Alfredo Cuzzocrea
email: alfredo.cuzzocrea@unical.it

Enzo Mumolo
email: mumolo@units.it

Edoardo Fadda
email: edoardo.fadda@polito.it

Marco Tessarotto
email: marco.tessarotto@regione.fvg.it

A Novel Big Data Analytics Approach for Supporting Cyber Attack Detection via Non-linear Analytic Prediction of IP Addresses

Keywords: Cyber attack, Distributed Denial of Service, Hammerstein models

published or not. The documents may come   L'archive ouverte pluridisciplinaire

A Novel Big Data Analytics Approach for Supporting Cyber Attack Detection via Non-linear Analytic Prediction of IP Addresses 1 Introduction

User modeling is an important task for web applications dealing with large traffic flows. They can be used for a variety of applications such as to predict future situations or classify current states. Furthermore, user modeling can improve detection or mitigation of Distributed Denial of Service (DDoS) attack [START_REF] Goldstein | Bayes optimal DDoS mitigation by adaptive history-based IP filtering[END_REF][START_REF] Pack | On filtering of DDoS attacks based on source address prefixes[END_REF][START_REF] Tan | Framework for statistical filtering against DDoS attacks in MANETs[END_REF], improve the quality of service (QoS) [START_REF] Yang | The role of traffic forecasting in QoS routing -a case study of time-dependent routing[END_REF], individuate click fraud detection and optimize traffic management. In peer-to-peer (P2P) overlay networks, IP models can also be used for optimizing request routing [START_REF] Agrawal | Clustering hosts in P2P and global computing platforms[END_REF]. Those techniques are used by severs for deciding how to manage the actual traffic. In this context, also outlier detection methods are often used if only one class is known. If, for example, an Intrusion Prevention System wants to mitigate DDoS attacks, it usually has only seen the normal traffic class before and it has to detect the outlier class by its different behavior. In this paper we deal with the management of DDos because nowadays it has become a major threat in the internet. Those attacks are done by using a large scaled networks of infected PCs (bots or zombies) that combine their bandwidth and computational power in order to overload a publicly available service and denial it for legal users. Due to the open structure of the internet, all public servers are vulnerable to DDoS attacks. The bots are usually acquired automatically by hackers who use software tools to scan through the network, detecting vulnerabilities and exploiting the target machine. Furthermore, there is also a strong need to mitigate DDoS attacks near the target, which seems to be the only solution to the problem in the current internet infrastructure.

The aim of such a protection system is to limit their destabilizing effect on the server through identifying malicious requests. There are multiple strategies with dealing with DDoS attacks. The most effective ones are the near-target filtering solutions. They estimates normal user behavior based on IP packet header information. Then, during an attack the access of outliers is denied. One parameter that all methods have in common is the source IP address of the users. It is the main discriminant for DDoS traffic classification. However, the methods of storing IP addresses and estimating their density in the huge IP address space, are different. In this paper, we present a novel approach based on system identification techniques and, in particular, on the Hammerstein models. The paper is organized as follows. In Sect. 2 we present the available methods for DDoS traffic classification (a broader overview of state-of-the-art mitigation research is given by [START_REF] Dietrich | Analyzing distributed denial of service tools: the shaft case[END_REF]). In Sects. 3 and 4 we present our proposed a technique based based on Hammerstein models and we recall some similar model. Experimental results reported in Sect. 5 confirm the effectiveness of our approach. Although DDoS mitigation is the most important practical application for IP density estimation, we do not restrict the following work on this topic. Our generic view on IP density estimation may be valuable to other applications as well. One might think of preferring regular customers in overload situations (flash crowd events), identifying non-regular users on websites during high click rates on online advertisements (click fraud detection) or optimizing routing in peer-to-peer networks. Finally, in Sect. 6 we draw conclusions and indicate future work.

Related Work

In this section we review existing IP density estimation approaches. Furthermore, we formulate the often implicitly used ideas in a probabilistic way using the PDF.

History-Based IP Filtering

One of the first work on the field of IP filtering is [START_REF] Peng | Protection from distributed denial of service attacks using history-based IP filtering[END_REF]. In their work, they proposed an algorithm called History based IP Filtering (HIF). Given an IP address database (IAD) containing all frequently observed IP addresses, during an attack, the algorithm allows the access to the website only to the IP addresses from the IAD. The idea behind this algorithm was introduced in [START_REF] Jung | Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites[END_REF]. In this paper, the authors observe that the IP addresses from Code Red worm attacks were different from the standard IPs accessing the website. In [START_REF] Peng | Protection from distributed denial of service attacks using history-based IP filtering[END_REF], the authors add an IP addresses to the IAD if a certain threshold (e.g. a certain number of packets) is exceeded. Later during an attack, the decision whether an IP has to be blocked or not is binary. This means, the density estimation results in a simple step function with only two values: Zero or a positive value, which is the same for all IP addresses. The PDF can be calculated as follows:

f (s) = min(n s , 1) N -1 i=0 min(n si , 1) (1)
where n s is the number of occurrence of an IP address s in the training set. The advantage of HIF is the low computational load required for its implementation. Nevertheless, it cannot be differentiated between users which revisit the server more often than others and is therefore a less precise density estimator.

Adaptive History-Based IP Filtering

To compensate the shortcomings of HIF, [START_REF] Goldstein | Bayes optimal DDoS mitigation by adaptive history-based IP filtering[END_REF] presented Adaptive History-based IP Filtering (AHIF). AHIF instead of using the binary decision, uses histograms, i.e.,

f (s) = n s N -1 i=0 n si (2)
where s represents a range of IP addresses (a bin of the histogram). So far, constant width networks with fixed network masks ranging from 16 up to 24 bit are used as source bins. The actual prediction C α of the appearance of an IP address (or an IP range) is done using a threshold over f (s), i.e.,

C α (s) := reject, if f (s) ≥ α accept, otherwise (3)
During attack mitigation, the most appropriate network mask is chosen such that a maximum numbers of firewall rules is not exceeded and the attack traffic is reduced to be below the maximum server capacity. It is shown, that the adaptive method performs better in terms of predicting user IP addresses during an attack. However, neighbor relations (between source networks) are not taken into account.

Clustering of Source Address Prefixes

In [START_REF] Pack | On filtering of DDoS attacks based on source address prefixes[END_REF], the authors introduce algorithms for mitigating DDoS attacks by filtering source address prefixes. Unlike AHIF, network masks may be at different sizes. For finding the appropriate networks, the authors are using a hierarchical agglomerative clustering algorithm with single linkage. The used distance measure is defined with respect to network boundaries. In general, the proposed method takes both into account -the amount of requests from a source network as well as neighboring density estimation as a result of using a (generalizing) clustering method. Unfortunately, hierarchical clustering methods consume a lot of memory and it was found [START_REF] Tan | Framework for statistical filtering against DDoS attacks in MANETs[END_REF], that the presented method is not applicable in practice on large source IP datasets.

Non-linear Analytic Prediction of IP Addresses

Data driven identification of mathematical models of physical systems (i.e. nonlinear) starts with representing the systems as a black box. In other terms, while we may have access to the inputs and outputs, the internal mechanisms are totally unknown to us. Once a model type is chosen to represent the system, its parameters are estimated through an optimization algorithm so that eventually the model mimics at a certain level of fidelity the inner mechanism of the nonlinear system or process using its inputs and outputs. These approach is, for instance, widely used in the related big data analytics area (e.g., [START_REF] Bonifati | Storing and retrieving XPath fragments in structured P2P networks[END_REF][START_REF] Chatzimilioudis | A novel distributed framework for optimizing query routing trees in wireless sensor networks via optimal operator placement[END_REF][START_REF] Cuzzocrea | Privacy preserving OLAP over distributed XML data: a theoretically-sound secure-multiparty-computation approach[END_REF][START_REF] Cuzzocrea | OLAP*: effectively and efficiently supporting parallel OLAP over big data[END_REF][9]).

In this work, we consider a particular sub-class of nonlinear predictors: the Linear-in-the-parameters (LIP) predictors. LIP predictors are characterized by a linear dependence of the predictor output on the predictor coefficients. Such predictors are inherently stable, and that they can converge to a globally minimum solution (in contrast to other types of nonlinear filters whose cost function may exhibit many local minima) avoiding the undesired possibility of getting stuck in a local minimum. Let us consider a causal, time-invariant, finite-memory, continuous nonlinear predictor as described in [START_REF] Cerone | A robust optimization approach to kernelbased nonparametric error-in-variables identification in the presence of bounded noise[END_REF].

ŝ(n) = f [s(n -1), . . . , s(n -N )] (4)
where f [•] is a continuous function, s(n) is the input signal and ŝ(n) is the predicted sample. We can expand f [•] with a series of basis functions f i (n), as shown in [START_REF] Chatzimilioudis | A novel distributed framework for optimizing query routing trees in wireless sensor networks via optimal operator placement[END_REF].

ŝ(n) = ∞ i=1 h(i)f i [s(n -i)] ( 5
)
where h(i) a re proper coefficients. To make (5) realizable we truncate the series to the first N terms, thus we obtain

ŝ(n) = N i=1 h(i)f i [s(n -i)] (6)
In the general case, a linear-in-the-parameters nonlinear predictor is described by the input-output relationship reported in [START_REF] Cuzzocrea | Privacy preserving OLAP over distributed XML data: a theoretically-sound secure-multiparty-computation approach[END_REF].

ŝ(n) = H T X(n) (7)
where H T is a row vector containing predictor coefficients and X(n) is the corresponding column vector whose elements are nonlinear combinations and/or expansions of the input samples.

Linear Predictor

Linear prediction is a well known technique with a long history [START_REF] Makhoul | Linear prediction: a tutorial review[END_REF]. Given a time series X, linear prediction is the optimum approximation of sample x(n) with a linear combination of the N most recent samples. That means that the linear predictor is described as Eq. ( 8).

ŝ(n) = N i=1 h 1 (i)s(n -i) ( 8
)
or in matrix form as

ŝ(n) = H T X(n) (9)
where the coefficient and input vectors are reported in [START_REF] Dietrich | Analyzing distributed denial of service tools: the shaft case[END_REF] and [START_REF] Fadda | Customized multi-period stochastic assignment problem for social engagement and opportunistic IoT[END_REF].

H T = h 1 (1) h 1 (2) . . . h 1 (N ) (10)
X T = s(n -1) s(n -2) . . . s(n -N ) (11)

Non-linear Predictor Based on Volterra Series

As well as Linear Prediction, Non Linear Prediction is the optimum approximation of sample x(n) with a non linear combination of the N most recent samples. Popular nonlinear predictors are based on Volterra series [START_REF] Peng | Volterra series theory: a state-of-the-art review[END_REF]. A Volterra predictor based on a Volterra series truncated to the second term is reported in [START_REF] Goldstein | Bayes optimal DDoS mitigation by adaptive history-based IP filtering[END_REF].

x(n) = N1 i=1 h 1 (i)x(n -i) + N2 i=1 N2 j=i h 2 (i, j)x(n -i)x(n -j) ( 12
)
where the symmetry of the Volterra kernel (the h coefficients) is considered. In matrix terms, the Volterra predictor is represented in [START_REF] Jung | Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites[END_REF].

ŝ(n) = H T X(n) ( 13
)
where the coefficient and input vectors are reported in [START_REF] Pack | On filtering of DDoS attacks based on source address prefixes[END_REF] and [START_REF] Pack | On filtering of DDoS attacks based on source address prefixes[END_REF].

H T = h 1 (1) h 1 (2) . . . h 1 (N ) h 2 (1, 1) h 2 (1, 2) . . . h 2 (N 2 , N 2 ) ( 14
)
X T = s(n -1) s(n -2) . . . s(n -N 1 ) s 2 (n -1) s(n -1)s(n -2) . . . s 2 (n -N 2 ) ( 15
)

Non-linear Predictor Based on Functional Link Artificial Neural Networks (FLANN)

FLANN is a single layer neural network without hidden layer. The nonlinear relationships between input and output are captured through function expansion of the input signal exploiting suitable orthogonal polynomials. Many authors used for examples trigonometric, Legendre and Chebyshev polynomials. However, the most frequently used basis function used in FLANN for function expansion are trigonometric polynomials [START_REF] Zhao | Adaptively combined FIR and functional link artificial neural network equalizer for nonlinear communication channel[END_REF]. The FLANN predictor can be represented by Eq. [START_REF] Peng | Volterra series theory: a state-of-the-art review[END_REF].

ŝ(n) = N i=1 h 1 (i)s(n -i) + N i=1 N j=1 h 2 (i, j) cos[iπs(n -j)] + N i=1 N j=1 h 2 (i, j) sin[iπs(n -j)] ( 16
)
Also in this case the Flann predictor can be represented using the matrix form reported in [START_REF] Jung | Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites[END_REF].

ŝ(n) = H T X(n) ( 17
)
where the coefficient and input vectors of FLANN predictors are reported in (25) and ( 26).

H T = ⎡ ⎣ h 1 (1) h 1 (2) . . . h 1 (N ) h 2 (1, 1) h 2 (1, 2) . . . h 2 (N 2 , N 2 ) h 3 (1, 1) h 3 (1, 2) . . . h 3 (N 2 , N 2 ) ⎤ ⎦ ( 18
)
X T = ⎡ ⎣ s(n -1) s(n -2) . . . s(n -N ) cos[πs(n -1)] cos[πs(n -2)] . . . . . . cos[N 2 πs(n -N 2 )] sin[πs(n -1)] sin[πs(n -2)] . . . . . . sin[N 2 πx(s -N 2 )] ⎤ ⎦ (19)

Non-linear Predictors Based on Hammerstein Models

Previous research [START_REF] Cerone | A robust optimization approach to kernelbased nonparametric error-in-variables identification in the presence of bounded noise[END_REF] shown that many real nonlinear systems, spanning from electromechanical systems to audio systems, can be modeled using a static nonlinearity. These terms capture the system nonlinearities, in series with a linear function, which capture the system dynamics as shown in Fig. 1. Indeed, the front-end of the so called Hammerstein Model is formed by a nonlinear function whose input is the system input. Of course the type of nonlinearity depends on the actual physical system to be modeled. The output of the nonlinear function is hidden and is fed as input of the linear function. In the following, we assume that the non-linearity is a finite polynomial expansion, and the linear dynamic is realized with a Finite Impulse Response (FIR) filter. Furthermore, in contrast with [START_REF] Cerone | A robust optimization approach to kernelbased nonparametric error-in-variables identification in the presence of bounded noise[END_REF], we assume a mean error analysis and we postpone the analysis in the robust framework in future work. In other word,

z(n) = p(2)x 2 (n) + p(3)x 3 (n) + . . . p(m)x m (n) = M i=2 p(i)x i (n) (20)
On the other hand, the output of the FIR filter is:

y(n) = h 0 (1)z(n -1) + h 0 (2)z(n -2) + . . . + h 0 (N )z(n -N ) = N j=1 h 0 (j)z(n -j) (21)
Substituting ( 20) in ( 23) we have:

y(n) = N i=1 h 0 (i)z(n -i) = N j=1 h 0 (j) M i=2 p(i)x i (n -j) = M i=2 N j=1 h 0 (j)p(i)x i (n -j) (22)
Setting c(i, j) = h 0 (j)p(i) we write

y(n) = M i=2 N j=1 c(i, j)x i (n -j) (23)
This equation can be written in matrix form as

ŝ(n) = H T X(n) ( 24
)
where

H T = ⎡ ⎣ c(2, 1) c(2, 2) . . . c(2, N 2 ) c(3, 1) c(3, 2) . . . c(3, N 2 ) . . . c(M, 1) C(M, 2) . . . C(M, N ) ⎤ ⎦ ( 25
)
X T = ⎡ ⎣ s 2 (n -2) s 2 (n -3) . . . s 2 (n -N ) s 3 (n -2) s 3 (n -3) . . . s 3 (n -N ) s M (n -2) s M (n -3) . . . s M (n -1) s M (n -3) . . . s M (n -N ) ⎤ ⎦ (26)

Predictor Parameters Estimation

So far we saw that all the predictors can be expressed, at time instant n, as

ŝ(n) = H T X(n) (27)
with different definitions of the input, X(n), end parameters vectors H T . There are two well known possibilities for estimating the optimal parameter vector.

Block-Based Approach

The Minimum Mean Square estimation is based on the minimization of the mathematical expectation of the squared prediction error e(n

) = s(n) -ŝ(n) E[e 2 ] = E[(s(n) -ŝ(n)) 2 ] = E[(s(n) -H T X(n)) 2 ] ( 28
)
The minimization of ( 28) is obtain by setting to zero the Laplacian of the mathematical expectation of the squared prediction error:

∇ H E[e 2 ] = E[∇ H e 2 ] = E[2e(n)∇ H e] = 0 (29)
which leads to the well known unique solution

H opt = R -1 xx R sx ( 30
)
where

R xx (n) = E[X(n)X T (n)] ( 31
)
is the statistical auto-correlation matrix of the input vector X(n) and

R sx (n) = E[s(n)X(n)] ( 32
)
is the statistical cross-correlation vector between the signal s(n) and the input vector X(n). The mathematical expectations of the auto and cross correlation are estimated using

R xx (n) = n k=1 X(n)X T (n) n ( 33
)
is the statistical auto-correlation matrix of the input vector X(n) and

R sx (n) = n k=1 s(k)(n)X(n) n (34)

Adaptive Approach

Let us consider a general second order terms of a Volterra predictor

y(n) = N -1 k=0 N -1 r=0 h 2 (k, r)x(n -k)x(n -r) (35)
It can be generalized for higher order term as

N k1=1 • • • N kp=1 c k1 • • • c kp H p x k1 (n), • • • x kp (n) (36)
where

N k=1 c k x k (n). (37)
For the sake of simplicity and without loss of generality, we consider a Volterra predictor based on a Volterra series truncated to the second term

r(n) = N1 i=1 h 1 (i)r(n -i) + N2 i=1 N2 j=i h 2 (i, j)r(n -i)r(n -j) (38)
By defining

H T (n) = |h 1 (1), • • • , h 1 (N 1 ) , h 2 (1, 1), • • • , h 2 (N 2 , N 2 )| (39) and X T (n) = r(n -1), • • • , r (n -N 1 ) , r 2 (n -1) r(n -1)r(n -2), • • • , r 2 (n -N 2 ) | (40)
Equation ( 38) can be rewritten as follows

r(n) = H T (n)X(n). (41)
In order to estimate the best parameters H, we consider the following loss function

J n (H) = n k=0 λ n-k r(k) -H T (n)X(k) 2 (42)
where λ n-k weights the relative importance of each squared error. In order to find the H that minimizes the convex function (42) it is enough to impose its gradient to zero, i.e.,

∇ H J n (H) = 0 (43) That is equivalent to R XX (n)H(n) = R rX (n) (44)
where

R XX (n) = n k=0 λ n-k X(k)X T (k) R rX (n) = n k=0 λ n-k r(k)X(k) (45)
It follows that the best H can be computed by

H(n) = R -1 XX (n)R rX (n) (46) Since R XX (n) = λR XX (n -1) + X(n)X T (n) (47) it follows that R -1 XX (n) = 1 λ R -1 XX (n -1) -k(n)X T (n)R -1 XX (n -1) (48)
where k(n) is equal to

k(n) = R -1 XX (n -1)X(n) λ + X T (n)R -1 XX (n -1)X(n) (49)
Instead, matrix R rX (n) in ( 46) can be written as

R rX (n) = λR rX (n -1) + r(n)X(n) (50)
Thus, inserting Eq. ( 50) and Eq. (48) in Eq. ( 46) and rearranging the terms, we obtain

H(n) = H(n -1) + R -1 XX (n)X(n) (n) (51) where = r(n) -H T (n -1)X(n) (52)
By recalling Eq. ( 49), we can write Eq. ( 51) as

H(n) = H(n -1) + (n)k(n) (53)
By introducing, the new notation,

F (n) = S T (n -1)X(n) (54)
The previous equations can be resumed by the following system

⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ L(n) = S(n -1)F (n) β(n) = λ + F T (n)F (n) α(n) = 1 β(n)+ √ λβ(n) S(n) = 1 √ λ S(n -1) -α(n)L(n)F T (n) (n) = r(n -1) -α(n)L(n)F T (n) (n) = H(n -1) + L(n) (n) β(n) (55)
It should be noted that by using Eq. (55) the estimation adapts in each step in order to decrease the error. Thus, the system structure is somehow similar to the Kalman filter.

Finally, we define the estimation error as

e(n) = r(n) -H T (n)X(n) (56)
It is worth noting that the computation of the predicted value from Eq. (41) requires 6N tot + 2N 2 tot operations, where

N tot = N 1 + N 2 (N 2 + 1) /2.

Experiments

In order to prove the effectiveness of the proposed approach, in this section we present our experimental results for a real dataset. Specifically, we consider the requests made to the 1998 World Cup Web site between April 30, 1998 and July 26, 19981 . During this period of time the site received 1,352,804,107 requests. The fields of the request structure contain the following information:

timestamp the time of the request, stored as the number of seconds since the Epoch. The timestamp has been converted to GMT to allow for portability.

During the World Cup the local time was 2 h ahead of GMT (+0200). In order to determine the local time, each timestamp must be adjusted by this amount. -clientID a unique integer identifier for the client that issued the request; due to privacy concerns these mappings cannot be released; note that each clientID maps to exactly one IP address, and the mappings are preserved across the entire data set -that is if IP address 0.0.0.0 mapped to clientID X on day Y then any request in any of the data sets containing clientID X also came from IP address 0.0.0.0 -objectID a unique integer identifier for the requested URL; these mappings are also 1-to-1 and are preserved across the entire data set size the number of bytes in the response method the method contained in the client's request (e.g., GET).

status this field contains two pieces of information; the 2 highest order bits contain the HTTP version indicated in the client's request (e.g., HTTP/1.0); the remaining 6 bits indicate the response status code (e.g., 200 OK). -type the type of file requested, generally based on the file extension (.html), or the presence of a parameter list. -server indicates which server handled the request. The upper 3 bits indicate which region the server was at; the remaining bits indicate which server at the site handled the request.

In the dataset, 87 days are reported. We use the first one in order to initialise the estimator in (38) and we use the others as test set by using a rolling horizon method (as in [START_REF] Cerone | A robust optimization approach to kernelbased nonparametric error-in-variables identification in the presence of bounded noise[END_REF]). Particularly, for each day t we compute the estimation by using all the IP observations in the previous days [0, t -1]. The results are reported in Fig. 2. The increase of errors in June is due to the sudden increment of different IP accessing the website due to the start of the competition (see [START_REF] Arlitt | Hewlett-Packard Laboratories: A workload characterization study of the 7998 world cup web site[END_REF]). It should be noted that the estimation error decrease exponentially despite dealing with several millions of IPs. Since the computation of the optimal coefficient H(n) may require some time, we measure the percentage of available data that our approach needs in order to provide good results. Particularly, in this experiment we consider the average estimation error done by the model at time t by considering a subset of the IPs observed in interval [0, t -1]. The experimental results on real data cubes are depicted in Fig. 3. It should be noted that the Hammerstain model outperform the results by the Volterra's kernel as well as the clustering techniques. In more detail, the clustering techniques are the one less performing. This is due to the nature of the clustering techniques that exploit the geometric information of the data more than their time dependency. We highlight that despite the calculation of H(n) is computational intensive, this does not effect the real time applicability of the method. In fact, the access decision is taken by considering the estimator r(n) that is computed once per day. Thus the computation of H(n) does not need to be fast.

Conclusions and Future Work

In this paper, we presented a new way to deal with cyber attack by using Hammerstein models. Experimental results clearly confirm the effectiveness of the proposed techniques for a real data set, outperforming other well-known techniques. Future work will have two objectives. First, we want to consider the problem in a stochastic optimization settings, as for example in [START_REF] Fadda | Customized multi-period stochastic assignment problem for social engagement and opportunistic IoT[END_REF]. Second, we want to test the approach on other case studies, by also exploiting knowledge management methodologies (e.g., [START_REF] Cuzzocrea | Combining multidimensional user models and knowledge representation and management techniques for making web services knowledge-aware[END_REF]).

3 Fig. 1 .

 31 Fig. 1. Representation of the Hammerstein Models

Fig. 2 .Fig. 3 .

 23 Fig. 2. Estimation error for each day of activity of the website.

ftp://ita.ee.lbl.gov/html/contrib/WorldCup.html.

Acknowledgements. This research has been partially supported by the French PIA project "Lorraine Université d'Excellence", reference ANR-15-IDEX-04-LUE.


Alfredo Cuzzocrea
email: alfredo.cuzzocrea@unical.it

Carson K Leung

Bryan H Wodi

S Sourav

Edoardo Fadda

An Effective and Efficient Technique for Supporting Privacy-Preserving Keyword-Based Search over Encrypted Data in Clouds

Keywords: emerging systems, emerging information, privacy preserving search, information retrieval, encrypted data, outsourced data emerging systems, emerging information, privacy preserving search, information retrieval, encrypted data, outsourced data

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Data are of high value in the present and future decades. Nowadays, it is possible to gather, and analyze huge amount of data from different sources. Valuable knowledge and information are embedded in these big data [START_REF] Debauche | Cloud platform using big data and HPC technologies for distributed and parallels treatments[END_REF][START_REF] Oliveira | Benchmarking business analytics techniques in big data[END_REF]. Hence, a field of interest is data science [START_REF] Leung | Data science for healthcare predictive analytics[END_REF]. In order to learn [START_REF] De Guia | DeepGx: deep learning using gene expression for cancer classification[END_REF][START_REF] Khan | Unmanned aerial vehicle in the machine learning environment[END_REF][START_REF] Leung | A machine learning approach for stock price prediction[END_REF], mine [START_REF] Leung | Uncertain frequent pattern mining[END_REF][START_REF] Leung | A tree-based approach for frequent pattern mining from uncertain data[END_REF], retrieve from [START_REF] Cuzzocrea | High-recall information retrieval from linked big data[END_REF][START_REF] Leung | Information technology-based patent retrieval model[END_REF][START_REF] Singhal | Modern information retrieval: a brief overview[END_REF][START_REF] Wodi | Fast privacy-preserving keyword search on encrypted outsourced data[END_REF],

Introduction

Data are of high value in the present and future decades. Nowadays, it is possible to gather, and analyze huge amount of data from different sources. Valuable knowledge and information are embedded in these big data [START_REF] Debauche | Cloud platform using big data and HPC technologies for distributed and parallels treatments[END_REF][START_REF] Oliveira | Benchmarking business analytics techniques in big data[END_REF]. Hence, a field of interest is data science [START_REF] Leung | Data science for healthcare predictive analytics[END_REF]. In order to learn [START_REF] De Guia | DeepGx: deep learning using gene expression for cancer classification[END_REF][START_REF] Khan | Unmanned aerial vehicle in the machine learning environment[END_REF][START_REF] Leung | A machine learning approach for stock price prediction[END_REF], mine [START_REF] Leung | Uncertain frequent pattern mining[END_REF][START_REF] Leung | A tree-based approach for frequent pattern mining from uncertain data[END_REF], retrieve from [START_REF] Cuzzocrea | High-recall information retrieval from linked big data[END_REF][START_REF] Leung | Information technology-based patent retrieval model[END_REF][START_REF] Singhal | Modern information retrieval: a brief overview[END_REF][START_REF] Wodi | Fast privacy-preserving keyword search on encrypted outsourced data[END_REF],

and visualize [START_REF] Afridi | Visualizing serendipitous recommendations in user controlled recommender system for learnings[END_REF][START_REF] Leung | FpVAT: a visual analytic tool for supporting frequent pattern mining[END_REF][START_REF] Leung | An HSV-based visual analytic system for data science on music and beyond[END_REF] big data, it is common to consider different aspects (e.g., 3V's, . . ., 7V's) [START_REF] Cuzzocrea | An innovative framework for supporting big atmospheric data analytics via clustering-based spatio-temporal analysis[END_REF] of big data. The main goal of data analysis is to retrieve information and discover knowledge, via techniques like data mining. However, privacy concerns can limit the distribution and analysis of the data [START_REF] Li | On the tradeoff between privacy and utility in data publishing[END_REF]. Different business analytics or business intelligence (BI) solutions [START_REF] Ahn | A fuzzy logic based machine learning tool for supporting big data business analytics in complex artificial intelligence environments[END_REF][START_REF] Jiang | A business intelligence solution for frequent pattern mining on social networks[END_REF]-in terms of data analysis, mashups and services-can be brought if anonymity could be guaranteed. As much data are related to personal information (especially, social network data [START_REF] Aldwairi | Detecting fake news in social media networks[END_REF][START_REF] Jiang | Finding popular friends in social networks[END_REF][START_REF] Leung | Interactive discovery of influential friends from social networks[END_REF][START_REF] Tanbeer | Interactive mining of strong friends from social networks and its applications in e-commerce[END_REF]), privacy is of central importance, like also highlighted in similar studies (e.g., [START_REF] Cuzzocrea | Privacy Preserving OLAP and OLAP Security[END_REF]).

Nowadays, a very large volume of data involving sensitive information about an individuals and organizations are generated by data owners by means of various applications. Technologies such as hard disk, DVDs, floppy disk and many others enable data owners to store these data on local machine. Storing data in, and retrieving data from, local machines requires the management and integrity of data, and incurs long time and expensive hardware [START_REF] Zhang | Cloud computing: state-of-the-art and research challenges[END_REF]. The possibility of storing data on cloud infrastructure without the purchase of computational resources brought by advances in cloud computing as it reduces the operational overhead and let the use to access ubiquitous services [START_REF] Ren | Security challenges for the public cloud[END_REF].

Despite its advantages, privacy concerns may arise if sensitive information regarding an organization or an individual are loaded on the cloud service. For this reason, cloud service providers (CSPs) are providing privacy-preserving solutions [START_REF] Eom | Effective privacy preserving data publishing by vectorization[END_REF][START_REF] Parikh | Security and Privacy issues in cloud, fog and edge computing[END_REF]. Nevertheless, these techniques are prone to attacks from malicious inside attackers who abuse the information without proper authorization. Furthermore, data confidentiality is compromised by outside attacks. Encrypting metadata of the owners prior to the outsource of data onto the cloud server is a simple approach to solve the confidentiality problem [START_REF] Kamara | Cryptographic cloud storage[END_REF]. However, this approach makes it difficult to search, update and delete data. To overcome this new problem, a dummy strategy can be downloading all the encrypted data from the cloud server and then locally decrypting them to compute different tasks. However, this strategy is its high demand on the network bandwidth and its high hardware cost. Thus, being able to use multiple keywords to search encrypted data without lose of data confidentiality is really important. In particular, a goal is to design a search mechanism to retrieve data and rank the resulting documents-satisfying user input-according to their relevance in a cloud server based on a given input query. Another goal is to design a feature of providing most relevant data documents in sorted order from all searched documents to data consumers. Key contributions of this paper include the theoretical design and practical implementation of a scheme for supporting fast secure keyword-ranked search on data collection in the cloud. The resulting scheme enables data owners for the insertion and deletion of their encrypted data to and from the cloud, while obtaining high search efficiency. The extension of a secure searchable encryption scheme also allows data owners the update of encrypted data on the cloud. The implementation of a parallel search process on encrypted data further reduces the time cost.

Backoground and related work

For CSPs, security is of paramount importance. Their responsibility is to allow the users to process, format, and transmit data to a remote location, as well as to protect the data from internal or external threats [START_REF] Tripathi | Cloud computing security considerations[END_REF]. As unauthorized access to the data is a common problem in the public cloud, CSPs provide solutions like encryption, access control, virtualization to data owners to disseminate data [START_REF]Handbook of research on modern cryptographic solutions for computer and cybersecurity[END_REF]. One of the problem is crucial in the cloud environment is the secure keyword matching problem, which has gained attention. The existing methodologies for solving this problem include single-keyword searchable encryption [START_REF] Li | Fuzzy keyword search over encrypted data in cloud computing[END_REF][START_REF] Song | Practical techniques for searches on encrypted data[END_REF], Boolean keyword searchable encryption [START_REF] Katz | Predicate encryption supporting disjunctions, polynomial equations, and inner products[END_REF], and multi-keyword ranked searchable encryption. Single keyword techniques uses a symmetric encryption to store encrypted data documents and their encrypted searchable index on the server, and performs the searches with the trapdoor (TD) built from the data owner's secret key. A techniques called index blind storage (IBS) mechanism [START_REF] Hu | Toward complex search for encrypted cloud data via blind index storage[END_REF] enhances the search security, enables an execution of range queries on encrypted cloud data and conceals the query pattern at the same time. To achieve blind indexing, the IBS stores a key hash of the plaintext (i.e., unencrypted information) in a separate column on the table, and generates an index on that column. Through this separation of encryption key and index key, the key cannot be obtained by the database server.

The cosine and term frequency (TF) × inverse document frequency (IDF) have been used in multi-keyword ranked searchable encryption schemes [START_REF] Sun | Privacy-preserving multi-keyword text search in the cloud supporting similarity-based ranking[END_REF] for ranking similarity. However, while many of these methodologies provide secure keyword searchable encryption, update and delete operation on a given dataset on the cloud server are not possible. This justifies the need for the searchable encryption technique that supports dynamic operations.

Our privacy-preserving keyword search model

Architecture design

The architecture of our privacy-preserving keyword search (PPKS) model consists of three main components:

• Data owners, who aim to use the encrypted files for the search operation: They first build an encrypted tree index I for all the keywords gathered from collection F of raw documents belonging to the data owner who wishes to store at remote cloud location in the encrypted format. They then generate ciphertext (i.e., encrypted text transformed from plaintext) collection C for F , outsource both C and I to the cloud storage server, and update the documents in F in the cloud server by encrypting them in local and load it to the server later on. • Cloud service provider (CSP), who stores both C and I in the remote location: Once load the file, the CSP (i) receives the search request-in the form of TD-from the data user, (ii) executes the search operation on I based on TD, and (iii) returns to the data user those relevant encrypted documents ranked according to the order k. If the data owner loads new documents, the CSP performs update operation. • Data users, who obtained the authorization from the data owner to possess a secret key to utilize encrypted data: They use the search control mechanism to either use t keywords with TD for handling the search query, or retrieve k encrypted documents from the cloud storage server based on the keyword in the query. An "honestbut-curious" CSP performs all the operations in an honest manner but tries to infer the knowledge from query data. For instance, it analyzes the inferred knowledge to gain additional information and perform various operations.

To summarize, data owners possess F and outsource both C and I to the CSP, who returns ranked results upon receiving search requests from data users, who in turn communicate with the data owners by using symmetric keys and search control via TD.

Based on the information acquired by the cloud server, two key threat models include known ciphertext and background models. In a known ciphertext model, as the CSP has knowledge on both C and I outsourcing to the cloud by the data owner, ciphertext attack can be performed. In contrast, in a known background model, the CSP has knowledge on C, term frequency (TF), as well as statistics about the number of documents for each keyword in the whole documents. So, the CSP tries to deduce the query keyword based on keyword frequency.

Properties

Based on the aforementioned design, our PPKS model enables security, accuracy, and dynamic keyword ranked search over encrypted data stored in cloud server. To elaborate, our PPKS model preserves privacy by making the CPS unable to learn additional information about the stored documents and only able to learn about search result. Consequently, it achieves:

• index and query confidentiality, by encrypting both F and keywords in the index and query so that the adversary is totally unaware of the data. • keyword privacy, by hiding the underlying keyword used for the search. As TD does not prevent the adversary to make statistical inference for prediction of the keyword of the search query, background information about known ciphertext model can be used to find out the keyword of the search query. • trapdoor unlinkability, by generating TD non-deterministic to avoid the possibility of deducing whether or not the two TDs are generated for the same query keyword. Through the generation of frequencies of keywords used in different search queries, the CSP is able to breach the privacy requirement of the underlying keywords in the search query. By using a non-deterministic approach to generate TD, it ensures the privacy requirement for the same keyword utilizing for the same search query.

In addition, our PPKS model ensures efficient query mechanism by following index based tree that offers sub-linear efficiency while searching. Moreover, it also handles the keyword queries on encrypted data stored in the cloud server and dynamic document updates on the cloud server.

Practical implementation

The designed architecture of our PPKS model with the aforementioned properties is implemented by a literal search of encrypted data for single keywords and then an expansion of its utility to perform partial match searching. Afterwards, it is further extended to accommodate multiple keywords by using the blind indexing strategy (e.g., IBS). As an example of the IBS, see the schema in Table 1. Here, the IBS stores a key hash of the plaintext in a separate column on the table, and generates an index on that column. After storing a blind index of the plain keywords in a separate column, the IBS encrypts the keyword and stores the results in the table. In general, our implemented PPKS model adapts a password-based key derivation function (PBKDF) 2 to reduce vulnerabilities to brute force attacks. It uses a hash-based message authentication code (HMAC), which involves the cryptographic secure hash algorithm 1 (SHA1) and a secret cryptographic key for data integrity and message authenticity. In other words, the PPKS model combines the hashing and a unique "salt" (i.e., random data) for deriving a key from the keyword. Hence, given a list of documents with keyword, the PPKS model builds a keyword blind index, searches for the index, and returns a list of documents containing the keyword. To further enhance the searching process for privacy-preserving information retrieval, our implemented PPKS model accommodates partial string matches. The creation of an associated index speeds up the search process. Continue with the earlier example, see the schema in Table 2 for the associated index on both the string match and TD. Finally, for every type of the needed query, a distinct blind index per column is stored. To handle single keywords, a blind index of the first five characters for every keyword the user enters are store. It is different when handling multiple keywords.

Experimental assessment

The encryption key and index key are recommended to be store separately on the web server of the application because this would prevent the database server from obtaining the keys. In an event that unauthorized users access the database, they would be able to discover any private data besides the access and search patterns. This method solves the problem of insider as well as outsider attack. Hence, duplicate entries for the possible partial search strings are added to our table. By doing so, we aid indexing, which in turns enables fast SELECT queries. The creation of an index for partial SELECT queries to match the first five letters reduces memory consumption. Furthermore, we truncate the blind indexes to 16 bits and use them as a Bloom filter to further boost the method performance in term of speed.

Moreover, we compare the performance of our PPKS model with related work. For example, Cao et al. [START_REF] Cao | Privacy-preserving multi-keyword ranked search over encrypted cloud data[END_REF] developed a multi-keyword search scheme, but their scheme is not dynamic so that data owners cannot update their data once uploaded to the cloud. To allow update, Sun et al. [START_REF] Sun | Privacy-preserving multi-keyword text search in the cloud supporting similarity-based ranking[END_REF] regenerated indexes whenever data were updated, which can be computationally expensive. In contrast, our PPKS model stores a separate distinct blind index per column for each kind of query with its own key.

For the assessments, we computed the search times of multi-word queries on a collection of 2,000 unencrypted documents. When fed with the contents of these documents, we use a random word generator to generate keywords from a collection of five words, and use a text analyzer to find the most frequent phrases and frequencies of words. Search times, as well as percentages of RAM and thread loads, for queries with vs. without parallel scheme measured on a 32 GB Intel Core i7-7700HQ CPU with a 2.80 GHz processor, 8 threads, and a GeForce GTX 1060 graphics card. Here, the selected CSP is Dropbox, and API calls were used for uploading and retrieving files. Comparison results are shown in Table 3 and Fig. 1. As shown in the table, queries running in parallel required an average search time of less than 5 seconds, but the average search time grows proportional to the number of files when the search process was not executed in parallel. In the figure, memory usage is colored in red and average thread load is colored in green. It shows that the average thread load dropped when processing searches in parallel.

Conclusion and future work

In this paper, we described an effective and efficient technique for supporting privacy-preserving keyword-based search (PPKS) over encrypted outsourced data. This well-designed and implemented PPKS model allows the data owner to perform dynamic search on encrypted data that are stored in the cloud. It implements a document ranking feature to support queries for encrypted keyword frequency, and maintains data privacy and integrity via the symmetric encryption/decryption scheme to transfer and query the encrypted contents in the cloud. Moreover, the model speeds up the search by a parallel search scheme. By using the symmetric key encryption, it guarantees the invulnerability to many types of attacks (except the physical access to the key which is almost impossible in the ideal world).

Future work will (i) exploit and incorporate user cognitive constraints [START_REF] Deng | Cognitive-based hybrid collaborative filtering with rating scaling on entropy to defend shilling influence[END_REF][START_REF] Lakshmanan | The segment support map: scalable mining of frequent itemsets[END_REF][START_REF] Leung | Frequent itemset mining with constraints[END_REF] into the search, as well as (ii) transfer the learned knowledge-such as information from online analytical processing (OLAP) data [START_REF] Bellatreche | F&A: a methodology for effectively and efficiently designing parallel relational data warehouses on heterogenous database clusters[END_REF][START_REF] Bellatreche | Effectively and efficiently designing and querying parallel relational data warehouses on heterogeneous database clusters: the F&A approach[END_REF][START_REF] Ceci | Effectively and efficiently supporting roll-up and drill-down OLAP operations over continuous dimensions via hierarchical clustering[END_REF][START_REF] Cuzzocrea | Efficiently compressing OLAP data cubes via R-tree based recursive partitions[END_REF][START_REF] Cuzzocrea | OLAP*: Effectively and Efficiently Supporting Parallel OLAP over Big Data[END_REF], graphs [START_REF] Ashraf | WeFreS: weighted frequent subgraph mining in a single large graph[END_REF][START_REF] Cuzzocrea | Big graph analytics: the state of the art and future research agenda[END_REF][START_REF] Fariha | Mining frequent patterns from human interactions in meetings using directed acyclic graphs[END_REF][START_REF] Islam | WFSM-MaxPWS: an efficient approach for mining weighted frequent subgraphs from edge-weighted graph databases[END_REF][START_REF] Singh | A theoretical approach to discover mutual friendships from social graph networks[END_REF][START_REF] Upoma | Discovering correlation in frequent subgraphs[END_REF], web [START_REF] Fisichella | Detecting health events on the social web to enable epidemic intelligence[END_REF][START_REF] Leung | Web page recommendation from sparse big web data[END_REF][START_REF] Cuzzocrea | Combining multidimensional user models and knowledge representation and management techniques for making web services knowledge-aware[END_REF]-to effective and efficient PPKS models for supporting privacypreserving keyword-based search over encrypted outsourced data.

Fig. 1 .

 1 Fig. 1. Memory utilization and thread load (a) without parallel search process vs. (b) with parallel search process.

Table 1 .

 1 An example table for illustrating the IBS.

	Variable	Type	Nullable?	Characteristics
	ID	integer	N	auto increment, primary key, referenced by filter ID in Table 2
	UNIX name	text	N
	file name	character string	N	unique
	file size	integer	N
	file path	character string	N
	keyword	text	N
	index value	character string	N
	keyword blind index	character string

Table 2 .

 2 An example table for illustrating the associated index.

	Variable	Type	Nullable?	Characteristics
	filter ID	integer	N	auto increment, primary key
	file upload ID	integer		referencing ID in Table 1
	string match	text
	TD	text

Table 3 .

 3 Search time (a) with vs. (b) without parallel search process.

		(a) Search time (in seconds) with parallel search process	(b) Search time (in seconds) without parallel search process
	# files	Average	Standard deviation	Average	Standard deviation
	1	9.4	0.9	0.02	0.00
	5	5.2	0.4	0.26	0.04
	10	4.7	0.2	0.42	0.08
	50	4.2	0.4	0.84	0.04
	100	4.5	0.3	1.43	0.05
	200	5.1	0.7	2.42	0.23
	500	5.2	0.7	1.84	0.12
	1000	5.3	0.2	3.74	0.31
	1500	5.1	0.5	5.34	0.23
	2000	5.1	0.1	7.12	0.42

Acknowledgements. This project is partially supported by NSERC (Canada) and University of Manitoba.


Alfredo Cuzzocrea
email: alfredo.cuzzocrea@unical.it

Enzo Mumolo
email: mumolo@units.it

Edoardo Fadda
email: edoardo.fadda@polito.it

Marco Tessarotto
email: marco.tessarotto@regione.fvg.it

Supporting Cyber Attack Detection via Non-Linear Analytic Prediction of IP Addresses: A Big Data Analytics Technique

Computer network systems are often subject to several types of attacks. For example the distributed Denial of Service (DDoS) attack introduces an excessive traffic load to a web server to make it unusable. A popular method for detecting attacks is to use the sequence of source IP addresses to detect possible anomalies. With the aim of predicting the next IP address, the Probability Density Function of the IP address sequence is estimated. Prediction of source IP address in the future access to the server is meant to detect anomalous requests. In other words, during an access to the server, only predicted IP addresses are permitted and all others are blocked. The approaches used to estimate the Probability Density Function of IP addresses range from the sequence of IP addresses seen previously and stored in a database to address clustering, normally used by combining the K-Means algorithm. Instead, in this paper we consider the sequence of IP addresses as a numerical sequence and develop the nonlinear analysis of the numerical sequence. We used nonlinear analysis based on Volterra's kernels and Hammerstein's models.

Introduction

User modeling is an important task for web applications dealing with large traffic flows. They can be used for a variety of applications such as to predict future situations or classify current states. Furthermore, user modeling can improve detection or mitigation of Distributed Denial of Service (DDoS) attack [START_REF] Goldstein | Bayes optimal ddos mitigation by adaptive history-based ip filtering[END_REF][START_REF] Tan | Framework for statistical filtering against ddos attacks in manets[END_REF][START_REF] Pack | On filtering of ddos attacks based on source address prefixes[END_REF], DOI reference number: 10.18293/DMSVIVA2020-018 improve the quality of service (QoS) [START_REF] Yang | The role of traffic forecasting in qos routing -a case study of time-dependent routing[END_REF][START_REF] Fadda | Optimizing monitorability of multi-cloud applications[END_REF], individuate click fraud detection and optimize traffic management. In peer-to-peer (P2P) overlay networks, IP models can also be used for optimizing request routing [START_REF] Agrawal | Clustering hosts in p2p and global computing platforms[END_REF]. Those techniques are used by severs for deciding how to manage the actual traffic. In this context, also outlier detection methods are often used if only one class is known. If, for example, an Intrusion Prevention System wants to mitigate DDoS attacks, it usually has only seen the normal traffic class before and it has to detect the outlier class by its different behaviour. In this paper we deal with the management of DDos because nowadays it has become a major threat in the internet. Those attacks are done by using a large scaled networks of infected PCs (bots or zombies) that combine their bandwidth and computational power in order to overload a publicly available service and denial it for legal users. Due to the open structure of the internet, all public servers are vulnerable to DDoS attacks. The bots are usually acquired automatically by hackers who use software tools to scan through the network, detecting vulnerabilities and exploiting the target machine. Furthermore, there is also a strong need to mitigate DDoS attacks near the target, which seems to be the only solution to the problem in the current internet infrastructure. The aim of such a protection system is to limit their destabilizing effect on the server through identifying malicious requests. There are multiple strategies with dealing with DDoS attacks. The most effective ones are the near-target filtering solutions. They estimates normal user behavior based on IP packet header information. Then, during an attack the access of outliers is denied. One parameter that all methods have in common is the source IP address of the users. It is the main discriminant for DDoS traffic classification. However, the methods of storing IP addresses and estimating their density in the huge IP address space, are different. In this paper, we present a novel approach based on system identification techniques and, in particular, on the Hammerstein models. A broader overview of state-of-the-art research on the available methods for DDoS traffic classification is given by [START_REF] Dietrich | Analyzing distributed denial of service tools: The shaft case[END_REF]. The paper is organized as follows. In Sections 2 and 3 we present our proposed a technique based based on Hammerstein models and we recall some similar model. Although DDoS mitigation is the most important practical application for IP density estimation, we do not restrict the following work on this topic. Our generic view on IP density estimation may be valuable to other applications as well. One might think of preferring regular customers in overload situations (flash crowd events), identifying non-regular users on websites during high click rates on online advertise-ments (click fraud detection) or optimizing routing in peer-to-peer networks. Finally, in Section 4 we draw conclusions and indicate future work. The extended version of this paper appears in [START_REF] Cuzzocrea | A novel big data analytics approach for supporting cyber attack detection via non-linear analytic prediction of ip addresses[END_REF].

Analytic Prediction

Data driven identification of mathematical models of physical systems (i.e. nonlinear) starts with representing the systems as a black box. In other terms, while we may have access to the inputs and outputs, the internal mechanisms are totally unknown to us. Once a model type is chosen to represent the system, its parameters are estimated through an optimization algorithm so that eventually the model mimics at a certain level of fidelity the inner mechanism of the nonlinear system or process using its inputs and outputs. This approach is, for instance, widely used in the related big data analytics area (e.g., [START_REF] Cuzzocrea | Olap*: Effectively and efficiently supporting parallel OLAP over big data[END_REF][START_REF] Chatzimilioudis | A novel distributed framework for optimizing query routing trees in wireless sensor networks via optimal operator placement[END_REF][START_REF] Cuzzocrea | Privacy preserving OLAP over distributed XML data: A theoreticallysound secure-multiparty-computation approach[END_REF][START_REF] Cuzzocrea | Privacy preserving OLAP and OLAP security[END_REF])

In this work, we consider a particular sub-class of nonlinear predictors: the Linear-in-the-parameters (LIP) predictors. LIP predictors are characterized by a linear dependence of the predictor output on the predictor coefficients. Such predictors are inherently stable, and that they can converge to a globally minimum solution (in contrast to other types of nonlinear filters whose cost function may exhibit many local minima) avoiding the undesired possibility of getting stuck in a local minimum. Let us consider a causal, timeinvariant, finite-memory,continuous nonlinear predictor as described in [START_REF] Agrawal | Clustering hosts in p2p and global computing platforms[END_REF].

ŝ(n) = f [s(n -1), . . . , s(n -N )] (1)
where f [•] is a continuous function, s(n) is the input signal and ŝ(n) is the predicted sample. We can expand f [•] with a series of basis functions f i (n), as shown in [START_REF] Cerone | A robust optimization approach to kernel-based nonparametric error-in-variables identification in the presence of bounded noise[END_REF].

ŝ(n) = ∞ i=1 h(i)f i [s(n -i)] (2)
where h(i) a re proper coefficients. To make (2) realizable we truncate the series to the first N terms, thus we obtain

ŝ(n) = N i=1 h(i)f i [s(n -i)] (3)
In the general case, a linear-in-the-parameters nonlinear predictor is described by the input-output relationship reported in [START_REF] Cuzzocrea | Combining multidimensional user models and knowledge representation and management techniques for making web services knowledge-aware[END_REF].

ŝ(n) = H T X(n) (4)
where H T is a row vector containing predictor coefficients and X(n) is the corresponding column vector whose elements are nonlinear combinations and/or expansions of the input samples.

Linear Predictor

Linear prediction is a well known technique with a long history [START_REF] Makhoul | Linear prediction: A tutorial review[END_REF]. Given a time series X, linear prediction is the optimum approximation of sample x(n) with a linear combination of the N most recent samples. That means that the linear predictor is described as eq. ( 5).

ŝ(n) = N i=1 h 1 (i)s(n -i) (5)
or in matrix form as

ŝ(n) = H T X(n) (6)
where the coefficient and input vectors are reported in ( 7) and ( 8).

H T = h 1 (1) h 1 (2) . . . h 1 (N ) (7)
X T = s(n -1) s(n -2) . . . s(n -N ) (8)

Non-Linear Predictor based on Volterra Series

As well as Linear Prediction, Non Linear Prediction is the optimum approximation of sample x(n) with a non linear combination of the N most recent samples. Popular nonlinear predictors are based on Volterra series [START_REF] Peng | Volterra series theory: A state-of-the-art review[END_REF]. A Volterra predictor based on a Volterra series truncated to the second term is reported in [START_REF] Dietrich | Analyzing distributed denial of service tools: The shaft case[END_REF].

x(n) = N1 i=1 h 1 (i)x(n-i)+ N2 i=1 N2 j=i h 2 (i, j)x(n-i)x(n-j) (9)
where the symmetry of the Volterra kernel (the h coefficients) is considered. In matrix terms, the Volterra predictor is represented in [START_REF] Fadda | Optimizing monitorability of multi-cloud applications[END_REF].

ŝ(n) = H T X(n) ( 10
)
where the coefficient and input vectors are reported in [START_REF] Makhoul | Linear prediction: A tutorial review[END_REF] and [START_REF] Makhoul | Linear prediction: A tutorial review[END_REF].

H T = h 1 (1) h 1 (2) . . . h 1 (N ) h 2 (1, 1) h 2 (1, 2) . . . h 2 (N 2 , N 2 ) ( 11
)
X T = s(n -1) s(n -2) . . . s(n -N 1 ) s 2 (n -1) s(n -1)s(n -2) . . . s 2 (n -N 2 ) ( 12
)

Non-Linear Predictor based on Functional Link Artificial Neural Networks (FLANN)

FLANN is a single layer neural network without hidden layer. The nonlinear relationships between input and output are captured through function expansion of the input signal exploiting suitable orthogonal polynomials. Many authors used for examples trigonometric, Legendre and Chebyshev polynomials. However, the most frequently used basis function used in FLANN for function expansion are trigonometric polynomials [START_REF] Zhao | Adaptively combined fir and functional link artificial neural network equalizer for nonlinear communication channel[END_REF]. The FLANN predictor can be represented by eq.( 13).

ŝ(n) = N i=1 h 1 (i)s(n-i)+ N i=1 N j=1 h 2 (i, j) cos[iπs(n-j)]+ N i=1 N j=1 h 2 (i, j) sin[iπs(n -j)] (13)
Also in this case the Flann predictor can be represented using the matrix form reported in [START_REF] Peng | Volterra series theory: A state-of-the-art review[END_REF].

ŝ(n) = H T X(n) (14)
where the coefficient and input vectors of FLANN predictors are reported in ( 15) and ( 16).

H T =   h 1 (1) h 1 (2) . . . h 1 (N ) h 2 (1, 1) h 2 (1, 2) . . . h 2 (N 2 , N 2 ) h 3 (1, 1) h 3 (1, 2) . . . h 3 (N 2 , N 2 )   (15) X T =   s(n -1) . . . s(n -N ) cos[πs(n -1)] . . . . . . cos[πs(n -N 2 )] sin[πs(n -1)] . . . . . . sin[πx(s -N 2 )]   (16)

Non-Linear Predictors based on Hammerstein Models

Previous research [START_REF] Cerone | A robust optimization approach to kernel-based nonparametric error-in-variables identification in the presence of bounded noise[END_REF] shown that many real nonlinear systems, spanning from electromechanical systems to audio systems, can be modeled using a static non-linearity. These terms capture the system nonlinearities, in series with a linear function, which capture the system dynamics as shown in Figure 1.

Indeed, the front-end of the so called Hammerstein Model is formed by a nonlinear function whose input is the system input. Of course the type of non-linearity depends on the actual physical system to be modeled.

x (n) 2 x (n) 3 x (n) m . . . + p m FIR x(n) y(n) p 2 p 3

Figure 1. Representation of the Hammerstein Models

The output of the nonlinear function is hidden and is fed as input of the linear function. In the following, we assume that the non-linearity is a finite polynomial expansion, and the linear dynamic is realized with a Finite Impulse Response (FIR) filter. Furthermore, in contrast with [START_REF] Cerone | A robust optimization approach to kernel-based nonparametric error-in-variables identification in the presence of bounded noise[END_REF], we assume a mean error analysis and we postpone the analysis in the robust framework in future work. In other word,

z(n) = p(2)x 2 (n) + p(3)x 3 (n) + . . . p(m)x m (n) = = M i=2 p(i)x i (n) (17)
On the other hand, the output of the FIR filter is:

y(n) = h 0 (1)z(n -1) + . . . + h 0 (N )z(n -N ) = = N j=1 h 0 (j)z(n -j) (18)
Substituting ( 17) in (18) we have:

y(n) = N i=1 h 0 (i)z(n -i) = N j=1 h 0 (j) M i=2 p(i)x i (n -j) = M i=2 N j=1 h 0 (j)p(i)x i (n -j) (19)
Setting c(i, j) = h 0 (j)p(i) we write

y(n) = M i=2 N j=1 c(i, j)x i (n -j) (20)
This equation can be written in matrix form as

ŝ(n) = H T X(n) (21)
where

H T =   c(2, 1) c(2, 2) . . . c(2, N 2 ) c(3, 1) c(3, 2) . . . c(3, N 2 ) . . . c(M, 1) c(M, 2) . . . c(M, N )   (22) X T =   s 2 (n -2) . . . s 2 (n -N ) s 3 (n -2) . . . s 3 (n -N ) s M (n -2) . . . s M (n -1) . . . s M (n -N )   (23)

Estimation of Predictor Parameters

So far we saw that all the predictors can be expressed, at time instant n, as

ŝ(n) = H T X(n) (24)
with different definitions of the input, X(n), end parameters vectors H T . There are two well known possibilities for estimating the optimal parameter vector.

Block-based Approach

The Minimum Mean Square estimation is based on the minimization of the mathematical expectation of the squared prediction error e

(n) = s(n) -ŝ(n) E[e 2 ] = E[(s(n) -ŝ(n)) 2 ] = E[(s(n) -H T X(n)) 2 ]
(25) The minimization of ( 25) is obtain by setting to zero the Laplacian of the mathematical expectation of the squared prediction error:

H opt = R -1 xx R sx (27)
where

R xx (n) = E[ X(n) X T (n)] (28)
is the statistical auto-correlation matrix of the input vector X(n) and

R sx (n) = E[s(n) X(n)] (29)
is the statistical cross-correlation vector between the signal s(n) and the input vector X(n). The mathematical expectations of the auto and cross correlation are estimated using

R xx (n) = n k=1 X(n) X T (n) n (30)
is the statistical auto-correlation matrix of the input vector X(n) and

R sx (n) = n k=1 s(k)(n) X(n) n (31)

Conclusions

In this paper, we presented a new way to deal with cyber attack by using Hammerstein models. Future work will have two objectives. First, we want to consider the problem in a stochastic optimization settings. Second, we want to test the approach on other case studies, by also exploiting knowledge management methodologies (e.g., [START_REF] Cuzzocrea | Combining multidimensional user models and knowledge representation and management techniques for making web services knowledge-aware[END_REF]).

∇

  H E[e 2 ] = E[∇ H e 2 ] = E[2e(n)∇ H e] = 0 (26) which leads to the well known unique solution

Acknowledgements

This research has been partially supported by the French PIA project "Lorraine Université d'Excellence", reference ANR-15-IDEX-04-LUE.

Adaptive Approach

Let us consider a general second order terms of a Volterra predictor

It can be generalized for higher order term as

where

For the sake of simplicity and without loss of generality, we consider a Volterra predictor based on a Volterra series truncated to the second term

(36) and

Eq (35) can be rewritten as follows

In order to estimate the best parameters H, we consider the following loss function

where λ n-k weights the relative importance of each squared error. In order to find the H that minimizes the convex function (39) it is enough to impose its gradient to zero, i.e.,

That is equivalent to

where

It follows that the best H can be computed by

where k(n) is equal to

Instead, matrix R rX (n) in ( 43) can be written as

Thus, inserting Eq (47) and Eq (45) in Eq (43) and rearranging the terms, we obtain

By recalling Eq. ( 46), we can write Eq. (48) as

By introducing, the new notation,

The previous equations can be resumed by the following system

It should be noted that by using Eq (52) the estimation adapts in each step in order to decrease the error. Thus, the system structure is somehow similar to the Kalman filter.

Finally, we define the estimation error as

It is worth noting that the computation of the predicted value from Eq. (38) requires 6N tot + 2N 2 tot operations, where N tot = N 1 + N 2 (N 2 + 1) /2.