Vincent Crombez
email: crombez.v@gmail.com

François Baudin

Sébastien Rohais

Laurent Riquier

Tristan Euzen

Stanislas Pauthier

Mathieu Ducros

Benoît Caron

Noga Vaisblat

Crombez Vincent

Baudin François

Rohais Sébastien

Riquier Laurent

Euzen Tristan

Pauthier Stanislas

Caron Benoit

Vaisblat Noga

Basin scale distribution of organic matter in marine fine-grained sedimentary rocks: Insight from sequence stratigraphy and multi-proxies analysis in the Montney and Doig formations

Keywords: Petroleum source rocks, Triassic, Montney and Doig Formations, Organic matter, Primary productivity, Redox conditions, Sedimentation rates, Canada

published or not. The documents may come

ABSTRACT

The occurrence of hydrocarbons in self-sourced reservoirs strongly depends on the concentration and maturity of organic matter in sediments. Therefore, understanding the distribution of organic heterogeneity at the time of deposition is key to reduce the risk in exploration and development of unconventional resources. This study focuses on the Lower and Middle Triassic Montney and Doig Formations (Alberta and British Columbia). Samples from outcrops, cores and cuttings were analyzed for organic content with a Rock-Eval VI and for major and trace element concentration using ICP-MS and ICP-AES techniques. The interpretation of the analysis results in relation with the stratigraphic architecture provides a mean to better understand the distribution of the organic heterogeneities and the variations of primary productivity, sedimentation rates and anoxia that control the development of source rocks.

The key findings of this analysis are:

-The basin-scale distribution of the organic matter suggests that the two major source-rock intervals of the Lower and Middle Triassic correspond to the sequence 3 (Spathian Montney unit) and to the transgressive systems tract of sequence 4 (Doig phosphate zone).

-The dominant controls on organic matter accumulations vary through time. The Montney source-rock interval is interpreted to be associated with a major basin restriction triggering anoxia during a second-order falling stage of relative sea level. The organic accumulation of the Doig phosphate zone is interpreted as being controlled by a sharp decrease of the sedimentation rate, combined with an increase of the primary productivity.

-The spatial and temporal variations of anoxia, primary productivity and dilution reflect the geodynamic evolution of the basin that ultimately controls the basin physiography as well as the sources of nutrient and sediments.

HIGHLIGHTS

The Montney and Doig Formations mainly present amorphous organic matter.

INTRODUCTION

With the development of self-sourced and closely associated tight reservoirs, there is a need for a better understanding of the origin and distribution of primary organic matter (OM) in source rocks [START_REF] Schwarzkopf | Model for prediction of organic carbon content in possible source rocks[END_REF][START_REF] Taylor | Improved hydrocarbon charge prediction by source-rock modelling[END_REF]Ducros et al., in press). Stratigraphic framework characterization is the first and main step needed to quantify and discuss the processes controlling the distribution of OM [START_REF] Creaney | Recurring Patterns of Total Organic Carbon and Source Rock Quality within a Sequence Stratigraphic Framework[END_REF][START_REF] Myers | Organic-Rich Facies and Hydrocarbon Source Rocks[END_REF][START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | Stratigraphic Control on Source-Rock Distribution: First and Second Order Scale[END_REF][START_REF] Van Buchem | Stratigraphic Patterns in Carbonate Source-Rock Distribution: Second-Order to Fourth-Order Control and Sediment Flux[END_REF][START_REF] Slatt | Comparative sequence stratigraphy and organic geochemistry of gas shales: Commonality or coincidence[END_REF]. Such integrated workflow gathering information on organic productivity, preservation and dilution at basin scale remains a challenge especially as geodynamic and climatic setting induce a large diversity of organic-rich deposits [START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | Stratigraphic Control on Source-Rock Distribution: First and Second Order Scale[END_REF].

Our work focuses on one of the largest unconventional play of Canada: the Montney and Doig Formations of the Lower and Middle Triassic interval (~ 252 -235 Ma) of Western Canada. The amount of data available due to an extensive oil and gas exploration in the area and the presence of time equivalent outcrops in the fold and thrust belt of the Canadian Cordillera, makes this interval an attractive case study to analyze OM distribution in sedimentary basins. This study is built on a database including core, cutting and outcrop descriptions and samples as well as wireline logs.

Geochemical and organic petrographical analyses (palynofacies, Rock-Eval, Major and Trace Metal Elements) were then performed on selected samples. Finally, the results were integrated in a

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT
sequence stratigraphic framework in order to discuss the main factors controlling the distribution of OM in the studied interval.

THE MONTNEY AND DOIG FORMATIONS

Generalities

The Montney, Doig and Halfway Formations are preserved in the foreland basin of the Canadian Cordillera and in time equivalent outcrops in its fold and thrust belt (figure 1). These Lower and Middle Triassic Formations have been studied since the 60's [START_REF] Armitage | Triassic Oil and Gas Occurrences in Northeastern British Columbia, Canada[END_REF]. The Montney and Doig Formations are mostly composed of fine-grained dolomitic sandstone and siltstone with subordinate amount of shale and moderate clay content (Davies, 1997a;Zonneveld et al., 2010;[START_REF] Chalmers | Geological evaluation of Halfway-Doig-Montney hybrid gas shale-tight gas reservoir, northeastern British Columbia[END_REF]Euzen et al., 2015). They were deposited on the western margin of Pangea (Davies et al., 1997). This location is considered as a passive margin during the Devonian and a foreland basin during the Jurassic. Doubts remain on the precise paleogeographic settings: foreland basin (Golding et al., 2015a) versus passive margin during the time of the deposition of the studied interval [START_REF] Monger | The Canadian cordillera: Geology and Tectonic Evolution[END_REF].

Stratigraphic settings and chronostratigraphy

The stratigraphic framework used in this paper is based on a recent regional sequence stratigraphic interpretation of the Lower and the Middle Triassic in the Western Canada Sedimentary Basin (e.g. Crombez, 2016). Based on more than 400 wells, it shows that the studied interval can be subdivided into two second-order sequences A and B and that sequence A can be further subdivided into three third order sequences 1, 2 and 3. Within sequence A, the maximum backstepping of the sedimentary system occurs during the second sequence (figure 2). Based on the biostratigraphic works of [START_REF] Orchard | The Lower Triassic Sulphur Mountain Formation in the Wapiti Lake area: lithostratigraphy, conodont biostratigraphy, and a new biozonation for the lower Olenekian (Smithian)[END_REF] and Golding et al. (2015b) [START_REF] Orchard | The Lower Triassic Sulphur Mountain Formation in the Wapiti Lake area: lithostratigraphy, conodont biostratigraphy, and a new biozonation for the lower Olenekian (Smithian)[END_REF]. Integrating these recent developments (Crombez, 2016) in [START_REF] Davies | The Lower Triassic Montney Formation, West-Central Alberta[END_REF] stratigraphic framework, the Montney Formation corresponds to sequence A. In this first second order sequence, sequence 1 can be considered as the Lower Montney, the sequence 2 as the Middle Montney and sequence 3 as the upper Montney whereas the Doig and Halfway Formations are part of sequence B. As the Montney Formation is interpreted as a second order cycle, the sequence 1 and the transgressive system tract (TST) 2 therefore represents a second order TST, the sequence 2 a second order HST and the sequence 3 a second order FSST (Crombez, 2016). From this work, as sequence B records the expression of a second order cycle, TST4 and HST4 can be considered as second order system tracts or third order sequences.

The figure 2 illustrates the position of the studied well and outcrop (restored location) sections within the stratigraphic framework of the basin. A recent study suggests that the Montney and Doig Formations were deposited in a fore-arc basin connected with the open marine setting to the Northwest (Rohais et al., 2016). The stratigraphic architecture of sequence A suggests a basin with a WNW-ESE axis and sedimentary inputs coming from East and Southeast. The distribution of thickness and facies in sequence B suggests a NW-SE basin axis with an additional sedimentary source to the West (Error! Reference source not found.). This change in sediment source areas and the clockwise rotation of the basin axis are interpreted to be linked to the evolution of the proto-Canadian Cordillera (Crombez, 2016;Rohais et al., 2016).

DATA AND METHODS

Data

For this study, data were collected from both outcrop in the Canadian Cordillera and subsurface in the foreland basin (figure 1). In Alberta, the cuttings from the Montney-Doig-Halfway intervals were sampled in 7 wells and in addition, 14 cores were also sampled. In British Columbia, the cuttings of the studied interval were sampled in 3 wells. Moreover, 4 cores including a 300m long core and one outcrop (Brown Hill, BH on figure 1) were sampled. In total, 365 samples collected from cores, 498

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT
from cuttings and 176 from outcrops were available for this work. The results of the present study is illustrated along a SE-NW section composed of 7 wells with cuttings sampled each 5-10m and a 300m long core, sampled each 5-10m, with additional constraints from both outcrops and subsurface (figure 1).

Methods

The workflow developed for this study unfolds as follow: (1) The characterization of the organic content in the studied interval, using Rock-Eval analyses (Espitalie et al., 1986;[START_REF] Behar | Rock-Eval 6 Technology: Performances and Developments[END_REF] and palynofacies study [START_REF] Tyson | Sedimentary organic matter: organic facies and palynofacies[END_REF]. ( 2) The study of the distribution of the organic rich layers in the stratigraphic framework. (3) The study of paleoenvironmental conditions through variations of major and trace element concentrations and mineralogy in order to highlight the dynamic of the primary productivity, the dilution by non-organic element and the O 2 levels along four sections [START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | The trace metal content of recent organic carbon-rich sediments: Implications for Cretaceous black shale formation[END_REF][START_REF] Tribovillard | Trace metals as paleoredox and paleoproductivity proxies: An update[END_REF][START_REF] Algeo | Environmental analysis of paleoceanographic systems based on molybdenum-uranium covariation[END_REF] and references herein).

Rock-Eval pyrolysis and hydrocarbons extraction

Routine source rock analyses were carried out on 900 samples with a Rock-Eval VI. The bulk-rock basic cycle, used for these routine analyses, is described by [START_REF] Behar | Rock-Eval 6 Technology: Performances and Developments[END_REF]. 50 to 70 mg of powdered sample is heated in an open pyrolysis system under non-isothermal condition (from 300 °C to 650 °C). During this pyrolysis, the amount of hydrocarbons released is measured by a flame ionization detector (FID) and CO and CO 2 release are monitored with an infrared (IR) detector. The residual sample is then put in an oxidation oven where it is heated (from 300 °C to 800 °C) under artificial air (N 2 /O 2 : 80/20). During this combustion, the amount of CO and CO 2 released are monitored with an IR detector.

In addition to the bulk-rock samples, organic solvent extraction was performed on selected samples.

The powdered sample was placed in a solution of dichloromethane and methanol (1/1) in an ultrasonic bath for 30 min. The sample was then filtered and placed in a drying oven for 30 min.

Finally the sample was analyzed with the basic Rock-Eval method described above.

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

Palynofacies

In addition to the source rock evaluation, palynofacies analyses were carried out on 26 selected samples. The preparation of the samples consists in the dissolution of 2 g of crushed rock in successive acid bath. The sample was placed in a cold solution of hydrochloric acid (70 %) for 180 min. After multiple rinsing, the residual sample was placed in a cold solution of hydrofluoric acid (70 %) for 180 min. Again, after multiple rinsing, the residual sample is place in a hot (40 °C) solution of hydrochloric acid (70 %) for 180 min. Finally, after multiple rinsing, the residual sample was sieved with a 15μm filter and the filtrate was mounted between two glass slides.

The slides were then observed with an optical microscope under different magnifications in order to classify the organic particles in three categories following the classification of [START_REF] Tyson | Sedimentary organic matter: organic facies and palynofacies[END_REF]: the amorphous organic matter (AOM), the phytoclasts and the palynomorphs.

Initial TOC computation

In order to better understand the distribution of organic matter at the time of deposition (before thermal maturation), Rock-Eval analysis and palynofacies were used to estimate the initial total organic carbon (TOC ini ). The equation (Equation Error! Reference source not found.1) used for the computation of the TOC ini is based on carbon mass balance and is similar to the formula proposed by [START_REF] Ingall | Influence of water column anoxia on the burial and preservation of carbon and phosphorus in marine shales[END_REF].

ini = × . ini (Equation 1)
This equation uses the total organic carbon (TOC), the free hydrocarbons (S1) and the oil potential (S2) from Rock-Eval analysis, and requires an estimation of the initial hydrogen index (HI ini ). The HI ini was estimated using the palynofacies analyses that provide insight into the nature and quality of the OM. The values of HI ini used in this study are 700 mgHC/gTOC for type I organic matter, 450 mgHC/gTOC for type II and 125 mgHC/gTOC for type III (Espitalié et al., 1986;[START_REF] Jarvie | Unconventional shale-gas systems: The Mississippian Barnett Shale of north-central Texas as one model for thermogenic shalegas assessment[END_REF].

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

Inductively Coupled Plasma Mass Spectrometry (ICP-MS) and Inductively Coupled Plasma Atomic Emission Spectrometry (ICP-AES)

Elementary analyses of samples from wells 0/14-14-76-12W6 and 0/06-33-72-25W5 and from Brown Hill outcrop were performed with an ICP-MS for trace elements and an ICP-AES for major elements.

Samples were powdered with an agate mortar beforehand. Then, 50 mg of sample was solubilized using a solution of hydrochloric acid (70 %) and a solution of boric acid (45 %). In order to dissolve entirely the OM, 2 ml of a hydrogen peroxide solution were added to the samples with a high TOC.

The residual samples were then diluted 10,000 times for the ICP-MS analyses and 1,000 for the ICP-AES analyses. International (ATHO-G from [START_REF] Borisova | Multi-Elemental Analysis of ATHO-G Rhyolitic Glass (MPI-DING Reference Material) by Femtosecond and Nanosecond LA-ICP-MS: Evidence for Significant Heterogeneity of B[END_REF] AGV-1, BCR-2, BH-VO2 and BIR-1 from the USGS) and in house standards were used and several duplicates were analyzed in order to control the accuracy of the measurements. A total of 244 samples were analyzed with this method.

Elementary analyses from well 0/16-17-83-25W6 were performed by ACT Labs following their 4A-4B protocols. A total of 138 samples were analyzed with this method. In the present work element concentration (ppm or %) refers to weigh ratios.

In order to investigate the vertical and the lateral variations of metal trace elements (MTE), the concentration of MTE was divided by the Aluminum content of the sample and normalized to the upper continental crusts (UCC) by computing an enrichment factors (EF) [START_REF] Taylor | Improved hydrocarbon charge prediction by source-rock modelling[END_REF][START_REF] Lord | Determination of trace metals in crude oil by inductively coupled plasma mass spectrometry with microemulsion sample introduction[END_REF]:

= [ ] [ ] !"#$% [ ] [ ] & ' (Equation 2)
With EF E the enrichment factor of E; [E] the atomic concentration of E (ppm) and [Al] the concentration of aluminum (ppm).

Mineralogical analyses

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT
In addition to core and outcrop descriptions, cuttings from one well were sampled in order to quantify the mineralogy of the Triassic strata. QEMSCAN analyses [START_REF] Gottlieb | Using quantitative electron microscopy for process mineralogy applications[END_REF] were performed by SGS Canada Inc. on 72 samples. QEMSCAN automated mineralogical analysis is based on backscattered-electron imaging and energy dispersive X-ray spectroscopy techniques.

Weathering index of Parker (WIP) and chemical index of alteration (CIA)

Based on elemental major element concentrations, the weathering index of parker (WIP, Parker, 1970) and the chemical index of alteration (CIA, [START_REF] Nesbitt | Early Proterozoic climates and plate motions inferred from major element chemistry of lutites[END_REF] provide information on the maturity of siliciclastic sediments:

()* = + [,-] * . / + [12] * .3 + [4] * . / + [ -] * .5
6 × 100 (Equation 3)

)9 = + [ : ; ] [ : ; ] [,-: ] [4 : ] [ -]

6

(Equation 4)

Where [E] is the atomic concentration of E (ppm) and [E]* represent the atomic concentration of an element divided by its atomic weight. In order to reflect chemical variations associated with climatic changes and the weathering of siliciclastic minerals, the [Ca] and [CaO] values used in the equation 3 and 4 were corrected for each samples to remove the effect of carbonate minerals using QEMSCAN analysis. WIP and CIA indexes were only calculated on one well where both elemental analysis and QEMSCAN data were available on the same samples (0/14-14-76-12W6). Furthermore, the sodium (Na) concentration was not measured on this well, but the impact of Na on these indexes is likely negligible based on its low concentration in other wells of this study (average of 0.8% in well 0/16-17-83-25W6).

RESULTS

Characterization of the organic content

Rock-Eval analyses

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT
Most of the studied samples have Rock Eval TOC values ranging between 0.25 and 1.75 wt%, with a mean TOC of 1.28 wt% (see figure 7). However locally, organic-rich intervals present TOC higher than 4 wt% in the Montney Fm. and can reach up to 13 wt% in the Doig phosphate zone (TST4). The wide range of Tmax (from 397 to 479 °C) of our dataset is globally consistent with published vitrinite reflectance data [START_REF] Rokosh | Summary of Alberta's Shale-and Siltstone-Hosted Hydrocarbon Resource Potential[END_REF][START_REF] Romero-Sarmiento | Artificial thermal maturation of source rocks at different thermal maturity levels: Application to the Triassic Montney and Doig Formation in the Western Canada Sedimentary Basin[END_REF] and suggests NE-SW increasing maturity trend from immature to overmature. The wide range of maturity may induce an under or over estimation of the in-situ TOC. Indeed, the dysmigration of the generated HC will lead to the underestimation of the TOC whereas the contamination by migrated HC will lead to the overestimation of the TOC. Rock-Eval pyrolysis results of the low maturity samples show that most of the HI values fall between 150 and 450 mgHC/gC. This observation suggests that the OM found in the Montney and Doig Formations is mainly of Type II and Type III (figure 3).

Detailed analysis of Rock-Eval pyrograms shows that the S2 peak often presents a shoulder during the beginning of the temperature increasing (between 300 °C and 450 °C, figure 4). This shoulder can be interpreted in two different ways: there are two types of kerogen in the sample, or there is a presence of heavy hydrocarbons [START_REF] Grundman | Evaluation of hydrocarbon potential of the Paleozoic (Cambrian-Devonian) source rocks of the Gaspé Peninsula, Québec, Canada: Geochemical characterization, expulsion efficiency, and erosion scenario[END_REF]. Figure 4 presents the pyrogram of both bulk-rock (BR) and extracted bulk-rock (eBR) samples. The analysis of both bulk-rock and extracted sample shows that the S2 is composed of both soluble and non-soluble OM, likely representing respectively heavy hydrocarbons and primary kerogen (figure 4). According to the work of [START_REF] Behar | Role of NSO compounds during primary cracking of a Type II kerogen and a Type III lignite[END_REF] and considering the low maturity of this sample (Tmax = 439 °C), those heavy hydrocarbons may come from the early cracking of the kerogen.

Palynofacies studies

The investigated samples contain mainly AOM (figure 5). In the analyzed samples, only a small proportion of the OM derives from woody and terrestrial debris, regardless of the sedimentary facies from undamaged particles to AOM suggests that the AOM was more likely derived from marine rather than terrestrial sources [START_REF] Tyson | Sedimentary organic matter: organic facies and palynofacies[END_REF].

Distribution of the organic content in the stratigraphic framework

TOC and TOC ini in the stratigraphic framework

The Rock-Eval results show that the two samples with the lowest maturity present high to moderate HI (respectively 549 and 373 mgHc/gTOC). This is consistent with of a good Type II marine kerogen and a fair Type II/III kerogen. The palynofacies analyses paired with the Rock-Eval measurements suggest that regardless of the sedimentary facies, the AOM mainly derives from marine sources, typically having an initial HI (HI ini ) between 350 and 600 mgHC/gTOC. These two values were used to compute a maximum and a minimum value of TOC ini . In low maturity areas (Tmax < 450°C), the computed TOC ini values likely reflect the initial organic content of the sediment. On the other hand, in more mature areas (Tmax > 450°C), TOC ini computation can be affected by the secondary cracking of migrated oil. Figure 6 and 7 illustrate that sequence 3 and TST4 are the two main organic-rich intervals of this succession based on TOC ini computation. In low maturity areas TOC ini is close to present day TOC, whereas in more mature areas, TOC ini can be up to twice as high as present day TOC (with HI ini = 600).

The vertical distribution of TOC values within the stratigraphic framework highlight major differences between sequences (figure 6 and7). Sequences 1 and 2 have low background present day TOC (respectively 1.3 and 0.9 wt% on average), with localized organic-rich intervals up to about 3 wt% (figure 7). Sequence 3 has higher background TOC (average of 2.2 wt%) and fewer low TOC values (<1 wt%) than sequence 1 and 2. TOC ini values can reach up to 9 wt% in LST3. The base of Sequence 4 is the richest interval in OM, with TOC ini up to 14% (TST4=phosphate zone), but the rest of sequence 4 is organic-lean (average of 1.1wt%). The two main organic-rich intervals LST3 and TST4 show contrasting spatial distributions of the OM:

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT
In LST3, the organic content increase in the deeper central part of the basin at that time (offshore environment).

In TST4, TOC increase towards both margins of the basin (well 0/16-17-83-25W6 and 07-14-74-06W6 on figure 6) while lower values are observed toward the axis of the basin (well 0/14-14-76-12W6 on figure 6).

Sedimentology of organic rich intervals

In this section, we illustrate the sedimentological features of the organic-rich intervals of sequence 3 and 4. Figure 8 presents a synthetic sedimentary section from the sequence boundary 3 (SB3) up the maximum flooding surface 4 (MFS4). This interval dominantly consists of wave-dominated deposits, from offshore (bathymetry ≈ 200 m) to shoreface depositional environments (figure 8, Crombez, 2016). In both sequences, organic-rich intervals correspond to offshore depositional environments.

Sequence 3 presents a thick continuous interval of prograding deposits from offshore to lower shoreface (e.g. from 2380 to 2260 m on figure 8) whereas TST4 consists of thinly interbedded offshore and offshore transition deposits (e.g. from 2255 to 2240 m on figure 8). In sequence 3, the high TOC intervals are associated with pyrite and phosphate grains, but with only rare bioturbations (from 2380 to 2320 m on figure 8). In contrast, organic-rich layers in TST4 are associated with erosive lags, shell debris as well as pyrite and phosphate grains whereas bioturbations are present in the coarse-grained interbedded shallower deposits (from 2255 to 2240 m on figure 8). These differences suggest that the organic rich offshore deposits of TST4 are shallower than the offshore deposits of sequence 3

Vertical and lateral variation of the sediment rates

Sequence stratigraphic surfaces provide time lines across the basin (Crombez, 2016) and allowed for the computation of average sedimentation rates (SR) in the studied intervals. The sequence A was deposited during the lower Triassic (approximately 5 My) and the sequence B during the Middle Triassic (approximately 8 My).

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

The figure 9 presents a cross-plot of the distribution of TOC ini versus the SR in the third order sequences along 8 sections. It shows that sequence B presents lower sedimentation rates (SR < 6 cm/ka) than sequence A (SR < 16 cm/ka). More precisely it shows that sequences 1 to 3 present increasing average sedimentation rates (average SR from 4 cm/ka to 12 cm/ka) whereas HST4 present lower sedimentation rates than TST4 (respectively average SR: 2 cm/ka and 3 cm/ka). On figure 9, the sequences 1 and 2 present decreasing TOC ini concentration (from 3 to 0.2 wt%) with increasing SR (from 16 to 4 cm/ka). The sequence 3 presents a similar evolution but with a steepest trend (TOC ini from 7 to 3 wt% and SR from 12 to 16 cm/ka). The TST4 does not present a clear relation between TOC ini accumulation and SR. On one side, the figure 9 presents high TOC ini (up to 15 wt%) associated with the highest SR of the TST4 (4 cm/ka) and on the other side it shows decreasing TOC ini (from 2.5 to 0 wt%) with increasing SR (from 1 to 2 cm/ka). Lastly HST4 presents an increasing then decreasing TOC ini (from 1 to 2.5 wt% then from 2.5 to 0 wt%) with increasing SR (from 0.3 to 4 cm/ka). [START_REF] Tyson | Sedimentation rate, dilution, preservation and total organic carbon: some results of a modelling study[END_REF] highlighted the impact of SR on OM accumulation. On one side, this study showed that, in oxic environments, a range of SR (from 2 to 20 cm/ka) is increasing OM preservation. In oxic intervals, the impact of the SR results in an increasing then decreasing TOC concentration with a maximum accumulation above 5 cm/ka. The cross-plots of sequences 1, 2 and of the HST4 highlight the direct impact of organic particles dilution: sequences 1 and 2 only present the decreasing TOC ini whereas the HST4 presents both the increasing and decreasing trends linked to the ideal sedimentation rates interval. On the other side, in anoxic environments the preservation of the organic matter is assured and an increasing SR will only decrease the TOC [START_REF] Tyson | Sedimentation rate, dilution, preservation and total organic carbon: some results of a modelling study[END_REF]. The rapid increase of the TOC ini in the Seq 3 and the complex relation between TOC ini and SR in TST4 suggest that organic matter accumulation in TST4 and sequence 3 is not solely controlled by the dilution but by a complex combination of primary productivity, preservation and dilution.

Trace metal element variations

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

Copper (Cu) and Nickel (Ni) variations

Organic productivity can be studied through several proxies, including Cu and Ni which are micronutrients assimilated by the micro and macro-organisms [START_REF] Calvert | Geochemistry of Namibian Shelf Sediments[END_REF][START_REF] Calvert | Geochemistry of Recent oxic and anoxic marine sediments: Implications for the geological record[END_REF]Whitfield, 2001;[START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | The trace metal content of recent organic carbon-rich sediments: Implications for Cretaceous black shale formation[END_REF][START_REF] Tribovillard | Trace metals as paleoredox and paleoproductivity proxies: An update[END_REF][START_REF] Schoepfer | Total organic carbon, organic phosphorus, and biogenic barium fluxes as proxies for paleomarine productivity[END_REF]. In the present study, the vertical evolution of Ni/Al and Cu/Al are chosen to reflect the variations of nutrients input in the basin which may be associated with primary organic productivity variations (Whitfield, 2001;[START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | The trace metal content of recent organic carbon-rich sediments: Implications for Cretaceous black shale formation[END_REF][START_REF] Tribovillard | Trace metals as paleoredox and paleoproductivity proxies: An update[END_REF] The figure 10 The figure 11 presents the vertical evolution of Cu/Al and Ni/Al along the four sections. In these sections, Cu/Al ranges from 3.10 -4 to more than 30.10 -4 whereas Ni/Al ranges from 5.10 -4 to 55.10 -4 .

0/16-17-83-25W6:

In sequences 1 and 2, both ratios show little variations and stay low (Cu/Al ≈ 5.10-4 and Ni/Al ≈ 7.5.10-4), slightly higher than the Upper crust average (Cu/Al = 3.1.10-4 and Ni/Al = 5.5.10-4).

Sequence 3 records a small increase in Cu/Al (from 5.10-4 to 6.10-4) and in Ni/Al (from 7.5.10-4 to 11.10-4). In contrast, sequence 4 shows high Ni/Al and Cu/Al ratios (Cu/Al > 20.10-4 and Ni/Al > 25.10-4). These higher concentrations of Cu and Ni in TST4 are associated with high TOC value.

0/14-14-76-12W6:

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT
In this section, TST4 shows a strong increase of Ni/Al ratio from 7.5.10 -4 to 50.10 -4 and a slight increase of Cu/Al ration from 5.10 -4 to 9.10 -4 . No other significant variations are present along this section (Cu/Al ≈ 5.10 -4 and Ni/Al ≈ 7.5.10 -4 ).

0/06-33-72-25W5:

This section shows low values for both ratios (Cu/Al ≈ 5.10 -4 and Ni/Al ≈ 7.5.10 -4 ), consistent with a more proximal depositional setting dominated by detrital inputs.

Brown Hill:

In sequences 1 and 2, the low Cu/Al and Ni/Al (respectively 6.10 -4 and 8.10 -4 ) are punctuated by peaks of higher Cu/Al (up to 22.10 -4 ). Along this section, the highest peaks of both ratios are not linked to an important concentration of Ni and Cu but to a very low concentration of Al, it is therefore an artifact of normalization.

Interpretation:

On the four sections, the only significant increase in Cu/Al and Ni/Al ratios occurs during TST4, suggesting a strong increase in organic paleoproductivity during this interval. High amplitude variations of both ratios in this interval also highlight cyclic fluctuations of paleoproductivity during TST4. It is important to note that the increase of the authigenic Ni and Cu occurred after a sharp drop of the sedimentation rates across the boundary between sequence A and B. Even though HST4 present low Ni/Al and Cu/Al ratios, the influence of low sedimentation rates on TST4 enrichment cannot be ruled out. However, it is also worth noting that both Cu and Ni concentrations are positively correlated to Al during sequence A, whereas no such relations were observed in TST4. This evidence supports the hypothesis of a change of nutrient source between sequence A and B, with an increase of primary productivity during TST4. In sequence 3, the small increase of Ni and Cu concentration can be either linked to a small increase of the primary productivity or to a better preservation of the OM (confirmed by U/Th and Mo/Al proxies) at the water sediment interface that will induce a lower recycling of the nutrients included in the OM [START_REF] Riquier | Understanding Late Devonian And Permian-Triassic Biotic and Climatic Events -Towards an Integrated Approach[END_REF].

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

Uranium (U), Molybdenum (Mo) and Vanadium (V) variations

Some trace elements present in the water are sensitive to redox condition (e.g. U, Mo, V and Ce) and provide information on the oxygen and sulfur content in the water at the time of the deposition [START_REF] Emerson | Ocean anoxia and the concentrations of molybdenum and vanadium in seawater[END_REF][START_REF] Calvert | Geochemistry of Recent oxic and anoxic marine sediments: Implications for the geological record[END_REF][START_REF] Crusius | Rhenium and molybdenum enrichments in sediments as indicators of oxic, suboxic and sulfidic conditions of deposition[END_REF][START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | The trace metal content of recent organic carbon-rich sediments: Implications for Cretaceous black shale formation[END_REF][START_REF] Algeo | Mo-total organic carbon covariation in modern anoxic marine environments: Implications for analysis of paleoredox and paleohydrographic conditions[END_REF][START_REF] Tribovillard | Trace metals as paleoredox and paleoproductivity proxies: An update[END_REF][START_REF] Algeo | Environmental analysis of paleoceanographic systems based on molybdenum-uranium covariation[END_REF].

The figure 12 presents a cross-plot of the U/Th and V/Cr ratios from four different sections across the basin. In these ratios, the redox-sensitive elements (U and V) are normalized to Th and Cr which are both assumed to be linked to detrital inputs. These ratios therefore present the authigenic variation of U and V that are linked to anoxic episodes. These cross-plots show a link between the ratios and the TOC content along wells 0/16-17-83-25W6 and 0/14-14-76-12W6: samples with high ratios present the highest TOC. These cross-plot also show that sequence 1 and 2 present higher oxygen content (U/Th < 0.75 and V/Cr < 2) than sequence 3 and part of sequence 4 (most of U/Th > 0.75 and V/Cr > 2).

The figure 13Error! Reference source not found. presents the vertical evolution of U/Th and Mo/Al along four sections. In the four sections, U/Th ranges from 0.3 to 4.5 whereas the Mo/Al ranges from 1.10 -4 to 24.10 -4 .

0/16-17-83-25W6:

From SB1 up to MFS2, both ratios stay low (U/Th ≈ 0.3and Mo/Al ≈ 1.10 -4 ). The interval between MFS2 and SB3 shows an increase, then a decrease of U/Th and Mo/Al ratios (U/Th: from 0.3 up to 1.25 down to 0.3 and Mo/Al: from 1.10 -4 up to 7.5.10 -4 down to 1.10 -4 ). In sequence 3 the interval presents moderate U/Th (> 0.75) and high Mo/Al (> 5.10 -4 ) that seems to oscillate with no correlation with the transgressive and regressive trends of the sedimentary system. Lastly in the TST4, U/Th and Mo/Al both show significant increases (U/Th: from 0.3 up to 4.5; Mo/Al: from 2.10 -4 up to 25.10 -4 ).

0/14-14-76-12W6:

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT
Along this section, U/Th and Mo/Al mainly present low values (U/Th < 0.75 and Mo/Al < 5.10 -4 ) except in the TST4 where both ratios increase significantly (up to U/Th ≈ 2.25 and Mo/Al < 15.10 -4) .

0/06-33-72-25W5:

On this section no significant increase of both ratios are present (U/Th < 0.75 and Mo/Al < 5.10 -4 )

Brown Hill:

As for the 0/06-33-72-25W5, both proxies along Brown Hill section show very low values. The only high values of both ratios are linked to very low concentration of Al or Th.

Interpretation:

Figures 12 and 13 present sedimentary records of redox sensitive elements. These figures suggest that the water column was oxic to dysoxic during sequence 1 and 2. In sequence 2, the small increase then decrease of the U/Th and Mo/Al ratios is interpreted as the development of small anoxic puddle in the deepest part of the basin. Above SB3, redox sensitive trace elements suggest variations of O 2 concentrations in the water column and the occurrence of dysoxic to anoxic layers in the deepest part of the basin (located near the well 0/16-17-83-25W6 at that time). In this sequence, the high concentration of Mo suggests that water/sediment interface may contain H 2 S [START_REF] Jones | Comparison of geochemical indices used for the interpretation of palaeoredox conditions in ancient mudstones[END_REF]. In sequence 4, due to the geodynamic evolution and the changes in the basin physiography, the well 0/16-17-83-25W6 present more proximal deposits. In the TST4, the high U/Th and Mo/Al ratios show the occurrence of anoxic to euxinic conditions. In this interval, O 2 -depleted and possible H 2 S enriched conditions took place along the more proximal areas. As already mentioned for Ni/Al and Cu/Al ratios, the drop of sedimentary fluxes across the boundary between sequence A and B may influence the dilution of authigenic molybdenum and uranium. However, when corrected from dilution effect based on computed sedimentation rates (dilution 4 times lower in sequence B compared to sequence A), U/Th and Mo/Al ratios are still characteristic of anoxia (respectively 1 and 5.10 -4 ).

Molybdenum (Mo) and TOC variations

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

Changes in basin restriction can be investigated thanks to molybdenum and TOC covariations. Figure 14 presents molybdenum versus TOC cross-plot along four sections. On these cross plots, TOC values range from 0 to 15.2 wt%, with the maximums located in the sequence 4 and, the molybdenum concentration ranges from 0 to 101.6 ppm with the maximums located in the sequence 3. The TOC and Mo concentrations from wells 0/14-14-76-12W6 and 0/06-33-72-25W5 and from Brown Hill In restricted basin, due to low water and molybdenum reservoir renewal, the Mo/TOC ratio generally stays low (< 15) whereas in open marine settings, due to the water circulation, the Mo/TOC ratio is relatively high (> 60). The cross-plots of figure 14 show that regardless of the well and the sequence, samples always presents relatively low Mo/TOC ratios (< 35) which tend to highlight a moderately to highly restricted basin [START_REF] Algeo | Mo-total organic carbon covariation in modern anoxic marine environments: Implications for analysis of paleoredox and paleohydrographic conditions[END_REF]. The cross-plots of 0/14-14-76-12W6, 0/06-33-72-25W5 and Brown Hill sections are consistent with figure 13: anoxia proxies (U/Th, V/Cr and Mo/Al) do not highlight major anoxic event along those three sections excepted in the early sequence 4 of the 0/14-14-76-12W6 well which induced a low concentration of Mo. Along the well 0/16-17-83-25W6, the interpretation of the basin restriction evolution between sequence A and sequence B must be done with caution: firstly only some intervals of sequence 3 and the TST 4 present anoxia.

Secondly, the significant drop of the sedimentary supply across the boundary between sequence 3 and 4 (see figure 9) may also impact the concentration of Mo and the TOC. In order to remove this impact, Mo and TOC values from sequence 4 were divided by 4. (which represents the average

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

sedimentary supply decrease between sequence A and B, Crombez, 2016). This correction puts the sequence 4 samples in the lower left side (with sequences 1 and 2) of the cross plot in an area where a restriction is uncertain. All these observation tends to show that both sequence A and B were deposited in a restricted basin, that may be more restricted in sequence 3 that in the other sequences.

Weathering index of Parker (WIP) and chemical alteration index (CIA) variations

Figure 15 presents a cross-plot of the WIP and CIA along the 0/14-14-76-12W6. On this figure, the WIP ranges from, 20 to 80 but most of the samples are comprised between 35 and 50 whereas the CIA ranges from 45 to 85. This figure does not show any maturity trend along the four sequences.

Sediment maturity trend are likely to reveal climatic evolution of an area (Parker, 1970;[START_REF] Nesbitt | Early Proterozoic climates and plate motions inferred from major element chemistry of lutites[END_REF][START_REF] Bahlburg | Chapter 6 A review of the Chemical Index of Alteration (CIA) and its application to the study of Neoproterozoic glacial deposits and climate transitions[END_REF], the cross plot presented in figure 15 suggests that no major climatic changes took place over the western Canada sedimentary basin during the Lower and Middle Triassic.

DISCUSSIONS

In the following section, we discuss the source of OM in the Montney and Doig Formations, the spatial and temporal variations of controlling factors on the accumulation and preservation of this OM and finally, their relationship with relative sea level variations and the basin physiography.

Organic matter in the Montney and Doig Formations

Rock-Eval analyses show that the OM in the Montney and Doig Formation represents Type II/III source rocks (figure 3), which is consistent with the studies of [START_REF] Riediger | Lower and Middle Triassic source rocks, thermal maturation, and oil-source rock correlations in the Peace River Embayment area, Alberta and British Columbia[END_REF][START_REF] Riediger | Geochemistry of Potential Hydrocarbon Source Rocks of Triassic Age in the Rocky Mountain Foothills of Northeastern British Columbia and West-Central Alberta[END_REF]. In the Montney and Doig Formations, two intervals present significant enrichment in OM: the sequence 3 (Upper Montney) and the TST4 (Doig phosphate) which is also consistent with previous studies [START_REF] Ibrahimbas | Hydrocarbon source rock potential as determined by Rock-Eval 6/TOC pyrolysis, northeast British Columbia and Northwest Alberta, Resource Development and Geosciences Banch[END_REF].

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

Our Rock-Eval analyses data on extracted, low maturity samples, confirm the presence of kerogen in the studied samples (figure 4) whereas palynomorphs analyses (figure 5), show that this primary OM derives from planktonic sources. Lastly, the analysis of trace elements shows the occurrence of Cu, Ni, U and Mo enrichments in the Montney and Doig Formations. In the present work, these enrichments are interpreted to be linked to redox conditions and/or primary productivity variations [START_REF] Tribovillard | Trace metals as paleoredox and paleoproductivity proxies: An update[END_REF]. As crude oil contains important concentration of trace metal elements [START_REF] Lord | Determination of trace metals in crude oil by inductively coupled plasma mass spectrometry with microemulsion sample introduction[END_REF][START_REF] Duyck | Trace element determination in crude oil and its fractions by inductively coupled plasma mass spectrometry using ultrasonic nebulization of toluene solutions[END_REF], the enrichments that are highlighted in sequence 3 could also be linked to bitumen associated with secondary cracking of migrated oil. In the present study, we were unable to establish a clear relation between TOC concentration and the trace metal element concentrations, or the Al-normalized concentration of those elements and the TOC. It is therefore unlikely that all the organic content in the Montney Formation comes from migrated hydrocarbons.

In the present work, the study of Rock-Eval S1 values does not allow for the recognition of good conventional reservoir intervals. In the Montney and Doig Formations, average S1 value is low (< 0.4 mgHC/gRock) and high S1 values within low maturity areas, which correspond to good conventional reservoir, are absent. Recent works of [START_REF] Sanei | Effects of nanoporosity and surface imperfections on solid bitumen reflectance (BRo) measurements in unconventional reservoirs[END_REF] and [START_REF] Sanei | Effects of nanoporosity and surface imperfections on solid bitumen reflectance (BRo) measurements in unconventional reservoirs[END_REF] concluded that most of the organic content in the Montney Formation derives from migrated hydrocarbons. In their studies, the most part of the organic content in the Montney Formation is considered to be pyrobitumen, resulting from the secondary cracking of migrated oil. Regarding the low maturity (Tmax < 450) of the primary organic matter in some part of the basin and the very low permeability of the Montney and Doig Formation (< 0.01 mD, [START_REF] Chalmers | Geological evaluation of Halfway-Doig-Montney hybrid gas shale-tight gas reservoir, northeastern British Columbia[END_REF], it is unlikely that the organic matter is coming from the secondary cracking of a migrated bitumen (due to the le permeability) or from the secondary cracking of a light oil (due to the low thermic maturity). Our study does not question the presence of pyrobitumen in the Montney-Doig Formations, but it also emphasizes the occurrence of primary kerogen in this interval. Analysis of the elementary proxies shows that the sequence 3 and part of sequence 4 present propitious redox conditions and primary productivity for source rocks development, whereas sequences 1 and 2 present less conductive

Spatial variations and temporal evolution of primary productivity, anoxia and dilution and their impacts on organic matter distribution

Recent works [START_REF] Sageman | A tale of shales: the relative roles of production, decomposition, and dilution in the accumulation of organic-rich strata, Middle-Upper Devonian, Appalachian basin[END_REF][START_REF] Bohacs | Production, destruction, and dilution-the many paths to sourcerock development[END_REF][START_REF] Katz | Controlling Factors on Source Rock Development-A Review of Productivity, Preservation, and Sedimentation Rate[END_REF] showed that the organic richness of sedimentary rocks is controlled by a combination of three mains factors: (1) the primary organic production by flora and fauna, (2) its dilution by non-hydrogenated particles and (3) its preservation. [START_REF] Bohacs | Production, destruction, and dilution-the many paths to sourcerock development[END_REF] showed that a high productivity combined with a low dilution rates is not the most efficient way to produce and preserve an organic rich rock. Indeed, an extremely high planktonic productivity will dilute the organic content in the tests of the micro-organisms and a low SR will minimize the burial efficiency and will allow a higher bacterial degradation and oxidation at the water sediment interface and therefore lead to weak preservation.

In the present study, the palynofacies analyses mostly revealed AOM coming from marine planktonic faunas. In a sedimentary basin, the OM can be degraded or destructed by various processes occurring in the water column and in the first centimeters below the water-sediment interface [START_REF] Demaison | Anoxic Environments and Oil Source Bed Genesis[END_REF][START_REF] Southam | Dynamics of anoxia[END_REF][START_REF] Einsele | Sedimentary basins: evolution, facies, and sedimentary budget[END_REF][START_REF] Calvert | Influence of water column anoxia and sediment supply on the burial and preservation of organic carbon in marine shales[END_REF]: (1) In the production areas, the OM produced by micro-organisms can be consumed and recycled by macroorganisms (Eppley and Peterson, 1979). However assuming that the macro organisms also produce OM, this phenomenon only has a small impact on the total OM production.

(2) While settling through the water column, the OM can be oxidized and therefore degraded by the oxygen present in the water [START_REF] Karl | Downward flux of particulate organic matter in the ocean: a particle decomposition paradox[END_REF][START_REF] Wakeham | Production, Transport, and Alteration of Particulate Organic Matter in the Marine Water Column[END_REF]. Therefore, at a constant production rate, the OM is better preserved in anoxic or dysoxic water [START_REF] Cowie | The role of anoxia in organic matter preservation in coastal sediments: relative stabilities of the major biochemicals under oxic and anoxic depositional conditions[END_REF][START_REF] Canfield | Organic Matter Oxidation in Marine Sediments[END_REF]. However, if production is high enough, sinking OM consume all the oxygen leading to the creation of Oxygen Minimum Zone (OMZ) and the preservation of the remaining OM [START_REF] Southam | Dynamics of anoxia[END_REF] (3) In the first centimeter below the water/sediments interface, rapid degradation of the OM takes place as long as oxygen is present. The occurrence of macroorganism in oxic sediments results in bio-degradation of the OM present in the sediments [START_REF] Ingall | Influence of water column anoxia on the burial and preservation of carbon and phosphorus in marine shales[END_REF]. Most of OM degradation will stop a few centimeters below the water/sediments interface due the depletion in oxygen in the buried layers (Wenzhofer and Glud, 2002). Globally, the preservation of OM is highly linked to the oxygen content in the water and sediments.

Basin scale variations of primary productivity, anoxia and dilution

The relative contribution of the three main factors (production-dilution-preservation) controlling initial TOC of sediment can be estimated by integrating sequence stratigraphy interpretation with trace element analysis. Based on trace elements analyses from wells 0/16-17-83-25W6; 0/14-14-76-12W6 and 0/06-33-72-25W5 and based on the Rock-Eval analyses of five additional wells, the figure 16 presents an interpretation of the vertical and the lateral variations of the factors that drive organic richness in sedimentary rocks. It confirms that there is no simple relation between SR (dilution) and the organic content in the studied interval. [START_REF] Tyson | Sedimentation rate, dilution, preservation and total organic carbon: some results of a modelling study[END_REF] concluded that SR close to 5 cm/ka may enhance the concentration of the OM which is observable in sequence 1, 2 and the HST4 (figure 9).

On the figure 16, it is apparent that local OM enrichment occurs near MFS or parasequence flooding surfaces, similar to trends observed by [START_REF] Creaney | Recurring Patterns of Total Organic Carbon and Source Rock Quality within a Sequence Stratigraphic Framework[END_REF]. However, a low SR alone cannot explain the organic enrichment of condensed layer, indeed low burial efficiency resulting from a low SR will promote the degradation of OM [START_REF] Tyson | Sedimentation rate, dilution, preservation and total organic carbon: some results of a modelling study[END_REF][START_REF] Bohacs | Production, destruction, and dilution-the many paths to sourcerock development[END_REF][START_REF] Katz | Controlling Factors on Source Rock Development-A Review of Productivity, Preservation, and Sedimentation Rate[END_REF]. In the studied interval, small increases of anoxia proxies are commonly associated with organic rich intervals, suggesting occurrence of small anoxic puddles, most likely linked to basin floor physiography. Local and punctual enrichment would therefore be linked to a combination of starved intervals and local anoxic layers [START_REF] Algeo | Paleoceanographic applications of trace-metal concentration data[END_REF].

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

Figure 16 illustrates that low to moderate organic productivity, mainly oxic water (85% of the U/Th ratio < 0.75, [START_REF] Jones | Comparison of geochemical indices used for the interpretation of palaeoredox conditions in ancient mudstones[END_REF]) and high sedimentation rates prevailed during sequence 1 and 2, regardless of the position along the depositional profile. In this interval, rare TOC peaks are present and are interpreted to be associated with either local dysoxic to anoxic episodes (U/Th ratio increase) or punctual decrease SR (e.g. near MFS). Above sequence 1 and 2, figure 16 shows a major change in the paleo-redox conditions. At that time the oxic to dysoxic water of sequence 2 turns into dysoxic to anoxic water marked by an increase of U/Th and Mo/Al ratios [START_REF] Emerson | Ocean anoxia and the concentrations of molybdenum and vanadium in seawater[END_REF][START_REF] Tribovillard | Enhanced trapping of molybdenum by sulfurized marine organic matter of marine origin in Mesozoic limestones and shales[END_REF][START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | The trace metal content of recent organic carbon-rich sediments: Implications for Cretaceous black shale formation[END_REF]. These anoxic conditions are clearly present in the deepest part of the basin, in offshore facies and are weaker in the shoreface facies on the edges on the basin (figure 16). This major change of the water's oxygen content is not interpreted to be associated with an important variation of primary productivity. Indeed, the small increases in Cu/Al ratio observed on the 0/16-17-83-25W6 are interpreted to be linked to the better preservation of the OM [START_REF] Riquier | Understanding Late Devonian And Permian-Triassic Biotic and Climatic Events -Towards an Integrated Approach[END_REF]. In sequence 3, the organic-rich deposits are located in the central part of the basin where oxygen content is minimum (figure 16). In this interval, the fluctuation of anoxic conditions are associated with the progradation and backstep of the depositional system.

Above this anoxic episode, the figure 16 shows for the first time an important increase of primary productivity associated with anoxic water marked by important increase of Cu/Al, Ni/Al, U/Th and Mo/Al ratios [START_REF] Tribovillard | Enhanced trapping of molybdenum by sulfurized marine organic matter of marine origin in Mesozoic limestones and shales[END_REF][START_REF] Algeo | Mo-total organic carbon covariation in modern anoxic marine environments: Implications for analysis of paleoredox and paleohydrographic conditions[END_REF][START_REF] Tribovillard | Trace metals as paleoredox and paleoproductivity proxies: An update[END_REF]. In this interval, organic rich deposits are located in periphery of the basin. Unlike in sequence 3, anoxia is strongest at the edges of the basin and alternate with dysoxic periods, suggesting the onset of an OMZ, triggered by the high primary productivity at sea surface. Above the MFS4, the basin returns to similar conditions as in sequence 1 and 2: low to moderate productivity and high oxygen content in the water, leading to low production and poor preservation of OM (figure 16).

Models for organic-rich rocks deposition

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

In this study, we highlight four main stages characterized by contrasted depositional dynamics that result in different temporal and spatial distributions of OM in the basin:

-Sequence 1 and 2: oxic water and low paleoproductivity.

-Sequence 3: dysoxia/anoxia takes place in the deepest part of the basin.

-TST4: the anoxia is associated with an increase of paleoproductivity on the basin margins.

-Above MSF4, the basin returned to its initial condition: oxic water associated with a low productivity.

Based on these observations we propose a model for the deposition of the organic-rich layer in the Montney and Doig Formations (figure 17). These models split the investigated interval in 3 conceptual basin types: Type 1: an oxic basin, that prevailed during sequence 1 and 2 and HST4. Type 2: a restricted basin that is representative of the sequence 3. Type 3: a high primary productivity basin that is diagnostic of the TST4.

During sequence 1, 2 as well as HST4, the low primary productivity along the coast, the high oxygen content in the water lead to limited organic accumulation in the basin (figure 16 and 17 A).

In sequence 3, a restriction of the connection between the open marine settings and the basin due to low relative sea level induced a decrease of water circulation and therefore a stratification of the water column that to the development of anoxia in the deepest part of the basin (figure 16 and 17 B, [START_REF] Demaison | Anoxic Environments and Oil Source Bed Genesis[END_REF][START_REF] Huc | Aspects of depositional processes of organic matter in sedimentary basins[END_REF][START_REF] Arthur | Marine Black Shales: Depositional Mechanisms and Environments of Ancient Deposits[END_REF][START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | The trace metal content of recent organic carbon-rich sediments: Implications for Cretaceous black shale formation[END_REF][START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript Algeo | Modern and ancient epeiric seas and the super-estuarine circulation model of marine anoxia. Dynamics of Epeiric seas: sedimentological, paleontological and geochemical perspectives[END_REF][START_REF] Algeo | Paleoceanographic applications of trace-metal concentration data[END_REF]. The stratification is supposed to take place below the storm weather wave base (SWWB) where water mixing is limited. This stratification associated with a primary productivity similar to sequence 1 and 2 allows for the preservation of produced OM transported in the deepest part of the basin. On the edges of the basin, where the bathymetry does not go below the SWWB, OM is poorly preserved (figure 16).

This study highlighted an increase in primary productivity and the occurrence of anoxic water along the margin of the basin In the TST4 (figure 16 and 17 C, [START_REF] Demaison | Anoxic Environments and Oil Source Bed Genesis[END_REF][START_REF] Calvert | Geochemistry of Namibian Shelf Sediments[END_REF][START_REF] Emeis | Sedimentary and geochemical expressions of oxic and anoxic conditions on the Peru Shelf[END_REF]Wignall and Newtown, 2001;[START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | The trace metal content of recent organic carbon-rich sediments: Implications for Cretaceous black shale formation[END_REF][START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript Algeo | Modern and ancient epeiric seas and the super-estuarine circulation model of marine anoxia. Dynamics of Epeiric seas: sedimentological, paleontological and geochemical perspectives[END_REF]. This productivity, associated with the anoxia controlled the preservation of very rich organic layers on the edges of the basin. In this systems tract, anoxic condition and increased productivity were also highlighted in the central part of the basin, but with a lower intensity than on the edges of the basin.

The integration of geochemical analyses in the stratigraphic framework highlighted three different types of basin in the studied interval. Those three types of basin present drastically different distribution of OM due to differences in dynamic of anoxia and primary productivity.

Sequence stratigraphy study shows that the deposition of the Montney and Doig Formations most likely took place in an oval shaped basin between the proto-cordillera and the western margin of Pangea (Crombez, 2016;Rohais et al., 2016). In these settings, OM is poorly preserved in type 1 basin (figure 17 A). In a type 2 basin (figure 17 B), organic rich deposits are located in the central part of the basin where the oxygen content is minimum. This type of basin is very similar to the present-day Black Sea where the production of the OM takes place along the margin of the basin and OM is accumulated in the central part of the basin [START_REF] Huc | Aspects of depositional processes of organic matter in sedimentary basins[END_REF]Wilkin et al., 1997;[START_REF] Arthur | Organic-matter production and preservation and evolution of anoxia in the Holocene Black Sea[END_REF][START_REF] Algeo | Mo-total organic carbon covariation in modern anoxic marine environments: Implications for analysis of paleoredox and paleohydrographic conditions[END_REF][START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript Algeo | Modern and ancient epeiric seas and the super-estuarine circulation model of marine anoxia. Dynamics of Epeiric seas: sedimentological, paleontological and geochemical perspectives[END_REF]. In this type of basin, the organic rich area will likely be round-shaped in the deep basin. Lastly, in a type 3 basin (figure 17 C), the organic-rich layers are located below the production areas, where the oxygen content is minimum due to the development of OMZ. As the production areas can be considered a function of the distance to the shore [START_REF] Calvert | Oceanographic controls on the accumulation of organic matter in marine sediments[END_REF][START_REF] Baudin | Géologie de la matière organique[END_REF], the organic rich areas resulting from this type of basin are likely to be halo-shaped parallel to the shoreline.

Controls on primary productivity and anoxia

Our analysis suggest that during the Lower and Middle Triassic in Western Canada, the evolution of primary productivity and anoxia through time was associated with major stratigraphic surfaces (figure 16). In particular, physiographic changes of the basin across the boundary between thirdorder sequence 2 and 3 as well as between second-order sequence A and B (Crombez, 2016) appear

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT
to have a major impact on the distribution of organic matter. These changes likely reflect the early geodynamic evolution of the Canadian Cordillera.

Primary productivity

A strong increase of primary productivity occurred during TST4, above a major erosional unconformity that modified the physiography of the basin. Several models explain the increase of organic productivity by an augmentation of nutrients inputs from the continent due to climate enhanced continental weathering [START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript Algeo | Modern and ancient epeiric seas and the super-estuarine circulation model of marine anoxia. Dynamics of Epeiric seas: sedimentological, paleontological and geochemical perspectives[END_REF] or associated with a marine transgression [START_REF] Wignall | Black shales on the basin margin: a model based on examples from the Upper Jurassic of the Boulonnais, northern France[END_REF]. Other studies explain the increase of primary productivity by the input of deep marine nutrients associated with upwelling cells [START_REF] Heckel | Origin of phosphatic black shale facies in Pennsylvanian cyclothems of midcontinent North America[END_REF][START_REF] Demaison | Anoxic Environments and Oil Source Bed Genesis[END_REF][START_REF] Calvert | Geochemistry of Namibian Shelf Sediments[END_REF][START_REF] Emeis | Sedimentary and geochemical expressions of oxic and anoxic conditions on the Peru Shelf[END_REF].

During sequence A, the positive correlation of detrital supply proxies (Al) with organic productivity proxies (Ni, Cu) suggests that nutrients were supplied by the continent and their low concentration resulted in low to moderate organic productivity in the Montney Formation. During TST4, such a relation between detrital input and organic productivity was not observed, suggesting another source of nutrients. A recent study [START_REF] Krajewski | Organic matter-apatite-pyrite relationships in the Botneheia Formation (Middle Triassic) of eastern Svalbard: Relevance to the formation of petroleum source rocks in the NW Barents Sea shelf[END_REF] on Triassic strata from Svalbard archipelago, shows that the increase of primary productivity in the basin is mainly controlled by the stratigraphic evolution that establish the connection between upwelling cells and a moderately restricted basin (figure 14). A major change of basin physiography across the boundary between sequence A and B, associated with the early geodynamic evolution of the foreland basin might have resulted in the connection with upwelling cells present during the Triassic along the NW margin of Pangea [START_REF] Parrish | Atmospheric circulation, upwelling, and organic-rich rocks in the Mesozoic and Cenozoic eras[END_REF]. Accordingly, the increase of nutrients delivery during TST4 is probably linked to a combination of the transgressive trend and the regional geodynamic evolution that connect the basin with upwelling cells.

Anoxia

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

Anoxia in sedimentary basin is mainly driven by two processes: the basin restriction (e.g. the Black Sea, [START_REF] Demaison | Anoxic Environments and Oil Source Bed Genesis[END_REF][START_REF] Huc | Aspects of depositional processes of organic matter in sedimentary basins[END_REF][START_REF] Arthur | Marine Black Shales: Depositional Mechanisms and Environments of Ancient Deposits[END_REF][START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | The trace metal content of recent organic carbon-rich sediments: Implications for Cretaceous black shale formation[END_REF][START_REF] Algeo | Paleoceanographic applications of trace-metal concentration data[END_REF] and the primary productivity (e.g. the Peruvian Margin, [START_REF] Demaison | Anoxic Environments and Oil Source Bed Genesis[END_REF][START_REF] Arthur | Marine Black Shales: Depositional Mechanisms and Environments of Ancient Deposits[END_REF][START_REF] Emeis | Sedimentary and geochemical expressions of oxic and anoxic conditions on the Peru Shelf[END_REF][START_REF] Calvert | Geochemistry of Namibian Shelf Sediments[END_REF][START_REF] Arthur | Organic-matter production and preservation and evolution of anoxia in the Holocene Black Sea[END_REF][START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript | The trace metal content of recent organic carbon-rich sediments: Implications for Cretaceous black shale formation[END_REF][START_REF] Paulmier | Oxygen minimum zones (OMZs) in the modern ocean[END_REF].

The Montney and Doig Formations present two intervals of anoxia during sequence 3 and TST4. The anoxia in sequence 3 is associated with a moderate to low productivity and a major falling stage of relative sea level whereas TST4 is a second order transgressive period associated with increased primary productivity.

During sequence 3, the lowstand relative sea level lead to restricted connections between the basin and the open marine settings and resulted in reduced water exchange between the two domains and a stratification of the water column. In this setting, the anoxia in the basin is controlled by both the physiography of the basin and the stratigraphic settings that allow for the occurrence of a threshold area.

In the TST4, the high primary productivity triggered the development of an oxygen minimum zone directly below the production area. Unlike in sequence 3, the anoxia in TST4 was controlled by the primary productivity, although the additional impact of basin restriction on anoxia is difficult to estimate.

In the Montney and Doig Formations, the two anoxic episodes present different extension and dynamic.

(1) The anoxic episode at the upper part of the Montney Formation was mainly linked to the physiography of the basin and to its stratigraphic evolution.

(2) The anoxic areas in TST4 were likely controlled by organic productivity and therefore were not located in the center of the basin but instead in halo-shaped belts associated with up-welling cells. Further work involving forward stratigraphic modeling would help addressing the relative impact of primary productivity versus basin restriction on the resulting anoxia.

M A N U S C R I P T A C C E P T E D

ACCEPTED MANUSCRIPT

CONCLUSIONS

The work presented in this paper is based on well and outcrop data. It integrates geochemical analyses in a stratigraphic framework in order to understand the distribution of organic-rich layers in a sedimentary basin and the dynamic of the key controlling factors: primary productivity, dilution and preservation of OM at basin scale. This multidisciplinary study shows:

-The occurrence of primary OM in the Montney and Doig Formations. The palynofacies analyses reveal the occurrence of planktonic OM (figure 5).

-The need for a large scale sequence stratigraphic framework to understand local variation of OM accumulation. In the studied interval, the time lines provided the opportunity to understand the major spatial and temporal changes of organic primary productivity and redox conditions.

-The impact of these variations of redox conditions and productivity on the vertical distribution of OM in the Montney and Doig Formations. Sequences 1 and 2 present low TOC content, whereas sequence 3 and TST4 present some organic-rich accumulations.

This complex distribution is linked to the development of a "Restricted basin" in sequence 3 and a "High primary productivity basin" in the TST4.

-The lateral variation of OM content due to different rates of productivity and different types of anoxia. In a "High primary productivity basin", the organic rich layers are located along the coast below the production areas whereas, in a "Restricted basin", the organic rich layers is deposited in the center basin.

-The occurrence of two different types of anoxia. In the Montney Formation, sequence 1 and 2 may show small episodic "Restricted basins" (ponds) in the basin center and the sequence 3 can be considered as a large "Restricted basin" (figure 17 B). In the TST4, the anoxia is located along the basin margin ("High primary productivity basin", figure 17 C).

In the Montney Formation, the anoxia is induced by the physiography of the basin and by

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

the sea level falling stage whereas in the Doig phosphate unit, the anoxia is linked to organic primary productivity associated with a second order transgressive trend induced by major geodynamical changes.

-The primary controls of the basin physiography and stratigraphic settings on anoxia. In the studied interval, the "Restricted basin" is the result of a major sea level falling stage in a threshold basin whereas the "High primary productivity basin" is linked to a major transgressive interval. In the present study, the threshold is linked to the proto-Canadian

Cordillera accretion and induces strong restriction.

-The second order transgressive periods do not always present high organic accumulation.

-In our case study anoxia and primary productivity are the two main controls on organic richness, while dilution as only a marginal impact. shows that paleoproductivity increased significantly in the TST4 whereas it remains stable in the rest of the studied interval.

FIGURES CAPTIONS

M

  FIGURES CAPTIONS ................................................................................................................................ 38

  , sequence A and B are respectively Lower Triassic and Middle Triassic in age. Within sequence A, sequence 2 was deposited above the Induan-Olenekian boundary and sequence 3 lays on top of the Smithian-Spatian boundary. According to biostratigraphic data, the top of sequence B is older than the Ladinian-Carnian boundary (Orchard

(

  SP and PM on figure 5 B, C and I). The absence of damaged terrestrial OM showing a transformation

  figure, most of EF of Cu and Ni are higher than 1. In comparison to black shale (Cretaceous and

  outcrop stay very low (TOC < 3wt% and Mo < 25) except for two cutting samples located near SB3 and SB4. Mo and TOC covariations in different restricted basins (the Saanich inlet, the Cariaco basin, the Framvaren fjord and the Black sea, respectively SI, CB, FF and BS on figure14) are presented by[START_REF] Algeo | Mo-total organic carbon covariation in modern anoxic marine environments: Implications for analysis of paleoredox and paleohydrographic conditions[END_REF]. All the low TOC and Mo samples of the present cannot be related to one of these case studies. The samples of well 16-17-83-25W6 present more significant results with moderate to high TOC and molybdenum concentration (1.5 < TOC < 15.2 wt% and 0 < Mo < 101.6 ppm). Along this well, values for sequences 1 to 3 fall between the Cariaco basin trend and the Black sea trend, whereas sequence 4 values clearly fall along the Black sea trend.

  rich sediment accumulation (figure 10 to 13). Estimating the relative proportion of migrated versus in place hydrocarbons in the Montney Formation is beyond the scope of the present study and would necessitate a quantitative basin analysis.

  [START_REF] Paulmier | Oxygen minimum zones (OMZs) in the modern ocean[END_REF].

Figure 1 :

 1 Figure1: Location map of the data available for this study. The names 0/06-33, 0/14-14 and 0/16-17,

Figure 2 :

 2 Figure 2: Simplified sedimentary architecture of the Lower and Middle Triassic strata of the Western

Figure 3 :

 3 Figure 3: A. HI vs Tmax cross-plots for core samples with TOC values. B. HI vs Tmax cross-plots for

Figure 4 :

 4 Figure 4: FID curves from the Basic Rock-Eval pyrolysis of an early mature cutting sample before and

Figure 5 :

 5 Figure 5: Palynofacies view of the Montney and Doig Fm. showing that most of the primary OM of

Figure 6 :

 6 Figure 6: Well section across the Montney and Doig Fm with TOC measurements and estimations of

Figure 7 :

 7 Figure 7: Distribution of the TOC and computed TOC ini in the studied interval and in the four

Figure 8 :

 8 Figure 8: Sedimentary section of sequences 3 and 4 from the core description of the 0/16-17-83-

Figure 9 :

 9 Figure 9: Cross-plots of the TOC ini and the SR. Here, SR are based on undecompacted sediments.

Figure 10 :

 10 Figure 10: Cross-plots of the enrichment factors (EF) of Ni and Cu. The EF are computed based on the

Figure 11 :

 11 Figure 11: Vertical evolution of paleoproductivity proxies (Cu/Al and Ni/Al) in relation to TOC and

Figure 12 :

 12 Figure 12: Cross-plots of paleoredox proxies (U/Th and V/Cr). Limit values between

Figure 13 :

 13 Figure 13: Vertical evolution of paleoredox proxies (U/Th and Mo/Al) in relation to TOC and TOC ini in

Figure 14 :

 14 Figure 14: Cross-plot of the molybdenum versus the TOC in the stratigraphic framework. This figure

Figure 15 :

 15 Figure 15: Cross-plot of the weathering index of Parker (WIP) and the chemical index of alteration

Figure 16 :Figure 17 :

 1617 Figure 16: TOC distribution and its controlling factors. This figure shows that high TOC values may

  Wilkin, R.,Arthur, M., Dean, W., 1997. History of water-column anoxia in the Black Sea indicated by pyrite framboid size distributions. Earth and Planetary Science Letters 148, 517-525.

	ACCEPTED MANUSCRIPT
	doi:10.1016/S0012-821X(97)00053-8
	Wood, J.M., Sanei, H., Curtis, M.E., Clarkson, C.R., 2015. Solid bitumen as a determinant of reservoir
	quality in an unconventional tight gas siltstone play. International Journal of Coal
	Geology. doi:10.1016/j.coal.2015.03.015
	M Zonneveld, J.-P., MacNaughton, R.B., Utting, J., Beatty, T.W., Pemberton, S.G., Henderson, C.M., 2010. Sedimentology and Ichnology of the Lower Triassic Montney Formation in the Pedigree-Ring/Border-Kahntah River Area, Northwestern Alberta and Northeastern A N U S C R I P T British Columbia. Bulletin of Canadian Petroleum Geology 58, 115-140.
	A C C E P T E D

ACKNOWLEDGEMENTS

Acknowledgments go to all those who have contributed to this project: IFP Technologies (Canada) Inc., SGS Canada, Alberta Energy regulator and the Geological Survey of Canada. Special acknowledgments go to M.F. Romero Sarmiento, J. Letord, F. Savignac for their help during sample analysis and to Schlumberger that provided Petrel academic licenses.

Oil & Gas Science and Technology 40, 563-579. doi:10.2516/ogst:1985035


Carlos Aguayo Gonzalez

Alan Hinton

DETECTING MALICIOUS SOFTWARE EXECUTION IN PROGRAMMABLE LOGIC CONTROLLERS USING POWER FINGERPRINTING

Keywords: Industrial control systems, malware detection, power fingerprinting

Traditional cyber security mechanisms, such as network-based intrusion detection systems and signature-based antivirus software, have limited effectiveness in industrial control settings, rendering critical infrastructure assets vulnerable to cyber attacks. Even four years after the discovery of Stuxnet, security solutions that can directly monitor the execution of constrained platforms, such as programmable logic controllers, are not yet available. Power fingerprinting, which uses physical measurements from a side channel such as power consumption or electromagnetic emissions, is a promising new technique for detecting malicious software execution in critical systems. The technique can be used to directly monitor the execution of systems with constrained resources without the need to load third-party software artifacts on the platforms.

This paper demonstrates the feasibility of using power fingerprinting to directly monitor programmable logic controllers and detect malicious software execution. Experiments with a Siemens S7 programmable logic controller show that power fingerprinting can successfully monitor programmable logic controller execution and detect malware similar to Stuxnet. Indeed, power fingerprinting has the potential to dramatically transform industrial control system security by providing a unified intrusion detection solution for critical systems.

Introduction

Industrial control systems are computer-based systems that monitor and control process systems in critical infrastructure assets such as water treatment and distribution facilities, transportation systems, oil and gas pipelines, electrical power transmission and distribution systems, and large telecommunications systems. Attacks against industrial control systems by a well-funded adversary can have devastating consequences to modern society. Current industrial control system defenses involve updating and patching, strengthening the periphery and implementing other traditional information technology solutions. Unfortunately, these approaches have limited success in industrial control system environments [START_REF] Das | Handbook on Securing Cyber-Physical Critical Infrastructure: Foundations and Challenges[END_REF], which render critical systems highly vulnerable to cyber attacks -as Stuxnet famously demonstrated [START_REF] Falliere | Stuxnet Dossier, Version 1.4[END_REF]. Consider, for example, intrusion detection systems that rely on traffic analysis. Such systems are notoriously ineffective against advanced persistent threats, which leverage attacks that are immune to signature detection, minimize network utilization and mimic legitimate network traffic [START_REF] Axelsson | The base-rate fallacy and the difficulty of intrusion detection[END_REF][START_REF] Erbacher | Distributed sensor objects for intrusion detection systems[END_REF][START_REF] Tankard | Advanced persistent threats and how to monitor and deter them[END_REF]. Furthermore, the systems are incapable of detecting malicious software whose execution does not generate traditional network traffic. For example, the malware could communicate using alternative channels (e.g., Bluetooth [START_REF] Bose | On mobile viruses exploiting messaging and Bluetooth services[END_REF]) or simply remain dormant for extended periods of time. Signature-based solutions also have severe shortcomings in industrial control system environments, including the inability to detect zero-day attacks [START_REF] Bose | Behavioral detection of malware on mobile handsets[END_REF][START_REF] Christodorescu | Semanticsaware malware detection[END_REF][START_REF] Oberheide | CloudAV: N-version antivirus in the network cloud[END_REF][START_REF] Rajab | Trends in Circumventing Web-Malware Detection[END_REF], the consumption of valuable host resources that CPU-constrained platforms simply do not have [START_REF] Das | Handbook on Securing Cyber-Physical Critical Infrastructure: Foundations and Challenges[END_REF][START_REF] Reeves | Lightweight intrusion detection for resource-constrained embedded control systems[END_REF], and the lack of support for embedded systems [START_REF] Cui | Defending embedded systems with software symbiotes[END_REF].

Power fingerprinting (PFP) is a promising new technique that detects malicious software execution using physical side channel measurements. The technique involves the direct monitoring of systems with constrained resources and does not require the loading of third-party software artifacts on target platforms. As such, power fingerprinting is ideal for detecting malicious software execution in industrial control system environments and can provide an extra layer of protection that is not afforded by traditional intrusion detection approaches.

This paper demonstrates the feasibility of using power fingerprinting to directly monitor programmable logic controllers and detect malicious software execution. The experimental results demonstrate that power fingerprinting can successfully detect the execution of malware similar to Stuxnet in a Siemens S7 programmable logic controller.

Power Fingerprinting

Power fingerprinting analyzes a processor side channel, such as power consumption or electromagnetic emissions, to determine whether or not it deviates from expected operation. A power fingerprinting monitor, shown in Figure 1, uses a physical sensor to capture electromagnetic signals containing small patterns that emerge during the transition from one instruction to another. In power fingerprinting, captured power traces are processed by an external device that implements signal detection and classification techniques. The observed traces are compared against baseline references to assess whether or not execution has deviated from its expected behavior, such as when malware alters normal operation. Because monitoring is performed on an external device, memory and processing overhead on the target device are eliminated. Additionally, a power fingerprinting monitor can be built using commercial off-the-shelf components.

Basic Concepts

The concept behind power fingerprinting is relatively straightforward. It involves three main elements that are common to pattern recognition systems: (i) sensing; (ii) feature extraction; and (iii) classification. Sensing involves direct or indirect measurements of the instantaneous current drain. The measurements may be made using a variety of techniques, including current or electromagnetic probes.

During a runtime assessment, power fingerprinting compares the captured traces against baseline references and looks for deviations beyond what are characterized as normal execution. The baseline references uniquely identify the execution of software routines that are extracted in a controlled environment before the system is deployed. The power fingerprinting monitor uses the stored references to detect anomalous execution deviations at runtime.

The level of expected deviation during normal operation is identified during a characterization process that determines the threshold between normal and anomalous execution. An intrusion is deemed to have occurred when the observed traces do not match the baseline references within a defined tolerance.

Characterization

The baseline references contain the expected side channel signals and indicate the acceptable tolerance variation. Power fingerprinting baselines are determined by exercising a good sample in a controlled environment while capturing side channel signals. Note that this process is similar to automated software testing; thus, power fingerprinting can leverage existing tools to facilitate the baseline extraction process. Indeed, while references are unique to a target system, the process for extracting them is general and can be applied across platforms and applications.

Ideally, a reference is extracted for every execution path in the target. Programmable logic controllers are ideal candidates for complete characterization because their execution is limited in functionality. In cases where extracting a reference for every execution path is not feasible due to complexity, the characterization may focus on critical system modules (e.g., kernel and bootloader).

Advantages and Limitations

Power fingerprinting enables the continuous, real-time and direct monitoring of industrial control devices that currently lack commercial solutions for detecting malicious software execution. Power fingerprinting can detect malware that induces the slightest anomalies in execution, even when the malware remains dormant or mimics legitimate network traffic. This enhanced detection capability enables the implementation of immediate responses to neutralize a threat. Furthermore, power fingerprinting does not interfere with the operation of critical industrial control systems, allowing the monitoring of the most sensitive components.

While power fingerprinting is a powerful mechanism for detecting malicious software execution, it provides limited support for forensic analysis and attack attribution. Specifically, power fingerprinting can identify the modules that have been tampered with, but not the modifications made to the system or the attacker's intentions. Power fingerprinting is intended to be applied in a defense-in-depth approach as part of a comprehensive security solution.

Related Work

Power fingerprinting has been demonstrated in a number of experiments on a variety of target platforms [START_REF] Gonzalez | Dynamic power consumption monitoring in SDR and CR regulatory compliance[END_REF][START_REF] Gonzalez | Power fingerprinting in SDR and CR integrity assessment[END_REF][START_REF] Gonzalez | Detecting unauthorized software execution in SDR using power fingerprinting[END_REF][START_REF] Gonzalez | Power fingerprinting in unauthorized software execution detection for SDR regulatory compliance[END_REF][START_REF] Gonzalez | Power fingerprinting in SDR integrity assessment for security and regulatory compliance[END_REF]. Aguayo Gonzalez and Reed [START_REF] Gonzalez | Power fingerprinting in unauthorized software execution detection for SDR regulatory compliance[END_REF] have detected unauthorized software modifications in a basic commercial radio platform (PICDEM Z Evaluation Board with a PIC18 processor). The unauthorized modifications had a physical impact on the behavior of the system that could trigger regulatory certification violations. In a different experiment using the same platform, Aguayo Gonzalez and Reed [START_REF] Gonzalez | Detecting unauthorized software execution in SDR using power fingerprinting[END_REF] used a power fingerprinting monitor to detect execution deviations that affect the encryption process of radio transmissions.

Other researchers (e.g., [START_REF] Stone | Radio-Frequency-Based Programmable Logic Controller Anomaly Detection[END_REF][START_REF] Stone | Radio-frequency-based anomaly detection for programmable logic controllers in the critical infrastructure[END_REF]) have used techniques similar to power fingerprinting for industrial control system security. In particular, they have used electromagnetic emissions to detect anomalies in Allen Bradley SLC-500 programmable logic controllers using a correlation-based approach.

Experimental Setup and Methodology

This section demonstrates the ability of power fingerprinting to monitor industrial control systems and identify malicious software execution. A reference system was implemented using a Siemens SIMATIC S7-1200 micro programmable logic controller to extract its power fingerprinting baseline references. A malicious modification, similar in structure and operation to Stuxnet, was introduced in the programmable logic controller and the baseline references were used to detect the resulting anomalous execution. The following sections describe the experimental setup and methodology.

Target Platform

The Siemens SIMATIC S7-1200 micro programmable logic controller used in the experiments had a 1212C CPU; a scalable and flexible design for compact solutions; an integrated Industrial Ethernet/PROFINET interface for programming, I/O and HMI connections, and CPU-to-CPU communications; and integrated technology functions for counting, measurement, closed-loop control and motion control.

Measurement Setup

The power fingerprinting monitor was implemented using commercial offthe-shelf components. The target programmable logic controller was first instrumented with a near-field sensor for electromagnetic compatibility testing to capture the side channel signal. The near-field sensor employed was a commercial probe from Beehive Electronics with fine spatial resolution that reduced interference from other subsystems on the board. The increased spatial resolution resulted in reduced sensitivity, which was compensated for by a wide-band amplifier with 30 dB gain. The power fingerprinting monitor setup is presented in Figure 2.

The signal captured by the sensor was digitized using a Tektronix oscilloscope. The oscilloscope was configured with a sampling rate of 2.5 GSPS; a total of 100K samples were collected in each trace. A triggering signal was provided by an I/O pin in the programmable logic controller for synchronization purposes. The captured signals were transferred via a USB drive and processed by the power fingerprinting host using custom software tools and scripts.

Control System Logic

The experiment involved a simple tank level control system shown in Figure 3. In the experiment, the S7-1200 programmable logic controller was used to control the tank level using two sensors to determine when to turn the pump on and off. Figure 4 shows a simplified model of the control logic. The sensors were configured to provide a logical one when the tank water level was at or above the sensor level and a logical zero when the water level was below the sensor level.

Tank

High

Low Pump Alarm Sensor Sensor

0 0 1( O n ) 0( O ff) 0 1 * 0( O ff) 1 0 0( O ff) 1 (On) 1 1 0( O ff) 0 (Off)
According to the control system logic shown in Table 1, the programmable logic controller turns the pump on when the tank level drops below the low sensor and turns the pump off when the level reaches the high sensor. When the level is between both sensors (low sensor = 1 and high sensor = 0), there is no change in the pump state. The remaining combination of input values (low sensor = 0 and high sensor = 1) is a faulty condition and raises an alarm.

The control system logic was implemented in the S7-1200 programmable logic controller as a SCL program in block OB1. The following pseudocode specifies the control system logic: The control system logic has four execution paths. An execution path is selected based on the combination of input values at the beginning of the logic cycle. To facilitate synchronization, the logic incorporates a physical trigger, an electric signal sent to the digitizer via the output port of the programmable logic controller to indicate when the logic cycle is started.

Modified Control System Logic

In order to test the ability of power fingerprinting to detect malicious software execution, the control system logic was modified to incorporate a malicious attack. The alteration resembles the Stuxnet modification to Siemens S7-315 programmable logic controllers that hooked DP RECV to collect information about normal uranium hexafluoride centrifuge operations.

The attack, which is shown in Figure 5, moves the original DP RECV routine to a different logic block and replaces it with an infected block that monitors inputs and forwards requests to the original DP RECV routine. The attack causes the pump to be turned on regardless of the sensor inputs while disabling the alarm. Figure 6 shows how the original logic block is moved in the tampered version. After the original logic is executed, the tampered block post-processes the results to change the system behavior. The most important element of the tampering, however, is the fact that behavioral modifications only take place under specific conditions. Similar to Stuxnet, the attack remains dormant and the system exhibits normal behavior until the triggering condition is encountered.

The triggering condition is induced by another digital input pin that controls the sabotage routine. Note that the triggering mechanism is arbitrary; selecting a different triggering mechanism would have no impact on power fingerprinting.

Tank

Figure 7 shows a simplified model of the tampered control system logic.

x x 1 1( O n ) 0( O ff) 0 0 0 1( O n ) 0( O ff) 0 1 0 * 0( O ff) 1 0 0 0( O ff) 1 (On) 1 1 0 0( O ff) 0 (Off)
Table 2 shows the tampered control system logic. When the triggering condition is induced, the programmable logic controller turns the pump on regardless of the sensor inputs, causing the water in the tank to overflow. When the triggering condition is absent, the observed behavior matches the original logic.

Experimental Results

After characterizing the original control logic and extracting the power fingerprinting references for all the execution paths, the power fingerprinting monitor was able to effectively monitor the integrity of the Siemens S7-1200 programmable logic controller. Furthermore, power fingerprinting successfully detected malicious software execution even when the triggering condition was absent.

Baseline Reference Extraction

In order to perform the runtime assessment of the original programmable logic controller, it was necessary to extract the baseline references for all the execution paths during the characterization process. Training traces were captured in a controlled environment in which input vectors were provided to exhaustively exercise all the possible execution paths.

A total of 100 training traces were captured for each execution path and processed using a spectral periodogram (spectrogram) to extract the frequency components of each training trace at different time segments. The spectrogram, which corresponds to the squared magnitude of the discrete-time short-time Fourier transform (X(τ, ω)), is given by:

spectrogram{x (t)} (τ, ω) = |X (τ, ω) | 2 where X (m, ω) = ∞ n=-∞ x[n]w[n -m]e -jωn .
Note that x[n] is the captured power fingerprinting trace and w[n] is a Gaussian window. The power fingerprinting references were constructed by averaging the spectrograms of the 100 training traces for each execution path. For Path 0, the power fingerprinting reference is denoted by S 0 ; for Path 1, the power fingerprinting reference is denoted by S 1 ; and so on.

After the references for each execution path were computed, the power fingerprinting monitor captured a new runtime test trace r[n], and compared it against the references to determine if r[n] corresponded to an authorized execution path or if it should be flagged as an anomaly. In order to match r[n] to a specific path reference S i , the spectrogram of r[n] was computed and subtracted from each baseline reference over selected time segments and frequency bands. The difference was then smoothed and summed across the selected time segments and frequency bands to determine the final distance for each path reference y i .

The reference that produced the minimum distance from the test trace, y f = min i {y i }, was selected as the likely execution path that generated the test trace r[n]. If y f is within the normal range as determined during the characterization, the power fingerprinting monitor classifies the trace as belonging to the corresponding execution path. If the test trace does not match any reference within the predefined tolerance, then the power fingerprinting monitor determines that an anomaly exists and raises an alarm.

Detection Performance

The ability of power fingerprinting to detect malicious software execution was tested by capturing 100 traces from the tampered programmable logic controller with the malware in a dormant state (i.e., the triggering condition was absent and the tampered version displayed the same observable behavior as the original logic).

Figure 8 shows the sample distribution (histogram) of the differences (y f ) between the original execution traces and the traces during the execution of the tampered control system logic. Note that the closer y f is to zero, the more similar the tampered execution trace is to the baseline reference trace. A clear separation can be seen between the distributions, which demonstrates the ability of power fingerprinting to detect malicious software execution.

Similar results were obtained for the other execution paths. Figure 9 presents a boxplot of an aggregated view of the execution paths. The boxplot shows that the separation between the original and tampered distributions is maintained for all possible execution paths. The results demonstrate the ability of power fingerprinting to detect malicious software in an industrial control system by directly monitoring programmable logic controller execution.

Conclusions

Power fingerprinting is a novel technique for directly monitoring the execution of systems with constrained resources. The technique, which has been successfully demonstrated on a variety of platforms, does not require software artifacts to be loaded on the target platforms.

The experimental results demonstrate that power fingerprinting can directly monitor programmable logic controller execution and detect the presence of malware. Because of its zero-day detection capability and negligible overhead, power fingerprinting can potentially transform cyber security by enabling malware detection in industrial control systems as well as in other critical systems.

Figure 1 .

 1 Figure 1. Power fingerprinting monitor.

Figure 2 .

 2 Figure 2. Power fingerprinting monitor setup.

Figure 3 .

 3 Figure 3. Tank level control system.

Figure 4 .

 4 Figure 4. Control system operation.

Figure 5 .

 5 Figure 5. Functional representation of the attack.

Figure 6 .

 6 Figure 6. Modified control system logic SCL OB1.

Figure 7 .

 7 Figure 7. Tampered control system operation.

Figure 8 .

 8 Figure 8. Deviation of Path 1 from the baseline sample distribution.

Figure 9 .

 9 Figure 9. Anomaly detection performance for execution paths in the original logic.

Table 1 .

 1 Control system logic table.

Table 2 .

 2 Tampered control system logic table.

	High	Low	Malware Pump Alarm
	Sensor Sensor	Trigger