David Pierrot
email: david.pierrot1@univ-lyon2.fr

Nouria Harbi
email: nouria.harbi@univ-lyon2.fr

Jérôme Darmont
email: jerome.darmont@univ-lyon2.fr

Hybrid Intrusion Detection in Information Systems

Keywords: Intrusion, Detection, Firewall, Security

The expansion and democratization of the digital world coupled with the effect of the Internet globalization, has allowed for individuals, countries, states and companies to interconnect and interact at incidence levels never previously imagined. Cybercrime, in turn, is unfortunately one the negative aspects of this rapid global interconnection expansion. We often find malicious individuals and/or groups aiming to undermine the integrity of Information Systems for either financial gain or to serve a cause. Our study investigates and proposes a hybrid data mining methodology in order to detect abnormal behavior that could potentially threaten the security of an Information System, in a simple way that is understandable to all involved parties, whether they are security experts or standard users.

I. INTRODUCTION

Nowadays, it is very easy to communicate, exchange ideas, acquire content and develop knowledge by using the Internet. The operational maintenance of Information Systems is therefore an essential criterion for any business, government and/or individual seeking to use this medium to deliver content, offer services, or simply wishing to communicate with others. Unfortunately, an often experienced negative aspect of this Information System's global expansion is a phenomenon called Cybercrime. Malicious individuals and/or groups aim to attack and harm individuals, companies and/or even government branches for monetary reward and/or in pursuit of a cause. The objective of this paper is to first analyze and explain the current state of intrusion detection practices, and secondly discuss the work that we carried out to facilitate Information System data flow visualization and first level intrusion/attack detection (scanning, brute forcing). The main contribution of this paper is the use and analyze firewall logs to detect misuses and abuse with data mining methods. It is important to note that we do not use any network packet inspection tools or attack classification made by an IDS. This paper is organized as follows. In section II, we present the overview of some related researches in the aera of intrusion detection systems. Our motivations for choosing this approach are detailed in section III. The data sets and the results used and obtained from our experimentation are presented in section IV. Finally, our conclusions and the scope of potential future work is presented in section V.

II. RELATED WORKS A. Intrusion detection systems

There are a variety of available tools (IDS, IPS, HIDS, Firewalls 1 ) that allow for scanning and ensuring the relative 1 A firewall is a network security system that controls the incoming and outgoing network traffic based on an applied rule set security of an entire system. However, these tools themselves can be vulnerable, as they often misinterpret real-time observations, fail to report abnormal behavior, and can become quickly outdated, which can potentially result in a treat or attack to the individual system components mentioned above [1][2]. It is therefore appropriate and desirable to be able to respond in a timely manner from the instant an intrusion is detected, to deploy adequate countermeasures to respond swiftly to a potential cyberattack. The scope of current Intrusion Detection System solutions can be classified into three groups.

• NIDSs (Network Intrusion Detection Systems) can monitor data collected from their own network segment and signal abnormal transactions/behaviors [START_REF] Bhruyan | Survey on incremental approaches for network anomaly detection[END_REF].

B. Data mining-based IDSs

Since the initial studies by Denning [START_REF] Denning | An intrusion-detection model[END_REF], detection systems have continued to evolve. Data mining offers various solutions for the detection and analysis of computer attacks [START_REF] Deepa | A comprehenseive survey on approaches to intrusion detection system[END_REF]. Lee and Stolfo use data mining methods [START_REF] Lee | A data mining framework for building intrusion detection model[END_REF], which do not require an experts intervention. These methods tend to generate a lot of association rules and therefore exponentially increase the system's level of complexity. This work is based on network capture tool tcpdump and Unix audit data. To use this method, it is compulsory to install a sensor network with a large memory storage space and it is only for Unix systems. Using a hybrid (combine different data mining methods) approach is very interesting because it takes care about alert management [START_REF] Siraj | A hybrid intelligent approach for automated alert clustering and filtering in intrusion alert analysis[END_REF] [START_REF] Bahri | Real detection intrusion using supervised and unsupervised learning[END_REF]. H.Nguyen et al. [START_REF] Nguyen | An effcient local region and clustering-based ensemble system for intrusion detection[END_REF] use an ensemble system of classifiers, called CBE based on K-mean algorithm but the classe number must be fixed a priori [START_REF] Lavanya | Improving Network Intrusion Detection Based on Multi Objective Criteria[END_REF]. This may take time depending on the number of servers to be monitored. A.R. Ajiboye et al. proposed to use the density-based DSB-CAN algorithm [START_REF] Ajiboye | Anomaly Detection in Dataset for Improved Model Accuracy Using DBSCAN Clustering Algorithm[END_REF]. In fact, even DBSCAN [START_REF] Ester | A Density-Based Algorithm for Discovery Clusters in Large Databases with Noise[END_REF] or OPTICS algorithm [START_REF] Ankerst | OPTICS: ordering points to identify the clustering structure[END_REF] are capable of determining the cluster number. However, it is compulsory for us to define two hard-to-estimate input parameters chiefly the radius of the cluster and the minimum required points inside the cluster for DBSCAN and fix the minipoints argument for OPTICS. Moreover with such a large dataset, these algorithms require large memory and computing resource. Using PCA model with K nearest neighborhood for intrusion detection (on a KDD 99 dataset) [START_REF] Elkhadir | Intrusion Detection System Using PCA and Kernel PCA Methods[END_REF] or Hierarchical Agglomerative Clustering (HAC) [START_REF] Debabrata | SQLiGoT: Detecting SQL injection attacks using graph of tokens and SVM[END_REF] have the advantage of providing good graphic visualization to assist with finding the relevant numbers of cluster. The studies and works presented in the current section are all based on data flow from either KDD99 based models [START_REF]Kdd cup 1999 data[END_REF]. We feel there are several disadvantages of using this process. First, it is necessary to capture network traffic and this can affect memory storage and time analysis.

III. MOTIVATIONS AND PROPOSAL

A. General principle

We believe security systems should be simple enough and automated as much as possible as to be understood and deployed when needed by all users of a specific system. It is critical for Information System supervision tools to allow for behavior based decision support methods (behavior of users, services, servers, etc.), so that accurate event data streams and attack analysis can happen in real-time. Considering these ideas should result in the ability to predict risks and threats, not only from known and monitored assets (servers), but also from the evolution of the Information System. Our study is based on four phases:

• Phase 1: Monitoring and visualization of network data. Graphical representation of computer network activities via a data model. • Phase 2: Behavior analysis and alert based on data mining methods. • Phase 3: Risk scoring and evaluation.

• Phase 4: Action plan building.

Phase 1 and 2 could be merge, the vizualtion phase is finaly useful when an alert is received or to make a diagnostic. This model is very similar to the Defense Life-cycle [START_REF] Shameli-Send | Taxonomy of intrusion risk assessment and response system[END_REF] and to the intrusion response systems of Kanoun et al. [START_REF] Kanoun | Automated reaction based on risk analysis and attackers skills in intrusion detection systems[END_REF]. We added a graphic part and we do not have any attack classifications made by an IDS. Hence, we opted for a monitoring/visualization phase which is a conventional approach and then an assessment of the risk is determined by an analysis of behavior. At the end, an action plan will help to stop or to prevent an abnormal action. Before introducing the concepts of intrusion detection or behavior analysis, let us explain usual procedures. Typically, a network intrusion is based on the following five steps.

1) Reconnaissance: use different sources from the internet for gathering potential target information (address IP, site and DNS name owner, email address, social network). 2) Scanning the port: find and record ports, services, operating system and versions used. 3) Gaining access: analyze vulnerabilities for potential exploitation. 4) Maintaining access: keep the system or network permanently engaged. 5) Covering tracks: delete and remove traces from the network and/or system. The first step is extremely difficult to detect because it is dependent on the digital footprint of a business and its staff. Thus, our work focuses on steps 2 and 3 which correspond to the phases 1-3 of the cyber kill chain 3.0 model [START_REF] Yadav | Technical aspects of cyber kill chain[END_REF]. All computer attacks usually start by gathering intelligence.

Step 2's ultimate goal is to receive a scanning service offer from a server. A successful information request provides a list of available services (HTTP, HTTPS, FTP, mail, etc.), the version of the services used (Microsoft Internet Information Services or Apache for a Linux server), and the base of the operating system. Scanning activities represent more than 80% of detected cyberattacks [START_REF] Molina | Operationnal experiences with anomaly detection[END_REF]. Once this information is known, it is not difficult to find and/or create malicious tools/scripts to exploit known vulnerability in the target server. Hence, it is essential to be able to detect quickly whenever this kind of scanning and enumerating phase is taking place. The methods for information gathering have also evolved. It is now possible to use multiple IP addresses2 , or use stretched intelligence to limit the arrival of access requests to different ports on a server. The attacker's goal is to receive the required information while minimizing traces of any exchanges. These are used to identify the information needed for preparing potential attacks and for detecting technical anomalies and vulnerabilities.

Although this paper focuses on Phase 2, we still need to quickly provide a summary of Phase 1. This phase is used to provide full data visualization to relevant users (security ingeneer, network analyst, chief information security officer). It is a crucial phase in terms of decision-making for security readiness. Additionally, they are the preamble to the data mining process that is conducted in phase 2. We have decided to use a firewall as a capture data source. Due to its placement, a firewall can potentially offer full and complete data flow visibility. It can also open the opportunity to trace and keep information to highlight these flows on events that have been either authorized and/or prohibited. Moreover, the firewall is the most security component used, the business equipment rate was 95% in 2010 [START_REF] Clusif | Menaces informatiques et pratiques de sécurité en france[END_REF]. Pre-treatments is made from logs connection filtering equipment (log option) and they are sent to the Syslog-ng server 3 . Through its Perl compatible regular expression(PCRE) pattern matching and filtering options, all flows are saved on the databaseThereafter, computation is carried out via a Perl script. Finally, Graphviz Suite 4 and Afterglow 5 script components are used to create graphs.The terms of the variables listed below are exported to data containers.

• source IP address, destination IP address • destination port, protocols (UDP and TCP)

• date and time

• firewall policy rule number matching • firewall action (accept or reject) Choosing these variables, we offer the possibilty to integrate several types of firewall of different brands. Futhermore, a network probe implementationis no longer necessary.

B. Phase 2: Behavior analysis and alert

Phase 2 is intended to allow for data analysis and the detection of abnormal behavior (if any, which in turn will trigger an alert (if needed). We feel it would be wise to use firewall event data mining methods for anomaly detection. Besides, Our work uses session data from firewall Logs as explained in section IV. Our main goal is to predict risks and threats according network transactions. After consideration of the data studied in Phase 1, we have to perform preprossing to reduce the available data range. This is required because, for example, the destination port variable includes 65535 possibilities. We opted for grouping variables in the three following categories:

• well-known ports (under 1024) accept and deny;

• port 1024 through 65535 accept and deny;

• administration port (portadm), port activity for server or database administration accept and deny. Preprocessing aggregates of IP source addresses and combines the occurrences according to the categories mentioned above. Furthermore, it would probably be wise to consider the total number of transactions carried out by the same source IP address and the number of flows rejected (action deny) and allowed (action permit) by the firewall. This can be achieved from the data already collected, which is available in different data containers. Once preprocessing was complete, we sought the advice of experts (five in total) to determine whether the observed behavior could definitely be defined as a potential risk or threat. From labeled training data set, we want to predict intrusion from the aggregates of IP source addresses.

The supervised learning give us the possiblily to construct an estinator which is able to predict the risk. Experts analysis give us a picture of the security policy. So, we intraged this data set training into a framework that we made and called D113 [START_REF] Pierrot | D113 : une plateforme open-source dédié à l'analyse des flux et à la détection des intrusions[END_REF]. Throughout the supervised leaning process and when using the aggregated data obtained through preprocessing, we focuse only on the IP source classification problem. This method does however allow for a few potential risks when compared to a security policies defined by experts (which are not necessarily exhaustive). For example, some servers could add or suppress event data as the Information System evolves. In our view, it would be prudent to analyze the suffered behavior by the different servers in order confirm the supervised learning result of. By using two different learning methods [START_REF] Meesala | A Hybrid Intrusion Detection System Based on C5.0 Decision Tree and One-Class SVM[END_REF], it should be possible to have a quick overview of the IP source and the inherent misuse risks and servers deviation behavior. We want finaly group behavoir into different groups of activities. This method opens up the opportunity to detect abnormal and misuse activity events. On the other hand, we decided to look for abnormal activity on the destination address (server). With this kind of process, it is possible to detect and monitor any and all behavior on the server. Our first step is to create a data frame and extract every data flow received on each server. The next step is to identify and show that behavior is different. There are a large number of methods to execute unsupervised learning. We want to group IP source behavior according the destination server IP. This cluster analysis revolves around the concept of placing a set of objects in the same group or cluster. By following this methodology, it should be possible to identify and verify any behavior deviation. Again, there are various algorithms for achieving this. The main problem with clustering methods is how to determine the numbers of clusters (classes) to be used. Both these solutions have the advantage of providing good graphic visualization to assist with finding the relevant numbers of cluster. Thus, to find the best method for determining the correct cluster number, we use internal validation. We have tested different algorithms and after analyzing the results, we opted for using the Partitioning Around Medoids (PAM) [START_REF] Lamiaa | Using Modified Partitioning Around Medoids Clustering Technique in Mobile Network Planning[END_REF], as this provides the best set of results. But the relevant numbers of cluster have to be fixed a priori as with the other methodologies. To solve this problem, using the PAMK (Partitioning around medoids with estimation of number of cluster) method automatically gives the correct class number by estimating the optimum average.

IV. VALIDATION / PROOF OF CONCEPT

A. Use case

We work in our study on architecture from a health industry public company with 92,000 employees. Our analysis focuses on three interconnected networks within an extended network (WAN: Wide Area Network) geographically remote and protected by filtering equipment. The objective is to be able to monitor firewall related events and export them to a data container. To simplify references to different networks, the following nomenclature is used:

• production site: SP1;

• qualification site: SQ1; • office and remote administration site: SAB1; These three sites are currently operational, and the information processed and analyzed in the following sections corresponds to real-time data production. IP addresses have been anonymized for privacy reasons. Network SP1 has its own pasteboard outcome of events sent in real-time by the firewall. Network SP1 provides services to 14 million people. Data used is financially sensitive, and needs 9.2 terabytes for storage related to transactions several million Euros a day. Data are heterogeneous and received from several different sources. Table II summarizes the volume in number of lines processed by the filtering equipment. In order to strengthen the integrity of this work, we requested for several users from several companies who work as Information Systems security managers to review and critique our implementation.

B. Phase 2 use case results

Execution of Phase 1 provides us with the opportunity to review network activity. This, in turn, allows for easy understanding when compared to reviewing raw data and events (Figure 1). It is important to note that our study focuses only on session type information (source IP address, destination IP address, protocols and services). After preprocessing, we III, so the 0.7% permit flow could be defined as a marker/trigger for an intrusion. This should be sufficient information to attempt a server access attack. We have tested different kinds of methods for information gathering, such as classic scan (one shot scan), decoy scan (add multiple source of the scan), zombi (use a compromise victim to send the scan), distributed scan (use different machines for the same scan) with different delays (increase the delay when scanning ports; in fact, we saw that a long interval port scanning can hardly find or detect events). In order to have the best detection accuracy, we also teste different supervised learning algorithms by using cross validation. We see that the best results are achieves when using the Random Forest algorithm (Table IV). For the second step of phase 2, we must to find the best method for determining the correct cluster number. We have tested different algorithms and after analyzing the results, we opted for using the Partitioning Around Medoids (PAM) algorithm [START_REF] Lamiaa | Using Modified Partitioning Around Medoids Clustering Technique in Mobile Network Planning[END_REF], as this provides the best set of results. But the relevant numbers of cluster have to be fixed a priori as the other methodologies. To solve this problem, the PAMK (Partitioning around medoids with estimation of number of cluster) method automatically gives the correct class number by estimating the optimum average. We compared the PAMK methodology output versus priori methods (Figure 2), and we noticed that the results were positive for all servers involved in our study. For instance, the computation time for 53 servers is approximately 0.353 seconds. We have built a training data set and saved the class attribution result for reference. Which means that each server has a specific class number, and any derivation could be potentially considered as abnormal behavior. Further, we create a test data set for different kind of scans and we launched several brute force and path traversal attacks (Phase 2 obtain access) 6 . Bydoing this, we saw that the number of class was directly detected in the target servers. For instance, the main server shifted from 6 to 2 classes. This source of behavior deviation is automatically identified as abnormal activity. We then extract data in order to trigger an alert. However, it is possible for an attacker to send massive amounts of data as decoy to try and hide a discreet attack. So, we extract that to make new computations until a similar class number is obtained. Therefore, we can use a variation coefficient (CV) to generate a score [START_REF] Breunig | An almost unbiased estimator of the coefficient of variation[END_REF]. For the moment, we do not manage the score, but the variation coefficient provides a general overview which is good enough for the training dataset when compared to the test data set. We believe that Fig. 2: Example of internal validation for one server with this kind of process, it will be possible to detect and identify destination servers that have undergone changes in behavior. Once we know this, we can then have a specific overview based on server class variation with CV, which allows to focus on the most critical activity. Our approach allows us to detect large scan, brute force attacks and path tranversal attacks, without any help from experts.

C. Experts feedback

From the point of view of experts (2 senior security ingeneer, 1 security consultant,1 chief information security officer, 1 senior network analyst), the D113 tool give us the possibility of obtaining access to all the rejected flow including port scanning and brute force attacks, etc... In addition of that, this tool is very useful to make diagnostics based on verification of security filtering rules. It was possible to report and alert abnormal access to the intrusion detection team. In fact, the diffrents IDS did not identify these actions. With the data mining learning methods, experts were able to visualize the different behaviors on servers. However, the provisional alert thresholds does not appear to correspond to all firewall according to their volumetric flow. The establishment of effecive variation coefficient is expected to change this.

V. CONCLUSION AND PERSPECTIVES

The work done on Phase 2, allows us to check internal security by using Random Forest supervised method with an experts help. The PAMK unsupervised method allows us to detect different kind of information gathering, potential attacks, and other access methods. By using the variation coefficient (CV) it is possible to score the behavior change levels. In order to make Phase 4 operational, we have worked on a simple method for interpreting this scoring and triggering alerts. Additionally, the work completed in Phase 1 has to be improved as to result in a specific and accurate overview of abnormal behavior and misuse. We suggest that other supervised methods, like bagging or boosting, are tested in order to have improved accuracy. These phases will generate association rules based on the assets covered by the several attack vectors. A consideration of techniques from supervised and unsupervised learning allow for better account of the attacks within the automatic definition of reported thresholds. We believe this would create a scalable and adaptive real-time system for identifying changes in behavior due to intrusions and attacks.

Fig. 1 :

 1 Fig. 1: D113: Example of rejected flow

TABLE I :

 I Classic IDS advantages and disadvantages

		Avantages	Disadvantages
	NIDS	Alarm in case of anomalies	Signatures update needed
		Multiple positioning	Absorption network traffic
		Real time	Ineffective for encrypted stream
			False positives
			Expert needed
	HIDS	Workstation protection	Ineffective against attacks
			on multiple hosts
			Configurations depending on
			systems
	Hybrid	Decrease false positives	More sources,
		Real time	management and interpretation
			Event correlation more difficult
			for events and alarms

TABLE II :

 II Flow treated with SP1, SQ1, SAB1 in numbers of lines

		Daily flows processed	Average per minute
	SP1	9 886 928	6 865
	SAB1	572 272	397
	SQ1	20 670	14

TABLE III :

 III Aggregated flow with risk analysis supervised learning

	Sum	Action	Action	Inf	Sup	Adm	Risk
		deny	Permit	1024	1024 port
	16	0.0	100.0	0.0	0.0	0.0	No
	12	0.0	100.0	0.0	0.0	0.0	No
	3296	99.3	0.7	61.9	38	0.1	Yes
	36	100.0	0.0	0.0	100	0.0	No

TABLE IV :

 IV Supervised algorithms error rate comparison

	Algorithms	Error rate %
	CART	9.09
	C4.5	11.3
	C5.0	8.5
	Random Forest	8.2

Firewall/IDS Evasion and Spoofing, http://nmap.org/book/man-bypassfirewalls-ids.html

Log management solution, http://www.balabit.com/network-security/

Graph Visualization Software, http://www.graphviz.org

Link Graph Visualization, http://afterglow.sourceforge.net/

https://www.owasp.org/index.php/Path Traversal


Catherine Avon
email: catherine.avon@hotmail.fr

Laurent Bergès

Prioritization of habitat patches for landscape connectivity conservation differs between least-cost and resistance distances

Keywords: habitat network connectivity, graph theory, connectivity indices, least-cost path, resistance distance, circuit theory, landscape resistance, species dispersal, landscape fragmentation, habitat patch importance

Prioritization of habitat patches for landscape connectivity conservation differs between least-cost and resistance distances

C. Avon, Laurent Bergès

Introduction

Landscape connectivity is accepted as being crucial for biodiversity conservation, because land-use changes and habitat fragmentation per se can dramatically damage species' habitats and species' dispersal. The way a landscape allows or impedes movement of species determines the fluxes of individuals or genes that are exchanged between habitat patches, which help to maintain populations and metapopulations [START_REF] Verbeylen | Does matrix resistance influence Red squirrel (Sciurus vulgaris L. 1758) distribution in an urban landscape?[END_REF][START_REF] Stevens | Gene flow and functional connectivity in the natterjack toad[END_REF][START_REF] Amos | Species-and sex-specific connectivity effects of habitat fragmentation in a suite of woodland birds[END_REF]. Recently, applications of graph theory to landscape ecology have shown potential for quantifying the connectivity of landscape for a species or species group by focusing on the role of habitat patches and dispersal linkages between them [START_REF] Pascual-Hortal | Comparison and development of new graph-based landscape connectivity indices: towards the priorization of habitat patches and corridors for conservation[END_REF][START_REF] Mcrae | Circuit theory predicts gene flow in plant and animal populations[END_REF][START_REF] Pinto | Beyond the least-cost path: evaluating corridor redundancy using a graph-theoretic approach[END_REF][START_REF] Rayfield | Connectivity for conservation: a framework to classify network measures[END_REF]). In particular, researchers have developed methods to identify the most important habitat patches for maintaining the global connectivity of habitat networks [START_REF] Pascual-Hortal | Comparison and development of new graph-based landscape connectivity indices: towards the priorization of habitat patches and corridors for conservation[END_REF]; [START_REF] Urban | Graph models of habitat mosaics[END_REF][START_REF] Bodin | Ranking individual habitat patches as connectivity providers: Integrating network analysis and patch removal experiments[END_REF][START_REF] Saura | A common currency for the different ways in which patches and links can contribute to habitat availability and connectivity in the landscape[END_REF][START_REF] Ernst | Quantifying landscape connectivity through the use of connectivity response curves[END_REF].

These prioritization methods are thought to be particularly useful for conservation biologists and landscape managers: they can guide the location of future finer-scale studies and help to define conservation, restoration or mitigation measures that should favour a better (spatial) allocation of funds and efforts to protect biodiversity [START_REF] Zetterberg | Making graph theory operational for landscape ecological assessments, planning, and design[END_REF][START_REF] Foltete | A methodological framework for the use of landscape graphs in land-use planning[END_REF][START_REF] Gurrutxaga | Prioritizing highway defragmentation locations for restoring landscape connectivity[END_REF].

Habitat patch prioritization based on landscape graphs uses connectivity indices that quantify the importance of each habitat patch for habitat network connectivity, taking into account its position in the habitat network with, for example, centrality indices (e.g. [START_REF] Estrada | Using network centrality measures to manage landscape connectivity[END_REF]. But, connectivity indices generally consider both the position and the quality (or quantity) of available habitat such as the Integral Index of Connectivity (IIC) and

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8 the Probability of Connectivity index (PC) [START_REF] Pascual-Hortal | Comparison and development of new graph-based landscape connectivity indices: towards the priorization of habitat patches and corridors for conservation[END_REF][START_REF] Saura | A new habitat availability index to integrate connectivity in landscape conservation planning: Comparison with existing indices and application to a case study[END_REF][START_REF] Saura | A common currency for the different ways in which patches and links can contribute to habitat availability and connectivity in the landscape[END_REF]. These connectivity indices make a compromise between the effects of landscape composition and landscape structure on species presence, a question still debated in the literature [START_REF] Didham | Rethinking the conceptual foundations of habitat fragmentation research[END_REF]. Different attributes of habitat patches can be used to consider habitat patch quality: this can depend on species requirements, but more often on the information available, often justifying the use of proxies of habitat patch quality calculated from landscape maps such as patch area, patch interior area or level of anthropogenization. How well one habitat patch is linked to the rest of the habitat network depends on the distance between this habitat patch and the other patches, but the way in which the method used to calculate this distance affects the degree of connectivity of habitat patches remains unclear. Traditionally in graph theory, distance between habitat patches was just the topological distance, i.e. Euclidean distance, but in this last decade many studies on animal dispersal movement have shown that Euclidean distance is not realistic because it does not integrate the difficulty or mortality encountered by a species moving through a landscape mosaic [START_REF] Adriaensen | The application of 'least-cost' modelling as a functional landscape model[END_REF][START_REF] Belisle | Measuring landscape connectivity: The challenge of behavioral landscape ecology[END_REF]). Many efforts have been made to integrate landscape resistance more fully with species movement, and two methods are now widely used to quantify the distance a species has to travel to disperse between habitat patches.

The classical least-cost path is based on friction maps reflecting the difficulty for a species to move between two source patches [START_REF] Adriaensen | The application of 'least-cost' modelling as a functional landscape model[END_REF]. A species accumulates a cost with increasing distance from source patches, depending on its dispersal capacities and specific habitat encountered. The least-cost distance (LCD) is the accumulated cost distance of the most likely route an individual would take to move between the two habitat patches considered, i.e. the least-cost path (LCP). However, LCP implies that species

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8 know the optimal path to get to a new habitat patch, and a major criticism is that it does not take into account the existence of other optimal paths, whereas species generally use random or alternative dispersal routes depending on individual behaviour [START_REF] Belisle | Measuring landscape connectivity: The challenge of behavioral landscape ecology[END_REF].

Nevertheless, LCD itself indicates the minimum distance separating the individual habitat patches and so the reachability of habitat for species. LCD is therefore now preferred to Euclidean distance for parameterizing connectivity indices prioritizing habitat patch importance [START_REF] Zetterberg | Making graph theory operational for landscape ecological assessments, planning, and design[END_REF][START_REF] Gurrutxaga | Key connectors in protected forest area networks and the impact of highways: A transnational case study from the Cantabrian Range to the Western Alps (SW Europe)[END_REF][START_REF] Clauzel | Impact assessment of a high-speed railway line on species distribution: Application to the European tree frog (Hyla arborea) in Franche-Comte[END_REF]. A recent significant advance in quantifying resistance distance separating habitat patches was provided by circuit theory, which takes into account random movement paths and path redundancy [START_REF] Mcrae | Circuit theory predicts gene flow in plant and animal populations[END_REF][START_REF] Mcrae | Using Circuit Theory to Model Connectivity in Ecology, Evolution, and Conservation[END_REF]). An electric current flowing through landscape resistance maps represents species dispersal flux at each point of the landscape: all the alternative paths between two habitat patches are used to calculate resistance distance (RD), which represents the effective distance separating the two habitat patches for a species. The more alternative paths there are, the shorter RD is compared to LCD. RD has been particularly widely used in genetic studies to evaluate functional landscape connectivity by correlating RD to genetic distance between population patches [START_REF] Amos | Species-and sex-specific connectivity effects of habitat fragmentation in a suite of woodland birds[END_REF][START_REF] Marrotte | Landscape resistance and habitat combine to provide an optimal model of genetic structure and connectivity at the range margin of a small mammal[END_REF], and current maps are considered to identify dispersal corridors well [START_REF] Roever | Functional connectivity within conservation networks: Delineating corridors for African elephants[END_REF]. Some studies have used both LCD and RD (or resulting maps) to find out which is the better predictor of species movement corridors [START_REF] Poor | Comparing Habitat Suitability and Connectivity Modeling Methods for Conserving Pronghorn Migrations[END_REF][START_REF] Lapoint | Animal behavior, cost-based corridor models, and real corridors[END_REF] or how they change with cost map parameterization [START_REF] Koen | The effect of cost surface parameterization on landscape resistance estimates[END_REF].

One recent study [START_REF] Ayram | Identifying potential conservation areas in the Cuitzeo Lake basin, Mexico by multitemporal analysis of landscape connectivity[END_REF]) used both LCD and circuit theory to identify important landscape elements: IIC index was based on LCD to determine key habitat patches, and current maps were used to locate corridors for two mammal species. However, to our knowledge, how LCD and RD influence patch importance and the identification of key

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8 elements maintaining habitat network connectivity has never been studied. It remains unclear whether the modelling of alternative paths, which is very time-consuming, is really required to identify key elements for habitat connectivity, or whether the modelling of the one best path, which is faster, is sufficient to approximate habitat patch importance adequately.

In this article, we compare the prioritization of habitat patches from graph models based on LCP and from graph models based on RD. We used binary and probabilistic connectivity indices, i.e. Betweenness Centrality (BC), patch importance based on Integral Index of Connectivity (dIIC) and based on Probability of Connectivity (dPC), in order to provide support in the use of the most commonly employed connectivity indices in conservation studies. We hypothesized that the identification of key habitat patches would tend to agree with increasing dispersal distance, but that identification could remain different in certain cases, particularly when the probability of dispersal was considered, since RD integrates multiple paths unlike LCD. We go on to discuss ecological hypotheses that might explain these differences. Our comparison is based on two real landscapes (e.g. [START_REF] Koen | The Effect of Map Boundary on Estimates of Landscape Resistance to Animal Movement[END_REF][START_REF] Koen | The effect of cost surface parameterization on landscape resistance estimates[END_REF] ranging in habitat cover, fragmentation level, and spatial extent to verify consistency of relationship with landscape structure. Habitat patch prioritization focused on forest mammal species with different dispersal distances using a generic approach and following a conservation perspective, not a restoration or mitigation perspective. In this case, habitat patch prioritization aims to evaluate the importance of each habitat patch for maintaining the global connectivity of the habitat network for the species.

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

Material and Methods

Study area and land cover map

Two study cases were selected in the South of France (43°01' -45°07' N and 4°13' -7°43' E).

The first study case, hereafter named "Region", followed the administrative boundaries of Region PACA, excluding isolated parts (e.g. Mediterranean islands) and encompassed about 31700 km 2 . Region was mainly covered by forests (38%), other semi-natural and natural areas (35%), agricultural areas (17%) and artificial areas (7%); other areas were wetlands and water bodies (3%). A second landscape hereafter named "Sub-region" was a sub-area of about 7090 km 2 , and contained strong human-created barriers. Sub-region was affected by a higher level of anthropogenization than Region, with a lower cover of forests and other semi-natural and natural areas (27% and 26% respectively), and a higher cover of agricultural areas and artificial areas (31% and 11% respectively). Other areas were wetlands and water bodies (3%). The study area was bordered by the Alps at the East, anthropogenized areas at the West and the Mediterranean Sea at the South. Landscape habitats came from the map ocsol2006 of Crige PACA (www.crige-paca.org), an adaptation of the CORINE land cover nomenclature of the European Environmental Agency (http://www.eea.europa.eu/dataand-maps) for French Mediterranean landscapes with a smaller spatial resolution. The land cover map identified 42 types of landscape features, including natural and humandominated lands, highways and major railways, with a minimal mapping unit varying from 0.5 to 2.5 ha.

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

Functional group approach

We focused on generalist forest mammal species using a generic approach for our connectivity models, because these species depend on a well-defined habitat and are known to be sensitive to landscape features of interest for land managers, such as transportation infrastructures, and urban and other anthropogenized areas. We collected scientific literature on forest mammal species and consulted studies using a generic forest species approach [START_REF] Verbeylen | Does matrix resistance influence Red squirrel (Sciurus vulgaris L. 1758) distribution in an urban landscape?[END_REF][START_REF] Watts | Targeting and evaluating biodiversity conservation action within fragmented landscapes: an approach based on generic focal species and least-cost networks[END_REF][START_REF] Garcia-Feced | Improving landscape connectivity in forest districts: A two-stage process for prioritizing agricultural patches for reforestation[END_REF][START_REF] Gurrutxaga | Key connectors in protected forest area networks and the impact of highways: A transnational case study from the Cantabrian Range to the Western Alps (SW Europe)[END_REF][START_REF] Gimona | Woodland networks in a changing climate: Threats from land use change[END_REF] to determine the resistance of landscape features to animal movement. The attribution of cost values to landscape features is still under debate [START_REF] Zeller | Estimating landscape resistance to movement: a review[END_REF][START_REF] Mc | Estimating effective landscape distances and movement corridors: comparison of habitat and genetic data[END_REF] and would be based on ad hoc data, i.e. showing species dispersal movement (pathways data), in the ideal but very uncommon case. Consequently, we focused on studies that conducted sensitivity analyses to model connectivity between forest habitat patches, such as that of [START_REF] Verbeylen | Does matrix resistance influence Red squirrel (Sciurus vulgaris L. 1758) distribution in an urban landscape?[END_REF], who tested a range of cost values and cost classes to find the best combination explaining the presence of forest species in forest habitat patches. Our review caused the original land cover map to turn into a landscape resistance map with five cost classes: 1 for forest areas (species habitat), 10 for less open areas with trees (or potential feeding-seed trees), 300 for more open areas including shrubs or gardens, 800 for areas with low vegetation such as agricultural lands, and 1000 for landscape features that most impeded animal movement such as highways, buildings and permanent snow. We then rasterized the cost map at a 100 m pixel size to reduce calculation time for analysis [START_REF] Mcrae | Using Circuit Theory to Model Connectivity in Ecology, Evolution, and Conservation[END_REF]. Habitat patches were defined as entirely covered by forest, up to the upper tree-line at 2100 m a.s.l. and with a surface area of at least 10 ha. We kept 621 forest habitat patches for Sub-region and 2482 forest habitat patches for Region. GIS calculations were performed with ArcGis 10 (ESRI®).

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

Least-cost distance and resistance distance

Linkages were modelled between habitat patches using a maximum distance according to species dispersal capacities and the extent of the study area. For connectivity analyses (see below), we used a range of distances rather than only one, enabling us to take into account information disparity in the literature and variation in species dispersal distance (e.g. juvenile dispersal, adult dispersal, long-distance dispersal events). Most importantly, this enabled us to analyse how our connectivity models changed with dispersal distance and so to what extent LCP-based prioritization is correlated to RD-based prioritization. Our review prompted us to use the following dispersal distances (edge-to-edge of habitat patches): 200 m, 700 m, 1000 m, 4000 m, 6000 m, 10 km, 15 km, 20 km and 25 km. Our connectivity models thus considered a range of dispersal distances ranging from 200 m to 25 km, enabling us to consider short-, medium-and long-distance dispersal of forest mammal species. The maximum dispersal distance of 25 km yielded 898 linkages for Sub-region and 3399 for Region. In this article, dispersal distance was in kilometres but it was actually a cost distance: in the analyses, dispersal distance was multiplied by the median value of the cost raster to reflect the cost of the path travelled by the species (e.g. [START_REF] Gurrutxaga | Key connectors in protected forest area networks and the impact of highways: A transnational case study from the Cantabrian Range to the Western Alps (SW Europe)[END_REF]. A species moves a larger geographical distance through permeable landscape features than through landscape features with high resistance. Dispersal distances stated in the literature often result from straight-line distance calculations between pre-and post-dispersal habitat patches (e.g. [START_REF] Wauters | Dispersal and habitat cuing of Eurasian red squirrels in fragmented habitats[END_REF], whereas species had actually moved through different landscape features along a much longer non-linear path [START_REF] Rowcliffe | Bias in estimating animal travel distance: the effect of sampling frequency[END_REF].

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

We used Linkage Mapper 1.0.3 (McRae and Kavanagh 2011), a free tool box implemented in ArcGis, to calculate LCD between each pair of habitat patches: LCD is the accumulated cost distance of the most likely route an individual would take to move between the two habitat patches considered. Only direct linkages between habitat patches were considered to construct the habitat network model (see below). Using circuit theory with Circuitscape (McRae et al. 2008;[START_REF] Shah | Circuitscape: a tool for landscape ecology[END_REF], we then calculated RD between each pair of habitat patches (pairwise mode and connection option with eight neighbours). Calculating RD was particularly time-consuming with a large numbers of patches and linkages, because all the paths between two habitat patches have to be considered. The resistance to current flow was therefore computed on the entire landscape area, and for each pair of habitat patches. We were not interested in the precise location of dispersal corridors, but in a measure of distance between habitat patches that took into account alternative paths. Hence to calculate RD, we restricted the current flow analysis to a corridor surrounding the least-cost path determined previously by applying a cut-off of 700 m (cost width of corridor) and using an extension of Linkage Mapper that applied Circuitscape in this specific way [START_REF] Mcrae | Pinchpoint Mapper Connectivity Analysis Software[END_REF]. Consequently, all alternative paths not exceeding 700 m from the least-cost path were kept to compute RD between a pair of patches. When landscape impedes species movement, least-cost corridors are narrow and there are few alternative paths between patches for species, so RD approximates to or equals LCD, but when landscape is favourable to species movement, least-cost corridors are wide and there are many alternative paths, making RD strongly shorter than LCD. In this case, individuals have more chance of reaching the other habitat patch. We also calculated RD for a corridor cut-off of 4000 m in order to verify how corridor cut-off could change the estimation of habitat patch importance. Habitat patch importance for the two cut-offs was

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8 closely correlated: Spearman's rho was at least 0.92, but generally above 0.94 for both Region and Sub-region. We therefore kept RD based on a corridor cut-off of 700 m in what follows. The calculation of LCD and RD for Sub-region was applied to the spatial extent of Region (acting as a buffer, see [START_REF] Koen | The Effect of Map Boundary on Estimates of Landscape Resistance to Animal Movement[END_REF], to make the estimation of distance independent of artificial boundary (only present at the North of Sub-region, see Material and Methods).

Connectivity indices for evaluating habitat patch importance

The habitat network model was composed of nodes representing habitat patches characterized by their surface area, and of direct links representing linkages between habitat patches characterized by their travel cost (LCD or RD). A set of connectivity indices was calculated from the habitat network model with the free software Conefor 2.6 [START_REF] Saura | Conefor Sensinode 2.2: A software package for quantifying the importance of habitat patches for landscape connectivity[END_REF] in order to quantify the relative importance of habitat patches for global network connectivity. Here we present the different indices used only briefly, all being detailed and their use justified in an abundant literature. Moreover, our aim was not to investigate the differences between connectivity indices (see [START_REF] Bodin | Ranking individual habitat patches as connectivity providers: Integrating network analysis and patch removal experiments[END_REF][START_REF] Baranyi | Contribution of habitat patches to network connectivity: Redundancy and uniqueness of topological indices[END_REF]), but to compare habitat patch ranking according to LCD-based linkages and RDbased linkages for different connectivity indices currently used in the conservation biology literature. A path or linkage is always the direct dispersal between two habitat patches (i.e. with no other intermediate habitat patch), whereas the term pathway is used with a general meaning, i.e. dispersal ways in habitat network (direct or indirect). All connectivity indices used in this study are given in Table 1. Betweenness Centrality (BC) considers the number of shortest pathways between all pair of nodes that go through a particular node, and so does

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8 not consider the node attribute (surface area). dIIC flux (dIICf), dIIC connector (dIICc), dPC flux (dPCf) and dPC connector (dPCc) are fractions resulting from the decomposition of the node importance value (dIIC, dPC) based on Integral Index of Connectivity (IIC) and on Probability of Connectivity (PC) respectively (Table 1). Flux fraction of a particular node (dIICf, dPCf) quantifies the amount of dispersal flux that occurs between the node and the rest of the network, and depends on the node attribute and the shortest pathways that link the node to the network (topological position). Connector fraction of a particular node (dIICc, dPCc) exists only if the shortest pathways between other nodes pass through the node, and so depends only on topological position; it quantifies the importance of the node as a steppingstone for dispersal, i.e. facilitating dispersal between excessively far nodes. We also computed the last fraction of node importance, the intra fraction (dIICi, dPCi) of a particular node, which depends only on the node attribute, and so has the same value whether the node is connected or not (see [START_REF] Saura | A common currency for the different ways in which patches and links can contribute to habitat availability and connectivity in the landscape[END_REF]. Investigating how the fractions connector and flux change with linkage type helped us to make a better evaluation of how connectivity models impact the importance of patch, and so support more precise recommendations for the use of prioritization methods. All indices were calculated for the nine dispersal distances and for the two landscapes. Dispersal distance acted as a threshold determining the presence of a link between two nodes in the case of binary indices (BC, dIICf, dIICc). In the case of probabilistic indices (dPCf, dPCc), dispersal distance determined the median probability associated with a link, defining the distance-decay constant α in the relation p ij = e -αd ij [START_REF] Urban | Landscape connectivity: A graph-theoretic perspective[END_REF][START_REF] Saura | A new habitat availability index to integrate connectivity in landscape conservation planning: Comparison with existing indices and application to a case study[END_REF] where p ij is the probability of dispersal between nodes i and j, and d ij their distance (LCD or RD). BC, dIICf, dIICc, dPCf and dPCc have been shown to be non-redundant indicators of patch contribution in the maintaining of habitat network connectivity [START_REF] Baranyi | Contribution of habitat patches to network connectivity: Redundancy and uniqueness of topological indices[END_REF]. Finally, we summed node importance values for each fraction flux, connector and intra over all the nodes, and then calculated the percentage of each sum relative to the total node importance values [START_REF] Saura | A common currency for the different ways in which patches and links can contribute to habitat availability and connectivity in the landscape[END_REF]. This percentage was calculated for each dispersal distance in order to examine how habitat network connectivity (flux fraction and connector fraction of habitat

Comparison of LCD-and RD-based connectivity indices

The higher the value of connectivity index, the greater the importance of the node for global habitat network connectivity. For each connectivity index and each dispersal distance, we compared node importance given by the LCD-based index to node importance given by the

Results

Habitat patch prioritization according to LCD-based and RD-based indices

Correlations between LCD-based indices and RD-based indices increased with dispersal distance for the two landscapes Sub-region and Region (Fig. 1 and Fig. S1). Correlations strongly increased from 200 m to 1000 m, then increased more slowly up to 4000 m, where Spearman's rho generally exceeded 0.9, and were stable further away. while they became more similar with increasing dispersal distances. The sum of node importances reflected this convergence with increasing dispersal distances (Fig. 2 and Fig. S2). Differences persisted at slightly longer dispersal distances for probabilistic indices than for binary indices, particularly for connector fraction (Figs 1 and2). The sum of node importances for Sub-region showed that dPCc peaked at 200 m and was rather stable from 1000 m when based on RD, but strongly decreased after 4000 m when based on LCD. By contrast, values of dIICc were similar at least from 4000 m for both distance types (same results for Region, Fig. S2). This difference occurred because for probabilistic indices, dispersal probability associated with the linkages increased much more rapidly when considering RD and alternative paths than when considering LCP and only one optimal path. The comparison of habitat patch ranking according to importance values given by LCD-based indices and by RD-based indices showed strong similarities (Fig. 3 and Fig. S3) that could be explained by strong correlations between connectivity indices for a type of linkages.

First, the comparison of habitat patch ranking followed the same pattern for dIICf and dPCf, and their correlations were above 0.92 both for LCD-based and RD-based indices for Subregion (>0.9 for Region). Second, comparison showed the same pattern for dIICc and BC, and LCD linkages were up to 74 times longer than RD linkages, so habitat network based on LCD strongly differed from habitat network based on RD for small and medium dispersal distances, dispersal probability associated with LCD being very small compared with RD (Fig. 6). As dispersal capacity increased, dispersal probability increased strongly for LCD linkages, and the habitat patches identified only by RD-based dPCc tended to be identified also by LCD-based dPCc, i.e. the disparity of patch ranking for these patches decreased (compare top-ranked patches by RD-based dPCc between Figs 6 and7). However, the disparity of patch ranking increased for the patches identified only by LCD-based dPCc (compare Figs 6

their
and 7): they occurred in landscape areas that remained poorly connected by LCD linkages at a large distance (Fig. 7a), whereas these areas became well connected by RD linkages (Fig. 7b). There were alternative pathways with high dispersal probabilities since large corridors and different paths between patches could be used by individuals to disperse (Fig. S4).

Discussion

We report evidence that there was strong divergence between habitat patch prioritization based on linkage reflecting the least-cost path and that based on linkage reflecting multiple paths, depending on the type of connectivity indices and species dispersal distance. The

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8 same patterns of prioritization occurred for both landscapes Region and Sub-region, which strongly differed in terms of spatial extent, landscape composition and fragmentation. This suggests that the correlation patterns we found in this study may not depend on landscape extent and landscape structure. However, further investigations are needed to measure to what extent the correlation between LCP-based prioritization and RD-based prioritization will follow the same pattern when landscape structure changes. Prioritization indices are presented as tools helping practitioners to orientate field conservation measures by the use of available knowledge about dispersal capacities and species requirements [START_REF] Galpern | Patch-based graphs of landscape connectivity: A guide to construction, analysis and application for conservation[END_REF]), since it is not (or only rarely) possible to obtain robust data on real species fluxes between habitat patches at large scales. Hence, the use of prioritization indices and leastcost corridors or current maps identifying potential key landscape areas is an important advance for landscape and species conservation management [START_REF] Beier | Toward Best Practices for Developing Regional Connectivity Maps[END_REF][START_REF] Lawler | Projected climate-driven faunal movement routes[END_REF][START_REF] Ayram | Identifying potential conservation areas in the Cuitzeo Lake basin, Mexico by multitemporal analysis of landscape connectivity[END_REF]. LCD and RD are methods with marked conceptual differences, and we showed that the way they influence prioritization of landscape features is not trivial.

LCD-based and RD-based indices identified almost the same habitat patches even for short dispersal (from 700 m) when considering the role of patches as providers (or receivers) of individual fluxes. Habitat patch attribute weighted the influence of distance type, and when large habitat patches were well connected to the habitat network (mean patch area was 178 ha for Sub-region but 3140 ha for the 25 top-ranked habitat patches by dIICf or dPCf), it was sufficient to calculate LCD to properly quantify the importance of habitat patches for dispersal fluxes into the habitat network. Accordingly, we recommend that conservation managers calculate only LCD in a first line approach, and then verify the degree of connection between large (high quality) habitat patches and the rest of the habitat

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

network before deciding whether the calculation of RD is required for quantifying the contribution of patches to dispersal fluxes at the scale of the landscape.

Concerning the role of habitat patches as stepping-stones, i.e. facilitating species dispersal between far habitat patches, the choice of RD or LCD could depend on the assumptions about how the species population functions. Considering the presence or absence of the linkage, i.e. the use of binary indices (BC, dIICc), almost all linkages were established for LCP above a certain dispersal distance of the species. In one study on a plant species [START_REF] Neel | Patch connectivity and genetic diversity conservation in the federally endangered and narrowly endemnoc plant species Astragalms albens (Fabaceae)[END_REF], IIC tended to explain genetic differences between populations better than PC, but for a Euclidean distance less than 2500 m, so actually a much shorter distance than in our study. If we hypothesize that one individual would be sufficient to change the genetic structure of population (see [START_REF] Wang | Application of the one-migrant-per-generation rule to conservation and management[END_REF], the convergence of patch prioritization based on LCD and on RD should be expected. LCD indicated the minimum distance a particular individual had to move between habitat patches, and when the individual dispersal capacity was at least LCD, the individual was able to move to any population patch.

Accordingly, our results show that the calculation of RD did not provide any further information about key stepping stones in the landscape.

When considering the linkage probability between habitat patches (dPCc), strong differences remained whatever the dispersal distance. RD considered the probability of dispersal between habitat patches taking into account path redundancy, i.e. it indicated the resistance distance one species moved between population patches [START_REF] Fletcher | The matrix alters the role of path redundancy on patch colonization rates[END_REF].

RD can be more closely correlated with genetic distance compared with LCP, which implies that taking into account the flux of dispersers better reflects genetic differences between we can hypothesize that RD-based dPCc predicts functional connectivity between populations better than LCD-based dPCc, since the establishment of linkages between patches is proportional to the number of dispersers, and not only to the inter-patch distance [START_REF] Fletcher | The matrix alters the role of path redundancy on patch colonization rates[END_REF]. The current map (Fig. S4) illustrates the differentiation of narrow corridors for forest species dispersal (pinchpoints), versus large corridors or alternative paths between habitat patches that increase the probability of dispersal for the species (compare dispersal probability in Figs 7a and7b).

Future studies will use genetic data to corroborate that RD best identifies key landscape elements that contribute to the long-term persistence of species. Our results also show that LCD-based dPCc allowed the identification of landscape parts that remain difficult to reach for one individual because of a strong impedance of the surrounding landscape:

restoration actions to facilitate individual dispersal will ameliorate the connectivity with other landscape parts, and probably also the long-term persistence of the species. Habitat patch importance was evaluated similarly according to RD based on 700-m corridor cut-off and 4000-m corridor cut-off, but if RD was calculated considering the entire surrounding landscape as space for dispersal movements, the prioritization differences between LCD and RD might be accentuated. Circles illustrate some cases where prioritization strongly differed. Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8 Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

Figures

Figure 1 Author , 2016, 31, 7, 1551-1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

Figure 3

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

Figure 4

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

Figure 5

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

  network) changes according to LCD-based or RD-based indices. Connector fraction peaks when key stepping-stones become connected to habitat network, and flux fraction increases with connection of large habitat patches (high quality patches) and with the number of alternative pathways in the habitat network[START_REF] Saura | A common currency for the different ways in which patches and links can contribute to habitat availability and connectivity in the landscape[END_REF]. We also calculated BC(IIC) and BC(PC), which are modifications of BC integrating properties of IIC and PC and are argued to be further useful indices[START_REF] Bodin | Ranking individual habitat patches as connectivity providers: Integrating network analysis and patch removal experiments[END_REF]), but we do not present the results for these indices since they were very closely correlated to dIICc and dPCc for both LCD and RD linkages (Spearman's rho was at least 0.91) and showed the same correlation pattern as dIICc and dPCc (see below).

Figure 1 .

 1 Figure 1. Correlation between habitat patch importance according to LCD-based and RD-based index for binary (a) and probabilistic indices (b) for Sub-region. Intra fraction (i), flux fraction (f) and connector fraction (f) are the partition of node importance dIIC and dPC. Tick marks without labels are 700, 1000 and 6000 m respectively.

Figure 2 .

 2 Figure 2. Relative contribution of each fraction intra (i), flux (f), connector (c) to habitat network connectivity according to LCD-based and RD-based indices for Sub-region. Each fraction represents the contribution of all individual habitat patches relative to their total importance for maintaining connectivity. Tick marks without labels are 700, 1000 and 6000 m respectively.

  correlation was above 0.91 for both LCD-based and RD-based indices for Sub-region (>0.92 for LCD-based indices and >0.87 for RD-based indices for Region). The pattern wasAuthor-produced version of the article published in LandscapeEcology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8 prioritization in our study, but it had high importance when connectivity indices were based only on dispersal distance for short-and medium-distance dispersers (BC and IICc) or when they were based on dispersal probability (dPCc). In certain cases for binary indices, habitat patches were top-ranked by the RD-based index, whereas the LCD-based index gave them a null importance as habitat patches were at one end or totally isolated in the LCD-based habitat network (see arrow 1 on Fig.5). However, in other cases, habitat patches were topranked only by the RD-based index, although they might have been expected to be topranked also by the LCD-based index (arrows 2, Fig.5): the loss of these habitat patches seriously affected dispersal between group of patches and the rest of the LCD-based habitat network for short-distance and medium-distance dispersers, because there was no alternative pathway, or only much longer pathways with many intermediate steps. LCDbased indices evaluated other habitat patches as being more important for network connectivity (e.g. arrows 3 on Fig.5), their loss causing the total isolation of a large part of the habitat network. However, RD linkages showed several alternative pathways with an equivalent or smaller number of steps, thus providing other connections with the rest of the habitat network. Consequently, LCD-based indices tended to overestimate the role of certain habitat patches compared with RD-based indices, because they seemed to act as key connectors for maintaining habitat network connectivity whereas alternative pathways existed (see Figs5 and 6). This resulted in a decrease in the importance of the other habitat patches identified as key-elements by RD-based indices.

Figure 4 .Figure 5 .

 45 Figure 4. Among the 25 top-ranked habitat patches, number of patches identified commonly by LCD-based and RD-based indices.

Figure 6 .

 6 Figure 6. Maps showing the 25 top-ranked habitat patches according to dPCc for the 6000-m median dispersal distance. LCD-based (a) and RD-based linkages (b) are represented according to their dispersal probability. See Fig. 5 for other details.

Figure 7 .

 7 Figure 7. Maps showing the 25 top-ranked habitat patches according to dPCc for the 25-km median dispersal distance. LCD-based (a) and RD-based linkages (b) are represented according to their dispersal probability. See Fig. 5 for other details.

Figure 1 .

 1 Figure 1. Correlation between habitat patch importance according to LCD-based and RD-

Figure 2 .

 2 Figure 2. Relative contribution of each fraction intra (i), flux (f), connector (c) to habitat

Figure 3 .

 3 Figure 3. Habitat patch importance rank according to LCD-based versus RD-based indices for

Figure 4 .

 4 Figure 4. Among the 25 top-ranked habitat patches, number of patches identified by both

Figure 5 .

 5 Figure 5. Map showing the 25 top-ranked habitat patches according to dIICc for a maximum

Figure 6 .

 6 Figure 6. Maps showing the 25 top-ranked habitat patches according to dPCc for the 6000-m

Figure 7 .

 7 Figure 7. Maps showing the 25 top-ranked habitat patches according to dPCc for the 25-km

  -produced version of the article published in LandscapeEcology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336

  Figure 2

  Figure 6

  Author-produced version of the article published in LandscapeEcology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

  populations than considering one (best) disperser[START_REF] Mcrae | Circuit theory predicts gene flow in plant and animal populations[END_REF]. Consequently,

	Author-produced version of the article published in Landscape Ecology, 2016, 31, 7, 1551-1565
	The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8
	DOI: 10.1007/s10980-015-0336-8

Table 1

 1

Table 1 .

 1 Binary and probabilistic connectivity indices used for prioritization of habitat

	Author-produced version of the article published in Landscape Ecology, 2016, 31, 7, 1551-1565
	The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8
	DOI: 10.1007/s10980-015-0336-8
	patches in our study
		INDEX	TYPE	MEANING	REFERENCES
	BC	Betweenness	Binary Considers the role of patch i as connecting other patches	Estrada and Bodin
		Centrality		(stepping-stone) with shortest pathways	2008; Bodin and
					Saura 2010
	dIIC	delta IIC	Binary Importance of patch i according to Integral Index of	Urban and Keitt 2001;
				Connectivity. IIC considers both habitat amount and habitat	Pascual-Hortal
				reachability in habitat network, and linkages as dispersal events	and Saura 2006;
				between patches. dIIC quantifies the loss of connectivity if patch	Saura and Rubio 2010
				i is removed from habitat network and can be decomposed into
				dIICf, dIICc, dIICi
	dPC	delta PC Probabilistic Importance of patch i according to Probability of Connectivity.	Saura and Pascual-
				Like IIC, PC considers both habitat amount and habitat	Hortal 2007; Saura
				reachability in habitat network, but the probability of dispersal	and Rubio 2010
				between patches. dPC can also be decomposed into dPCf, dPCc,
				dPCi
		Flux fraction		Quantifies the role of patch i as receiving (emitting) flux from	Saura and Rubio 2010
	dIICf	of dIIC	Binary	(to) other patches. It considers the attributes of i and of other
	dPCf	of dPC Probabilistic	patches, and the shortest pathways between them
		Connector fraction		Quantifies the role of patch i as connecting other patches	Saura and Rubio
	dIICc	of dIIC	Binary	(stepping-stone). It considers shortest pathways passing through	2010; Gurrutxaga et
	dPCc	of dPC Probabilistic	i and the attribute of other patches	al. 2011; Saura et al.
					2014
		Intra fraction		Quantifies the role of patch i as providing intra-connectivity so	Saura and Rubio 2010
	dIICi	of dIIC	Binary	considering only the attribute of i.
	dPCi	of dPC Probabilistic

Acknowledgments C.A. was supported by Region PACA (APRF 2011 projet Alterbio PACA) and Irstea.

slightly different for dPCc and its correlation with other indices was lower (<0.8 in all cases). Indeed, three different cases occurred concerning habitat patch prioritization. Firstly, LCDbased indices gave a much higher importance to habitat patches than RD-based indices. The most illustrative case occurred when habitat patches had a moderate importance with LCDbased indices and had null importance (rank 1) with RD-based indices (see Fig.

Identification of top-ranked habitat patches

We focused on the 25 habitat patches with the greatest contribution for maintaining global habitat network connectivity at Sub-region level and projected the three different cases on the habitat network map. From the 700-m dispersal distance, almost the same habitat patches were identified by IICf and PCf based on LCD or RD linkages, whereas they strongly differed until the 1000-m dispersal distance for BC and IICc (Figs 4 and5). The prioritization of habitat patches by dPCc remained divergent even when considering large dispersal distances, and only about 50% of top-ranked habitat patches were identified by both index types whatever the distance (Fig. 4). This means that when connectivity indices were weighted by patch attributes (IICf and PCf), linkage type had very little importance for patch

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8 Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8

Supporting Material Captions

Author-produced version of the article published in Landscape Ecology, 2016Ecology, , 31, 7, 1551Ecology, -1565 The original publication is available at http://link.springer.com/article/10.1007/s10980-015-0336-8 DOI: 10.1007/s10980-015-0336-8