could be made is considering the case where the noise is no longer white, and can instead have any covariance matrix 𝐶, which is then estimated. We could also go further in our comparison simulations. The comparison that we chose between the RDT and NP tests is not necessarily the most informative one, due to their vastly different natures. It might be more interesting to replace the Neyman-Pearson with one that requires less a priori knowledge. The GLRT could be an interesting one to consider with an adapted problem with composite hypotheses, in which the RDT test might still be applicable. For example, we could consider testing the presence of a signal with unknown phase. Finally, the method that we showed to adjust the tolerance of the RDT test to take the noise estimation into account could use some refinement. As it stands, it is currently quite computationally heavy since it requires a large number of simulations, and it could be worth properly studying in order to find a more usable approach.

As already emphasized in Section 4.3, data is a crux in such a research. It is questionable whether having data beforehand might be detrimental, as tt may narrow the research focus or bias the overall approach. Furthermore, in some applications, industrials may be reluctant to provide data, thence the importance of having direct access to the means to generate data easily and rapidly, according to the advances achieved during the research. It is not merely a question of being data-rich, it is also about having the relevant data that we may need at any given time.

In short, regarding the initial objectives of this research, we have a rather advanced theoretical framework to support statistical detection. The application of this framework to learning and anomaly detection cannot be fully assessed because of the lack of labeled data. Qualitatively, the experimental results show that our segmentation approach performs well. Clustering and anomaly/attack detection, are more intricate to evaluate, even empirically, beyond the intrinsic limitations of K-means.

In addition to the previous suggestions for a full detection method, we could also consider using the resulting segmentation in correlation with the state of the actuators present on the system, in order to verify whether they are coherent. For example, if we observe that a pump connected to a tank is active and emptying that tank, the associated water level sensor is expected to observe a decrease in the water level in that tank. If we do not observe this decrease, this means there is an incoherence in the state of the system and we should trigger an alarm. In order to perform such detection, we would first need to discover the cause-and-effect relations that exist between sensors and actuators.

Overall, there is still work required to achieve a complete anomaly detection method based on this approach, but the work presented in this thesis provides a fairly solid foundation for robust detection methods, with a theoretical basis and encouraging results in our experiments so far.

A Deterministic Distortion Testing

We have seen in Chapter 1 how the RDT problem differs from usual testing problems. But this does not mean that they are completely unrelated. Indeed, with a simple change to the RDT problem, we can fall back on a more classic testing problem, that defines two families of probability distributions and that consists in deciding which of these families contains the distribution that generated the observation. This In Chapter 2, we described a set of sufficient conditions under which we know that we are able to prove that the test 𝒯 𝜆 𝛾 (𝜏) is 𝛾-MCCP. We need to use the euclidean norm ‖ ⋅ ‖ 2 as the maximal invariant, and the probability density function of the noise 𝑋 must be such that the family of densities {𝑓 𝜌 , 𝜌 ≥ 0} has monotone likelihood ratio (see Definition 1.1.5) where 𝑓 𝜌 is the density of ‖𝜃 + 𝑋‖ 2 with ‖𝜃‖ 2 = 𝜌. In this appendix, we will describe the Calculations to show that this is the case when 𝑋 follows a Gaussian distribution.

B.1 Notations and preliminary results

• 𝑆 𝑑-1 designates the unit (𝑑 -1)-sphere in ℝ 𝑑 centered on the origin:

𝑆 𝑑-1 = {𝑥 ∈ ℝ 𝑑 ∶ ‖𝑥‖ 2 = 1}
Its surface is denoted 𝑚(𝑆 𝑑-1 ) (𝑚 denotes the surface Lebesgue measure on 𝑆 𝑑-1 ) and we have:

𝑚(𝑆 𝑑-1 ) = 2𝜋 𝑑/2 Γ(𝑑/2)
• 𝜎 denotes the normalized spherical measure on the (𝑑 -1)-sphere:

∀𝐴 ∈ ℬ(𝑆 𝑑-1 ), 𝜎(𝐴) = 𝑚(𝐴) 𝑚(𝑆 𝑑-1 )

• For any 𝜌 > 0, we denote by 𝜌𝑆 𝑑-1 the sphere centered on the origin with radius 𝜌, and we have: For any spherically invariant random vector 𝑋 ∈ ℳ(Ω, ℝ 𝑑 ) that has a probability density function 𝑓 𝑋 , the random variable ‖𝑋‖ 2 also has a probability density function 𝑓 ‖𝑋‖ 2 and we have: ∀𝑥 ∈ ℝ 𝑑 , 𝑓 ‖𝑋‖ 2 (‖𝑥‖ 2 ) = 𝑚(𝑆 𝑑-1 )‖𝑥‖ 𝑑-1 2 𝑓 𝑋 (𝑥)

∫ 𝜌𝑆 𝑑-1
where 𝑚(𝑆 𝑑-1 ) is the surface of the unit 𝑑 -1-sphere 𝑆 𝑑

B.2 Calculations

Let 𝑋 ∈ ℳ(Ω, ℝ 𝑑 ) be a spherically invariant random vector with density 𝑓 𝑋 . Its density 𝑓 𝑋 can be written ∀𝑥 ∈ ℝ 𝑑 , 𝑓 𝑋 (𝑥) = ℎ(‖𝑥‖ 2 2 ) with ℎ ∶ ℝ + → ℝ + [25, Theorem 6. From here, it is difficult to get anything out of this expression without considering a specific probability distribution.

To give an example where we know we can get a result out of this calculation, we will consider the case where the random vector 𝑋 follows a Gaussian distribution with zero mean and independent components: 𝑋 ∼ 𝒩(0, 𝜎 0 2 𝐼 𝑑 ). We then have for any 𝑥 ∈ ℝ 𝑑 𝑓 𝑋 (𝑥) = ℎ(‖𝑥‖ 2 2 ) with ℎ being defined by: ∀𝑥 ≥ 0, ℎ(𝑥) = (2𝜋𝜎 0 2 ) -𝑑/2 exp ( -𝑥 2𝜎 0 2 )

We also have: ∀𝑛 ∈ ℕ, ∀𝑥 ≥ 0, ℎ (2𝑛) (𝑥) = 𝜋 -𝑑/2 (2𝜎 0 2 ) -2𝑛-𝑑/2 exp ( -𝑥 2𝜎 0 2 )

In the gaussian case, we would expect ‖𝑌 ‖ 2 2 to follow a non-central 𝜒 2 distribution (potentially up to a scale factor) with a certain non-centrality parameter depending on 𝜌. As a reminder, the probability density function for the non-central 𝜒 2 distribution with 𝜈 ∈ ℕ degrees of freedom and non-centrality parameter 𝜆 ≥ 0 is [54, Eq 26. This appendix is dedicated to proving that the Generalized Marcum function 𝑄 𝑑/2 is uniformly continuous, which we need in the proof of Theorem 3.2.2 to use the Portmanteau theorem.

As a reminder, the Generalized Marcum function 𝑄 𝑑/2 is defined by:

𝑄 𝑑/2 ∶ [0, ∞) × [0, ∞) ⟶ ℝ (𝜌, 𝜂) ⟼ 1 -𝔽 𝜒 2 𝑑 (𝜌 2 ) (𝜂 2 ) (C.1)
where 𝔽 𝜒 2 𝑑 (𝜌 2 ) is the cumulative distribution function of the non-central 𝜒 2 distribution with 𝑑 degrees of freedom and non-centrality parameter 𝜌 2 . This means that for any Gaussian random variable 𝑋 ∼ 𝒩(𝜃, 𝐼 𝑑 ) with 𝜃 ∈ ℝ 𝑑 , and for any 𝜆 ≥ 0, we have 𝑄 𝑑/2 (𝜌, 𝜆) = ℙ[‖𝑋‖ 2 2 ≥ 𝜆 2 ], where 𝜌 = ‖𝜃‖ 2 . One expression of 𝑄 𝑑/2 is given by: ∀𝜌 ≥ 0, ∀𝜆 ≥ 0, 𝑄 𝑑/2 (𝜌, 𝜆) = 𝑒 -𝜌 2 /2 We now consider the case when 𝑑 ≥ 2. For any 𝜌 ≥ 0, we can consider the vector 𝜃 = (𝜌, 0, …, 0) ∈ ℝ 𝑑 , which yields:

𝑅 𝑑/2 (𝜌, 𝜆) = ∫ 𝟙 𝐵 𝑑 (0,𝜆) (𝑥 1 , …, 𝑥 𝑑 ) 1 (2𝜋) 𝑑/2 exp(- The first inequality can be found in [START_REF] Jones | An Extension of an Inequality Involving Modified Bessel Functions[END_REF], and the second can be deduced immediately from [START_REF] Yudell | Inequalities for Generalized Hypergeometric Functions[END_REF]Eq 6.25].

(𝑥 1 -𝜌) 2 2 ) exp(- 1
Lemma C.0.3 𝜕𝑅 𝑑/2 𝜕𝜆 is bounded on [0, +∞) × [0, +∞).

Proof. We start by considering the case when 𝑑 = 1. In this case, from Eq. (C.7), 𝑅 1/2 is differentiable with respect to 𝜆 and we have: . We now consider the general case when 𝑑 ≥ 2.

∀𝜌 ≥ 0, ∀𝜆 ≥ 0, 𝜕𝑅 1
From Eq. (C.4), we have: ∀𝜌 ≥ 0, ∀𝜆 ≥ 0, 𝑅 𝑑/2 (𝜌, 𝜆) = 𝑒 -𝜌 2 /2 Studying the functions 𝑔 1,𝑎 and 𝑔 2,𝑎 shows that, for every 𝑎 > 0, both functions present a maximum at 𝜆 𝑎 = √ 𝑑-1+√(𝑑-1) 2 +4𝑎 2

2

. Thus, for any 𝑎 > 0, we have: Let 𝑎 0 > 0.

1. On (0, 𝑎 0 ], the function 𝑎 ↦ 𝑔 1,𝑎 (𝜆 𝑎 ) is continuous and admits a finite limit in 0. It is therefore bounded on that interval: there exists 𝐶 1 ∈ ℝ such that, for any 𝑎 ∈ (0, 𝑎 0 ], we have 𝑔 1,𝑎 (𝜆 𝑎 ) < 𝐶 1 .

2. Similarly, on [𝑎 0 , +∞), the function 𝑎 ↦ 𝑔 2,𝑎 (𝜆 𝑎 ) is continuous and admits a finite limit in +∞.

It is therefore bounded on that interval: there exists 𝐶 2 ∈ ℝ such that, for any 𝑎 ∈ [𝑎 0 , +∞), we have 𝑔 2,𝑎 (𝜆 𝑎 ) < 𝐶 2 .

Therefore: ∀𝑎 ∈ (0, 𝑎 0 ], ∀𝜆 > 0, 𝑔 We now have to study the cases 𝜌 = 0 and 𝜆 = 0. For any 𝑑 ≥ 2, we have 0 𝐹 1 ( The first expression is clearly bounded, and the second one is continuous on [0, +∞) and has a finite limit as 𝜆 grows to +∞, thus it is also bounded. Therefore Abstract: The objective of this thesis is the development of new cyberattack detection methods based on machine learning techniques. This work focused on industrial systems, and consisted in characterizing the normal behavior of the physical signals of the system. This characterization then allows us to detect anomalies that occur in the system, these anomalies being deviations from the learned nominal behavior. The work presented here is based on the RDT (Random Distortion Testing) theory, which stems from statistical decision theory, and offers an optimal test to determine whether some phenomenon lies close enough to some model, without requiring any knowledge about its probability distribution. We used this theory as a basis to develop a change-detection method, which was then successfully applied to real signals, while also allowing control of the false-alarm rate. We developed an extension of the RDT framework to account for the estimation of the model and of the noise variance, which were assumed to be known in the initial theory. This change-detection method has then been used as a basis to characterize the different phases of the signals in the system using clustering methods. Our first attempts to develop a complete learning and anomaly-detection method have yielded encouraging results for attack detection on real signals.

4. 1

 1 Detecting discontinuities on continuous signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Segmenting and learning phases, and detecting anomalies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.1 Change-detection in time series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.2 An RDT-based change-in-mean detection method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.3 Application to real signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.4 Perspectives: towards learning a model and detecting anomalies . . . . . . . . . . . . . . . . 4.3 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3 Asymptotic Random Distortion Testing 3 . 1

 331 architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 SWaT Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Example of signals recorded under normal operating conditions in the SWaT testbed . . . . 4 Example of signals recorded in presence of attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Hypothesis Testing and Random Distortion Testing 1.1 Threshold 𝜆 𝛾 (𝜏) against 𝜏 (left) and 𝛾 (right) for 𝑑 = 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Measured false alarm rate against 𝛾 with known 𝜎 0 for different values of DNR . . . . . . . . 3.2 Measured false alarm rate against 𝛾 with estimated 𝜎 0 for different values of DNR and numbers of samples 𝑁 used to estimate 𝜎 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3.3 Measured false alarm rate against number of samples 𝑁 used to estimate 𝜎 0 for different values of 𝛾 with DNR = 5 dB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 ROC curves obtained for the NP and RDT tests with no distortion and 𝜎 0 known. . . . . . . . 3.5 Measured false alarm rate against 𝛾 for the NP and RDT tests with no distortion and 𝜎 0 known . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6 ROC curves obtained for the NP and RDT tests with distortion and 𝜎 0 known for SNR = 15 dB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.7 Measured false alarm rate against 𝛾 for the NP and RDT tests with distortion and 𝜎 0 known 3.8 ROC curves for the NP and RDT tests with estimation of 𝜎 0 , SNR = 15 dB, DNR = 5 dB 3.9 Measured false alarm rate against 𝛾 for the Neyman-Pearson test with estimation of 𝜎 0 . . 3.10 Measured false alarm rate against 𝛾 for the RDT test with estimation of 𝜎 0 . . . . . . . . . . . . . 3.11 Measured values of 𝜏 * against 𝛾 for different values of 𝑁 and DNR . . . . . . . . . . . . . . . . . . . . 3.12 Measured false-alarm rate against 𝛾 using the adjusted tolerance 𝜏 * . . . . . . . . . . . . . . . . . . . 3.13 Measured values of 𝜏 * against 𝛾 for different values of 𝑁 and DNR with 𝜎 0 = 2 . . . . . . . . 3.14 Measured values of 𝜏 * against 𝛾 for different values of 𝑁 and DNR with 𝜎 0 = 100 . . . . . . 3.15 Comparison of ROC curves obtained using the tolerances 𝜏 and 𝜏 * . . . . . . . . . . . . . . . . . . . . 4 Learning behaviors and detecting anomalies on real signals 4.1 Examples of discontinuities observed on the water level signal LIT101 . . . . . . . . . . . . . . . . . 4.2 Wavelet transform on the signal LIT101 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 Wavelet transform on normal LIT101 signal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4 Threshold applied on the detail coefficients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5 Late attack detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 Sensor LIT101 and actuators MV101 and P101 during normal operation . . . . . . . . . . . . . . . 4.7 Proposed RDT-based change-in-mean detection algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 3 :

 3 Figure 3: Example of signals recorded under normal operating conditions in the SWaT testbed

Figure 4 :

 4 Figure 4: Example of signals recorded in presence of attacks

3 Figure 1 . 1 : 2 Theorem 1 . 2 . 10 :

 31121210 Figure 1.1: Threshold 𝜆 𝛾 (𝜏) against 𝜏 (left) and 𝛾 (right) for 𝑑 = 2

Definition 2 .

 2 1.2: Group homomorphism Let (𝐺, * ) and (𝐻, •) be two groups, and let 𝑓 ∶ 𝐺 → 𝐻 be a function. The function 𝑓 is a group homomorphism from (𝐺, * ) to (𝐻, •) if it verifies:

Lemma 2 . 1 . 13 :

 2113 Characterization of invariant functions[24, Proposition 7.7]

Lemma 2 . 2 . 6 :

 226 Distribution of 𝑀(𝜃 + 𝑋) (i) The distribution of 𝑀(𝜃 + 𝑋) depends on 𝜃 only through 𝑀(𝜃), i.e. for any pair (𝜃 1 , 𝜃 2 ) ∈ ℝ 𝑑 × ℝ 𝑑 such that 𝑀(𝜃 1 ) = 𝑀(𝜃 2 ), the random variables 𝑀(𝜃 1 + 𝑋) and 𝑀(𝜃 2 + 𝑋) have the same probability distribution. (ii) For any 𝜌 ∈ ℝ and any random variable Ξ ∈ ℳ(Ω, ℝ 𝑑 ) such that Ξ ∈ Υ 𝜌 almost surely, 𝑀(Ξ + 𝑋) has the same probability distribution as 𝑀(𝜃 + 𝑋) for any 𝜃 ∈ Υ 𝜌 .

  Proof. Let 𝜖 > 0. We want to prove that ℙ[‖𝑋 𝑛 -𝑐‖ 2 ≥ 𝜖] ----→ 𝑛→∞ 0, or equivalently that ℙ[‖𝑋 𝑛 -𝑐‖ 2 < 𝜖] ----→ 𝑛→∞ 1. Let 𝐵(𝑐, 𝜖) be the open ball with center 𝑐 and radius 𝜖. Since 𝑋 𝑛 𝒟 --→ 𝑐, and since 𝐵(𝑐, 𝜖) is an open set, from the Portmanteau theorem [35, Theorem 2.1, p.16], we have:lim inf ℙ[𝑋 𝑛 ∈ 𝐵(𝑐, 𝜖)] ≥ ℙ[𝑐 ∈ 𝐵(𝑐, 𝜖)] = 1Since we always have 0 ≤ ℙ[𝑋 𝑛 ∈ 𝐵(𝑐, 𝜖)] ≤ 1, we therefore have lim inf ℙ[𝑋 𝑛 ∈ 𝐵(𝑐, 𝜖)] = 1. In addition to that, we also have:1 ≥ lim sup ℙ[𝑋 𝑛 ∈ 𝐵(𝑐, 𝜖)] ≥ lim inf ℙ[𝑋 𝑛 ∈ 𝐵(𝑐, 𝜖)] = 1Hence lim sup ℙ[𝑋 𝑛 ∈ 𝐵(𝑐, 𝜖)] = lim inf ℙ[𝑋 𝑛 ∈ 𝐵(𝑐, 𝜖)] = 1. Therefore lim ℙ[𝑋 𝑛 ∈ 𝐵(𝑐, 𝜖)] exists and lim ℙ[𝑋 𝑛 ∈ 𝐵(𝑐, 𝜖)] = 1. Lemma 3.1.2: Convergence in probability of random vectors Let (𝑋 𝑛 ) 𝑛∈ℕ = (𝑋 1 𝑛 , ..., 𝑋 𝑑 𝑛 ) 𝑛∈ℕ ∈ ℳ(Ω, ℝ 𝑑 ) ℕ be a sequence of random vectors and 𝑋 = (𝑋 1 , ..., 𝑋 𝑑 ) ∈ ℳ(Ω, ℝ 𝑑 ) be a random vector. We have: 𝑋 𝑛 ℙ -→ 𝑋 ⇔ ∀𝑖 ∈ {1, ..., 𝑑}, 𝑋 𝑖 𝑛 ℙ -→ 𝑋 𝑖

25 )

 25 Proof. Proof of Eq.(3.23):𝑥 ∈ (𝐴 ∩ 𝐵) 𝜃 0 ,𝜎 0 ⇔(𝑥, 𝜃 0 , 𝜎 0 ) ∈ (𝐴 ∩ 𝐵) ⇔(𝑥, 𝜃 0 , 𝜎 0 ) ∈ 𝐴 and (𝑥, 𝜃 0 , 𝜎 0 ) ∈ 𝐵 ⇔𝑥 ∈ 𝐴 𝜃 0 ,𝜎 0 and 𝑥 ∈ 𝐵 𝜃 0 ,𝜎 0 ⇔𝑥 ∈ 𝐴 𝜃 0 ,𝜎 0 ∩ 𝐵 𝜃 0 ,𝜎 0 Proof of Eq. (3.24): 𝑥 ∈ (𝐴 𝑐 ) 𝜃 0 ,𝜎 0 ⇔(𝑥, 𝜃 0 , 𝜎 0 ) ∈ 𝐴 𝑐 ⇔(𝑥, 𝜃 0 , 𝜎 0 ) ∉ 𝐴 ⇔𝑥 ∉ 𝐴 𝜃 0 ,𝜎 ⇔𝑥 ∈ (𝐴 𝜃 0 ,𝜎 ) 𝑐Proof of Eq. (3.25):

•

  The dimension of the problem 𝑑, • The desired level 𝛾, • The distribution of the signal Θ, • The tolerance 𝜏, • The noise standard deviation 𝜎 0 , • The model 𝜃 0 , • The noise standard deviation estimator σ, • The model estimator θ .

Figure 3 . 1 :

 31 Figure 3.1: Measured false alarm rate against 𝛾 with known 𝜎 0 for different values of DNR

Figure 3 . 2 :

 32 Figure 3.2: Measured false alarm rate against 𝛾 with estimated 𝜎 0 for different values of DNR and numbers of samples 𝑁 used to estimate 𝜎 0

3 Figure 3 . 3 :

 333 Figure 3.3: Measured false alarm rate against number of samples 𝑁 used to estimate 𝜎 0 for different values of 𝛾 with DNR = 5 dB

Figure 3 . 4 :Figure 3 . 5 :

 3435 Figure 3.4: ROC curves obtained for the NP and RDT tests with no distortion and 𝜎 0 known

Figure 3 . 6 :

 36 Figure 3.6: ROC curves obtained for the NP and RDT tests with distortion and 𝜎 0 known for SNR = 15 dB

Figure 3 . 7 :

 37 Figure 3.7: Measured false alarm rate against 𝛾 for the NP and RDT tests with distortion and 𝜎 0 known

Figure 3 . 8 :

 38 Figure 3.8: ROC curves for the NP and RDT tests with estimation of 𝜎 0 , SNR = 15 dB, DNR = 5 dB

Figure 3 . 9 :Figure 3 . 10 :Figure 3 . 11 :Figure 3 . 12 :

 39310311312 Figure 3.9: Measured false alarm rate against 𝛾 for the Neyman-Pearson test with estimation of 𝜎 0

DNR = - 5 Figure 3 . 13 :

 5313 Figure 3.13: Measured values of 𝜏 * against 𝛾 for different values of 𝑁 and DNR with 𝜎 0 = 2

Figure 3 . 14 :Figure 3 . 15 :

 314315 Figure 3.14: Measured values of 𝜏 * against 𝛾 for different values of 𝑁 and DNR with 𝜎 0 = 100

Figure 4 . 1 :

 41 Figure 4.1: Examples of discontinuities observed on the water level signal LIT101

Figure 4 . 2 :

 42 Figure 4.2: Wavelet transform on the signal LIT101

Figure 4 . 3 :

 43 Figure 4.3: Wavelet transform on normal LIT101 signal

Figure 4 . 4 :

 44 Figure 4.4: Threshold applied on the detail coefficients

Figure 4 . 5 :

 45 Figure 4.5: Late attack detection

Figure 4 . 6 :

 46 Figure 4.6: Sensor LIT101 and actuators MV101 and P101 during normal operation

Figure 4 . 7 :

 47 Figure 4.7: Proposed RDT-based change-in-mean detection algorithm

Figure 4 . 8 :

 48 Figure 4.8: Signal LIT101 and its derivative under normal operation

Figure 4 . 9 :

 49 Figure 4.9: Tracked signal mean on the derivative of LIT101 (𝑁 = 40, 𝛾 = 10 -3 , 𝜏 ′ = 0.05)

Figure 4 . 10 :

 410 Figure 4.10: Tracked signal mean on the derivative of LIT101 (𝑁 = 10, 𝛾 = 10 -3 , 𝜏 ′ = 0.05)

Figure 4 . 11 :

 411 Figure 4.11: Tracked signal mean on the derivative of LIT101 (𝑁 = 10, 𝛾 = 10 -6 , 𝜏 ′ = 0.05)

Figure 4 . 12 :

 412 Figure 4.12: Tracked signal mean on the derivative of LIT101 with attacks (𝑁 = 40, 𝛾 = 10 -3 , 𝜏 ′ = 0.05)

Figure 4 . 13 :

 413 Figure 4.13: Tracked signal mean on the derivative of LIT101 with attacks (𝑁 = 40, 𝛾 = 10 -2 , 𝜏 ′ = 0.01)

Figure 4 .

 4 Figure 4.14: K-means output on normal LIT101 signal

Figure 4 . 15 :

 415 Figure 4.15: Example of segmentation artifacts caused by short segments

Figure 4 .

 4 Figure 4.17: K-means output on normal LIT101 signal with manual seeding

Figure 4 . 18 :

 418 Figure 4.18: Comparison of slopes obtained on signal LIT101 both in normal and attack conditions

1

 1 modified RDT problem is what we call the DDT (Deterministic Distortion Testing) problem, and is defined in Definition A.0.1 hereafter. Definition A.0.1: DDT problem statement⎧ { { { { { { { { { { { { ⎨ { { { { { { { { { { { { ⎩ Data model: ∃𝑌 ∈ ℳ(Ω, ℝ 𝑑 ), ∃𝜃 ∈ ℝ 𝑑 , ∃𝑋 ∈ ℳ(Ω, ℝ 𝑑 ), ⎧ { { ⎨ { { ⎩ (𝑋 ∼ 𝒩(0, 𝐶)) ∧ (𝑌 = 𝜃 + 𝑋) ∧ (∀𝑦 ∈ ℝ 𝑑 , ∃𝜔 ∈ Ω, 𝑦 = 𝑌 (𝜔))Testing problem:Given one realization 𝑦 = 𝑌 (𝜔) = 𝜃 + 𝑋(𝜔), determine whether:⎧ { ⎨ { ⎩ ℋ 0 ∶ 𝜈 𝐶 (𝜃 -𝜃 0 ) ≤ 𝜏 or ℋ 1 ∶ 𝜈 𝐶 (𝜃 -𝜃 0 ) > 𝜏 with 𝜏 > 0 and 𝜃 0 ∈ ℝ 𝑑 (A.1)As a reminder, here is the RDT problem defined in Chapter 1:Definition 1.2.2: RDT problem statement ⎧ { { { { { { { { { { { { { { ⎨ { { { { { { { { { { { { { { ⎩ Data model: ∃𝑌 ∈ ℳ(Ω, ℝ 𝑑 ), ∃Θ ∈ ℳ(Ω, ℝ 𝑑 ), ∃𝑋 ∈ ℳ(Ω, ℝ 𝑑 ), ⎧ { { { ⎨ { { { ⎩ (𝑋 ∼ 𝒩(0, 𝐶) with 𝐶 a 𝑑 × 𝑑 definite positive matrix) ∧ (Θ and 𝑋 are independent) ∧ (𝑌 = Θ + 𝑋) ∧ (∀𝑦 ∈ ℝ 𝑑 , ∃𝜔 ∈ Ω, 𝑦 = 𝑌 (𝜔))Testing problem:Given one realization 𝑦 = 𝑌 (𝜔) = Θ(𝜔) + 𝑋(𝜔), determine whether:⎧ { ⎨ { ⎩ ℋ 0 ∶ 𝜈 𝐶 (Θ(𝜔) -𝜃 0 ) ≤ 𝜏 or ℋ 1 ∶ 𝜈 𝐶 (Θ(𝜔) -𝜃 0 ) > 𝜏 with 𝜏 > 0 and 𝜃 0 ∈ ℝ 𝑑 (1.12)This problem can be seen as a particular case of the RDT problem, obtained by restricting the set of random variables that we consider to the random variables Θ such that Θ = 𝜃 almost surely, for some deterministic 𝜃 ∈ ℝ 𝑑 . Notations and preliminary results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 B.2 Calculations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

  𝑚(d𝑥) = 𝜌𝑑-1 𝑚(𝑆 𝑑-1 ) ∫ 𝜌𝑆 𝑑-1 𝜎(d𝑥) = 𝜌 𝑑-1Lemma B.1.1: Spherically invariant random vectors [52, Eq. (12)]

- 1 : 1 𝑓 (𝑡‖𝑥‖ 2 )( 1 -𝑡 2 )

 11212 𝑚(𝑆𝑑-1 ) = 2𝜋 𝑑/2 Γ(𝑑/2) Lemma B.1.2: [53, Ch. 1, Eq (1.2)]For any continuous function 𝑓 defined on ℝ, we have:∀𝑥 ∈ ℝ 𝑑 , ∫ 𝑆 𝑑-1𝑓 (⟨𝑥, 𝑦⟩)𝑚(d𝑦) = 𝑚(𝑆 𝑑-2 ) ∫ +1 -

1 𝑡 𝑛 ( 1 -𝑡 2 ) 3 2 3 2 1 0𝑡 2𝑘 ( 1 -𝑡 2 ) 1 0𝑡 𝑥- 1 ( 1 - 2 )

 112331121112 2.1]. Let 𝜌 > 0 and let Ξ 𝜌 ∼ 𝑈(𝜌𝑆 𝑑-1 ) independent from 𝑋 uniformly distributed on 𝜌𝑆 𝑑-1 : Let 𝑌 = Ξ 𝜌 + 𝑋. Since 𝑋 admits a density and is independent from Ξ 𝜌 , 𝑌 also admits a density 𝑓 𝑌 (⋅, 𝜌) = 𝑓 𝑥 * ℙΞ-1 𝜌 . Let 𝑦 ∈ ℝ 𝑑 . We have:𝑓 𝑌 (𝑦, 𝜌) = ∫ 𝑓 𝑋 (𝑦 -𝜉)ℙΞ -1 𝜌 (d𝜉)Assume that ℎ is infinitely differentiable and equal to its Taylor series expansion:∀𝑎 ∈ ℝ + , ∀𝑥 ∈ ℝ + , ℎ(𝑥) = ∞ ∑ 𝑛=0 ℎ (𝑛) (𝑎) 𝑛! (𝑥 -𝑎) 𝑛For every 𝑛 ∈ ℕ, we have to compute the integral:𝐼 𝑛 = ∫ +1 -If 𝑛 is odd (𝑛 = 2𝑘 + 1, 𝑘 ∈ ℕ), the function 𝑡 ↦ 𝑡 𝑛 (1 -𝑡 2 )𝑑is odd, which means that:∀𝑘 ∈ ℕ, 𝐼 2𝑘+1 = 0 If 𝑛 is even (𝑛 = 2𝑘, 𝑘 ∈ ℕ), the function 𝑡 ↦ 𝑡 𝑛 (1 -𝑡 2 )𝑑is even and we have:∀𝑘 ∈ ℕ, 𝐼 2𝑘 = 2 ∫By applying the change of variable 𝑢 = 𝑡 2 (d𝑢 = 2𝑡 d𝑡), we get:∀𝑘 ∈ ℕ, 𝐼 2𝑘 = ∫where Β is the Beta function defined by [54, Eq 6.2.1]:∀𝑥 ≥ 0, ∀𝑦 ≥ 0, Β(𝑥, 𝑦) = ∫ 𝑡) 𝑦-1 d𝑡 A property of the Beta function is [54, Eq 6.2.2]: Applying Lemma B.1.1, we get: 𝑓 ‖𝑌 ‖ 2 (‖𝑦‖ 2 , 𝜌) = 𝑚(𝑆 𝑑-1 )‖𝑦‖ 𝑑-1 2 𝑓 𝑌 (𝑦, 𝜌) = 2𝜋 𝑑/2 ‖𝑦‖ 𝑑-

2𝜌 2𝑛 ‖𝑦‖ 2𝑛 2 2 2 𝜎 0 2 ,

 222 4.25]:∀𝑥 ≥ 0, 𝑓 𝜒 2 𝜈,𝜆 (𝑥) = 𝑑 , 𝑓 ‖𝑌 ‖ 2 (‖𝑦‖ 2 , 𝜌) = 2𝜋 𝑑/2‖𝑦‖ 𝑑-𝑑/2 𝜎 0 𝑑 exp ( -2𝑛 𝜎 0 4𝑛 Γ(𝑛 + and let 𝑓 𝑍 (⋅, 𝜌) be its probability density function. Let 𝜌 0 = 𝜌/𝜎 0 . We have:CUniform continuity of the Generalized Marcum function 𝑄 𝑑/2

24 )

 24 cos 𝜃) sin 𝑑-2 𝜃d𝜃 ≤ 𝜋𝐼 0 (𝑥) (C.22) Combining Eqs. (C.21) and (C.22) gives the desired result. Proof of Eq. (C.19). We have: sin 2 𝜃)d𝜃 (C.23) For any 𝜃 ∈ [0, 𝜋/2], we have sin 𝜃 ≥ In addition to Eqs. (C.18) and (C.19), we will also make use of the following inequalities: ∀𝑥 > 0, ∀𝜇 > 𝜈 ≥ 0, 𝐼 𝜈 (𝑥) > 𝐼 𝜇 (𝑥) (C.25) ∀𝑥 ≥ 0, 𝐼 0 (𝑥) ≤ 𝑒 𝑥 (C.26)

𝑔 1 , 1 𝑔 2 , 2 (C. 39 )- 1 𝑔 2 ,

 11223912 𝑎 (𝜆 𝑎 ) = 𝑒 𝑎 𝑒 -𝑎 (𝜆 𝑎 ) = 𝑒 𝑎 𝑒 -These two expressions present the following limits:𝑔 1,𝑎 (𝜆 𝑎 ) ----→ 𝑎→0 𝑒 𝑎 (𝜆 𝑎 ) -----→

𝜕𝑅 𝑑/ 2 𝜕𝜆

 2 is bounded on [0, +∞) × [0, +∞).Theorem C.0.4The Generalized Marcum function 𝑄 𝑑/2 is uniformly continuous on [0, +∞) × [0, +∞). Titre : Contributions aux statistiques et méthodes d'apprentissage automatique pour la détection d'attaques basée sur la physique dans les systèmes industriels Mots clés : Cybersécurité, détection d'anomalies, détection d'attaques, random distortion testing, apprentissage non-supervisé Résumé : L'objectif de cette thèse est de développer de nouvelles méthodes de détection de cyberattaques basées sur des techniques d'apprentissage automatique. Ces travaux se sont concentrés sur l'étude de systèmes industriels, et plus spécifiquement la caractérisation du comportement normal des signaux physiques du système. Cette caractérisation permet ensuite de détecter des anomalies du système comme étant des déviations du comportement du système par rapport à ce modèle nominal appris. Les travaux effectués sont basés sur la théorie RDT (Random Distortion Testing), issue de la théorique statistique de la décision et permettant de donner un test optimal pour déterminer si une grandeur est suffisamment proche ou non d'un modèle donné, sans en connaître la distribution de probabilité. Cette théorie a été utilisée comme base afin de développer une méthode de détection de changement et a été appliquée avec succès sur des signaux réels, permettant également de contrôler le taux de fausses alarmes. Une extension de la théorie RDT a été développée afin de prendre en compte l'estimation du modèle et de la variance du bruit, supposés connus dans la théorie initiale. La méthode de détection de changements développée a ensuite été utilisée comme base pour caractériser les différentes phases des signaux du système via des méthodes de clustering. Les premiers essais d'une méthode complète d'apprentissage et de détection d'anomalies effectués sur des signaux réels offrent des résultats encourageants pour la détection d'attaques.Title: Contributions to Statistics and Machine Learning for Physics-based Attack Detection in Industrial SystemsKeywords: Cybersecurity, anomaly detection, attack detection, random distortion testing, non-supervised learning

  Pour ce test, on dispose de deux résultats théoriques concernant ses propriétés asymptotiques lorsque les estimateurs θ 𝑛 et σ𝑛 convergent. Ces deux résultats concernent le niveau asymptotique du test et un critère d'optimalité asymptotique. Le premier résultat, énoncé dans le Théorème 3.2.2, indique que le test T 𝜆 𝛾 (𝜏) a niveau asymptotique 𝛾 lorsque θ 𝑛 et σ𝑛 convergent, si le signal Θ et les estimateurs sont indépendants :

	(8)
	0 sinon
	lim sup

1 si ‖𝑦 -𝜃‖ 2 > 𝜎𝜆 𝛾 (𝜏) 𝑛 sup Θ ind. de ( θ𝑛 ,σ 𝑛 )

  détecter des anomalies et des attaques menées contre ces systèmes de façon robuste. Generalization of the RDT approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.1 Problem statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.2 Redefining notions for the GRDT problem. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.3 Preliminary results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.4 Generalization when the maximal invariant is the euclidean norm. . . . . . . . . . . . . . . 2.3 Conclusion and perspectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Preliminary results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Asymptotic RDT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.1 Problem statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 Asymptotic size and power. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Simulation experiments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.1 Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.2 Application to a detection problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.3 Recovering a test with level 𝛾 when estimating 𝜎 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

	Contents
	2.2 3 Asymptotic Random Distortion Testing
	3.1

Contents

  Context. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 A short primer on industrial systems and cybersecurity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Industrial Control Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The SWaT testbed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Objectives and contributions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Thesis structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

	Introduction

. 20 Detection schemes: misuse detection vs. anomaly detection . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

) 1 Hypothesis Testing and Random Distortion Testing Contents 1

  .1 Traditional hypothesis testing approaches. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.1.1 Non-Bayesian binary classification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.1.2 Optimality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.2 The RDT approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 1.2.1 Problem statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 1.2.2 Optimality: 𝛾-MCCP tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.2.3 Thresholding tests and optimality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.3 Robustness and hypothesis testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 1.3.1 Huber's approach to robust hypothesis testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.3.2 RDT and robust hypothesis testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

  Being able to quantify the occurrences of each of these outcomes is important to evaluate the performance of a given test. This is usually done through the notions of size, level, and power function, which help measure the probability of each of these four outcomes.A test 𝒯 is said to have level 𝛾 if 𝛼 𝒯 ≤ 𝛾.

			1.1 -Traditional hypothesis testing approaches
	Definition 1.1.2: Level, size and power function of a test
	Let 𝒯 ∶ ℝ 𝑑 → {0, 1} be a test.
	The size 𝛼 𝒯 and the power function 𝛽 𝒯 of 𝒯 are defined as:
	Power function: ∀𝑃 ∈ ℱ, 𝛽 𝒯 (𝑃) = ℙ[𝒯(𝑌 ) = 1] with 𝑌 ∼ 𝑃
	Size:	𝛼 𝒯 = sup	𝛽 𝒯 (𝑃)
		𝑃∈ℱ 0
	2. Accept ℋ 0 and ℋ 1 is true (Type II error, i.e. false negative or missed detection)
	3. Reject ℋ 0 and ℋ 0 is true (Type I error. i.e. false positive or false alarm)
	4. Reject ℋ 0 and ℋ 1 is true (true positive)

any other test 𝒯 with level 𝛾, we have:

	Definition 1.1.3: Uniformly Most Powerful (UMP) Test
	A test 𝒯 * is said to be Uniformly Most Powerful (UMP) with level 𝛾 if:
	1. 𝒯 * has level 𝛾.
	2. For

2 Invariance and Generalized Random Distortion Testing Contents 2

  .1 Invariance in group theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Generalization of the RDT approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Conclusion and perspectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

. 46 2.1.1 Group theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 2.1.2 Invariance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 2.1.3 Orbits and maximal invariant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 2.1.4 Invariance applied to probability distributions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 2.2 . 53 2.2.1 Problem statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 2.2.2 Redefining notions for the GRDT problem. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 2.2.3 Preliminary results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 2.2.4 Generalization when the maximal invariant is the euclidean norm. . . . . . . . . . . . . . . 61 2.3

  Definition 2.1.6: Invariant subset Let Π be a group action of 𝐺 on 𝒳, and let 𝐸 ⊂ 𝒳 be a subset of 𝒳. 𝐸 is an invariant subset of 𝒳 under the action Π of 𝐺 on 𝒳 if: ∀𝑥 ∈ 𝐸, ∀𝑔 ∈ 𝐺, Π(𝑔)(𝑥) ∈ 𝐸 𝒳 is invariant under the action of Π of 𝐺 on 𝒳 if and only if:

	We can also equivalently write:
	∀𝑔 ∈ 𝐺, Π(𝑔)(𝐸) ⊂ 𝐸
	where Π(𝑔)(𝐸) = {Π(𝑔)(𝑥), 𝑥 ∈ 𝐸}
	Lemma 2.1.7: Invariant subset characterization
	A subset 𝐸 ⊂

  Definition 2.1.10: Orbit For an element 𝑥 ∈ 𝒳, the orbit of 𝑥 is the set orb(𝑥) ⊂ 𝒳 defined by:

	orb(𝑥) = {Π(𝑔)(𝑥), 𝑔 ∈ 𝐺}	(2.2)
	Definition 2.1.11: Invariant function
	Let 𝑓 be a function defined on 𝒳.
	The function 𝑓 is said to be invariant under Π if:
	∀𝑥 ∈ 𝒳, ∀𝑔 ∈ 𝐺, 𝑓 (Π(𝑔)(𝑥)) = 𝑓 (𝑥)

Equivalently, a function 𝑓 defined on 𝒳 is invariant if and only if it is constant on each orbit of 𝒳. Definition 2.1.12: Maximal invariant Let 𝑀 be a function defined on 𝒳. The function 𝑀 is a maximal invariant of the group action Π if it verifies both following properties:

  Definition 2.2.5: 𝛾-MCCP (Maximum Constant Conditional Power) test Let 𝒯 * ∶ ℝ 𝑑 → {0, 1} be a test, and let 𝛾 ∈ (0, 1). The test 𝒯 * is said to have level 𝛾 and Maximum Constant Conditional Power over 𝔉 -and we simply say that 𝒯 * is 𝛾-MCCP -if: (i) 𝒯 * has level 𝛾.

  𝛼 𝒯 which completes the proof.

	Lemma 2.2.10: Constant condition power function on an orbit

Let 𝜌 ∈ ℝ and Θ ∈ ℳ(Ω, ℝ 𝑑 ). If a test 𝒯 has constant conditional power function given Θ ∈ Υ 𝜌 , then 𝒯 has constant power function on Υ 𝜌 . Proof. This is a direct consequence of the definition of a constant conditional power function (see Definition 2.2.4). Lemma 2.2.11: Constant conditional power function and constant power function (i) A test 𝒯 has constant power function on every orbit Υ 𝜌 ∈ 𝔉 if and only if there exists a function 𝑄 * 𝒯 ∶ ℝ → [0, 1] such that for any Θ ∈ ℳ(Ω, ℝ 𝑑 ) and for ℙ𝑀(Θ) -1 -almost every 𝜌 ∈ ℝ: 𝑄 * 𝒯 (𝜌) = ℙ[𝒯(Θ + 𝑋) = 1 | Θ ∈ Υ 𝜌 ] (2.21) (ii) If a test 𝒯 has constant power function on every orbit Υ 𝜌 ∈ 𝔉 and 𝑄 * 𝒯 ∶ ℝ → [0, 1] satisfies Eq. (2.21), then: ∀𝜌 ∈ ℝ, ∀𝜃 ∈ Υ 𝜌 , 𝛽 𝒯 (𝜃) = 𝑄 * 𝒯 (𝜌) (iii) A test 𝒯 has constant power function on every orbit Υ 𝜌 ∈ 𝔉 if and only if, for any Θ ∈ ℳ(Ω, ℝ 𝑑 ), the test 𝒯 has constant conditional power given Θ ∈ Υ 𝜌 for ℙ𝑀(Θ) -1 -almost every 𝜌 ∈ ℝ.

  Applying Lemma 2.2.15 with 𝜌 0 = 𝜏 and every 𝜌 1 > 𝜏 and Theorem 2.2.12, we get that 𝒯 𝜆 𝛾 (𝜏) is 𝛾-MCCP for the RDT problem.

Theorem 2.2.16: Optimality of 𝒯 𝜆 𝛾 (𝜏) Under the assumption that the family of densities {𝑓 𝜌 , 𝜌 ≥ 0} has a monotone likelihood ratio, the test 𝒯 𝜆 𝛾 (𝜏) is 𝛾-MCCP. Proof. From Lemma 2.2.14, 𝒯 𝜆 𝛾 (𝜏) has size 𝛾 for the RDT problem. From Lemma 2.2.8, 𝒯 𝜆 𝛾 (𝜏) has constant power function on every orbit Υ 𝜌 ∈ 𝔉, therefore from Lemma 2.2.11, it has constant conditional power function given any Θ ∈ ℳ(Ω, ℝ 𝑑 ) for ℙ‖Θ‖ -1 2 -almost every 𝜌 > 0.

3 Asymptotic Random Distortion Testing Contents 3

  .1 Preliminary results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 3.2 Asymptotic RDT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 3.2.1 Problem statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 3.2.2 Asymptotic size and power. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 3.3 Simulation experiments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 3.3.1 Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 3.3.2 Application to a detection problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 3.3.3 Recovering a test with level 𝛾 when estimating 𝜎 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 3.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

  From this we can deduce that 𝑔 ≥ 0 𝜇-almost everywhere, i.e.:

	lim sup	𝑓 𝑛 ≥ 0 𝜇 -a.e.
	𝑛
	3.2 Asymptotic RDT
	3.2.1 Problem statement
	Let us start by stating the problem we consider in this chapter.
	Definition 3.2.1: ARDT problem statement
	then:
	lim sup
	Therefore:
	∀𝑛 ∈ ℕ, ∀𝑘 ≥ 𝑛, ∀𝐴 ∈ ℬ, ∫	𝑔 𝑛 d𝜇 ≥ ∫	𝑓 𝑘 d𝜇
		𝐴	𝐴
	From Eq. (3.2), we can deduce that:
	∀𝐴 ∈ ℬ, ∀𝑛 ∈ ℕ, ∫

1.4

Let (𝑓 𝑛 ) 𝑛∈ℕ be a sequence of ℝ-valued measurable functions defined on a measure space (Ω, ℬ, 𝜇), with 𝜇 a finite measure. If there exists 𝐶 > 0 such that for all 𝑛 ∈ ℕ, we have |𝑓 𝑛 | ≤ 𝐶, and if we have:

∀𝐴 ∈ ℬ, lim 𝑛 ∫ 𝐴 𝑓 𝑛 d𝜇 ≥ 0 𝑛 𝑓 𝑛 ≥ 0 𝜇a.e. (

3

.2) Proof. For every 𝑛 ∈ ℕ, let 𝑔 𝑛 ∶ 𝑥 ↦ sup{𝑓 𝑘 (𝑥) | 𝑘 ≥ 𝑛} (pointwise supremum). Let 𝑔 = lim sup 𝑛 𝑓 𝑛 = lim 𝑛 𝑔 𝑛 . Since the functions 𝑓 𝑛 are measurable and uniformly bounded by 𝐶, the functions 𝑔 𝑛 and 𝑔 are also measurable and uniformly bounded by 𝐶. The constant function 𝑥 ∈ Ω ↦ 𝐶 is 𝜇-integrable since 𝜇 is a finite measure, therefore from the Dominated Convergence Theorem, we have: ∀𝐴 ∈ ℬ, ∫ 𝐴 𝑔 𝑛 d𝜇 -→ 𝑛 ∫ 𝐴 𝑔d𝜇 (3.3) By definition of 𝑔 𝑛 , we have: ∀𝑛 ∈ ℕ, ∀𝑘 ≥ 𝑛, ∀𝑥 ∈ Ω, 𝑔 𝑛 (𝑥) ≥ 𝑓 𝑘 (𝑥) 𝐴 𝑔 𝑛 d𝜇 ≥ 0 Therefore with Eq. (3.3), we get: ∀𝐴 ∈ ℬ, ∫ 𝐴 𝑔d𝜇 ≥ 0

Table 3 .

 3 .1 the area under the ROC curve for the RDT test. dB 72.28 % 73.48 % 74.17 % 74.41 % 74.61 % 74.64 % 5 dB 0 dB 68.02 % 69.07 % 69.68 % 69.88 % 70.05 % 70.09 % 5 dB 5 dB 60.30 % 61.20 % 61.79 % 61.99 % 62.16 % 62.20 % 10 dB -5 dB 91.19 % 92.80 % 93.67 % 93.94 % 94.18 % 94.20 % 10 dB 0 dB 87.21 % 88.91 % 89.87 % 90.18 % 90.44 % 90.48 % 10 dB 5 dB 76.62 % 78.27 % 79.20 % 79.52 % 79.78 % 79.81 % 15 dB -5 dB 99.31 % 99.78 % 99.91 % 99.93 % 99.95 % 99.95 % 15 dB 0 dB 98.69 % 99.44 % 99.69 % 99.75 % 99.80 % 99.80 % 15 dB 5 dB 95.53 % 97.11 % 97.82 % 98.03 % 98.20 % 98.22 %

				N (samples)
	SNR DNR	10	20	50	100	1000	𝜎 known
	5 dB -5

1: Area under the ROC curve for the RDT test

4 Learning behaviors and detecting anomalies on real signals Contents 4

  .1 Detecting discontinuities on continuous signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 4.2 Segmenting and learning phases, and detecting anomalies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 4.2.1 Change-detection in time series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 4.2.2 An RDT-based change-in-mean detection method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 4.2.3 Application to real signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 4.2.4 Perspectives: towards learning a model and detecting anomalies . . . . . . . . . . . . . . . . 105 4.3 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

table : Valve (MV101) Pump (P101) Water level (LIT101)

 :

		Closed	Off	Constant
		Open		Off	Fast increase
		Closed	On	Fast decrease
		Open		On	Slow increase
	Table 4.1: Relations between the states of the sensor LIT101 and the actuators MV101 and P101
				Water level (LIT101)
	800
	700
	600
	500
	Open	Motorized valve (MV101) -Inflow control
	Closed
			Pump (P101) -Outflow control
	On
	Off
	20,000	25,000	30,000	35,000	40,000	45,000	50,000
				Time (s)

  .7. Time series 𝑌 𝑛 , block size 𝑁, tolerance 𝜏 ′ , desired false alarm probability 𝛾 Output: Estimated instants of change θ ← mean(𝑌 0 , ..., 𝑌 𝑁-1 ) (Initial mean estimate) σ ← std(𝑌 0 , ..., 𝑌 𝑁-1 ) (Initial variance estimate) 𝑛 ← 𝑁 (Number of samples in the current segment) 𝑖 𝑠 ← 0 (Index of the first sample of the current segment) repeat 𝑠 ← mean(𝑌 𝑖 𝑠 +𝑛 , ..., 𝑌 𝑖 𝑠 +𝑛+𝑁-1 ) (Current block mean) 𝑌 𝑖 𝑠 , ..., 𝑌 𝑖 𝑠 +𝑛+𝑁-1 ) (Update the mean estimate) σ ← std(𝑌 𝑖 𝑠 , ..., 𝑌 𝑖 𝑠 +𝑛+𝑁-1 ) (Update the variance estimate) else Notify that a change has been detected between indices 𝑖 𝑠 + 𝑛 and 𝑖 𝑠 + 𝑛 + 𝑁 -1 𝑖 𝑠 ← 𝑖 𝑠 + 𝑛 + 𝑁 (Start the next segment after the end of the current block) θ ← mean(𝑌 𝑖 𝑠 , ..., 𝑌 𝑖 𝑠 +𝑁-1 ) (Initial mean estimate) σ ← std(𝑌 𝑖 𝑠 , ..., 𝑌 𝑖 𝑠 +𝑁-1 ) (Initial variance estimate)

	Input: 𝑧 ← |𝑠 -θ |/σ (Test statistic)
	𝑇 ← 𝜆 𝛾 (𝜏 √ 𝑁/σ)/ √ 𝑁 (Threshold)
	if 𝑧 ≤ 𝑇 then
	𝑛 ← 𝑛 + 𝑁 (Extend the current segment)
	θ ← mean(𝑛 ← 𝑁
	end if
	until end of 𝑌 𝑛 reached

  4.16.

	Measured slopes
	Cluster centers
	-0.02	-0.01	0	0.01	0.02	0.03
			Slope
	Figure 4.16: K-means output on normal LIT101 signal (zoom around 0)

  𝐹 1 is a generalized hypergeometric function. Proving that 𝑄 𝑑/2 is uniformly continuous means that we have to prove the following:∀𝜀 > 0, ∃𝛼 > 0, ∀(𝜌 1 , 𝜆 1 , 𝜌 2 , 𝜆 2 ) ∈ [0, ∞) 4 , √ (𝜌 1 -𝜌 2 ) 2 + (𝜆 1 -𝜆 2 ) 2 < 𝛼 ⇒ |𝑄 𝑑/2 (𝜌 1 , 𝜆 1 ) -𝑄 𝑑/2 (𝜌 2 , 𝜆 2 )| ≤ 𝜀 (C.3)In order to slightly simplify the following calculations, we will work on the function 𝑅 𝑑/2 = 1 -𝑄 𝑑/2 , which is completely equivalent. We have:∀𝜌 ≥ 0, ∀𝜆 ≥ 0, 𝑅 𝑑/2 (𝜌, 𝜆) = 𝑒 -𝜌 2 /2Gaussian random variable 𝑋 ∼ 𝒩(𝜃, 𝐼 𝑑 ) with 𝜃 ∈ ℝ 𝑑 and 𝜌 = ‖𝜃‖ 2 :∀𝜆 ≥ 0, 𝑅 𝑑/2 (𝜌, 𝜆) = ℙ[‖𝑋‖ 2 2 ≤ 𝜆 2 ] = 𝔽 𝜒 2 𝑑 (𝜌 2 ) (𝜆 2 ) (C.5)To prove that 𝑅 𝑑/2 is uniformly continuous on [0, ∞) × [0, ∞), we will prove that its partial derivatives are bounded.Proof. From Eq. (C.5), for any 𝜆 ≥ 0, 𝜌 ≥ 0, and 𝜃 ∈ ℝ 𝑑 such that ‖𝜃‖ 2 = 𝜌, we have:𝑅 𝑑/2 (𝜌, 𝜆) = ∫We will start by considering the case 𝑑 = 1. Taking 𝜃 = 𝜌, we get: 𝜕𝑓 𝜕𝜌 is continuous on [-𝜆, 𝜆] × [0, +∞). Therefore 𝑅 1/2 is differentiable with respect to 𝜌 and we have:

								𝐵(0,𝜆)	1 (2𝜋) 𝑑/2 exp(-	‖𝑥 -𝜃‖ 2 2 2	)d𝑥	(C.6)
			𝑅 1/2 (𝜌, 𝜆) =	1 √ 2𝜋	∫ -𝜆 𝜆	exp(-	(𝑥 -𝜌) 2 2	)d𝑥	(C.7)
	The function 𝑓 ∶ 𝑥, 𝜌 ↦ exp(-and we have:	(𝑥-𝜌) 2 2 𝜕𝑓 𝜕𝜌 (𝑥, 𝜌) = (𝑥 -𝜌) exp(-) defined on [-𝜆, 𝜆] × [0, +∞) is differentiable with respect to 𝜌 (𝑥 -𝜌) 2 2 ) (C.8)
		𝜕𝑅 1/2 𝜕𝜌	(𝜌, 𝜆) =	1 √ 2𝜋	∫ -𝜆 𝜆	(𝑥 -𝜌) exp(-	(𝑥 -𝜌) 2 2	)d𝑥	(C.9)
	We can now bound this expression:
		|	𝜕𝑅 1/2 𝜕𝜌	(𝜌, 𝜆)| ≤	1 √ 2𝜋	∫ -𝜆 𝜆	|𝑥 -𝜌| exp(-	(𝑥 -𝜌) 2 2	)d𝑥
	2 √ 2𝜋 𝑑 2 1 ∫ -∞ ∞ -1 Γ(𝑑/2) |𝑡| exp(-∫ ∞ 𝜆 𝑡 2 𝑒 -𝑡 2 /2 𝑡 𝑑-1 )d𝑥 2 𝑑 2 -1 Γ(𝑑/2) ∫ 𝜆 0 𝑒 -𝑡 2 /2 𝑡 𝑑-1 0 𝐹 1 ( 0 𝐹 1 ( 𝑑 𝑑 2 2 ; ; ≤ √ 2 ≤ 𝜋 where 0 2 Therefore 𝜕𝑅 1/2	𝜌 2 𝑡 2 4 𝜌 2 𝑡 2 4	)d𝑡 )d𝑡	(C.2) (C.10) (C.4)
	and for any Lemma C.0.1
	𝜕𝑅 𝑑/2 𝜕𝜌	is bounded on [0, ∞) × [0, ∞).

𝜕𝜌

is bounded.

  2 𝑥 2 …𝑥 𝑑 𝟙 𝐵 𝑑 (0,𝜆) (𝑥 1 , …, 𝑥 𝑑 ) exp(-1 2 )d𝑥 2 …d𝑥 𝑑 )d𝑥 1 (C.11) For any 𝑥 1 ∈ [-𝜆, 𝜆], we have: ∫ 𝑥 2 …𝑥 𝑑 𝟙 𝐵 𝑑 (0,𝜆) (𝑥 1 , …, 𝑥 𝑑 ) exp(-1 2 𝑥 2 …𝑥 𝑑 𝟙 𝐵 𝑑-1 (0,√𝜆 2 -𝑥 1 2 ) (𝑥 2 , …, 𝑥 𝑑 ) exp(-Thus, for any 𝑑 ≥ 2, taking 𝜈 = 𝑑/2 -1 yields: 𝑥 cos 𝜃) sin 𝑑-2 𝜃d𝜃 (C.21) For any 𝑑 ≥ 2 and any 𝜃 ∈ [0.𝜋], we have sin 𝑑-2 𝜃 ≤ 1, hence:

		𝐼 𝑑/2-1 (𝑥) =	Γ(	1 𝑑-1 2	)√𝜋	(	𝑥 2	𝑑/2-1 )	𝜋 0 ∫	exp(
										𝑑
										∑	𝑥 𝑖	2 )d𝑥 1 …d𝑥 𝑑
										𝑖=2
	=	1 (2𝜋) 𝑑/2 ∫ 𝜆 𝑥 1 =-𝜆 exp(-	𝑑 ∑ 𝑖=2 2 𝑑 (𝑥 1 -𝜌) 2 2 )(∫ 𝑥 𝑖
						∑	𝑥 𝑖	2 )d𝑥 2 …d𝑥 𝑑
						𝑖=2
		= ∫							1 2	𝑑 ∑ 𝑖=2	𝑥 𝑖	2 )d𝑥 2 …d𝑥 𝑑	(C.12)
		= ∫ 𝐵 𝑑-1 (0,√𝜆 2 -𝑥 1 2 )	exp(-	‖𝑦‖ 2 2 2	)d𝑦
						𝑑-1
		= (2𝜋)	2 𝔽 𝜒 2 𝑑-1 (𝜆 2 -𝑥 1	2 )

  𝑅 𝑑/2 is differentiable with respect to 𝜆 and we have: Therefore for any 𝜌 > 0 and 𝜆 > 0, and taking 𝜈 = 𝑑/2 -1, we get:𝜕𝑅 𝑑/2 𝜕𝜆 (𝜌, 𝜆) = 𝑒 -𝜌 2 /2 𝑒 -𝜆 2 /2 𝜆 𝑑-1 (𝜌𝜆) 𝑑/2-1 𝐼 𝑑/2-1 (𝜌𝜆) (C.31)We can already note here that we have Using Eqs. (C.18) and (C.26), we get:

										2	𝑑 2	-1 Γ(𝑑/2)	∫ 0 𝜆	𝑒 -𝑡 2 /2 𝑡 𝑑-1	0 𝐹 1 (	𝑑 2	;	𝜌 2 𝑡 2 4	)d𝑡	(C.28)
	∀𝜌 ≥ 0, ∀𝜆 ≥ 0,	𝜕𝑅 𝑑/2 𝜕𝜆	(𝜌, 𝜆) =	𝑒 -𝜌 2 /2 𝑒 -𝜆 2 /2 2 𝑑 2 -1 Γ(𝑑/2)	𝜆 𝑑-1	0 𝐹 1 (	𝑑 2	;	𝜌 2 𝜆 2 4	)	(C.29)
	From [54, Eq. 9.6.47], we have:
	∀𝑥 ≥ 0, ∀𝜈 ≥ 0, 𝐼 𝜈 (𝑥) =	(𝑥/2) 𝜈 Γ(𝜈 + 1) 0 𝐹 1 (𝜈 + 1;	𝑥 2 4	)	(C.30)
							𝜕𝑅 𝑑/2 𝜕𝜆	≥ 0
		𝜕𝑅 𝑑/2 𝜕𝜆	(𝜌, 𝜆) ≤ 𝑒	-	1 2	(𝜌-𝜆) 2	𝜆 𝑑-1	Γ(	√𝜋 𝑑-1 2 )2	𝑑 2	-1	(C.32)
	Similarly, using Eqs. (C.19) and (C.25), we get:
		𝜕𝑅 𝑑/2 𝜕𝜆	(𝜌, 𝜆) ≤ 𝑒	-	1 2	(𝜌-𝜆) 2	(	𝜆 𝜌	)	𝑑-1 2 √	𝜋 8	(C.33)
	For any 𝜌 > 0 and any 𝜆 > 0, let:
		𝑓 1 (𝜌, 𝜆) = 𝑒	-	1 2		(𝜌-𝜆) 2	𝜆 𝑑-1	Γ(	√𝜋 𝑑-1 2 )2	𝑑 2	-1	(C.34)
		𝑓 2 (𝜌, 𝜆) = 𝑒	-	1 2		(𝜌-𝜆) 2	(	𝜆 𝜌	)	𝑑-1 2 √	𝜋 8	(C.35)
	and for any 𝑎 > 0 and any 𝜆 > 0, let:
	𝑔 1,𝑎 (𝜆) = 𝑓 1 (	𝑎 𝜆	, 𝜆) = 𝑒 𝑎 𝑒 -	1 2 ( 𝑎 2 𝜆 2 +𝜆 2 ) 𝜆 𝑑-1	Γ(	√𝜋 𝑑-1 2 )2	𝑑 2	-1	(C.36)
	𝑔 2,𝑎 (𝜆) = 𝑓 2 (	𝑎 𝜆	, 𝜆) = 𝑒 𝑎 𝑒 -	1 2 ( 𝑎 2 𝜆 2 +𝜆 2 ) 𝜆 𝑑-1 √	𝜋 8	𝑎	2 1 𝑑-1	(C.37)
	With these notations, we have:
	∀𝜌 > 0, ∀𝜆 > 0,	𝜕𝑅 𝑑/2

𝜕𝜆 (𝜌, 𝜆) ≤ 𝑔

1,𝜌𝜆 (𝜆) and 𝜕𝑅 𝑑/2 𝜕𝜆 (𝜌, 𝜆) ≤ 𝑔 2,𝜌𝜆 (𝜆) (C.38)

  1,𝑎 (𝜆) ≤ 𝐶 1 ∀𝑎 ∈ [𝑎 0 , +∞), ∀𝜆 > 0, 𝑔 2,𝑎 (𝜆) ≤ 𝐶 2 (C.41)

	From Eq. (C.38), we can then deduce that:
	∀𝜌 > 0, ∀𝜆 > 0,	𝜕𝑅 𝑑/2 𝜕𝜆	(𝜌, 𝜆) ≤ max(𝐶 1 , 𝐶 2 )	(C.42)

Recall that we are testing the detail coefficients from the first level of wavelet decomposition, hence the sampling rate of the detail coefficients is half of that of the original signal.

Remerciements

List of Theorems, Lemmas and Definitions 1 Hypothesis Testing and Random Distortion Testing

Invariance and Generalized Random Distortion Testing

Asymptotic Random Distortion Testing

A Deterministic Distortion Testing

B Finding suitable families of TP-2 distributions for the GRDT problem

Conclusion of these simulations

We have seen throughout these simulations that the NP and RDT tests behave fairly differently in presence of a distortion and when replacing 𝜎 0 with an estimate σ. The ROC curves show that the NP test always offers a higher detection rate for identical false-alarm rates, regardless of the distortion or the noise standard deviation estimation. However, as soon as a distortion is introduced, this test is no longer able to respect a given level 𝛾, unlike the RDT test which is robust to a distortion, and also has level 𝛾 asymptotically.

Recovering a test with level 𝛾 when estimating 𝜎 0

In the previous simulations we strongly insisted on the level of the tests, as we believe that this property is important to preserve. A nice feature of the RDT test is the use of a tolerance that can be used to compensate a lack of knowledge, in our case here the fact that 𝜎 0 is not perfectly known. In this section, we describe a possible way to adjust the RDT test in order to recover a test with level 𝛾 using this tolerance 𝜏. We decided to focus on the RDT test here since we only have to account for the effect of the noise variance estimation, whereas working with the NP test would require compensating both the distortion and the estimation of 𝜎 0 .

The idea here is to adjust the tolerance 𝜏 so that it encompasses the effects of both the distortion and the estimation of the noise variance. This means that for a given tolerance 𝜏 and a given estimator σ, we want to find an adjusted tolerance 𝜏 * such that the test T 𝜆 𝛾 (𝜏 * ) has size 𝛾. Of course, this assumes that such a tolerance does exist. And then, if it exists, we have to figure out a way to find it.

First, let us start by addressing the existence of this tolerance 𝜏 * . Judging from the previous simulations, the estimation of 𝜎 0 increases the false-alarm rate beyond 𝛾. From the definition of the test T 𝜆 𝛾 (𝜏) (see Eq. (3.7)), this means that the test statistics ‖𝑦‖ 2 /σ exceeds the threshold 𝜆 𝛾 (𝜏) too frequently. In order to lower the false-alarm rate back down to 𝛾, we then need to increase this threshold 𝜆 𝛾 (𝜏). From Lemma 1.2.9, we know that the threshold 𝜆 𝛾 (𝜏) increases continuously with 𝜏 to +∞. Therefore, by replacing 𝜏 in the test 𝒯 𝜆 𝛾 (𝜏) with a greater value, we should be able to find a value 𝜏 * such that the test T 𝜆 𝛾 (𝜏 * ) has size 𝛾. Keep in mind that the tolerance 𝜏 used to define the RDT problem does not change: we still consider a distortion with maximum amplitude 𝜏. We only modify the RDT test, keeping the same test structure and only replacing the tolerance used with a different value 𝜏 * . Now that we know that this tolerance 𝜏 * exists, we need to be able to compute it. We present here a way to estimate it through simulations. We will proceed using the same simulations that we used in Section 3.3.1 to estimate the false-alarm rate of the RDT test. The idea is simple: we want to find 𝜏 * such that ℙ[ T 𝜆 𝛾 (𝜏 * ) (Θ + 𝑋, σ) = 1] = 𝛾. Therefore, we estimate ℙ[ T 𝜆 𝛾 (𝜏 * ) (Θ + 𝑋, σ) = 1] for different values of 𝜏 * , until the measured probability is close enough to 𝛾.

Since these simulations can take some time (especially when 𝛾 is small), we have to choose the values 𝜏 * somewhat carefully to complete this process in a reasonable time. We first determine a closed interval in which 𝜏 * is contained, then we perform a binary search within that interval to get a good estimate of 𝜏 * . At the beginning, we only know that 𝜏 * is contained in the interval [𝜏, +∞), which is not useable for a binary search. Therefore the first step consists in finding an upper bound for 𝜏 * . To do so, we have chosen to estimate the false-alarm rate using the tolerance 𝑘𝜏 for 𝑘 = 2, 3, 4, …, until we find 𝑘 such that the measured false-alarm rate is lower than 𝛾. At this point, we know that 𝜏 * is contained in the interval [(𝑘 -1)𝜏, 𝑘𝜏], on which we then perform a binary search to refine our estimate of 𝜏 * . Figure 3.11 displays the values of 𝜏 * we obtained through this process. From this figure, we can see that 𝜏 * appears to be affected by the level 𝛾, the estimator σ and the DNR. An expected takeaway from these results is that coarser estimates of 𝜎 0 require increasing the tolerance more to compensate its effect. Another interesting aspect to note is that lower values of 𝛾 also require a larger increase to compensate the effect of the estimation of 𝜎 0 . We also need to verify that the false-alarm rate we get using this tolerance 𝜏 * is effectively 𝛾. Figure 3.12 shows that this is indeed the case for every tested set of parameters.

Appendices

We can also see the DDT problem as a regular testing problem, where the family of distributions considered is the family of Gaussian distributions with mean 𝜃 ∈ ℝ 𝑑 and covariance matrix 𝐶.

The DDT problem here is shown in comparison to the RDT problem presented in Chapter 1, but the following is also applicable to the GRDT problem studied in Chapter 2.

For this DDT problem, we have an appropriate optimality criterion, the 𝛾-MCP criterion, which is an adaptation of the 𝛾-MCCP criterion presented in Definition 1.2.7 for the RDT problem and in Definition 2.2.5 for the GRDT problem. Definition A.0.2: 𝛾-MCP (Maximum Constant Power) test Let 𝒯 * ∶ ℝ 𝑑 → {0, 1} be a test, and let 𝛾 ∈ (0, 1). The test 𝒯 * is said to have level 𝛾 and Maximum Constant Power over 𝔉 -and we simply say that 𝒯 * is 𝛾-MCP -if:

(i) 𝒯 * has level 𝛾 (ii) For every 𝜌 > 𝜏, 𝒯 * has constant power function on Υ 𝜌 (iii) For every 𝜌 > 𝜏 and for any test 𝒯 with level 𝛾 and constant power function on Υ 𝜌 we have:

We have the following result which links the 𝛾-MCP and 𝛾-MCCP criterions.

Proof.

• Let 𝒯 * be a 𝛾-MCCP test. Since 𝒯 * has constant conditional power function given any Θ ∈ Υ 𝜌 , we can deduce from Lemma 2.2.10 that 𝒯 * has constant power function on every Υ 𝜌 for 𝜌 > 𝜏.

Let 𝜌 > 𝜏 and let 𝒯 ∈ 𝒦 𝛾 be a test with constant power function on Υ 𝜌 and let Θ be a random variable such that Θ ∈ Υ 𝜌 almost surely. We have:

Therefore 𝒯 * is 𝛾-MCP.

• Conversely, let 𝒯 * be a 𝛾-MCP test with constant power function on every orbit Υ 𝜌 ∈ 𝔉. From Lemma 2.2.11, 𝒯 * has constant conditional power function given any Θ ∈ ℳ(Ω, ℝ 𝑑 ) on Υ 𝜌 for ℙ𝑀(Θ) -1 -almost every 𝜌. Let Θ ∈ ℳ(Ω, ℝ 𝑑 ), let 𝜌 > 𝜏 and let 𝒯 ∈ 𝒦 𝛾 be a test with constant conditional power function given Θ ∈ Υ 𝜌 . We have:

Since 𝒯 * is 𝛾-MCP, we have 𝛽 𝒯 * (𝜃) ≥ 𝛽 𝒯 (𝜃) for any 𝜃 ∈ Υ 𝜌 , which in turn means that we have:

Therefore 𝒯 * is 𝛾-MCCP.

As a consequence of this lemma, since the thresholding test 𝒯 𝜆 𝛾 (𝜏) is 𝛾-MCCP (Theorem 1.2.10), it is also 𝛾-MCP.

We have for any 𝑎 ∈ ℝ + :

Let 𝑓 be the function defined for every 𝑥 1 ∈ [-𝜆, 𝜆] and 𝜌 ∈ [0, +∞) by:

The function 𝑓 is differentiable with respect to 𝜌 and we have:

From this expression, we can see that

differentiable with respect to 𝜌, and for any 𝜆 ≥ 0 and 𝜌 ≥ 0:

We can now conclude that

𝜕𝜌

(𝜌, 𝜆) is bounded for any integer 𝑑 ≥ 1.

Before proving that the second partial derivative

𝜕𝜆 is bounded, we introduce several useful inequalities. In the following, 𝐼 𝜈 (𝑥) is the modified Bessel function of the first kind.

Lemma C.0.2

We have the following inequalities:

List of Publications