Ana Vrgoč

Zvonimir Tomičević
email: zvonimir.tomicevic@fsb.hr

Benjamin Smaniotto

Application of different imaging techniques for the characterization of damage in fiber reinforced polymer

Keywords: Digital Image Correlation (DIC), Digital Volume Correlation (DVC), Full-field measurement, Gray level residuals, Polymer matrix composite

may come

Application of different imaging techniques for the characterization of damage in fiber reinforced polymer

Ana Vrgoč, Zvonimir Tomičević, Benjamin Smaniotto, François

Introduction

The increased application of lightweight structures has contributed to the development and utilization of advanced materials. Fiber reinforced polymers (FRPs) are increasingly being regarded as efficient substitutes for conventional engineering materials in critical-1 safety and lightweight structural applications [START_REF] Prashanth | Fiber reinforced composites -a review[END_REF]. The heterogeneous and anisotropic nature of FRPs induces the occurrence of various damage mechanisms (e.g., fiber/matrix interface debonding, matrix microcracking, fiber pull-out, fiber breakage, delamination of individual layers), which often initiate in-depth and subsequently propagate at different length scales [START_REF] Brunner | Identification of damage mechanisms in fiber-reinforced polymer-matrix composites with acoustic emission and the challenge of assessing structural integrity and service-life[END_REF]. Due to simultaneous activation of different damage mechanisms and their interactions, the failure of laminated FRPs is a direct result of events occurring at microstructural levels [START_REF] Nguyen | A micro-mechanical model of reinforced polymer failure with length scale effects and predictive capabilities. validation on carbon fiber reinforced high-crosslinked rtm6 epoxy resin[END_REF]. This strong interconnection calls for advanced techniques for early detection of both damage initiation and monitoring damage growth, which is essential to assess the state of structures and their residual strength [START_REF] Bělský | Capability of non-destructive techniques in evaluating damage to composite sandwich structures[END_REF].

Recent advancements in camera technology and the development of image processing algorithms have contributed to the wide application of Digital Image Correlation (DIC) in experimental mechanics [START_REF] Sutton | Computer vision-based, noncontacting deformation measurements in mechanics: A generational transformation[END_REF]. The method allows in-plane displacement fields to be measured on the surface of loaded specimens. In original DIC algorithms, the acquired images were discretized into smaller zones (i.e., subsets, facets) [START_REF] Sutton | Determination of displacements using an improved digital correlation method[END_REF][START_REF] Chu | Applications of digital-image-correlation techniques to experimental mechanics[END_REF], and the series of subsets were registered independently. Such approaches are now referred to as local DIC [START_REF] Hild | Comparison of local and global approaches to digital image correlation[END_REF]. In order to measure continuous displacement fields, global approaches were introduced [START_REF] Wagne | Spectral approach to displacement evaluation from image analysis[END_REF], for instance based on finite element (FE) discretizations [START_REF] Broggiato | Adaptive image correlation technique for full-field strain measurement[END_REF][START_REF] Sun | Finite-element formulation for a digital image correlation method[END_REF][START_REF] Besnard | Finite-element" displacement fields analysis from digital images: Application to Portevin-Le Chatelier bands[END_REF].

The utilization of DIC in experimental mechanics proved to be crucial in improving identification procedures and validations of constitutive laws [START_REF] Grédiac | Full-Field Measurements and Identification in Solid Mechanics[END_REF]. Since the application of FRPs is in constant growth, extensive research has focused on identifying damage mechanisms that induce failure of engineering components. DIC has been increasingly utilized to obtain strain fields, and conduct detailed investigations of meso-and macromechanical aspects associated with FRP damage and failure [START_REF] Brynk | Digital image correlation measurements as a tool of composites deformation description[END_REF][START_REF] Haris | Experimental analysis of composite bolted joints using digital image correlation[END_REF][START_REF] Khechai | Strength degradation and stress analysis of composite plates with circular, square and rectangular notches using digital image correlation[END_REF][START_REF] Szebényi | Detection of delamination in polymer composites by digital image correlation-experimental test[END_REF]. Even though such measurements efficiently detect areas of strain localization corresponding to meso-and/or macro damage locations, the influence of bulk microstructural changes on the macroscopic response was not assessed. This limitation was bypassed via coupling DIC with other NDT methods (such as Acoustic Emission (AE), Scanning Electron Microscopy (SEM) and Infrared Thermography (IR)) into hybrid frameworks [START_REF] Godara | Influence of fiber orientation on global mechanical behavior and mesoscale strain localization in a short glass-fiber-reinforced epoxy polymer composite during tensile deformation investigated using digital image correlation[END_REF][START_REF] Muc | Fatigue damage growth monitoring for composite structures with holes[END_REF][START_REF] Kolanu | Damage assessment studies in cfrp composite laminate with cut-out subjected to in-plane shear loading[END_REF], which enabled for more comprehensive analyses of damage extent and precise characterization of damage mechanisms. However, bulk kinematic and microstructural changes were still not assessed in situ.

In this regard, Digital Volume Correlation (DVC) allows for the measurement of displacement fields and calculation of strain maps in the 3D space. DVC is the 3D volumetric extension of DIC in which the registration is performed on 3D images generally acquired with an X-ray scanner [START_REF] Gigliotti | X-ray microcomputed-tomography characterization of cracks induced by thermal cycling in noncrimp 3d orthogonal woven composite materials with porosity[END_REF]. In recent years, the aforementioned approach has emerged as a powerful measurement technique in experimental solid mechanics [START_REF] Bay | Methods and applications of digital volume correlation[END_REF][START_REF] Buljac | Digital volume correlation: Review of progress and challenges[END_REF]. The majority of bulk damage investigations of FRP composites include applications of local DVC approaches, which enabled changes in the microstructure to be correlated with measured bulk kinematic fields, and thus to damage development in the material bulk [START_REF] Brault | In-situ analysis of laminated composite materials by x-ray micro-computed tomography and digital volume correlation[END_REF][START_REF] Croom | Unveiling 3d deformations in polymer composites by coupled micro x-ray computed tomography and volumetric digital image correlation[END_REF][START_REF] Wang | In-situ 3d fracture propagation of short carbon fiber reinforced polymer composites[END_REF][START_REF] Hanhan | Predicting microstructural void nucleation in discontinuous fiber composites through coupled in-situ x-ray tomography experiments and simulations[END_REF][START_REF] Agyei | Detecting damage initiation in short fiber composites via in-situ x-ray tomography and digital volume correlation[END_REF].

Further, as for 2D measurements, global approaches were also introduced to register and analyze 3D volumes [START_REF] Roux | Three dimensional image correlation from X-Ray computed tomography of solid foam[END_REF][START_REF] Réthoré | Extended three-dimensional digital image correlation (X3D-DIC)[END_REF]. The key advantage of global approaches is the availability of correlation residual maps, which correspond to the gray level difference between the reference volume and the volume of deformed material corrected by the measured displacement field. These residuals, which are probed for all pixels/voxels belonging to the region of interest (ROI), provide useful information when checking the convergence of DIC/DVC analyses, i.e., as the displacement fields are assumed to be continuous over the inspected ROI, the areas of elevated residuals reveal damaged zones. The analysis of correlation residual maps has proven to be successful in detecting discontinuities in both 2D and 3D measurements [START_REF] Tomičević | Evaluation of fatigue crack network growth in cast iron for different biaxial loading paths via full-field measurements[END_REF][START_REF] Mazars | Damage investigation and modeling of 3d woven ceramic matrix composites from x-ray tomography in-situ tensile tests[END_REF][START_REF] Buljac | Effect of void arrangement on ductile damage mechanisms in nodular graphite cast iron: In situ 3d measurements[END_REF]. In addition, voxel-wise correlation residuals allowed for the detection of damage initiation and growth within the bulk of FRPs [START_REF] Tomičević | Damage observation in glass fiber reinforced composites via µ-tomography[END_REF].

The aim of the investigation performed herein is to compare the capabilities of different image registration techniques (namely, DIC and DVC) in detecting damage onset and monitoring damage growth within a glass fiber mat reinforced polymer composite. First, a uniaxial and monotonic tensile experiment was conducted, and the global material behavior was assessed via FE-based DIC. The extracted major eigen strain fields and corresponding correlation residual maps are analyzed to monitor damage development on the specimen surface. Based on the reported stress-strain response, an in situ experimental study was performed to measure the 3D kinematics of the specimen subjected to cyclic tensile loading from reconstructed scans acquired with an X-ray scanner. FE-based DVC was employed to measure 3D displacements and thus calculate strain fields within the bulk of the investigated material. Before cycling the specimen, two scans were acquired in the undeformed configuration to assess measurement uncertainties. Furthermore, the first advantage of computed tomography is to reveal the underlying microstructure [START_REF] Maire | Quantitative X-ray tomography[END_REF], while the calculated eigen strain fields and correlation residual maps are studied to track damage inception and growth within the loaded microstructure. To highlight the advantages of DVC compared to surface observations, a section-based DIC approach is proposed. The front and rear sections extracted from the scans acquired during cyclic tension are used as 2D images to perform inplane registrations. The 2D-DIC fields on the front and rear specimen surfaces are analyzed and compared to DVC results.

Materials and methods

The present section introduces the material and methods employed in the investigation performed herein. The manufacturing procedure and properties of the investigated material are presented, then followed by a brief overview of regularized DIC/DVC.

Glass fiber mat reinforced epoxy resin composite

The material studied herein is a continuous glass fiber mat reinforced epoxy resin composite produced by manual lay-up followed by compression molding. The investigated laminate comprised 12 plies of R-glass fiber mat laid in 438 g of epoxy resin mixture (LG 285 laminating resin, GRM Systems, Germany), and was cured under pressure for 24 h at room temperature. The post-curing was conducted at 100 • C for 3 h. As vacuum was not applied during molding, the micrographs shown in Fig. 1 reveal the presence of air voids, the volume fraction of which was found to be 5%. The fiber volume fraction was 40%, while that of the matrix was equal to 55%. In addition, the mean fiber diameter was equal to 9 µm.

Digital Image/Volume Correlation

Digital Image/Volume Correlation is a widely employed technique enabling for fullfield displacement measurements [START_REF] Sutton | Image correlation for shape, motion and deformation measurements: Basic Concepts, Theory and Applications[END_REF][START_REF] Hild | Digital image correlation[END_REF]. The general concept relies on pattern matching to measure displacement fields by correlating the image of the reference configuration f (x) and another one of the deformed configuration g(x). The images are 2D or 3D matrices of gray levels, where x denotes the pixel/voxel location. Gray level conservation is usually assumed to relate the two registered images

f (x) = g(x + u(x)), (1)
where u is the sought displacement field. The global approaches employed herein consist in minimizing the sum of squared differences over the ROI with respect to the sought displacement amplitudes [8]

Φ 2 c = ROI ϕ 2 c (x), (2)
where ϕ c defines the correlation residual field

ϕ c (x) = f (x) -g(x + u(x)). (3)
The objective of global DIC/DVC is to circumvent the ill-posedness of registration, and thus to reduce the measurement uncertainties by assuming continuity of the displacement field

u(x) = n u n Ψ n (x), (4)
where Ψ n are the selected shape functions associated with the finite element discretization of the displacement field, u n the associated nodal displacements. The correlation procedure consists in minimizing Φ 2 c with respect to all unknown degrees of freedom u n , which are gathered in the column vector {u}. A Gauss-Newton scheme is employed and consists in iteratively solving linear systems to determine nodal displacement corrections {δu}

[M]{δu} = {b i }, (5)
where [M] is the Hessian matrix comprising of shape functions Ψ n and image gradient ∇ ∇ ∇ f (x), and thus computed once for all

M mn = ROI (∇ ∇ ∇ f (x) • Ψ m (x))(∇ ∇ ∇ f (x) • Ψ n (x)), (6)
{b i } the residual vector at iteration i accounting for the current image residuals

b i m = ROI ( f (x) -g i (x))(∇ ∇ ∇ f (x) • Ψ m (x)), (7)
and g i (x) is equal to g(x + u i (x)), which is referred to as the corrected deformed image by the current estimate u i of the displacement field.

Moreover, mechanical regularization based on the equilibrium gap in linear elasticity may be utilized to further bypass the ill-posedness of registrations, thus reducing measurement uncertainties [START_REF] Tomičević | Mechanics-aided digital image correlation[END_REF][START_REF] Leclerc | Digital volume correlation: What are the limits to the spatial resolution[END_REF]. Such an approach consists in minimizing the L 2 norm of the un-balanced nodal forces for bulk degrees of freedom (DOFs) and traction-free surfaces (Neumann DOFs) [START_REF] Mendoza | Complete mechanical regularization applied to digital image and volume correlation[END_REF] Φ m ({u}

) = {u} [K m ] [K m ]{u}, (8)
where Φ m is the equilibrium gap cost function, and [K m ] the partial stiffness matrix for the aforementioned DOFs. This premise is not valid for the remaining (Dirichlet) DOFs since the external forces are not known [START_REF] Tomičević | Mechanics-aided digital image correlation[END_REF][START_REF] Mendoza | Complete mechanical regularization applied to digital image and volume correlation[END_REF]. Hence, an additional penalty term is applied for the loaded boundary nodes

Φ S ({u}) = {u} [K S ] [L][K S ]{u}, (9)
where [K S ] corresponds to the partial stiffness matrix for Dirichlet nodes, and [L] the discrete Laplace-Beltrami operator. Thus, the total cost function Φ t consists of a linear combination of DIC/DVC cost function Φ c , equilibrium gap Φ m , and penalty term for the gradient

of normal tractions Φ S Φ t ({u}) = ω c ω t Φ c ({u}) + ω m ω t Φ m ({u}) + ω S ω t Φ S ({u}), (10)
with

Φ c ({u}) = Φ c ({u})/({v} [M]{v}), Φ m ({u}) = Φ m ({u})/Φ m ({v}), Φ S ({u}) = Φ S ({u})/Φ S ({v}), (11)
and {v} are the nodal displacements associated with a trial displacement field corresponding to a shear wave of wavevector k [START_REF] Mendoza | Complete mechanical regularization applied to digital image and volume correlation[END_REF], and the weighting terms are provided based on corresponding characteristic lengths ξ

ω c = 1, ω m = (ξ m |k|) 4 , ω S = (ξ S |k|) 4 , (12)
such that

ω t = ω c + ω m + ω S . (13)
Mechanical regularization acts as a low-pass filter that enforces the smoothness of measured fields by means of characteristic lengths ξ, while leaving the low frequency resultant forces intact. When FE discretizations are employed, the regularization is activated for any ξ greater than the characteristic element length, thus enhancing the convergence rate of the correlation algorithm.

One major advantage of global DIC/DVC is the availability of gray level residual ϕ c maps for each analyzed image/scan, which are usually not computed in local registrations [START_REF] Sutton | Image correlation for shape, motion and deformation measurements: Basic Concepts, Theory and Applications[END_REF].

Besides serving as a tool for correlation quality inspection, they provide meaningful information on the gray level conservation since the latter is deteriorated when damage occurs.

Hence, in the present case, any significant local deviation to the gray level conservation or incompleteness of kinematic bases is expected to be related to damage initiation and growth.

Experimental analyses

This section addresses the experimental protocols employed in the present study. The experimental data were the applied force measured by the load cell of the testing machines and image series of specimen surface captured during the monotonic uniaxial tensile test, as well as CT scans acquired during the in situ cyclic experiment. An artificial black and white speckle pattern was applied onto the monitored surface to enable for displacement measurements via DIC. Table 1 gathers the hardware parameters of the optical setup.

Monotonic tensile test

The acquired images were analyzed via regularized FE-based DIC implemented within the Correli 3.0 framework [START_REF] Leclerc | Correli 3.0[END_REF]. Table 2 reports the parameters employed in the correlation analysis. In the present study, the displacement field was discretized with triangular (T3) elements with linear shape functions to properly describe the specimen boundaries. The finite element mesh employed in the DIC analysis, which was tailored to the actual specimen geometry, is shown in Fig. 2(a). The average element length, which was calculated as the square root of the mean element area, was equal to 20 px. Despite the fact that even finer FE meshes would better capture the surface kinematics (especially when the discontinuities are expected to occur), decreasing the element size yields higher measurement uncertainties.

Thus, a compromise between measurement uncertainties and spatial resolution needs to be reached. The former can be further reduced by employing mechanical regularization while maintaining the same spatial resolution. However, in the present study, the regularization lengths were kept of the order of the characteristic element length (Table 2). This choice allows for heterogeneities induced by the underlying random mesostructure and localized phenomena to be more apparent in strain fields since discontinuities in displacement fields are less smeared out.

Prior to performing surface measurements, the displacement and strain uncertainties were evaluated with the first 50 images acquired in the unloaded configuration (Table 3).

The displacement uncertainties lie in cpx range, while the corresponding level related to the maximum eigen strain is equal to 8 × 10 -5 , which represents lower bounds with the selected procedure. Even though mechanical regularization was limited and the supporting FE mesh consisted of small elements, the measurement uncertainties were deemed sufficiently low.

In situ cyclic test

Another 5.6 mm thick specimen (Fig. 2(b)) was subjected to in situ cyclic tension using the TTC Deben testing machine, which enables for tension, compression and torsional loadings (Fig. 3(b)). The in situ experiment was conducted in a displacement controlled mode with a velocity of 3 µm/s. The specimen was cycled with maximum load levels corresponding to 30%, 60% and 90% of its ultimate tensile strength (Fig. 3(a)). Since the proposed loading machine excludes the possibility of using the tomograph turntable, two rotational actuators allow for full rotation of the specimen during loading.

Imaging was performed on X50+ North Star Imaging tomograph of LMT. During the in situ test, 10 scans in total were acquired in loaded and unloaded stages; the first being acquired in the unloaded configuration for uncertainty quantification purposes, while the last two are scans of the fractured specimen (Fig. 3(a)). The second scan was performed in a pre-loaded state (i.e., F = 400 N). Two acquisition parameters (i.e., HQ-high quality and LQ-low quality) were utilized (Table 4). The HQ settings led to a scanning duration of approximately 2 h, while the LQ settings resulted in 4 min acquisitions, thus reducing the duration of the mechanical test and mitigating relaxation phenomena. Sections of the reference volumes acquired with HQ and LQ settings are displayed in Fig. 4. The contrast between the matrix, fibers and voids allows the bulk kinematics to be measured between the various constituents. The HQ settings resulted in lower noise levels and enabled microstruc-tural features to be imaged in more detail. In addition, such quality was compatible with the extraction of realistic microscale meshes explicitly accounting for the morphology of the investigated composite. All the volumes were reconstructed by using a filtered-backprojection algorithm and encoded as 8-bit deep gray levels and no filtering was applied to the reconstructed volumes (Table 4). The physical size of one voxel was 14.6 µm, which is close to the pixel resolution used in the first experiment (Table 4). The size of the ROI was adjusted to the specimen ligament (i.e., the thinned part of the dogbone specimen) and corresponded to 610 × 410 × 1180 voxels.

The reconstructed volumes represented by discrete scalar matrices of gray levels determined by the microstructure absorption of X-rays were analyzed via regularized FE-based DVC implemented within the Correli 3.0 framework [START_REF] Leclerc | Correli 3.0[END_REF]. The latter allows 3D displacement and strain fields to be measured in the bulk of the investigated materials [START_REF] Hild | Toward 4d mechanical correlation[END_REF]. The ROI investigated herein was discretized with first-order tetrahedral elements (T4) as shown in Fig. 2(b). The average element length, calculated as the cube root of the mean element volume, was equal to 18 voxels. Thus, the physical size (length) of 3D elements is close to that of 2D elements employed in DIC. Table 5 reports the parameters utilized in DVC analysis.

In the present case, higher regularization lengths compared to the DIC analysis were employed to obtain a strain noise floor level similar to that reported for DIC (Table 3) since the strain fields calculated via DIC/DVC are investigated to track damage growth.

Due to lower noise level and artifacts, as filtering was not applied on the reconstructed volumes, the HQ scan 0 was considered as the reference for the uncertainty quantification and subsequent correlation analyses. The uncertainties, which were calculated as the standard deviation of the measured displacement and strain fields, are reported in Table 6. DVC yielded higher displacement uncertainties compared to DIC, which is related to the natural contrast image compared to artificial black and white speckle patterns, as well as the tomography technique and its associated artifacts (e.g., image noise, displacement discretization, ring artifacts, spurious motions during scanning [START_REF] Buljac | Digital volume correlation: Review of progress and challenges[END_REF]). Additional causes are related to the second scan (LQ 00) being acquired in a pre-loaded state, as well as the fact that it was of low quality.

Results

In this section, the results of DIC/DVC analyses to track the damage development are presented. First, regularized FE-DIC was performed to estimate the global material response during the uniaxial tensile test. The mesurands in DIC/DVC analyses are displacement fields, based on which 2D/3D eigenstrain fields were calculated. The residual maps and major eigen strain fields are analyzed to track damage propagation on the surface of the investigated specimen during the monotonic, uniaxial tensile test. 3D strain maps and voxelbased residuals of the cyclic tensile test are studied to investigate damage on various scales.

In addition, the so-called section DIC procedure is proposed and run to further analyze the impact of the bulk localization phenomena on the surface observations. A comparison between DVC and section DIC results in terms of strain fields in the loading direction and correlation residual maps is presented.

DIC results

The global material response (i.e., stress / strain history) of the monotonic tension test was determined thanks to the optical sensor positioned over the thinned part of the observed ROI displayed in Fig. 5. The uniaxial stress was determined from the ratio of force by the initial area of the ligament. Both stress data and maximum eigen strain values extracted for different images acquired during the tensile test are reported in Table 7. From the stressstrain curve, a Young's modulus of E = 6.8 GPa was identified, while the ultimate tensile strength was equal to σ max = 178 MPa.

The major eigen strain fields (Fig. 6) and correlation residual maps (Fig. 7) are reported for different load levels (Table 7) to monitor damage development on the surface of the in-vestigated specimen. For visualization purposes, the strain fields consist of nodal values extrapolated from the supporting FE mesh. The initial major eigen strain field corresponding to Image 40 (captured in the unloaded state) is shown in Fig. 6(a). Strain fluctuations of small magnitude were induced by camera sensor noise. With the gradual increase of load levels, the major eigen strains also increased within the entire ROI (Fig. 6(b)). The first strained areas were captured for a load level of 2.8 kN still in the linear elastic regime (Fig. 6(c)). These localized phenomena initiated on the edges of the specimen ligament (the blue dashed arrows depict both initiation location and growth path of detected strained areas). The macroscopic nonlinearities are still very small, which indicates the impact of specimen machining-induced damage.

As the load levels became higher, localized phenomena were more apparent, as well as additional strained areas appeared on the edges of the sample ligament (marked with green arrows in Fig. 6(d)). Since the stress/strain response became nonlinear (Fig. 5), damage propagated on the specimen surface and presumably in the bulk of the material. Consequently, numerous strained bands bypassing underlying heterogeneities are observed on the specimen surface. Further, the gradual increase of loading induced increases of the strain levels within the whole ROI (Fig. 6(e)). Even though damage was observed in multiple areas, the final crack path following two strained bands initiated on the ligament edges was revealed in the narrowest gauge section (Fig. 6(f)). The observed path was curved, thereby revealing the impact of underlying heterogeneities.

The same pattern of both damage initiation and growth is observed when analyzing the correlation residual maps (Fig. 7). The gray level residuals were thresholded in a way that an increase of fluctuations can be visualized. In the unloaded stage, very low residuals induced by camera sensor noise were homogeneously distributed within the ROI (Fig. 7(a)), implying that DIC registration was successful. With the increase of load levels, the correlation residuals gradually increased within the observed ROI (Fig. 7(b)). The first disconti-nuities (i.e., areas of higher correlation residuals) were detected on the edges of the sample ligament (marked with blue dashed arrows in Fig. 7(c)) for Image 150 corresponding to a force equal to 2.8 kN. As the load levels became higher, localized phenomena became more evident and the presence of the dominant macrocrack in the narrowest gauge section was also revealed (Fig. 7(f)).

The quality of the measured kinematics was evaluated from the correlation residual maps since higher values indicate local violations to the gray level conservation. This phenomenon makes correlation residuals the ideal field to unveil the presence of cracks when displacement continuities were assumed. The conducted analysis proves the effectiveness of the employed methodology, i.e., regularized FE-DIC, to track damage development on the surface of composite materials. However, such an approach does not enable the extent of damage processes within the material bulk to be assessed, nor does it provide the possibility for relating microstructural and kinematic changes to damage developing in the material bulk. This may be achieved via in situ XCT coupled with FE-based DVC as discussed in the next section.

DVC results

During the in situ cyclic test, a total amount of 10 scans was acquired (Fig. 3(a)). The registration was performed between the undeformed volume (HQ scan 0) and the deformed ones (LQ scans 00-07). Fig. 8 displays 3D renderings of major eigen strain fields for different loading and unloading steps of the cyclic test. Strain fluctuations of small magnitude are observed in the reference configuration (i.e., scan 00). When observing the major eigen strain field of the first loading step, slightly elevated strains are apparent on the front surface in the narrowest gauge section. For the subsequent unloading step, the observed areas vanish, and an essentially homogeneous strain distribution occurs apart from measurement uncertainties. Several highly strained regions are first observed for scan 03 (i.e., when the specimen was loaded up to 60% of its ultimate tensile strength). These localized phenom-ena are established on the ligament surfaces, which again indicates the influence of sample machining. Further, the spatial distribution of major eigen strains exhibits a horizontal strained band in the narrowest gauge section on the front specimen surface (having positive y normal), as well as inclined bands contouring the underlying random mesostructure.

These localized phenomena again disappear after unloading. In the last step of loading, localized phenomena in the narrowest gauge section of the specimen front surface become even more dominant.

To examine the complex kinematics occurring within the material bulk, the thresholded voxel-based strain fields are analyzed and shown in Fig. 9. In the unloaded configuration, the fluctuations induced by measurement uncertainties are hardly observed with the selected range. Even in the first loading step, the formation of an inner strained band in the narrowest gauge section is detected, already indicating the path along which the final failure occurred. In the following unloading step the strain levels decrease, and the strain field exhibits distributions within the material bulk similar to scan 00 (i.e., the strained bands were no longer active). When loading the specimen up to 60% of its ultimate tensile strength, the strained bands observed in the first loading step become more apparent (the strain levels inside the bands increase), and the strain field is now more localized. Yet, the subsequent unloading step once again results in an essentially homogeneous strain field within the material bulk (apart from fluctuations induced by measurement uncertainties). During the last loading step, multiple strained bands are observed in the investigated ROI. Localized phenomena are dominant in the narrowest gauge section and surround the fully developed crack that induced specimen failure.

The analysis of the strain fields throughout the cycling history leads to the conclusion that one cannot benefit from any ex situ measurements (i.e., in the unloaded states) since most pieces of meaningful information were lost during specimen unloading. To further prove this statement, as well as to investigate damage development within the material bulk, 3D renderings of gray level residuals for scans acquired during the cyclic experiment are analyzed in the sequel (Fig. 10). The voxel-based residual fields were thresholded in a way that all estimated levels that fall outside of the specified range originate from mechanical causes (i.e., the focus is shifted only to an absolute range from 70 to 100 gray levels). In For a deeper understanding of damage development in the material bulk, the correlation residuals (Fig. 11) and major eigen strain fields (Fig. 12) of scan 05 extracted for characteristic sub-regions (1, 2 and 3) are laid over the corresponding mesostructure. Since the purpose of the conducted study was to demonstrate the capabilities of bulk measurements compared to surface observations, not all damaged areas were analyzed in detail.

For subset 1 located near the specimen front surface (y = 457 voxels), two characteristic sections are extracted, the first section being normal to the y-axis (y = 451 voxels) and the second being normal to the z-axis (z = 400 voxels) as shown in Fig. 11. Higher correlation residuals appear along the fiber longitudinal axis, as well as on the fiber-matrix interface (indicated with green arrows in Fig. 11 on the corresponding sections). When observing the corresponding major eigen strain distribution (Fig. 12), the same localized phenomena occur, namely, strained bands visible in y-and z-normal sections following the fiber contour, as well as fiber-matrix interfaces (marked with green arrows in Fig. 12).

Furthermore, the correlation residuals and major eigen strains of subset 2 are analyzed in two characteristic sections, the first being normal to the y-axis (y = 429 voxels) and the second being normal to the z-axis (z = 798 voxels), see Fig. 11. The correlation residual map of the section normal to the y-axis overlaid with the corresponding mesostructure in the background reveals elevated residuals both at fiber-matrix interfaces and along the longitudinal axis of fibers. The analysis of the correlation residuals in the z-normal section unveils areas with higher levels on the fiber-matrix interface near an air void (marked with green arrows in Fig. 11). Such localized phenomena (i.e., inclined strained bands containing the underlying fiber architecture) are displayed in Fig. 12.

The same procedure was followed in the analysis of correlation residuals and major eigen strains in subset 3, i.e., for y = 167 voxels and z = 828 voxels sections. As observed in Fig. 11, areas of elevated residuals visible in the section along the y-normal encompass the fiber region passing over an air void (marked with green arrows in Fig. 11), which contributed to damage development (since the matrix-fiber bond was damaged). This phenomenon is even more apparent in the section normal to z (Fig. 12) and jeopardized the integrity of the investigated specimen.

Section DIC

To further prove the importance of DVC (bulk) measurements, a section DIC (S-DIC) approach is proposed. The correlation analyses were conducted separately for the front and rear specimen surfaces, and the corresponding sections were extracted employing the following procedure. First, a binary mask of the reference configuration volume (HQ scan 0) was created. Next, the first and last high gradient values of the mask (corresponding to the front and rear surfaces) were searched for through the specimen thickness (i.e., along the y-direction). After obtaining the maps that contained the voxels belonging to the front and rear surfaces, a plane was fitted to these maps. Based on the plane parameters (i.e., point and normal vector), oblique sections of the front and rear specimen surface were extracted (Fig. 13). To obtain similar sections of the scans acquired during the loading/unloading history, rigid body motions were determined from the available DVC kinematics and applied to correct the position of the deformed scans to coincide with the reference scan (HQ scan 0).

Then, the previously introduced procedure was employed to extract oblique sections of the deformed volumes.

The extracted sections were used to perform regularized in-plane DIC. The front and rear section meshes consisting of 20-pixel T3 elements were tailored to the specimen ligament edges, while the spatial distribution of the nodes coincided with the surface nodes of the 3D mesh employed in the DVC correlation (Fig. 14) to maintain consistency with DVC analyses. Further, equal regularization lengths as in DVC analyses were kept (i.e., 96 px for bulk and 64 px for Dirichlet nodes). This choice also helped S-DIC analyses to converge and measurement uncertainties to be decreased. The uncertainty levels related to displacement and normal strain in the loading direction were found to be 0.14 px and 0.002 for the front surface, and 0.12 px and 0.002 for the rear surface. Although mechanical regularization was employed, S-DIC resulted in higher measurement uncertainties compared to DVC registration (Table 6). It is believed that a large part of these errors was induced by the procedure for extracting planar sections. Additional sources are, as for DVC, the use of low resolution scans.

Fig. 15 shows a comparison of mean strains in the loading direction ( zz ) for different loading/unloading steps extracted from the measured kinematic fields with virtual gauges positioned over the ROI (i.e., 2D gauge in S-DIC and 3D gauge in DVC of the same size).

At the macroscale, the average strains are consistent for the three gauges. It is worth re-membering that areas of elevated DVC residuals were observed near the front specimen surface (Fig. 10), namely, damage initiated in the bulk and propagated toward the front surface.

Yet the strain levels remained close.

From the DVC mesh, two surface meshes were also extracted. The corresponding nodal strains were obtained from the DVC results for these 2D meshes. The mean zz strains were calculated by virtual gauges positioned over the ROI and are compared to the S-DIC levels.

In both cases, DVC leads to slightly higher mean levels (Fig. 16). These results show very good consistency between DVC measurements, the corresponding surface data, and S-DIC.

It was noted that the average strains for scan 02 were systematically negative even though the applied force remained positive. The origin of this result could not be elucidated.

The previous statements are further proven by comparing zz fields on the front and rear surfaces calculated with both S-DIC and DVC for the last scan prior to specimen failure (Fig. 17). The color bar was limited to a maximum value of 0.06 to highlight differences in strain levels. Although local zones with higher measured strains are revealed on the front surface (namely, on the ligament edges), S-DIC yields significantly lower strain fluctuations compared to DVC (Fig. 17(a)). The maximum zz level of scan 05 was found to be 11.3% for DVC, while S-DIC measurements resulted in a maximum level equal to 5.4%.

The same trend was observed for the rear surface (Fig. 17(b)). These results underline the added value of bulk measurements, i.e., even though areas with higher strains were captured by S-DIC, the bulk kinematics, which contributed to surface observations could not be fully assessed. The strong impact of underlying heterogeneities on surface strain fields is exemplified, as well as the importance of bulk measurements when investigating damage in composite specimens.

Last, a comparison between S-DIC and DVC was also conducted in terms of correlation residuals. Areas with high levels were not observed on the rear surface. Thus, the comparison is discussed only for the front surface (Fig. 18). Elevated residuals occurred near the ligament edges (marked with green circles in Fig. 18). These areas correspond to damage observed in subsets 1 and 2 (Fig. 11), which initiated in the material bulk and subsequently grew toward the specimen surface. The S-DIC residual map in the remainder of the ROI displayed sufficiently low values. This is a confirmation that, despite higher measurement uncertainties, the strain fields were considered trustworthy. It is concluded that S-DIC can successfully capture damage development on the specimen surface. However, damage initiation could not be detected.

Conclusion

The present paper compared different image based registration techniques for the analysis of damage in a polymer matrix composite (i.e., Digital Image and Volume Correlation).

Monotonic and cyclic uniaxial tensile tests were performed on a continuous glass fiber mat reinforced epoxy resin composite specimens. First, FE-DIC was employed to measure kinematic fields on the surface of the investigated material during monotonic tension. The analysis of correlation residual maps and major eigen strain fields successfully revealed damage inception and growth. However, such measurements did not allow for the assessment of the 3D kinematics in the material bulk.

Additional insight into underlying damage mechanisms was obtained by performing an in situ cyclic test on a dogbone specimen imaged via X-ray tomography. Bulk kinematic fields were measured via FE-DVC. The analysis of 3D major eigen strain fields revealed several strained bands not only on the surfaces but in the material bulk as well. When observing the strain fields of unloaded steps after strain localization onset, the strained bands were no longer active, and the strain levels significantly decreased. The same trend was found for the voxel-based residual fields, namely, the discontinuities observed when cycling the specimen up to 60% of its ultimate tensile strength were no longer visible. These phenomena highlight the importance of in situ measurements since ex situ analyses (i.e., imaging the unloaded sample) would have resulted in a loss of information beneficial for damage detection. In addition, the residual fields and major eigen strain fields laid over the corresponding mesostructure enabled damage initiation to be assessed.

In order to further highlight the advantages of bulk measurements, so-called section DIC (or S-DIC) was implemented and conducted on the front and rear surfaces of the sample cycled in tension. It was shown that S-DIC resulted in lower strain fluctuations on both surfaces, which exemplified the impact of bulk kinematic changes on surface observations. S-DIC residual maps revealed zones of higher residuals on the ligament edges of the front surface corresponding to the areas observed when analyzing DVC residual fields. The latter ones proved that damage initiated in the material bulk and subsequently propagated toward the specimen surface. Even though S-DIC efficiently revealed macrocracks on the specimen surface, the first discontinuities appeared within the material bulk and could not be assessed with such measurements. scanning settings corresponding to scans 0 and 00, respectively (Fig. 3). The red contours depict the region of interest whose size was 610 × 410 × 1180 voxels. The physical length of one voxel was 14.6 µm.

Fig. 2 (

 2 Fig.2(a) shows a 5.8 mm thick dogbone specimen thinned in the central part with a radius of 49 mm to ensure that it breaks in the ligament area. The smallest cross-section of the specimen was equal to 5.8 × 5.8 mm 2 . The specimen was subjected to a displacementcontrolled monotonic and uniaxial tensile loading with a prescribed stroke rate of 2 mm/min. The ROI shown in Figure Fig.2(a)was monitored with a single CCD camera (images were acquired at a frame rate of 3 fps). Three hundred thirteen images were captured; the first 50 images corresponding to the reference configuration to evaluate measurement uncertainties.

  the reference configuration, very low residuals are homogeneously distributed within the ROI. The first discontinuities are captured for scan 03 corresponding to 60% of the ultimate tensile strength. These very localized phenomena appear near the front specimen surface (y = 457 voxels) in the section normal to the positive y-axis (y = 453 voxels), as well as in the material bulk. Besides these highlighted regions, the residual map in the remainder of the ROI exhibits sufficiently low values indicating successfully converged DVC calculations. In the present case, damage, which remained very localized, did not bias too much the DVC results[START_REF] Croom | Effect of fragile speckle patterns on accuracy of digital volume correlation[END_REF]. During the following unloading step, the observed localization areas disappear. If one assumes damage initiated during the previous loading stage, the subsequent unloading induced crack closure (and damage deactivation). Further, in the last loading cycle prior to specimen failure (scan 05 corresponding to 90% of the ultimate tensile strength), multiple regions of increased residuals are observed, some of which related to the same areas observed in the corresponding field of scan 03.

5 Stress/ 36 6 37 7 39 9

 5363739 strain response of the monotonic experiment. The solid black circles denote the images for which the correlation residual maps and major eigen strain fields are analyzed to detect damage. The blue rectangle plotted over the major eigen strain field calculated prior to the specimen failure depicts the virtual gauge used to calculate the mean strains in the thinned part of the investigated region of interest. . . . . . . . . . . . . . . . . . . . . . . . . . Major eigen strain fields for different load levels of the monotonic tensile test. The blue dashed arrows depict the initiation location and growth path of the first detected damage (i.e., zones in which eigen strains increase with prescribed load), while the green dashed arrows indicate additional areas of elevated major eigen strains. The size of the region of interest corresponded to 2040 × 615 pixels. The physical length of one pixel was 16 µm. . . . . . . Correlation residual maps for different load levels of the monotonic tensile test. The blue dashed arrows depict initiation locations and growth path of the first detected discontinuities (i.e., zones in which residuals increase with prescribed load), while the green dashed arrows indicate the additional areas of higher correlation residuals. The size of the region of interest was equal to 2040 × 615 pixels. The physical length of one pixel was 16 µm. . . . . . . 38 8 3D renderings of the major eigen strain fields captured in the undeformed configuration (scan 00) and subsequent loading/unloading steps (Fig. 3(a)). The size of the region of interest was equal to 610 × 410 × 1180 voxels, and the physical length of one voxel was 14.6 µm. . . . . . . . . . . . . . . . . . Thresholded major eigen strain fields calculated for the undeformed configuration (scan 00) and subsequent loading/unloading steps (Fig. 3(a)). The size of the region of interest corresponded to 610 × 410 × 1180 voxels. The physical length of one voxel was 14.6 µm. . . . . . . . . . . . . . . . . . . . 40

Fig 1 .Fig 2 .Fig 3 .Fig 4 .

 1234 Fig 1. Cross sections of the composite microstructure at two different magnifications obtained by optical microscopy.

Fig 5 .Fig 6 .Fig 7 .

 567 Fig 5.Stress / strain response of the monotonic experiment. The solid black circles denote the images for which the correlation residual maps and major eigen strain fields are analyzed to detect damage. The blue rectangle plotted over the major eigen strain field calculated prior to the specimen failure depicts the virtual gauge used to calculate the mean strains in the thinned part of the investigated region of interest.

Fig 8 .

 8 Fig 8. 3D renderings of the major eigen strain fields captured in the undeformed configuration (scan 00) and subsequent loading/unloading steps (Fig.3(a)). The size of the region of interest was equal to 610×410×1180 voxels, and the physical length of one voxel was 14.6 µm.

Fig 9 .Fig 10 .

 910 Fig 9.Thresholded major eigen strain fields calculated for the undeformed configuration (scan 00) and subsequent loading/unloading steps (Fig.3(a)). The size of the region of interest corresponded to 610 × 410 × 1180 voxels. The physical length of one voxel was 14.6 µm.

Fig 11 .

 11 Fig 11. Correlation residuals (scan 05) laid over the corresponding mesostructure sections. The subsets for which comprehensive analyses of correlation residuals and major eigen strain fields are performed are denoted as 1, 2 and 3. The green arrows indicate areas of increased correlation residuals in two perpendicular planes.

Fig 12 .

 12 Fig 12. Major eigen strain fields (scan 05) plotted over the corresponding mesostructure sections. Characteristics subsets for which comprehensive analyses of correlation residuals and major eigen strain fields are conducted are denoted with 1, 2 and 3. The green arrows indicate strain localization areas in two perpendicular planes corresponding to regions of increased correlation residuals, as noted in Fig. 11.

Fig 13 .

 13 Fig 13. 2D front and rear sections of HQ scan 0 (Fig. 3(a)). The corresponding front and rear sections of each acquired scan are then used to perform S-DIC.

Fig 14 .

 14 Fig 14. 2D mesh employed in S-DIC procedure (red) and DVC mesh (blue) plotted over the corresponding mesostructure for the front (a) and rear (b) specimen surfaces.

Fig 15 .

 15 Fig 15. Comparison of mean zz strain levels extracted from DVC and S-DIC runs. The mean strain levels are calculated with 2D and 3D virtual gauges of same size positioned over the ROI. The position and size of the gauge are depicted with the blue box on the S-DIC front surface showing zz strain field (scan 05).

Fig 16 .

 16 Fig 16. Comparison of mean zz strain levels extracted from the front/rear DVC and S-DIC runs. The mean strain levels are calculated via 2D virtual gauges of same size put over the ROI. The gauge position and size are depicted with the blue box in the S-DIC front surface showing zz strain field (scan 05).

Fig 17 .

 17 Fig 17. Comparison of longitudinal strain fields ε zz obtained with S-DIC (left) and DVC (right) for scan 05 on (a) the front, and (b) rear surfaces. The black arrows depict the location of maximum strain.

Fig 18 .

 18 Fig 18. Comparison of correlation residual fields on the front specimen surface obtained with S-DIC (left) and DVC (right) for scan 05. The green circles depict the areas of higher residuals observed on the specimen front surface.

Table 1 .

 1 DIC hardware parameters.

	Camera	CCD Dalsa
	Definition	2358 × 1728 pixels
	Gray levels amplitude 8 bits
	Lens	Titanar 50 mm
	Aperture	f / 2.8
	Field of view	38 × 28 mm 2
	Image scale	16 µm / pixel
	Stand-off distance	120 mm
	Image acquisition rate 3 fps
	Exposure time	26 ms
	Patterning technique	Sprayed black paint

Table 7 .

 7 Stress and maximum eigen strain levels for different load levels of the uniaxial tensile test.

	Image number σ, MPa	ε 1
	40	-	-
	100	37	0.006
	150	80	0.013
	195	119	0.018
	265	164	0.026
	299	178	0.037

Acknowledgments

This work was conducted within the FULLINSPECT project supported by the Croatian Science Foundation (UIP-2019-04-5460 Grant).

 4) Natural (Fig. 4)


Guillaume Bonfante

Matthieu Kaczmarek

Jean-Yves Marion

Morphological Detection of Malware

In the field of malware detection, method based on syntactical consideration are usually efficient. However, they are strongly vulnerable to obfuscation techniques. This study proposes an efficient construction of a morphological malware detector based on a syntactic and a semantic analysis, technically on control flow graphs of programs (CFG). Our construction employs tree automata techniques to provide an efficient representation of the CFG database. Next, we deal with classic obfuscation of programs by mutation using a generic graph rewriting engine. Finally, we carry out experiments to evaluate the false-positive ratio of the proposed methods.

Introduction

Since there are no obvious technologies to prevent fully and precisely the spreading of viruses and more generally of malwares, the issue of detection cannot be simply thrown out. There are several approach in detection, some of them put the accent on syntactic features, some others on behavioural considerations. Debar, Filiol and Jacob have proposed a taxonomy for detection technologies [START_REF] Debar | Behavioral detection of malware: from a survey towards an established taxonomy[END_REF]. Our technique is essentially syntactic, but we take into account some more semantical features of programs.

Generally speaking, string signature based detection uses a database of malware signatures made of regular expressions and a string matching engine to scan files and detect infected ones. There are (at least) three difficulties, which are bound to this kind of detection approach. First, the identification of a malware signature requires a human expert and the time to forge a reliable signature is long compared to the time related to a malware attack. Second, string signature approach can be easily bypassed by obfuscation methods. Among recent work treating this subject, we propose to see for example [START_REF] Beaucamps | On the possibility of practically obfuscating programs towards a unified perspective of code protection[END_REF][START_REF] Christodorescu | Testing malware detectors[END_REF][START_REF] Filiol | Malware pattern scanning schemes secure against black-box analysis[END_REF]. Third, as the quantity of malware increases, the ratio of false positive augments. One may remove old viruses from databases, but such a technique lets the door open to new (old) malware.

Thus, a current trend in the community is to design a new generation of malware detectors based on semantical aspects [START_REF] Dalla Preda | A Semantics-Based Approach to Malware Detection[END_REF][START_REF] Christodorescu | Semantics-aware malware detection[END_REF] or [START_REF] Walenstein | Normalizing metamorphic malware using term rewriting[END_REF]. However, a major difficulty of these approaches is the efficiency of the detection. Heuristics can be very complex as it is illustrated in the field of computer safety. We will put the accent on these issues.

In [START_REF] Bonfante | Control Flow Graphs as Malware Signatures[END_REF] , we proposed a new morphological analysis to detect viruses. The idea is to recognize the shape of the control flow graphs of malicious program. Unlike string signature detection, we are not only considering a program as a flat text, but rather as a semantical object, adding in some sense a new dimension to the analysis. To sum up, our approach tries to combine several features: (a) to associate syntactic and semantic analysis, (b) to be efficient and (c) to be as automatic as possible.

Our morphological detector is based on control flow graphs (CFG) of programs. We use a set of CFG which plays the role of a malware signature database. Next, the detection consists in scanning files in order to recognize the shape of a malware. As we see, the design is closed to a string signature based detector, so that both approaches may be combined in a close future. Moreover, it is important to notice that this framework make the signature extraction easier. Indeed, the CFG can be used directly as a witness of the program.

This detection strategy is close to [START_REF] Christodorescu | Semantics-aware malware detection[END_REF][START_REF] Bruschi | Detecting self-mutating malware using control-flow graph matching[END_REF]. However, we use a different notion of CFG, technically, we make the an other abstraction of instruction flow graph. Second point, we put our strengths to optimize the efficiency of algorithms, a key point for "real" applications. For that sake, we use tree automata, a generalization to trees of finite state automata over strings [START_REF] Comon | Tree automata techniques and applications[END_REF]. Here, we transform CFG into trees with, intuitively, pointers in order to represent back edges and cross edges. Then, the collection of malware signatures is a finite set of trees and so a regular tree language. Thanks to Myhill-Nerode construction, the minimal automaton gives us a compact and efficient database. Notice that the construction of the database is iterative and it is easy to add the CFG of a newly discovered malicious program.

Another issue of malware detections is the soundness with respect to classic mutation techniques. Here, we detect isomorphic CFG and so we take into account several classical obfuscation methods. Moreover, we add a rewriting engine which normalizes CFG in order to have a robust representation of the control flow with respect to mutations. Related works are [START_REF] Bruschi | Detecting self-mutating malware using control-flow graph matching[END_REF][START_REF] Christodorescu | Software transformations to improve malware detection[END_REF][START_REF] Walenstein | Normalizing metamorphic malware using term rewriting[END_REF] where program data flow is also considered.

The design of this complete chain of process is summarized by Figure 1.

We also provide large scale experiments, with a collection of 10156 malicious pro-

CFG in x86 languages

Roadmap. We consider an assembly language and we explain how its Control Flow Graph (CFG) can be extracted. We underline the difficulties that can be encountered and we outline how they can be overcome with classic techniques. Finally, we present a generic method to normalize mutation of the CFG using graph rewriting rules.

An x86 assembly language. We present the grammar of an assembly language which is close to the x86 assembly language from which we developed our malware detection system.

Addresses

N Offsets Z Registers R Expressions E ::= Z | N | R | [N] | [R] Flow instructions I f ::= jmp E | call E | ret | jcc Z Sequential instructions I d ::= mov E E | comp E E | ... Programs P ::= I d | I f | P ; P A program is a sequence of instructions p = i 0 ; ... ; i n-1 . The address of the instruction i k is k. The program entry point is the first instruction i 0 .
Prerequisites. The extraction of the CFG from a program is tied to several difficulties. First, since we need access to the instructions of the program, packing and encryption techniques can thwart the extraction. This problem is well known, and classical string signature detectors also suffer from those techniques. Many solutions such as sandboxes and generic unpackers have been developed to overcome this difficulty. The presentation of those solutions exceeds the scope of the current study then we refer to the textbooks [START_REF] Filiol | Advanced viral techniques: mathematical and algorithmic aspects[END_REF][START_REF] Filiol | Computer Viruses: from Theory to Applications[END_REF][START_REF] Ször | The Art of Computer Virus Research and Defense[END_REF].

Second, the extraction process should take care of obscure sequences of instructions such as push a; ret which has the behavior of the instruction jmp a. Again, this is also part of the folklore in the domain and we will suppose that such sequences of instructions are normalized during the disassembly phase of the extraction.

Third, the target addresses of jumps and function calls have to be dynamically computed. For example, to build the control flow graph at instruction jmp eax, one needs the value of the register eax in order to follow the control flow transfer. In such cases, our current procedure rely on a heuristic (|e| ) which provides the value of the expression e by static analysis. If the value cannot be computed then (|e| ) = ⊥. Such an heuristic can be based on partial evaluation, emulation or any other static analysis technique.

The extraction procedure. We suppose that we have access to the code of programs and that we have an heuristic (| | ) to evaluate expressions. Table 1 presents a procedure to abstract the control flow of programs. If an expression cannot be evaluated then the extraction yields an end node. The entry point of the program correspond to the root of the CFG. We remark that a CFG is a rooted directed graph with ordered successors as a result any CFG can be represented by a flow graph.

Instruction Graph

i n ∈ I d i n = jmp e (|e| ) = k i n = call e (|e| ) = k i n = jcc x

Otherwise Table 1: Control flow graph extraction

Normalize mutations. Our CFG representation is a rough abstraction of programs. Indeed we do not make any distinction between the different kinds of sequential instruction, there are all represented by nodes labelled with inst. This first abstraction level makes the CFG sound wrt mutations which substitutes instructions with the same behaviour. For example the replacement of the instruction mov eax 0 by the instruction xor eax eax does not impact our CFG representation.

We make the CFG even more sound with respect to classic mutation techniques consid-ering other abstractions.

• Concatenate consecutive instructions into blocks of instructions.

• Realign code removing superfluous unconditional jumps.

• Merge consecutive conditional jumps.

Those abstractions can be defined through the graph rewriting rules of We remark that each rewriting rule impose a diminution of the size of the rewritten graph then the reduction clearly terminates. Moreover, since there is no critical pair we have no problem of confluence. Nevertheless, normalizing mutation through rewriting rules is a generic principle that could be applied on sophisticated cases. Then, the issues of termination and confluence will be carefully considered.

Efficient database

Roadmap. Morphological detection is based on a set of malware CFG which plays the role of malware signatures. This collection of CFG is compiled into a tree automaton thanks to a term representation. Since tree automata fulfill a minimization property, we obtain an efficient representation of the database. Next, we apply this framework for the sub-CFG isomorphism problem in order to detect malware infection.

From graphs to terms. A path is words over {1, 2} * , we write ǫ the empty path. We define the path order for any path ρ, τ ∈ {1, 2} * and any integer i ∈ {1, 2} From now on, let the set of symbols be F = {inst, jmp, call, jcc, ret} ∪ {1, 2} * . In the corresponding trees, a node labelled by word/path ρ = {1, 2} * is thought of as a pointer to the corresponding node of the tree. Then, a tree have two kind of nodes: the inner nodes labelled by symbols of {inst, jmp, call, jcc, ret} and the pointer nodes labelled by path in {1, 2} ρ . In the following we write d(t) the set of inner nodes of the tree t, that is

ρ1 < ρ2 ρ < ρi ρ < τ ⇒ ρρ ′ < τ τ ′ A tree
d(t) = ρ ρ ∈ d(t) t(ρ) ∈ {inst, jmp, call, jcc, ret}
Next a tree t is well formed if for any paths ρ, τ ∈ d(t)

t(ρ) = τ ⇒ τ ∈ d(t) and ρ ≤ τ

Concatenate instructions

Realign code Merge jcc

→ → → Table 2: Control flow graph reductions

We observe that any CFG can be represented by a unique well formed tree Tree automata. A finite tree automaton is a tuple A = (Q, F, Q f , ∆), where Q is a finite set of states, F is a set of symbols, Q f ⊂ Q is a set of final states and ∆ is a finite set of transition rules of the type a(q 1 ... q i ) → q with a ∈ C has arity i and q, q 1 , ... , q i ∈ Q.

A run of an automaton on a tree t starts at the leaves and moves upward, associating a state with each sub-tree. Any symbol a of arity 0 is labelled by q if a → q ∈ ∆. Next, if the direct sub-trees t 1 , ... , t n of a tree t = a(t 1 , ... , t n ) are respectively labelled by states q 1 , ... , q n then the tree t is labelled by the state q if a(q 1 , ... , q n ) → q ∈ ∆. A tree t is accepted by the automaton if the run labels the root node of t with a final state. We observe that a run on a tree t can be computed in linear time, that is O(|t|).

For any automaton A, we write L(A) the set of trees accepted by A. A language of trees L is recognizable if there is a tree automaton A such that L = L(A). We define the size |A| of an automaton A as the number of its rules.

Tree automata have interesting properties. First, it is easy to build an automaton which recognize a given finite set of trees. This operation can be done in linear time, that is O(n) where n is the sum of the sizes of the trees in the language. Second, we can add new trees to the language recognized by an automaton com-puting a union of automata, see [START_REF] Comon | Tree automata techniques and applications[END_REF]. Given an automaton A, the union of A with an automaton A ′ can be computed in linear time, that is

O(|A ′ |).
Finally, for a given recognizable tree language, there exists a unique minimal automaton in the number of states which recognizes this language. This property ensures that the minimal automaton is the best representation by means of tree automata.

Theorem 1 (From [START_REF] Comon | Tree automata techniques and applications[END_REF]). For any tree automaton A which recognizes a tree language L we can compute in quadratic time (O(|A| 2 )) a tree automaton A which is the minimum tree automaton recognizing L up to a renaming of the states.

Building the database. We explain how this framework can be used to detect malware infections. Suppose that we have a set {t 1 , ... , t n } of malware CFG represented by trees. Since this set is finite, there is a tree automaton A which recognizes it.

Next, consider the tree representation t of a given program. Computing a run of A on t, we can decide in linear time if this tree is one of the the trees obtained from malware CFG. This means that that we can efficiently decide if a program have the same CFG as a known malware.

Finally, we can speed up the detection computing the minimal automaton which recog-nize the language {t 1 , ... , t n }. From a practical point of view this is the most efficient representation of the malware CFG database.

Detecting infections. Actually, when a malicious programs infects an other program, it includes its own code within the program of its host. Then, we can reasonably suppose that the CFG of the malicious program appears as a sub-graph of the global CFG of the infected program. As a result, we can detect such an infection by deciding the sub-graph isomorphism problem within the context of CFG.

So, our problem is a classical problem of subgraph isomorphism property, a property which is NP-complete in general. However, due to the fact that the successor relation is ordered, in the present terms, the problem is polynomial. Indeed a CFG composed of n vertices has only n distinct sub-CFG of at most n vertices1 . Then to detect sub-CFG it is sufficient to run the automaton on the tree representations of all the sub-CFG.

Experiments

Roadmap. We consider the win32 binaries of VX Heavens [2] malware collection. This collection is composed of 10156 malicious programs. Then, we have collected 2653 win32 binaries from a fresh installation of Windows Vista TM . This second collection is considered as sane programs.

Using those samples we experiments with our implementation of the morphological detector. We focus our attention on false positive ratios in order to validate the our method. Indeed, we have to know if it is possible to discriminate sane programs from malicious ones only considering their CFG. The following experimental results agree with this hypothesis. • We have implemented a dynamic disassembler based on the disassembler library Udis86 [1].

• We reduce the obtained CFG according to the rules of Table 2.

Figure 3 presents the result of the CFG extraction from the malware database. About 5% of the database are programs with a non valid PE header, they produce an empty graph. Then we are able to extract a CFG of more that 5 nodes from about 80% of the program of the database. The remaining 15% produce a CFG which have between 1 and 5. We think that those graphs are too small to be relevant.

Figure 3 gives the sizes of the reduced CFG extracted from the programs of those collections. On the X axis we have the upper bound on the size of CFG and on the Y axis we have the percentage of CFG whose size is lower than the bound.

Evaluation. As said above we dispose of a collection of 10156 malicious programs and 2653 sane programs. Figure 3 gives the sizes of the reduced CFG extracted form the programs of those collections. On the X axis we have the upper bound on the size of CFG and on the Y axis we have the percentage of CFG whose size is lower than the bound.

We are interested by false positives, that is sane programs detected as malicious. For that, we have collected 2653 programs from a fresh installation of Windows Vista TM . Let us note S this set of programs. Let N ∈ N be a lower bound on the size of malware CFG, we consider the following approximation of the false We do not evaluate false negatives, that is undetected malicious programs. Indeed, by construction all malicious programs of our malware collection are detected by the morphological detector. Nevertheless, this methods seems promising for this aspect. Indeed, the study [START_REF] Bruschi | Detecting self-mutating malware using control-flow graph matching[END_REF] has shown that a CFG based detection allows to detect the high-obfuscating computer virus MetaPHOR with no false negative.

Building the database. Let N ∈ N be the lower bound on the size of CFG. We build the minimized automaton A N M which recognizes the set of tree representations of malware CFG. We define the morphological detector D N M as a predicate such that for any program p ∈ P we have D N M (p) = 1 if a malware CFG appears as a sub-graph of CFG(p) and D N M (p) = 0 otherwise. We have seen in the previous sections that D N M can be decided using A N M . This design has several advantages. First, when a new malicious program is discovered, one can easily add the canonical tree of its CFG to the database using the union of tree automata and a new compilation to obtain a minimal tree automaton.

The computation of the 'not minimal' automata takes about 25 minutes. The minimization takes several hours but this delay is not so important. Indeed, within the context of an update of the malware database, during the minimization we can release the 'not minimal' automaton. Indeed, even if this is not the best automaton it still recognize the malware database and it could be used until the minimization is terminated.

Experimental results. We have built tree automata from the malware sample. According to the previous section we obtain the morphological detectors D N M . We have tested those detectors on the collection of saneware in order to evaluate the false positives. It takes about 5 h 30 min to analyse the collection of saneware, this represents the analysis of 2 ′ 319 ′ 294 sub-CFG. Table 3 presents the results. The first column indicates the considered detector according to the lower bound N . The second column indicates the number of false negatives, those are malicious programs whose CFG have sizes lower than the bound. The ratio is computed with respect to the whole database of 10156 malicious programs. The last column indicates the number of false positives and the ratio with respect to the collection of 2653 sane programs.

Conclusion

In this paper, we wanted to show that issues about the efficiency of detectors based on semantical features could be overwhelmed. From that point of view, the result we got are somewhat promising, and we still work on it. But now, our main issue is to get a better evaluation of the precision of our system. Indeed, the use of Vista distribution as saneware witnesses may provoke a bias in our analysis. We are currently working on this issue.

Figure 1 :

 1 Figure 1: Design of the control flow detector

Figure 2 :

 2 Figure 2: A program and its CFG

  domain is a set d ⊂ {1, 2} * such that for any path ρ ∈ {1, 2} * and any integer i ∈ {1, 2} ρi ∈ d ⇒ ρ ∈ d A tree over a set of symbol F is a pair t = (d(t), t) where d(t) is a tree domain and t is a function from d(t) to F.

  CFG extraction in practice. To overcome the difficulties of the CFG extraction we have chosen the following solutions • We use partly the unpacking procedure of ClamAV TM [3].

Figure 3 :

 3 Figure 3: Sizes of control flow graphs

Table 2

 2

	0: cmp eax 0
	1: jne +7
	2: mov ecx eax
	3: dec ecx
	4: mul eax ecx
	5: cmp ecx 1
	6: jne -3
	7: jmp +2
	8: inc ecx
	9: ret

. From now on CFG(p) denotes the flow graph which correspond to the reduced CFG of the program p. Figure

2

presents an assembly program and its reduced CFG.

Table 3 :

 3 Results of the experiments

Take care that we speak about sub-CFG, and not sub-graph. Otherwise, the result is incorrect.