Jinfeng Zhao

Xiaodong Cui

Bernard Bonello

Bahram Djafari-Rouhani

Weitao Yuan

Yongdong Pan

Jie Ren

Xiaoqing Zhang

Zheng Zhong

Broadband sub-diffraction and ultra-high energy density focusing of elastic waves in planar gradient-index lenses

Keywords: gradient-index lens, sub-diffraction focusing, metamaterials, energy harvesting

We demonstrate experimentally and theoretically the broadband sub-diffraction and ultra-high energy density focusing of elastic wave inside planar gradient-index (GRIN) plate lenses based on thickness variation. The full width at half maximum is ~0.40 times the minimum wavelength inside the lens λ 0 or ~1/11 times the incident wavelength in the background plate λ B . We analytically elucidate the underlying physical mechanism as the rapid oscillations in the propagator function at the focal distance. Our design displays several advantages including the broadband sub-diffraction behavior, three-order of magnitudes higher energy intensity at the focal point, and focusing capacity with a narrow transverse width of the lens, over the usual metastructure and/or phononic crystal based GRIN lenses. The broadband sub-diffraction and ultra-high energy density focusing can be used for energy harvesting and signal sensing.

Introduction

Gathering elastic wave energy or confining phonons over a sub-diffraction spot in a broad frequency range is fascinating, not only because of various applications, but also due to the lack in nature of materials having this property. To meet this challenge, a great deal of works has been devoted to the realization of structures and devices designed to focus wave beams over a sub-diffraction spot typically featuring the full width at half maximum (FWHM) less than half the wavelength. A first category inspired by J.B. Pendry's seminal work [START_REF] Pendry | Negative refracion makes a perfect lens[END_REF], relies on evanescent waves in the near field as evidenced in negative-refraction lenses [START_REF] Sukhovich | Experimental and theoretical evidence for subwavelength imaging in phononic crystals[END_REF][START_REF] Zhou | Superlensing effect of an anisotropic metamaterial slab with near-zero dynamic mass[END_REF]Zhao et al., 2016b;[START_REF] Dong | Topology optimization of anisotropic broadband double-negative elastic metamaterials[END_REF], hyperlenses [START_REF] Lu | Hyperlenses and metalenses for far-field super-resolution imaging[END_REF], metalenses (Zhao et al., 2016a) and metasurfaces [START_REF] Chen | Deep-subwavelength control of acoustic waves in an ultra-compact metasurface lens[END_REF]. The second category allows for sub-diffraction focusing without the need of evanescent waves and includes time reversal method [START_REF] Rupin | Super-resolution experiments on Lamb waves using a single emitter[END_REF] and super-oscillations [START_REF] Shen | Ultrasonic super-oscillation wave-packets with an acoustic meta-lens[END_REF]. Those lenses are generally based on phononic crystals  Corresponding author (Email address: zhongk@tongji.edu.cn) (PCs) [START_REF] Kushwaha | Acoustic band structure of periodic elastic composites[END_REF], metamaterials [START_REF] Liu | Locally resonant sonic materials[END_REF][START_REF] Zhu | Fine manipulation of sound via lossy metamaterials with independent and arbitrary reflection amplitude and phase[END_REF], or metasurfaces [START_REF] Chen | Acoustic scattering cancellation via ultrathin pseudo-surface[END_REF][START_REF] Cao | Flexural wave absorption by lossy gradient elastic metasurface[END_REF] to take advantage of their tremendous possibilities of dispersion and phases. The planar gradient-index (GRIN) lenses [START_REF] Lin | Gradient-index phononic crystals[END_REF][START_REF] Wu | Focusing of the lowest antisymmetric lamb wave in a gradient-index phononic crystal plate[END_REF] are of particular interest for focusing, collimating, and energy harvesting [START_REF] Tol | Gradient-index phononic crystal lens-based enhancement of elastic wave energy harvesting[END_REF]. Usually, the displacement field at the focus is only 3~4 times that of the incident wave [START_REF] Cui | Multi-branch subwavelength focusing of the lowest-order antisymmetric Lamb mode in a gradient-index phononic crystal[END_REF][START_REF] Liu | Subwavelength Sound Focusing and Imaging Via Gradient Metasurface-Enabled Spoof Surface Acoustic Wave Modulation[END_REF] which suffers from a severe problem, namely a relatively low signal to noise (S/N) ratio.

Despite their potential applications such as particle manipulation [START_REF] Xia | Acoustically driven particle delivery assisted by a graded grating plate[END_REF] or resonator excitation [START_REF] Benchabane | Surface-Wave Coupling to Single Phononic Subwavelength Resonators[END_REF][START_REF] Raguin | Dipole states and coherent interaction in surface-acoustic-wave coupled phononic resonators[END_REF], GRIN lenses encounter a construction dilemma to get the broadband focal spot with FWHM less than half a minimum wavelength inside the lens (labelled as λ 0 hereafter). For example, one possible way to overcome the diffraction limit is to increase the refractive index along the middle of the GRIN lens. Using locally resonant metamaterials to create a large refractive index, either for acoustic [START_REF] Liu | Subwavelength Sound Focusing and Imaging Via Gradient Metasurface-Enabled Spoof Surface Acoustic Wave Modulation[END_REF] or for elastic waves (Zhao et al., 2016a), shifts the relevant branches down to low frequency region. This is usually accompanied by strong dispersion so that the effective refractive index may be significantly affected, even by a slight imperfection of the sample [START_REF] Cui | Multi-branch subwavelength focusing of the lowest-order antisymmetric Lamb mode in a gradient-index phononic crystal[END_REF][START_REF] Liu | Subwavelength Sound Focusing and Imaging Via Gradient Metasurface-Enabled Spoof Surface Acoustic Wave Modulation[END_REF]. So far, FWHM of ~0.41 times the minimum wavelength λ 0 has been reported in an acoustic metamaterial-based GRIN lens [START_REF] Liu | Subwavelength Sound Focusing and Imaging Via Gradient Metasurface-Enabled Spoof Surface Acoustic Wave Modulation[END_REF], when the FWHM is retrieved from the profile of normalized energy density but not from the directly measured acoustic pressure. A similar scenario exists for light focusing inside metamaterials based GRIN optical lenses, featuring FWHM less than half the incident wavelength in the free space, but not the minimum wavelength inside the lens λ 0 [START_REF] Verslegers | Deep-subwavelength focusing and steering of light in an aperiodic metallic waveguide array[END_REF][START_REF] Ma | Extraordinary light focusing and Fourier transform properties of gradient-index metalenses[END_REF]. A comparable result is still lacking for elastic waves in solids, not even to mention the broadband challenge. The space-coiling metamaterials such as the zig-zag [START_REF] Liang | Extreme acoustic metamaterial by coiling up space[END_REF][START_REF] Liu | Source Illusion devices for flexural Lamb waves using elastic metasurfaces[END_REF], helical [START_REF] Zhu | Implementation of dispersion-free slow acoustic wave propagation and phase engineering with helical-structured metamaterials[END_REF] and Archimedean spiral structures [START_REF] Fu | Compact acoustic retroreflector based on a mirrored Luneburg lens[END_REF][START_REF] Song | Broadband high-index prism for asymmetric acoustic transmission[END_REF], may feature broadband large refractive index but they are cumbersome for internal focusing due to the extremely long paths and the intrinsic energy losses. In any case, it is still puzzling to what extent the increase in the refractive index can reduce the FWHM for the focusing of broadband elastic wave, and provides the possibility to obtain a FWHM less than half of the minimum wavelength λ 0 inside the lens.

The GRIN lens constructed by continuously varying the thickness of the plate [START_REF] Climente | Gradient index lenses for flexural waves based on thickness variations[END_REF][START_REF] Zhao | An experimental study of vibration based energy harvesting in dynamically tailored structures with embedded acoustic black holes[END_REF], presents the advantage of flexibility to modulate in a large extent the refractive index with broadband and identical profiles for the lowest-order antisymmetric Lamb (A 0 ) wave, and constitutes therefore a relevant model to gain insights on inner focusing, beyond the resonant metastructures with narrow operation frequency regime.

In this work, we show both experimentally and theoretically that the large refractive index along the central axis of a GRIN lens allows to reduce FWHM at the focus of A 0 mode to less than half the smallest wavelength in the beam λ 0 . We describe the GRIN lenses fabricated by varying the plate thickness, we evidence the broadband sub-diffraction focusing both experimentally and numerically, and we theoretically highlight the underlying physical mechanism. For comparison, we also designed GRIN lenses made of metamaterials, and report numerically the sub-diffraction focusing within a narrow frequency range. Interestingly, the GRIN lenses based on thickness variation features displacement (resp. energy) 30~40 (resp. ~1000) times that of incident wave, and they show outstanding achievements even when the transverse size of the GRIN lens is smaller than one incident wavelength λ B . To the best of our knowledge, this is the first experimental observation of broadband sub-diffraction and ultra-high energy density focusing of elastic waves in a GRIN lens. [START_REF] Climente | Gradient index lenses for flexural waves based on thickness variations[END_REF] where h B denotes the thickness of the background plate.

Experimental and numerical observation of sub-diffraction focusing

Suppose n(y) follows the hyperbolic secant profile    

0 sech n y n y  
where n 0 is the refractive index along the central axis of the lens and α is the graded coefficient. Such a profile guarantees that all the normally incident waves converge to the same point at the focal distance /2 l f   [START_REF] Gomez-Reino | Diffraction-free and diffraction-limited propagation of light in graded-index planar waveguides with hyperbolic secant refractive index profile[END_REF][START_REF] Lin | Gradient-index phononic crystals[END_REF]. The parameters n 0 , α, and T being related together by   0 sech 1 nT   , the thickness varies along the y-axis according to ) on the middle layer to 1 (resp. h B ) at the edges of the lens y = ±T.

For typical frequencies of a few tens of kHz, macroscopic GRIN lenses can be manufactured by using a numerically-controlled milling machine. Figure 1(b) shows the top and side views (inset) of a sample made on a 6061-T6 aluminum plate with n 0 = 6, h B = 18.3 mm, T = 30 mm, and α = 0.0826 mm -1 . Pulses of A 0 mode were generated through the excitation of 5-cycles sinusoidal signals under ±100V [START_REF] Zhao | Experimental evidence of quadrupolar whispering-gallery modes in phononic crystal based waveguides[END_REF] applied to a polypropylene piezoelectret (PP) film (60 mm × 10 mm) fixed to the plate, by a conductive adhesive, at a distance of about 95 mm in front of the GRIN lens. The PP film features a typical thickness 0.083 mm and quasi-static piezoelectric coefficient d 33 of ~218 pC/N. We used a laser Doppler vibrometer (Polytec vibrometer OFV 2570) to probe the out-of-plane displacement w both inside and outside the GRIN lens, on the plane surface in the back side of the plate [START_REF] Zhao | Experimental evidence of quadrupolar whispering-gallery modes in phononic crystal based waveguides[END_REF].

The propagation of the waves was simulated by finite element method (FEM) based on COMSOL Multiphysics, primarily in the time domain by a model similar to the experimental setup in Fig. 1(b) or in the frequency domain by the model depicted in Fig. 1(c). Note that in Fig 1(c), the A0 wave is generated by a line source in front of the graded lens and perfectly matched layers (PMLs) are attached to the background plate to prevent reflections from the boundaries. Further, in both Figs. 1(b) and 1(c), a transition zone (or coupler) is introduced at the inlet of GRIN lens, so as to prevent significant interface reflection, hence disturbing the internal focusing as little as possible. Regarding the material parameters of aluminum, we used the Young's modulus 67.7 GPa, Possion's ratio 0.35 and mass density 2700 kg/m 3 [START_REF] Zhao | Experimental evidence of quadrupolar whispering-gallery modes in phononic crystal based waveguides[END_REF].

Wave focusing characteristics versus n 0

We show in Fig. 2(a) the out-of-plane displacement field |w|, normalized to the amplitude of the incident wave, inside a lens with n 0 = 6.00 at 50 kHz. A focal spot centered at x = 16 mm and y = 0 is clearly observable. Figure 2(b) presents both the experimental (blue line) and numerical (red line) variation of |w| (a.u.) along y axis at x = 16 mm. Of primary interest is the central peak that yields a FWHM of 0.41λ 0 in experiment, in very good agreement with its numerical counterpart of 0.43λ 0 , both being less than half the minimum wavelength λ 0 (9.93 mm at 50 kHz) along the central axis of the structure. When compared with the incident wavelength in the background plate (labelled as λ B hereafter) at 50 kHz, i.e. λ B = 45.7 mm, the FWHM is about λ B /11.1. In the experimental results in Fig. 2(b), two sidebands are also observed at the positions expected from the numerical simulations.

We also fabricated two other samples with n 0 = 2.79 and 2.03, respectively, and the same width 2T = 60 mm, on a 8 mm thick plate. We adopted the previous experimental and numerical methods and investigated the focusing inside these lenses of A 0 mode at 50 kHz. As shown in Fig. 2(c), when n 0 = 2.79, the experimental (blue line) and numerical (red line) profiles of |w| (a.u.) along y axis feature FWHM = 0.47λ 0 and 0.48λ 0 (λ 0 = 14.06 mm), respectively, at the focus. Similarly, in Fig. 2(d), we show the case of n 0 = 2.03 where FWHM = 0.59λ 0 and 0.62λ 0 (λ 0 = 19.15 mm). In both cases, the experimental and numerical results well agree with each other. To illustrate the sub-diffraction focusing based on GRIN lens, Fig. 3 summarizes the FWHM measured experimentally for different values of n 0 by blue star symbols: FWHM is less than half a λ 0 for n 0 > 2.8. This is further confirmed by the numerical simulations shown as a red line in Fig. 3 where we compute FWHM as a function of n 0 when h B and T are fixed to h B = 18.3 mm and T = 30 mm, respectively: FWHM progressively decreases to ~0.4λ 0 as n 0 gradually increases to 12, evidencing that a high value of n 0 is essential to reduce the FWHM below half the wavelength λ 0 . Moreover, both the experimental and numerical results show that n 0 = 2.8 is a threshold for reaching the limit FWHM < 0.5λ 0 . Figure 3 can be transposed to Fig. 10 (in SI) when the FWHM is represented in units of λ B instead of λ 0 .

Wave focusing over a broad frequency range

To demonstrate the broadband achievement of the proposed lenses, we consider again the experimental sample described by Fig. 1(b) with n 0 = 6.00 and we set the central frequency of 5-cycles excitation signals to f = 39 and 30 kHz successively. The choice of the 5-cylces excitation signals allows us sweeping the central frequency with a relatively narrow frequency width of ~7 kHz. As such, the possible overlapping of different frequencies at the same position is avoided, so that the FWHM for a target frequency is characterized with less perturbation. This is significant since the FWHM is of particular interest here, while the broadband generation by using one wave source will be our goal in a future work.

In both cases, the experimental (blue line) profile along y-axis of |w| (a.u.) gives rise to a FWHM of 0.44λ 0 at the focal position x = 17 mm and 18 mm, in order. This is shown in Fig. 4(a) (λ 0 = 11.27 mm at 39 kHz) and Fig. 4(b) (λ 0 = 12.86 mm at 30 kHz), in good agreement with the FWHM of 0.43λ 0 derived from the numerical profiles (red lines). We also present in For the convenience of comparison, the computed results for FWHM between 30 kHz and 60 kHz are connected to each other by a red line in Fig. 5(a), when the geometrical parameters of the GRIN lens are set to T = 30 mm, h B = 18.3 mm, and n 0 = 6.00. The measured (stars) FWHMs show good agreement with the values computed at f = 30, 39 and 50 kHz. Both groups yield values less than half λ 0 . A slight increasing trend is observed for the numerical FWHMs, possibly due to variations of the refractive index as f increases.

Figure 5(b) shows the calculated (red line) and measured (stars) values of |w| max at the focal position, normalized to the amplitude of incident wave. Both clearly show an increasing trend of |w| max as f increases. Interestingly, the |w| max can reach values as high as ~31 and ~47 in both simulation and experiment with respect to the incident wave amplitude, whereas this ratio is only about 3~4 in literatures [START_REF] Wu | Focusing of the lowest antisymmetric lamb wave in a gradient-index phononic crystal plate[END_REF][START_REF] Tol | Gradient-index phononic crystal lens-based enhancement of elastic wave energy harvesting[END_REF][START_REF] Cui | Multi-branch subwavelength focusing of the lowest-order antisymmetric Lamb mode in a gradient-index phononic crystal[END_REF]. Further, the energy intensity is proportional to |w| 2 , so that at the focus the energy intensity is about 1000 times that of the incident wave, being about two-order of magnitude higher than known results (~10) [START_REF] Liu | Subwavelength Sound Focusing and Imaging Via Gradient Metasurface-Enabled Spoof Surface Acoustic Wave Modulation[END_REF] obtained from GRIN lens based on metastructures or PCs. It is noteworthy that the ultra-strong energy concentration, combined with FWHM less than half a λ 0 , allows us to get the sub-diffraction and ultra-high energy density focusing. In the following, we investigate the influence of another geometrical parameter in a practical device, i.e. the transverse size of the lens. We show in Fig. 6 Figure 6(a) is also of significance to the usual phenomenon relating to sub-diffraction focusing: the FWHM is reduced at the expense of increasing lateral lobes, for either acoustic [START_REF] Dubois | Time-driven superoscillations with negative refraction[END_REF]Zhao et al., 2016a;[START_REF] Shen | Ultrasonic super-oscillation wave-packets with an acoustic meta-lens[END_REF] or optic waves [START_REF] Kozawa | Superresolution imaging via superoscillation focusing of a radially polarized beam[END_REF]. From Fig. 6(a), the second lobes are gradually reduced when T decreases while the FWHM of the primary peak is very few affected until T = 15 mm. This provides a different approach to consider this question.

Wave focusing versus the transverse size of lens

Theoretical model and origin of sub-diffraction focusing

In this section, we give details on the analytical model used to calculate the distribution of |w| along the y-axis at the focal position, and we shed light on the origin of sub-diffraction focusing. We also analyze the influences of another factor in practice, i.e. the transverse size of the GRIN lens.

Theoretical model

Let us return to the GRIN lens based on thickness variation in Fig. 1(b), and write the out-of-plane component of the displacement field in the time harmonic form

      , , , w x y t W x y i t   .
When the thickness h of the plate is small as compared to the wavelength, the governing equation for the mode A 0 can be written as [START_REF] Climente | Gradient index lenses for flexural waves based on thickness variations[END_REF]:

    4 4 , , 0 W x y k W x y    , (1)
where the wavenumber k satisfies

    42 k h y D y   with the plate stiffness       3 2 12 1 D y Eh y v  
, and v is the Poisson's ratio. Equation ( 1) can be rewritten as

  2 2 2 2 ( )( ) , 0 k k W x y      (2)
whose general solution is given by the sum of the solutions of the equations 22 denoting the wavenumber along the central axis of the lens; then, the evanescent waves are identically null and Eq. ( 2) becomes identical to:

2 2 1 1 0 W k W    . (3)
We show in SI by Fig. 11 that this hypothesis is indeed well verified based on our numerical calculations. We then have W = W 1 and

   

      2 4 / 12 1 c y k h y E v      
. In analogy to optical lens, the refractive index of the plate lens can be defined by n(y) = k(y)/k B (Zhao et al., 2016a) or n(y) = c B /c(y) where c B is the phase velocity in the background plate. Therefore, the refractive index can be written as

    / B n y h h y 
, and the thickness of the plate inside the lens is given by     Since Eq. ( 3) is in the same form as the Helmholtz equation for optical waves in the GRIN fibers, we can use the same method as for optical waves based on geometrical optics to calculate W 1 using [START_REF] Gomez-Reino | Diffraction-free and diffraction-limited propagation of light in graded-index planar waveguides with hyperbolic secant refractive index profile[END_REF]:

      1 0 0 0 0 , , ; T T W y x K y y x W y dy    (-T < y < T). ( 4
)
In Eq. ( 4), W 0 (y 0 ) represents the field distribution along the local transverse axis y 0 at position x = 0, and K(y, y 0 ; x) is the propagator function that can be derived by using the stationary phase method (Gomez-reino et al., 2000)

                1/2 0 2 2 0 0 , ; exp 2 ( ) sinh cos exp 2 ( ) sinh cos 2sinh sinh a a V K y y x iV x i H x yx V i Hx y x y y                                   (-T < y < T) (5) with 0 Vk   and   ( ) sin / a H x x   . Then, W 1 at the focal position x = f l is obtained as           1/2 0 1 0 0 0 0 0 , exp 2 exp sinh sinh l l T T k W y x f iV f i k i y y W y dy                (-T < y < T).
(6) Before using Eq. ( 6) to analyze the distribution of W 1 along y-axis at the focal position, one must determine W 0 (y 0 ). For this purpose, we adopt a semi-analytical approach, different from the analytical formula for optical GRIN fibers [START_REF] Gomez-Reino | Diffraction-free and diffraction-limited propagation of light in graded-index planar waveguides with hyperbolic secant refractive index profile[END_REF]. When the GRIN lens has the hyperbolic secant profile n(y) = n 0 sech(αy) for given values of T (T = 30 mm here), we can determine the refractive index at any position y 0 at the entrance of lens by n(y 0 ) = n 0 sech(αy 0 ); then we retrieve the W 0 (y 0 ) from the calculated results shown in Fig. 7(b) by finding the normalized |w| at n eff = n(y 0 ) (n eff < 12 here) at 50 kHz. By repeating the procedure, we can get the profile of W 0 (y 0 ) at a selected n 0 . Figure 7(c) shows the mapped distribution of W 0 (y 0 ) versus n 0 , underlying a decreasing trend from the central axis to the lateral sides of the GRIN lens.

Once W 0 (y 0 ) is fixed, we can use Eq. ( 6) to calculate the distribution of |W 1 | (or |w|) along the y-axis at the focal distance [see for instance Fig. 6(b)], and retrieve the theoretical values of FWHM as a function of n 0 . The result is displayed as a black line in Fig. 3. Obviously, the FWHM continuously decreases to 0.3λ 0 as n 0 gradually increases to 12. It should be noted, however, that the theoretical values of FWHM, as shown in Fig. 3 and Fig. 6(c), are smaller than the numerically calculated ones. This difference must be attributed to the following reasons: first, in the derivation of the integral Eq. ( 6), many simplifications have been used, including the neglect of rotational inertia and shear deformation to get Eq. ( 1) [START_REF] Lee | Exact solution of Euler-Bernoulli equation for acoustic black holes via generalized hypergeometric differential equation[END_REF]. Secondly, when n 0 takes quite large values, e.g. n 0 = 6 in Fig. 6(a), the calculated transverse profiles displays large secondary peaks on either sides of the main peak; however, these sidebands are missing in the theoretical results obtained from the integration formula [see Fig. 6(b)]. This is because in geometrical acoustics [START_REF] Krylov | Acoustic 'black holes' for flexural waves as effective vibration dampers[END_REF]) (or optics) [START_REF] Gomez-Reino | Diffraction-free and diffraction-limited propagation of light in graded-index planar waveguides with hyperbolic secant refractive index profile[END_REF], the W 1 (or equally w) can be decoupled into a set of asymptotic series in relation to the wavenumber k B . However, only the first term of these asymptotic series is considered to get the propagator function given in Eq. ( 5). This truly loses some precision for the analytical solution when n 0 is large but still presents the evolution trends of the central peak versus the n 0 and/or T in an efficient and adequate way. Nevertheless, Fig. 3 shows that the theoretical, numerical and experimental results of FWHM decrease simultaneously and consistently as n 0 increases. Although no lowest limit is expected for the FWHM, in practice lower resolution than 0.40λ 0 will require very high values of n 0 and hence a very thin plate in the mid part of the GIRN lens. For instance, a thickness of 0.127 mm is required when n 0 = 12. This would make it very challenging for the manufacturing of the lens. In practice one cannot expect a resolution lower than ~0.40λ 0 for FWHM.

The calculation of W 0 (y 0 ) also helps the understanding of the important phenomenon noted in Section 2, namely at the focal position, |w| max is about 31~47 larger than incident wave amplitude. This high value of |w| max originates from the multiplication of two factors: the amplitude increase of w during the transition from a low-index plate to a higher one, e.g. close to 12 when n 0 = 6 [see Fig. 7(b)], and the wave focusing mechanism that can leads to a |w| max about 3~4 as shown in literatures [START_REF] Wu | Focusing of the lowest antisymmetric lamb wave in a gradient-index phononic crystal plate[END_REF][START_REF] Cui | Multi-branch subwavelength focusing of the lowest-order antisymmetric Lamb mode in a gradient-index phononic crystal[END_REF].

Discussion on the origin of sub-diffraction focusing

The subwavelength behavior of FWHM can be analyzed in the following way: at the focal distance, the integral in Eq. ( 6) implies that the transverse profile of w depends on 0 For the GRIN lens with h B = 18.3 mm and T = 30 mm at 50 kHz, the product α×0.8FWHM changes from 0.66 to 0.03 as n 0 increases from 1.15 to 12 so that within the central peak the product αy is smaller than one. As a result, we can make the approximation sinh(αy) = αy within the central peak. Under this condition, the integration in Eq. ( 6 Remembering that αT = sech -1 (1/n 0 ), one can calculate the profiles of αy 0 with n 0 = 1.15, 6 and 12, as shown by the blue solid, red dashed and black point-dashed lines respectively in Fig. 8(a), when f = 50 kHz, h B = 18.3 mm and T = 30 mm. The product αT changes gradually from 0.54 to 3.18 as n 0 increases from 1.15 to 12. Therefore, for a large n 0 , for example n 0 = 12, the αy 0 shall change between -3.18 and 3.18, beyond ±1. Accordingly, the calculated sinh(αy 0 ) as shown by the black point-dashed line in Fig. 8(b) for a large n 0 = 12, can change dramatically as compared to the profile with a small n 0 = 1.15 noted by the blue solid line.

k  ,   sinh y  ,   0 sinh y  ,
The big variation range of sinh(αy 0 ) with a large n 0 allows for the rapid oscillation of the exponential term or propagator function

    0 0 exp sinh ik y y  
. Indeed, this rapid oscillation is usually achieved by using the evanescent wave [START_REF] Pendry | Negative refracion makes a perfect lens[END_REF]Zhao et al., 2016a) or super-oscillation method [START_REF] Shen | Ultrasonic super-oscillation wave-packets with an acoustic meta-lens[END_REF] , as the base of creating sub-diffraction focusing.

To give further evidence, let us set y = 1 mm which is at the vicinity of the 0.5×FWHM when This gives the possibility of getting even smaller FWHM normalized to the relevant λ 0 when n 0 = 12 than the normalized FWHM when n 0 = 6.

n 0 = 12.
We can also see that αT = sech -1 (1/n 0 ) is independent of T, so that changing T cannot disturb the central peak profile in theory [see Fig. 6(b)], while the focal distance f l = π/2α is modified. The component W 0 (y 0 ), however, offsets the effect of rapid oscillation to a certain extend.

While the behavior of W 0 (y 0 ) does not matter in the integration domain when the exponential

    0 0 exp sinh ik y y  
oscillates fast, it can become significant in the domain where the exponential oscillates slowly. To demonstrate this, we replaced W 0 (y 0 ) par 1 in Eqs. ( 4) and ( 6)

and obtained a FWHM as small as 0.14λ 0 in theory when n 0 = 6 that is significantly different from the computed value of 0.41λ 0 .

Finally, we further discuss on one hidden factor in Eq. ( 7). Indeed, when designing the GRIN plate with a given T, we first define the value of n 0 and then calculate the plate thickness h(y) . Then, the wavenumber k 0 of A 0 mode in the middle layer of the lens is calculated at a given frequency [START_REF] Zhao | A study of pressure-shear vertical wave propagation in periodically layered fluid and piezoelectric structure[END_REF]. Let us call this selected n 0 as the nominal refractive index. For the sake of clarity, the effective refractive index defined by 0 / B kk is called the actual refractive index and we refer to it with another symbol 0 n %. The n 0 is almost equal to 0 n % when n 0 features a small value but not large ones. For example, when h B = 18.3 mm at f = 50 kHz, the 0 n % ( 0 B kk ) increases gradually from 1.07 to 15.2 as n 0 ranges from 1.15 to 20. Due to this discrepancy in Eq. ( 6), we always used the calculated value of k 0 ( 0 B nk % ) for a given thickness of 2 00 B h h n  instead of the value of n 0 k B as in the optical GRIN fibers [START_REF] Gomez-Reino | Diffraction-free and diffraction-limited propagation of light in graded-index planar waveguides with hyperbolic secant refractive index profile[END_REF]. However, the nominal refractive index n 0 is kept as in

according to    

Numerical Results on GRIN PC lens

As a matter of comparison, we have numerically studied the wave focusing inside the metamaterial-based GRIN PC lenses consisting of subwavelength pillars and holes [START_REF] Rupin | Experimental demonstration of ordered and disordered multiresonant metamaterials for lamb waves[END_REF][START_REF] Bilal | Observation of trampoline phenomena in -printed metamaterial plates[END_REF][START_REF] Colquitt | Seismic metasurfaces: Sub-wavelength resonators and Rayleigh wave interaction[END_REF] on a plate. Relevant results are presented in Appendix C. The calculated FWHMs for the GRIN PC lens that features n 0 = 7.32 and 3.92, respectively at 3.2 kHz and 12.25 kHz, are summarized by the yellow square symbols in Fig. 3. The values of 0.42λ 0 and 0.46λ 0 present a good agreement with the results obtained with GRIN plate made by varying plate thickness (red line). However, the pillared metamaterials are strongly dispersive, as evidenced by the flat branches in Fig. 12(b). Therefore, n 0 changes quickly when f shifts away from the target frequency and the n(y) has no longer a hyperbolic secant profile. Hence, sub-diffraction focusing with the metamaterial based GRIN lens is achieved in a relatively narrow frequency band only. Further, the amplitude of u z at the focusing is also quite small in comparison to the one inside the GRIN plate.

Conclusions

In summary, we presented the first experimental and theoretical study of broadband sub-diffraction focusing of elastic wave inside GRIN lenses based on thickness modulation.

The large refractive index in the middle of the structure is particularly important to reduce the FWHM of inner focusing to less than half the minimum wavelength λ 0 . A comprehensive explanation of the physical mechanism is given for this inside sub-diffraction focusing without introducing evanescent waves. Notable features of our design include the broadband frequency range, small transverse size comparable or even less than one incident wavelength in the background plate λ B , and an amplitude of displacement (resp. energy) at the focus about 30~40 (resp. ~1000) times of that of incident wave. We also designed metamaterials based GRIN lenses, and numerically put into evidence the sub-diffraction focusing within a narrow frequency band. Our results draw a picture on the essential parameters for controlling the FWHM of A 0 wave in GRIN lenses, without and with metastructures, and pave the way to the design of new structures for focusing of other types of waves or phonons. Specifically, the broadband sub-diffraction and ultra-high energy density focusing given by our GRIN lenses can be used to enhance the signals or harvest energy [START_REF] Tol | Gradient-index phononic crystal lens-based enhancement of elastic wave energy harvesting[END_REF][START_REF] Liu | Subwavelength Sound Focusing and Imaging Via Gradient Metasurface-Enabled Spoof Surface Acoustic Wave Modulation[END_REF], considering that the energy density amplification is an essential step for both of them. Typically, the resonators are adopted to enhance the energy density or relevant physical parameters within a narrow frequency. Our broadband GRIN lenses present quite an advantage, as evidenced by the ~1000 times energy amplification at the focal position, for resolving this problem even in presence of a significant noise in the incident wave. Of practical engineering interest, it is possible to implement one or several GRIN lenses in plate structures to capture the weak signals generated or scattered by small defects, so as to monitor their location reversely. The operation frequency range is wide.

The GRIN PC lens is designed by tailoring the graded values of h p such that n 0 = 7.32, T = 43.3a, α = 0.0526a -1 and n(y = ±T) = 1.48 at 3.2 kHz. With these characteristics, the GRIN lens enables for deep subwavelength control of the waves since a = λ B /46.6, with λ B = 67.2 mm. Figure 12(c) shows the computed distribution of w normalized to the amplitude of the incident wave at 3.2 kHz. The incident wave converges to a spot centered at x = 42.5 mm, in very good agreement with the theoretical focal distance expected at 43.1 mm. Figure 12(d) shows the transverse profile of |w| (a.u.) at the focal position, featuring a FWHM of about 0.42λ 0 (λ 0 = 9.29 mm) for the central peak that is less than half λ 0 . For more details on wave focusing inside the GRIN PC lens with a smaller n 0 , we designed another GRIN PC lens with (in mm) a = 1.443, d p = 1.24, h B = 1.5, and h g = 0.135. The GRIN PC lens is composed of three parts: within -43.3a < y < 43.3a, the pillar height h p changes gradually from 5 mm to 1 mm while the radius of the air holes is kept constant to r a = 0.65 mm; within -51.1a < y < -43.3a and 43.3a < y < 51.1a, r a gradually decreases from 0.65 mm to 0.28 mm at the most lateral sides while h p is kept constant to 1 mm. As such, the GRIN PC lens features n 0 = 3.92 on the middle layer and n(y = ±51.1a) = 1.16 at the most lateral sides at 12.25 kHz. Figure 13(a) shows the calculated distribution of w, normalized to the amplitude of the normally incident plane wave when f = 12.25 kHz. The focusing of the incident wave towards a spot at x = 59.17 mm is clearly observable. The transverse profile of |w| (a.u.) measured at the focal position is presented in Fig. 13(b): the FWHM of 0.46λ 0 (λ 0 = 8.76 mm) is achieved which is larger than the one 0.42λ 0 for n 0 = 7.32, while the second lobes in Fig. 13(b) is smaller than their counterparts in Fig. 12(d). As shown in Fig. 3, the calculated FWHMs that correspond to n 0 = 7.32 and 3.92 (yellow square markers) present a good agreement with the results obtained with GRIN plate made by varying plate thickness (red line), even although the operation frequency is different with each model. However, because of their discretized structure, each horizontal layer in a GRIN lens based on metamaterials may not behave exactly as expected. For example, the coupling efficiency between the pillars and the substrate varies along each horizontal layer. On the other hand, the wave vector k in the middle layer being close to M or K point of the Brillouin zone, the assumption of homogenization of the effective refractive index is not strictly respected any more. Based on these points, the accuracy of Eq. ( 6) may be affected when n 0 takes large values. The GRIN lenses based on elastic metamaterials must also face another common challenge, i.e. impedance mismatch between the lens and the background plate that can result in strong interface reflection. This reflection highly impacts the amount of energy converging towards the focal spot, as it is the case in both Figs. 13(a) and 12(c) where the amplitudes at the focus are much reduced in comparison to the GRIN lens based on plate thickness variation.

To prevent energy losses, a solution would consist of introducing a carefully designed transitional zone in front of the GRIN PC lens, as it is the case in Fig. 1(b).

Fig. 1 .

 1 Fig. 1. (a) Scheme of a GRIN lens featuring transversely graded refractive index n(y), (b) top and side (inset) views of the sample of GRIN plate constructed by varying the plate thickness with n 0 = 6, and (c) the numerical model to simulate A0 wave propagation.

Figure 1

 1 Figure 1(a) depicts the general scheme of a GRIN lens, either elastic or optical, featuring the variation of the refractive index n(y) along the transverse direction (y-axis) with dimensions -T < y < T and 0 < x < L. To construct such a GRIN lens on a thin plate, the refractive index n(y) is realized by gradually modulating the plate thickness h(y) along the y-axis, as shown in Fig. 1(b). The refractive index n(y) is defined as ( ) ( ) B n y k y k where k(y) and k B are the

Fig. 2 .

 2 Fig. 2. (a) Experimental mapping of |w| normalized to the amplitude of incident wave inside the lens when n 0 = 6.0 at 50 kHz. (b)-(d) Experimental (blue line) and numerical (red line) profiles of |w| (a.u.) along the transverse direction at the focal position when n 0 equates (b) 6.00, (c) 2.79 and (d) 2.03. (e)-(f) Experimental (blue line) and numerical (red line) profiles of |w| normalized to the amplitude of incident wave along the central axis in correspondence with panels (b)-(d), respectively. Note that the experimental profile is achieved at y = -2 mm in panel (g) and y = 0 in panels (e) and (f).

Fig. 3 .

 3 Fig. 3. Theoretical (black line, discussed in Section 3) and numerical (red line) FWHM of the primary transverse peak of |w| at the focal position as a function of n 0 with T = 30 mm and h B = 18.3 mm, at 50 kHz. Stars correspond to experimental results on GRIN plate with n 0 = 2.03, 2.79 and 6, h B = 8, 8 and 18.3 mm, respectively, at 50 kHz with the same T = 30 mm. Yellow squares correspond to numerical results on GRIN PC plates discussed in section 4 (see also Figs. 12 and 13) with n 0 = 3.92, 7.32, f = 3.2, 12.25 kHz, T = 36.1, 62.5 mm in this order.

  Figs. 4(c)-4(d) the experimental (blue lines) and numerical (red lines) profiles of normalized |w| along the central x-axis in correspondence with Figs. 4(a)-4(b), respectively. Along x-axis, the experimental and numerical profiles present similar trends for all the considered frequencies.

Fig. 4 .

 4 Fig. 4. (a)-(b) Experimental (blue line) and numerical (red line) profiles of |w| (a.u.) along the transverse direction at the focal position with n 0 = 6.0 at (a) 39 kHz and (b) 30 kHz. (c)-(d) Profiles of normalized |w| along the central axis, in correspondence with (c)-(d).

Fig. 5 .

 5 Fig. 5. (a) FWHMs and (b) normalized |w| max at the focal position normalized to the amplitude of the incident wave as a function of frequency f, derived from the numerical (red line) and experimental (stars) results for a GRIN lens featuring T = 30 mm, h B = 18.3 mm and n 0 = 6.00.

Fig. 6 .

 6 Fig. 6. (a) Numerical and (b) theoretical transverse profiles of |w| (a.u.) at the focal position of GRIN plate lens with n 0 = 6 and h B = 18.3 mm, at 50 kHz for different values of T. (c) FWHM in both simulation (red line) and theory (black line) derived from 6(a) and 6(b).

  (a) the computed profiles of |w| along the y-axis at the focal position inside the GRIN lens with n 0 = 6 and h B = 18.3 mm at 50 kHz, for different values of T between 10 mm and 120 mm. Clearly, the main peak keeps almost the same shape as long as T is larger than ~15 mm when the transverse size of the lens 2T is about 0.66λ B with the FWHM = 0.44λ 0 . By using the theoretical model in Section 3, Fig. 6(b) presents the theoretical profiles of |w| along the y-axis at focal distance which do not depend on T. Figure 6(c) shows the FWHM derived from both numerical (red line) and theoretical (black line) analysis. Both profiles keep a constant value less than 0.5λ 0 , until the transverse size of the lens (2T) becomes a little smaller than one incident wavelength in the background plate λ B , making it possible to get sub-diffraction focusing in subwavelength size GRIN lens. The difference between the numerical and theoretical profiles of |w| and the values of FWHM in Fig. 6(c) will be discussed in Section 3 together with theoretical formula.

  In general, the solutions of W 1 stand for the propagative components of the wave, whereas the solutions of W 2 correspond to the evanescent components. Let us assume that, whatever the coordinate y, |k(y)| < |k 0 | with k 0

  decreases from n 0 on the central axis to 1 at the lateral sides y = ±T. As a result, the plate thickness satisfies 

Figure 7

 7 Figure 7(a) represents the model where A 0 Lamb wave is launched from a background plate (n = 1) through a transitional zone to a plate (n = n eff ) with thickness 2 B eff hn . Periodic boundary conditions are applied to the lateral surfaces and perfect matching layers (PMLs) are added on the ends. The calculated |w| on the thinner part, as shown by the red line in Fig. 7(b) when h B = 18.3 mm at 50 kHz, features always a larger value than the amplitude of the incident wave[START_REF] Pelat | The acoustic black hole: A review of theory and applications[END_REF], and highlights an increasing trend in |w| as n eff increases. In Fig.7(b), we also show as star symbols the experimental normalized values of |w| at x = 0 and y = 0 for our three samples where n 0 = 6.00, 2.79, and 2.03, respectively. They show good agreement with the calculated values (red line), although the thickness of the plate h B is different in each sample.

Fig. 7 .

 7 Fig. 7. (a) Scheme of wave propagation from a low-index plate to a high-index one, (b) the amplitude (red line) of w in the high-index plate versus that of the incident wave when f = 50 kHz and h B = 18.3 mm, (c) the retrieved value of W 0 (y 0 ) versus the amplitude of the incident wave when f = 50 kHz and T = 30 mm. In Fig. 7(b), star symbols are for the experimental values of |w| at x = 0 and y = 0 (whereby n eff = n 0 ) retrieved from the lens samples with n 0 = 2.03, 2.79 and 6.00 at f = 50 kHz (the values of h B are different in each sample).

  Typically, the hyperbolic sine function sinh is linear when the variable is smaller than one but dramatically increases as the variable becomes larger. Let us confine the analysis to the central peak for which the coordinate y is approximately in the range of the FWHM: -0.8×FWHM < y < 0.8×FWHM as seen from the results in Figs. 2(b)-2(d) and Figs. 4(a)-4(b).

Fig. 8 .

 8 Fig. 8. Calculated profiles of (a) αy 0 and (b) sinh(αy 0 ) for n 0 = 1.15 (blue solid line), 6 (red dashed line) and 12 (black point-dashed line) when f = 50 kHz, h B = 18.3 mm and T = 30 mm. Related profiles of (c) k 0 y×sinh(αy 0 ) and (d) the real part of

Figure

  red dashed line) and 12 (black point-dashed line), which maintains similar profiles as their counterparts in Fig.8(b), featuring the slightly enlarged amplitude range. After that, Fig.8(d)gives the profiles of the real part of the propagator function black point-dashed line for n 0 = 12 oscillates much more quickly than the almost constant blue solid line for n 0 = 1.15. Similar phenomenon can be observed for the imaginary part of the corresponding value for a small n 0 . It is noteworthy that, the modulations of sinh(αy 0 ) in Fig.8c) are not linear as n 0 changes, but occur in an accelerated way. Consequently, the oscillations number in Fig.8(d)when n 0 = 12 (about 4.5) is more than doubled as compared to n 0 = 6 (with approximately one oscillation).

  engineering of the lens and a good precision in predicting the focal distance.

Fig. 13 .

 13 Fig. 13. (a) Calculated distribution of w normalized to the amplitude of the incident wave inside a GRIN PC lens featuring n 0 = 3.92 and the zoom in of the focal spot (see inset) when f = 12.25 kHz, (b) the transverse profile of |w| (a.u.) at the focal position.

Acknowledgements: This work was supported by the National Natural Science Foundation of China (Grant Nos. 11602174, 11772106, 11872282 and 52027816), and Shanghai Science and Technology Innovation Plan (Grant No. 20ZR1462700). Jinfeng Zhao would like to acknowledge the experimental helps given by PhD student Chao SONG from Tongji University.

Supplementary materials Appendix A. Evolution of focal distance and FWHM (in λ B ) versus n 0

In this section, we give an example of the evolution of focal distance f l of a GRIN lens as a function of n 0 . When n(y) has the hyperbolic secant profile, the focal distance f l is given by f l = π/2α. Let us consider a GRIN lens with T = 30 mm, h B = 18.3 mm and the refractive index relationship n 0 sech(αT) = 1. Figure 9 displays the theoretical (black line) and numerical (red line) results for f l as a function of n 0 at 50 kHz. Both are in good agreement, especially at high n 0 . For comparison, we show also as stars the measured focal distances at 50 kHz for three samples with n 0 = 6.00, 2.79 and 2.03, respectively. Although the thickness of the plate h B is different in each sample, the experimental results are consistent with both the theoretical and numerical ones. For the convenience of demonstrating the performance of GRIN lens based on plate thickness modulation or metamaterials, the FWHM shown in Fig. 3 in units of λ 0 are presented in Fig. 10 in units of λ B . From this latter figure, the theoretical (black line) and numerical (red line)

FWHMs calculated for the lens with thickness variations agree well with each other; they magnify a decreasing trend as n 0 increases for the GRIN plate lens with T = 30 mm and h B = 18.3mm, at 50 kHz, and the FWHM can be smaller than 0.1λ B . On the other hand, the experimental FWHM as noted by the star symbols agree well with the calculated and theoretical profiles of FWHM when n 0 = 2.03, 2.79 and 6 at 50 kHz, even the h B is different in each case. The computed FWHMs for the GRIN PC labelled by the square markers matches well with those computed for the GRIN plate lens. However, the GRIN PC usually works in narrow frequency range, and it is necessary to adapt for each n 0 the operation frequency and transverse size of lens; whereas the GRIN plate can perform even well in a broad band and is robust with respect to the transverse size of the plate lens. In this section we discuss the possible influence of evanescent waves on the focus size. and consequently large components of Fourier transform beyond the EFC (Zhao et al., 2016a). However, this is not observable in Fig. 11(b) and therefore, the evanescent waves do not contribute, or very little, to the inner focusing.

Appendix B. Discussion on the influence of evanescent waves

Further, the upper spot (k y > 0) in Fig. 11(b) derives from the converging incident wave from the lower side of GRIN lens (y < 0) in Fig. 11(a), for which the k y component tilts gradually from 0 to a quite large value at the focal position (Zhao et al., 2016a). The lower spot (k y < 0) in Fig. 11(b) can be understood in a similar way. The GRIN PC lenses are constituted in such a way that an array of steel pillars are fixed by the epoxy adhesive on the center of identical air holes perforated in a 6061-T6 aluminum plate in a honeycomb lattice [START_REF] Cui | Multi-branch subwavelength focusing of the lowest-order antisymmetric Lamb mode in a gradient-index phononic crystal[END_REF]. Figure 12(a) depicts the unit cell, the geometrical characteristics, and the first irreducible Brillouin zone of PC plate. Figure 12(b) shows the dispersion of A 0 mode, along ΓM direction of a perfect PC for various heights h p of the pillars, magnifying a decreasing trend as h p increases. The other parameters are (in mm) a = 1.443, r a = 0.65, d p = 1.24, h B = 1.5, h g = 0.135. The Young's modulus, Possion's ratio, and mass density are 199 GPa, 0.25 and 7850 kg/m 3 for the steel; 5.1 GPa, 0.38, and 1200 kg/m 3 for epoxy resin [START_REF] Cui | Multi-branch subwavelength focusing of the lowest-order antisymmetric Lamb mode in a gradient-index phononic crystal[END_REF]. Notice that ΓM of GRIN PC is parallel to both the x-and y-axes, and the crystallographic anisotropy at any layer is very weak for A0 mode. In this condition, the refractive index is defined by n = k ΓM / k B where k ΓM and k B are the wavenumber along ΓM direction in the PC plate and in pure aluminum plate, respectively [START_REF] Cui | Multi-branch subwavelength focusing of the lowest-order antisymmetric Lamb mode in a gradient-index phononic crystal[END_REF].

Appendix C. Detailed Numerical Results on GRIN PC lens


Laetitia Leichtnam
email: laetitia.leichtnam@centralesupelec.fr

Eric Totel
email: eric.totel@imt-atlantique.fr

Nicolas Prigent

Ludovic Mé
email: ludovic.me@inria.fr

Novelty detection on graph structured data to detect network intrusions

Keywords: Network Intrusion Detection System, Knowledge graph, Autoencoder

It is difficult to detect new types of attacks in heterogeneous and scalable networks in time without generating too many false alarms. While supervised anomaly detection techniques are often used to that end, security experts generally do not have labeled datasets. That's why unsupervised learning, that does not require labeled data, should be preferred. With sec2graph [4], we introduced a representation of security events in the form of a graph linking what we defined as security objects and proposed a method for anomaly detection based on auto-encoders. This representation allows a rich description of the events that are analyzed. In this paper, we apply our approach to the CICIDS2018 dataset and show that our method outperforms classical event modeling and anomaly detection approaches.

Introduction

Security Operational Centers (SOC) ensure the collection, correlation, and analysis of security events on the perimeter of the organization they defend. A SOC must detect and analyze internal and external attacks. This mission is hard because security analysts must supervise numerous highly-distributed and heterogeneous systems that use multiple communications protocols.

To process this very heterogeneous data, data model based on knowledge graphs, that allow semantic linking of diverse information have been proposed for example in STIX model [6]. A model built on a knowledge graph can indeed contain different types of valuable information while allowing automatic processing of the data.

Graphs structures need however one preprocessing step, the features encoding, before being process automatically [START_REF] Grover | node2vec: Scalable feature learning for networks[END_REF], [START_REF] Narayanan | graph2vec: Learning distributed representations of graphs[END_REF]. These techniques consist in transforming property graphs to a vector or a set of vectors that can be handled by machine learning algorithms.

To detect network attacks, anomaly detection techniques have been proposed. These techniques are often built on supervised learning, that requires labeled data during the learning phase. However, security experts often do not have such labeled data sets from their own event logs and data labeling is expensive [START_REF] Anagnostopoulos | Weakly supervised learning: How to engineer labels for machine learning in cyber-security[END_REF]. As an alternative, an unsupervised anomaly detection technique called "novelty detection", based on auto-encoding can be used. This technique is generally used when the amount of abnormal data available is insufficient to build explicit models for non-normal classes [START_REF] Pimentel | A review of novelty detection[END_REF].

In this paper, we first present the model sec2graph, a unified graph representation for heterogeneous network logs. It integrates into a single graph heterogeneous information found in the events and thus allows the construction of a rich vision of the normal situation. We then present a process to efficiently encode this unified graph so that an auto-encoder can learn the normal situation and then detect abnormal activities with two different strategies. We finally use CICIDS2018 dataset [START_REF] Sharafaldin | Toward generating a new intrusion detection dataset and intrusion traffic characterization[END_REF] to evaluate the ability of the learned model to detect anomalies.

Our contributions are, therefore: -The definition of two different strategies of detection based on the sec2graph's novelty detector that overpass previous results -Experimental results on the CICIDS2018 dataset showing that our approach brings a significant improvement over deep anomaly detection algorithms. In particular, this paper presents a features encoding method that is easier and computationally more efficient than the one presented in our previous paper [START_REF] Leichtnam | Sec2graph: Network attack detection based on novelty detection on graph structured data[END_REF]. It also presents a new anomaly computation strategy allowing to significantly increase the attack detection score.

This paper is organized as follows: our global approach, named sec2graph, is presented in Section 2. This section synthesizes the approach described in [START_REF] Leichtnam | Sec2graph: Network attack detection based on novelty detection on graph structured data[END_REF] and presents a detection strategy based on the auto-encoders. Anomaly detection results and comparative analysis with other methods on the CICIDIS2018 dataset are discussed in Section 3. Finally, conclusions are presented in Section 4.

The sec2graph approach

Network event logs are used as an input for the whole sec2graph process. Section 2.1 explains how we build a graph of security objects from network events; Section 2.2 explains how we encode this graph into vectors able to be handled by an auto-encoder; Section 2.3 explains how anomalies can be detected by the auto-encoder.

Building Security Object Graphs from Network Events

A log file can be described as a sequence of events resulting from the observation of activity in the network. Each event is made of several fields and some of these fields are particularly relevant to identify links between events. For each type of event, we identify the most relevant fields and create one or several Security Objects (SOs). A SO is a set of attributes, each attribute corresponding to a particular event field.

For example, a network connection event leads to four SOs: a source IP Address SO, a destination IP Address SO, a Destination Port SO and finally, the NetworkConnection SO itself that regroups attributes corresponding to the fields we identified as less important to create relations between events. For each type of event, we designed a translation into a set of linked SOs. Thus, each event is represented by a subgraph. For example, the SOs and the links created from logs extracted from the Zeek IDS tool [START_REF] Paxson | Bro: a system for detecting network intruders in real-time[END_REF] conn.log log files are illustrated in Figure 1. To build the complete graph, we take as an input the network events coming from various log files. From each event, and according to its type, we extract the SOs and the links between them as described before. We then take each SO of the sub-graph. If this SO already exists in the global graph (for instance, the same IPAddress was already identified in a previous event), we replace the SO in the new sub-graph with the SO that already exists in the global graph. Therefore, if an event contains an SO that was already found in a previous event, the old sub-graph will be linked to the new sub-graph through this SO.

The graph model in Figure 2 shows the different types of SOs (nodes of the graphs) and their semantic links (edges of the graphs). For clarity reason, we have not represented the attributes of the SOs on this figure. Our model is suited to the pieces of information that are representative of network events. It can also evolve easily according to the needs of the analysts. More details on the building of the SO graph can be found in [START_REF] Leichtnam | Sec2graph: Network attack detection based on novelty detection on graph structured data[END_REF].

Encoding the graph for machine learning

The second step of sec2graph transforms the graph we computed in a structure that can be processed efficiently by a machine learning algorithm. In our case, the encoding method must encode both the structure of the graph (i.e., the links between the SOs) and the specific information associated with both the nodes (SOs) and the edges (links). Moreover, the result of the encoding should be of required too many computational resources to be applied on graphs containing millions of nodes and edges. Moreover, the combination of node2vec with an anomaly detection algorithm made the interpretation of the results difficult. Since there does not exist a single best method to encode our graph, we had to design one that was tailored to our specific case.

A given SO can be linked to several events, normal or abnormal. An edge, on the other hand, is only related to the event that led to its construction. Therefore, an anomaly is not carried by the node (an IP address or a port are not abnormal per se) but by the edges that link the SOs together. Consequently, we have chosen to encode our graph by encoding each of its edges. Our representation takes into account the structure of the graph, information contained in SO's attributes, and the type of the edges. To this end, we encode an edge as a vector resulting from the concatenation of information on (a) the type of this edge, (b) the attributes of its source node, (c) the attributes of its destination node.

To encode the edge type and the attributes of the nodes, we use common machine learning techniques to transform numerical and categorical data such as the number of packets transferred or the protocol that was used (tcp, udp, or icmp) into a binary vector. The basic principle consists in determining a function which associates a category for each value of each attribute, regardless of the type considered. Then, the category is encoded in a binary vector by using the one-hot-encoding techniques. The result of this process is a fixed-dimension binary vector encoding an edge that can now be processed by an auto-encoder.

Novelty Detection with an Auto-encoder

An auto-encoder learns a representation (encoding) of a set of pieces of data, typically for dimensional reduction. To do so, it learns a function that sets the outputs of the network to be equal to its inputs. It is made of two parts : an encoder and a decoder. The encoder compresses the input data into a lowdimensional representation, and the decoder generates a representation that is as close as possible to its original input from the reduced encoding.

Anomaly detection methods based on auto-encoders use it to first learn the "normal" behavior by using a dataset with benign data. Then, it is assumed that attacks will generate "abnormal" observations that the auto-encoder has never seen. Therefore, it will not be able to reconstruct the data identically. As a consequence, by computing the difference between the input and the output, we can determine an error, called reconstruction error. If this error is above a determined threshold, an analyst is then able to detect anomalies in a dataset.

While classical approaches seek to identify anomalies linked to events, our approach seeks to identify anomalies related to the links between objects. To refer to the case of anomalies on events, we have considered two strategies called max and mean. The first one consists in considering as abnormal any event containing at least one link exceeding a detection threshold (max strategy). The second (mean strategy) consists in computing the mean of the reconstruction errors of all the links associated with an event. If this average exceeds our detection threshold, the event is considered abnormal. In other words, the first strategy supposes that the anomaly is carried by one link (one strong local anomaly), whereas the second strategy assumes that the anomaly is carried by all the links of the same event (the sum of several weak anomalies).

Implementation and experimental results

This section details our implementation choices and a comparison of the sec2graph approach with other approaches based on anomaly detection.

Configuration

We choose to use the CICIDS2018 dataset that is made of ten pcap encompassing millions of events. This dataset was generated at the Canadian Cybersecurity Institute and contains ten days of mixed traffic, benign and attacks such as DoS, DDoS, BruteForce, XSS, SQL injection, infiltration, and botnet activities. The CICIDS2018 dataset is the most recent one that models a complete network configuration with a wide variety of components. The data set is also labeled, allowing us to quantify the effectiveness of our method. To generate log files from the capture files, we used the Zeek IDS tool [START_REF] Paxson | Bro: a system for detecting network intruders in real-time[END_REF] (formerly Bro) that can generate network and application logs such as connections, http communications, or file transfers.

In addition to the number of true positives (TP), false positives (FP), true negatives (TN), and false negatives (FN), we evaluate our results using the following standard measures: Precision, Detection Rate also known as Recall (DR), True Negative Rate (TNR) and False Positive Rate (FPR). Precision gives the ratio of true abnormal events over events reported as abnormal. DR gives the proportion of events correctly detected as abnormal out of all truly abnormal events. TNR is the proportion of normal events correctly classified among all normal events and FPR the proportion of normal events incorrectly classified among all normal events. Formally, these criteria can be defined as follows:

P recision = T P T P + F P ; DR = T P T P + F N ; T N R = T N F P + T N ; F P R = F P F P + T N

Defining an optimal threshold for detection

In this section, we present the experiments conducted to determine the threshold value to be used for the anomaly score. The analyst sets this threshold value according to his or her supervisory context, lowering the threshold value if it is more important for the analyst not to miss any attacks than to have to eliminate a large number of false positives.

We determine the value of the threshold as follows: first, we consider all the events on the first day of the CICIDS2018 dataset in time windows where there is no attack. With this data, we determine the rate of false positives according to the detection threshold. We obviously want the lowest possible false-positive rate.

The curves in Figure 3 shows the evolution of the FPR as a function of the detection threshold for the strategies max (left) and mean (right). We computed the FPR on a sample of benign data composed of the 12 first attack-free hour-timeslot. A threshold of 0.0018 gives us an FPR of 0,46% for the max strategy while a threshold of 0.001 gives us an FPR of 0,25% for the mean strategy. For both strategies, we see in the figure that the FPR does not decrease significantly when we increase the detection threshold above 0.0018 for the max strategy and above 0.001 for the mean strategy. In addition, increasing the detection threshold too much can induce a high false-negative rate. We conclude that a threshold higher than 0.0018 for the max strategy and a threshold higher than 0.001 for the mean strategy should be retained.

Comparison with other anomaly detection algorithms on the same dataset

To compare our results with the state of the art, we took the results of a study on intrusion detection using deep learning methods [START_REF] Ferrag | Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study[END_REF] that uses the same data set as we do, the CICIDS2018 data set. The table 1 provides a comparison of the results obtained by Ferrag on the CI-CIDS2018 dataset with those of sec2graph using the previously determined optimal value for the detection limit for the two strategies max and mean. To compute the detection rate, we first train and validate our model on a sample of benign data composed of the 12 first attack-free hour-timeslot. We use a split ratio of 0.1 between the train and validation set. The TNR was computed on the whole dataset and the detection rate for each attack was computed on timeslot containing the attacks. The values in this table show that the sec2graph approach is superior to the other approaches in terms of FPR, regardless of the strategy chosen. The sec2graph approach with the medium strategy offers a 100% detection rate for all types of attacks while having a false positive rate of only 0.25%.

However, we note that the max approach first proposed in [START_REF] Leichtnam | Sec2graph: Network attack detection based on novelty detection on graph structured data[END_REF] gives poor results for the detection of FTP-Bruteforce, DoS-Slow-HTTPTest, and Infiltration attacks. It gives an average score for the DDOS-LOIC-UDP attack but also high scores for all other attacks where the detection rate surpasses one of the other learning machine algorithms.

Mean strategy is more able at highlighting small novelties on several links, novelties which together constitute an anomaly than max strategy. FTP-Bruteforce, DoS-Slow-HTTPTest, and Infiltration attacks present weak anomalies on most of the links and do not present big reconstruction errors. The max strategy could outperform the mean strategy only if a link with a low anomaly score compensates for the anomaly of a link with a high score. This case was not encountered in this dataset.

Conclusion

We proposed in this paper a graph representation of security events that underlines the relationship between them. We also proposed an unsupervised technique built on an auto-encoder to efficiently detect anomalies on this graph representation with two different strategies to compute the anomaly score. This approach can be applied to any data set without prior data labeling. Using the CICIDS2018 dataset, we showed that the use of graph structures to represent security data coupled with an auto-encoder gives results that are better than common deep anomaly detection methods (supervised and unsupervised).

To further improve our detection results, we plan to use another kind of autoencoder (LSTM auto-encoder) to take temporal links between events into account to complement to logical links that we already take into account. Another area for improvement is related to the usability and interpretability of results by a security analyst. Here, the idea is to present to the analyst a graphical view of the detected anomalies, based on the SOs graphs that we have defined. We believe that this would help the analyst eliminating false positives or reconstructing global attack scenarios.

Fig. 1 .

 1 Fig. 1. Building a graph from one log event of the conn.log file

Fig. 2 .

 2 Fig. 2. Complete Security Objects and Relations Model Representation

Fig. 3 .

 3 Fig. 3. False Positive Rate (FPR) according to the value of the detection threshold for max strategy (left) and mean strategy (right) computed on a sample of benign data.

  Ferrag et al. [2] compares the results of seven supervised and unsupervised classical deep learning algorithms applied to this dataset: Deep Neural Network (DNN), Recurrent Neural Network (RNN), and Convolutional Neural Network (CNN), that are all supervised algorithms as well as Restricted Boltzmann Machine (RBM), Deep Belief Network (DBN), Deep Boltzmann Machine (DBM) and Auto-Encoder (AE) that are unsupervised.

Table 1 .

 1 Comparison of True Negative Rate (TNR) and Detection Rate (DR) for each type of attack and for different methods (in %).

		DNN RNN CNN RBM DBN DBM DA sec2graph sec2graph
									(max ) [4] (mean)
	TNR (BENIGN)	96.915 98.112 98.914 97.316 98.212 96.215 98.101 99.538	99.743
	DR SSH-Bruteforce	100	100	100	100	100	100	100	100	100
	DR FTP-BruteForce	100	100	100	100	100	100	100	0.03	100
	DR Brute Force-XSS	83.265 92.182 92.101 83.164 92.281 92.103 95.223 99.573	100
	DR Brute Force-Web	82.223 91.322 91.002 82.221 91.427 91.254 95.311	100	100
	DR SQL Injection	100	100	100	100	100	100	100	100	100
	DR DoS-Hulk	93.333 94.912 94.012 91.323 91.712 93.072 92.112	100	100
	DR DoS-SlowHTTPTest 94.513 96.123 96.023 93.313 95.273 95.993 94.191	0	100
	DR DoS-Slowloris	98.140 98.220 98.120 97.040 97.010 97.112 97.120	100	100
	DR DoS-GoldenEye	92.110 98.330 98.221 92.010 97.130 97.421 96.222	100	100
	DR DDOS-HOIC	98.640 98.711 98.923 97.541 97.211 97.121 96.551 99.997	100
	DR DDOS-LOIC-UDP 97.348 97.118 97.888 96.148 96.122 96.654 96.445 86.932	100
	DR DDOS-LOIC-HTTP 97.222 98.122 98.991 96.178 97.612 97.121 97.102	100	100
	DR Botnet	96.420 98.101 98.982 96.188 97.221 97.812 97.717	100	100
	DR Infiltration	97.518 97.874 97.762 96.411 96.712 96.168 97.818	2.815	100