Léonard Turpin
email: leonard.turpin@ens-paris-saclay.fr

Stéphane Roux

Jean Bénézech

Guillaume Couégnat

Andrew King

Olivier Caty

Sébastien Denneulin

Éric Martin

Quantitative thermomechanical characterisation of 3D-woven SiC/SiC composites from in-situ tomographic and thermographic imaging

Keywords: Ceramic-matrix composites (CMCs), CT analysis, mechanical testing, thermomechanical

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

To reduce the impact of air traffic on the environment, aircraft manufacturers aim to enhance engine efficiency by increasing the service temperature in the combustion chamber. This upgrade requires materials sustaining high thermomechanical performances up to 1500°C [START_REF] Naslain | Design, preparation and properties of non-oxide CMCs for application in engines and nuclear reactors: An overview[END_REF]. 3D-woven SiC/SiC ceramic matrix composites (CMCs) are very promising as they exhibit excellent structural properties at high temperatures [START_REF] Murthy | Probabilistic analysis of a SiC/SiC ceramic matrix composite turbine vane[END_REF]. The woven structure makes those materials resistant to impact and delamination [START_REF] Boussu | General definition of 3D warp interlock fabric architecture[END_REF]. For aeronautical parts with intricate geometry, complex woven structures are designed to resist multiaxial non-homogeneous loadings [START_REF] Turpin | In-situ tomographic study of a 3D-woven SiC/SiC composite part subjected to severe thermo-mechanical loads[END_REF]. A thorough understanding of thermomechanical behaviour, especially for critical areas, is required to design, model and certify such parts [START_REF] Zok | Ceramic-matrix composites enable revolutionary gains in turbine engine efficiency[END_REF].

Recent studies bring out the determining influence of the micro-and mesostructure of SiC/SiC CMCs on their local or overall behaviour [START_REF] Mazars | Etude des endommagements sur CMC par une approche de modélisation micro-méso alimentée par des essais in-situ[END_REF][START_REF] Zayachuk | Linking microstructure and local mechanical properties in SiC-SiC fiber composite using micromechanical testing[END_REF]. Numerous works propose suitable micro-to-meso homogenisation [START_REF] Lomov | Meso-FE modelling of textile composites: Road map, data flow and algorithms[END_REF][START_REF] Wintiba | An automated procedure for the generation and conformal discretization of 3D woven composites RVEs[END_REF], and microstructure influence is well understood for regular geometries, typically coupon samples or weaving patterns [START_REF] Isart | Internal geometric modelling of 3D woven composites: A comparison between different approaches[END_REF]. Image-based models can reproduce the behaviour of materials presenting complex microstructure [START_REF] Mendoza | The correlation framework: Bridging the gap between modeling and analysis for 3D woven composites[END_REF][START_REF] Wielhorski | Numerical modeling of 3D woven composite reinforcements : A review[END_REF], and homogenisation procedures have been developed [START_REF] Liu | Prediction of linear and non-linear behavior of 3D woven composite using mesoscopic voxel models reconstructed from X-ray micro-tomography[END_REF]. Stochastic generation of elementary cells representative of the fibre distribution inside the tows allows taking into account the heterogeneity at the micro-scale [START_REF] Khafagy | Multiscale characterization and representation of variability in ceramic matrix composites[END_REF]. Nevertheless, for meso-to-macro homogenisation, defining a representative volume element is not always possible. Indeed, most actual parts have complex shapes (e.g. aeronautical parts such as turbine blades or containment rings) [START_REF] Bénézech | Modélisation aux échelles méso-et macroscopique du com-portement mécanique de zones singulières de pièces de structure en CMC[END_REF]. In such parts, the CMC displays large microstructure changes (e.g. bending with high curvature, changes in weaving patterns) -the fabric can even be non-periodic. Moreover, the characteristic lengths of the loading (e.g. T / ∇T for thermal gradient, 1/ ∇ε for strain), which are closely linked to the geometry, can also become smaller than the putative representative volume element length. Theoretically, usual homogenisation approaches reach their limits. The mesostructure is critical, and its influence is not properly characterised yet. The lack of experimental procedures to assess the representativity of image-based models is one of the main impediments to their further deployment for industrial uses. This study aims to validate (or invalidate) the use of homogenisation procedures out of their secured field of application. It is then crucial to confront the model and the experiment.

An experimental procedure has been developed to characterise complexshaped samples. To challenge current model hypotheses, geometry needs to be 3D, and the thermomechanical loadings have to be heterogeneous. Such tests require innovative instrumentation. X-ray tomography is a tool capable of accessing the material mesostructure [START_REF] Naouar | Meso-scale FE analyses of textile composite reinforcement deformation based on Xray computed tomography[END_REF]. It provides a 3D image of the X-ray absorption coefficient. Local damage due to loading can be observed and measured by conducting in-situ experiments instrumented by tomography [START_REF] Maire | In-situ X-ray tomographic study of materials[END_REF]. This technique is especially efficient in observing cracking (localisation, morphology, etc.), provided the crack opening is greater than the voxel scale. Tensile tests have already shown the capability of such an approach for the study of CMCs at high temperatures [START_REF] Mazars | Damage investigation and modeling of 3D woven ceramic matrix composites from X-ray tomography in-situ tensile tests[END_REF][START_REF] Bale | Real-time quantitative imaging of failure events in materials under load at temperatures above 1,600 • C[END_REF]. During in-situ tests, X-ray tomography coupled with Digital Volume Correlation (DVC) gives access to the displacement field in the bulk of the sample [START_REF] Bay | Methods and applications of digital volume correlation[END_REF][START_REF] Hild | Toward 4D mechanical correlation[END_REF][START_REF] Buljac | Digital volume correlation: Review of progress and challenges[END_REF]. From either measured strains or DVC residuals, cracks can be detected even with subvoxel openings. The displacement field is computed relying on the texture of the volume, which is nothing but the mesostructure of the woven sample. This mesostructure limits the accuracy and resolution of the DVC-computed displacement field [START_REF] Chen | 3D Detection and Quantitative Characterization of Cracks in a Ceramic Matrix Composite Tube Using X-Ray Computed Tomography[END_REF]. A relevant way to bypass this limitation is to take into account the sample model during DVC computation performing integrated -DVC (IDVC) [START_REF] Roux | Optimal procedure for the identification of constitutive parameters from experimentally measured displacement fields[END_REF]. For thermomechanical experiments, infrared thermography can provide the surface temperature field to be used as thermal boundary conditions for IDVC [START_REF] Archer | Creep behavior identification of an environmental barrier coating using full-field measurements[END_REF].

The present paper details the identification of mesoscale material parameters of an image-based model that conforms to the actual mesostructure using in-situ experiments. The purpose is to understand better the behaviour of genuine CMC parts under complex loading. Experiments were carried out on a dedicated thermomechanical testing machine, described in [START_REF] Turpin | In-situ tomographic study of a 3D-woven SiC/SiC composite part subjected to severe thermo-mechanical loads[END_REF], on the PSICHE beamline at synchrotron SOLEIL. The sample was subjected to severe thermal gradients and multiaxial loadings. Based on a self-calibrated projection model, infrared images are cast on the sample 3D finite-element mesh surfaces [START_REF] Turpin | Coupling tomographic and thermographic measurements for in-situ thermo-mechanical tests[END_REF]. The high load capacity of the testing machine required the presence of stiff columns that partly obscured the projections (radiographs). Nevertheless, using a tailored reconstruction procedure and artefact corrections, one could successfully reconstruct high-quality 3D images [START_REF] Turpin | A phase field approach to limited-angle tomographic reconstruction[END_REF]. The present study exploits such images.

Exploiting the considerable amount of data provided by full-field measurements is quite challenging. An original IDVC procedure was therefore developed to identify parameters of a model enabling, in turn, its validation.

The procedure is described in section 2: the construction of the model is detailed, together with the identification method. Section 3 presents the identification results of a high-temperature test on an L-shaped sample. In section 4, the quality of the results and the relevance of the chosen model are discussed.

Concluding remarks and perspectives are proposed in section 5.

IDVC procedure

In-situ experiment

The test is an in-situ corner bending test, described in detail in a companion paper [START_REF] Turpin | In-situ tomographic study of a 3D-woven SiC/SiC composite part subjected to severe thermo-mechanical loads[END_REF]. The sample is an L-shaped corner. Its inner radius is 4 mm. The long arm is 27 mm, the short one 12 mm, with a section of 4.15×3 mm 2 (Fig. 1a). The long arm is clamped during the experiment. First, a thermal loading is applied by heating the outer surface of the long arm (using a resistor) to generate a high temperature gradient in the zone of interest (Fig. 1b and1c). Once the sample reaches the prescribed temperature, a mechanical load is applied incrementally in the -z-direction, up to rupture, by an alumina punch on the short arm (Fig. 1b). An infrared camera is set up such that its optical axis is perpendicular to the tomograph X-ray axis. A set of thermographies is acquired during the tomographic scan while the sample is rotating, giving access to the thermal field of all the sample surfaces. The tests are carried out on the PSCHE beamline at synchrotron SOLEIL with a pink beam centred around 40 keV and at a resolution of 3.14 µm. Those acquisition conditions provide a sufficient texture for DVC (i.e. grey-level variations in the tomographic images), a good description of the mesostructure of the sample and a large enough field of view to observe the whole zone of interest. The resolution of infrared images is 217 µm. For more details about the acquisition conditions, the reader is referred to [START_REF] Turpin | In-situ tomographic study of a 3D-woven SiC/SiC composite part subjected to severe thermo-mechanical loads[END_REF].

Tomographic and thermographic acquisitions are performed at the initial state at room temperature, after the heating step and at each loading step.

Thermomechanical model

The structure of woven-SiC/SiC composites is complex (Fig. 2). The studied material is produced by Safran Ceramics. At the mesoscale, two constituents are generally distinguished [START_REF] Turpin | In-situ tomographic study of a 3D-woven SiC/SiC composite part subjected to severe thermo-mechanical loads[END_REF]:

• the tow, composed of Hi-Nicalon-S SiC fibres, coated by a boron nitride interphase and the intra-tow SiC matrix, both elaborated by Chemical Vapor Infiltration [START_REF] Mazars | Damage investigation and modeling of 3D woven ceramic matrix composites from X-ray tomography in-situ tensile tests[END_REF];

• the SiC matrix which is elaborated in two steps (SiC slurry cast and metal Si Melt Infiltration (MI) [START_REF] Carpentier | In situ observation of the capillary infiltration of molten silicon in a sic/sic composite by x-ray radiography[END_REF]) and thereby contains several phases (SiC, Si and SiC powder embedded in metal Si) and has an overall porosity of about 5% [START_REF] Turpin | In-situ tomographic study of a 3D-woven SiC/SiC composite part subjected to severe thermo-mechanical loads[END_REF].

Those phases are considered homogeneous, the identified mesoscale properties are thereby effective properties which will depend on the microstructure. The mesopores are explicitly considered on the model because their repartition is not homogeneous in the material, at least at the considered imaging scale. The micro-cracks and porosity are assumed to be more diffuse and integrated into the matrix effective mesoscale properties. Moreover, their very small size and aperture prevent their observation. They are thus not considered explicitly, but from their contribution to the effective elastic properties of the matrix phase.

The woven pattern, a custom 3D interlock, has a prominent influence on the thermomechanical behaviour of the composite. The image-based model deployed in the following aims to reproduce this effect. of using a simulated model instead of the actual sample microstructure is an attractive supplementary feature of the proposed methodology. The validation of the preform shaping simulation is also an important issue, although it is not addressed in the present paper.

As described in

The composite elementary constituents are assumed to have a linear thermoelastic behaviour in the ranges of temperature and strain applied. The matrix is isotropic, and the tows are transversely isotropic. They are both considered homogeneous, and the properties of all tows are chosen identical. Table 1 inventories the whole set of the constituent material properties and the notations used hereafter. As the thermal gradient in the sample is important, the variation of the properties with temperature has to be considered. In the considered temperature range (room temperature up to 1200°C), the SiC properties vary linearly [START_REF] Sakaguchi | The Poisson's ratio of engineering ceramics at elevated temperature[END_REF]. This observation is extended to the properties of tows. Properties are then considered at the two bound temperatures. As the anisotropy of the expansion coefficient of tows is low and its value is close to the matrix one, it is considered that the expansion coefficients of the tows are equal to that of the matrix k 11 = k 22 = k. Indeed, the two expansion coefficients of the tows, k 11 and k 22 , have very low sensitivities and induce ill-conditioning of the identification problem, as explained in Appendix C. Therefore, 18 mesoscale material parameters in total need to be identified.

The used macroscale mesh does not describe the mesostructure explicitly (Fig. 3a). A local homogenisation is required. The effective properties of each Table 1: Thermomechanical properties of the meso-constituents. Initial values are from [START_REF] Mital | Modeling of meltinfiltrated SiC/SiC composite properties[END_REF] and † [START_REF] Bénézech | Modélisation aux échelles méso-et macroscopique du com-portement mécanique de zones singulières de pièces de structure en CMC[END_REF]. The The sample is clamped in its lower part. In the model, the bottom surface of the mesh, Σ, is assumed to be subjected only to rigid-body displacement and thermal dilatation (Fig. 1c). Those parameters are determined by standard DVC over a zone of interest surrounding this surface. The loading is applied to the short arm with a punch. The punch geometry was chosen to be flat, and it is assumed that the entire lower surface of the punch is in contact with the sample. The temperature field is re-projected from multi-view infrared acquisition (Fig. 1c). It was shown to remain constant in time during an acquisition [START_REF] Turpin | In-situ tomographic study of a 3D-woven SiC/SiC composite part subjected to severe thermo-mechanical loads[END_REF], and it is used as Dirichlet thermal boundary conditions applied to the model surface.

Identification procedure

The experimental protocol aims to identify the best meso-constituent material parameters of the image-based model (listed in Table 1) to fit the observed behaviour. It is then used to validate the modelling choice.

DVC consists in computing the displacement field between two tomographic images based on their texture and assuming grey level conservation [START_REF] Buljac | Digital volume correlation: Review of progress and challenges[END_REF]. With global DVC, the displacement field is expressed on a kinematic basis, itself supported by a finite element mesh. The exploited image texture of the tomographic reconstruction is directly the contrast of the microstructure without any further alteration. In the considered composites, the tows are not uniformly distributed, and the major axes of the tow sections have lengths of the same order of magnitude as the thickness of the part. In classical DVC, the mesh should be very coarse. A more tailored basis can be used. IDVC directly uses a kinematic basis composed of the sensitivity fields with respect to the parameters of the sample model [START_REF] Hild | Digital image correlation: From displacement measurement to identification of elastic properties -A Review[END_REF]. Among full-field measurement-based methods, IDVC is the best identification procedure to minimise the uncertainty of the identified parameters, provided the model accurately describes the sample and its boundary conditions [START_REF] Roux | Optimal procedure for the identification of constitutive parameters from experimentally measured displacement fields[END_REF].

Appendix B details the IDVC procedure and its implementation in our particular case. In essence, IDVC aims to find the set of parameters that minimises the norm of this DVC residual (i.e. the difference between the reference image and the deformed image corrected by the current estimation of the displacement field). A Gauss-Newton algorithm is used. The residual is projected onto the vector space generated by the sensitivity fields of the parameters. The respective amplitude of those projections provides the estimate of the incremental correction of the parameters. The convergence criterion is defined using the norm of this incremental correction, ensuring the stationarity of the solution. As long as the material can be considered linear thermo-elastic, its properties do not vary from one acquisition step to another. It is, therefore, relevant to perform only one minimisation embracing all the steps in a so-called spatiotemporal approach.

Results

Model validation

This approach is valid as long as the thermo-elastic model remains relevant. Therefore, our analysis is performed over all data collected prior to the first visible sign of damage. The measured temperature and displacement fields of the elastic step of the test are displayed in Figure 4. The temperature fields are directly a projection of the infra-red images onto the sample mesh. The "measured" displacement fields are computed with the model using the identified set of parameters. Only thermal loading is applied during the first step (a), and the sample expands. As the thermal loading does not evolve much during the test, the displacement field at this step gives an insight of the thermal-induced displacement all along the test. The mechanical loading is applied during the following steps (b) to (d), and the sample bends about the x-axis. The amplitude of the thermal-expansion-induced displacement is relatively important compared to the mechanical one. On the thermal field, the effect of the contact with the punch, acting as a heat sink, explained the temperature variation between steps (a) and (b).

The identification procedure is initialised with material properties extracted from the literature (Table 1). The displacement field determined by the first finite element simulation provides the initial residual. If the model perfectly reproduces the measured displacement field, those residuals should reduce to noise images. The image textures should not be detectable. In practice, identification procedures, such as IDVC, reduce the kinematic basis drastically. The new parametric basis limits the solution to relevant ones. two lunulae, one positive and one negative, meaning the recalled position of this porosity is false. A displacement along y is missing.

However, the overall displacement is rather well determined with the initial parameters. The chosen model and properties are suitable as they already account well for the kinematics from the tomographic data. The identification procedure aims to fine-tune the material properties to minimise these residual fields further.

The norm of the residual (i.e. the root mean square of the residual field)

provides global information about the mismatch between the two images. Its variation is a good indicator for comparing several models and parameters. The residual norm with the identified set of parameters should be lower than the initial one.

Identification of the material parameters

Table 1 gathers the results of the identification of thermo-elastic material properties for a high-temperature test. In general, the differences between optimised and initial values are relatively low. However, substantial differences have to be noticed.

The initial choice of the matrix Young's modulus was overestimated, whereas the thermal expansion coefficient was underestimated. Considering the matrix as homogeneous at the mesoscale is daring, given its actual heterogeneity. Indeed, due to the woven-structure shaping, some regions between and inside tows are difficult to infiltrate and present shrinkage cracks and micro-pores. Although the resolution of the tomography is not sufficient to observe them, such cracks are expected within the slurry cast sintered matrix [START_REF] Galizia | Disclosing residual thermal stresses in uht fibrereinforced ceramic composites and their effect on mechanical behaviour and damage evolution[END_REF]. IDVC, by identifying the effective mesoscale properties, allows for taking into account the softening of the matrix induced by the micro-porosity and micro-cracks. Furthermore, the estimation of the mesoscale porosity is imperfect. As an ideal woven structure is used to build the model, which is not a perfect match to the real structure in places, the porosity map obtained from tomography intersects some tows. So as not to break their continuity, those pores are omitted, thereby reducing the actual porosity of the sample. The insufficient knowledge of the micro-structure of the matrix could explain the initial overestimation of Young's modulus E.

The rather large correction of high-temperature E can result from the presence of the metallic Si phase. The properties of this metallic phase vary much more with the temperature than those of the SiC ceramic phase.

The initial values of tow properties are the effective parameters proposed in [START_REF] Mital | Modeling of meltinfiltrated SiC/SiC composite properties[END_REF], which stem from homogenising unidirectional tows. Only the fibre, the interphase and the intra-tow matrix are considered during the homogenisation.

Regarding the longitudinal properties of tows, the final values remain close to the initial ones. The fibres dominate the longitudinal properties. They are thus less sensitive to microporosity. The elementary homogenisation to determine them is efficient. Although homogenisation is rather coarse, the results appear to be accurate despite the high tow curvature in the elbow of the sample. For the transverse properties, particularly the shear modulus G 23 , identified values are significantly lower than their initialisation. Micro-mechanical simulations of tows show that their porosity substantially impacts their transverse properties [START_REF] Gélébart | Effects of porosity on the elastic behaviour of CVI SiC/SiC composites[END_REF]. The underestimation of porosity and intra-tow matrix discontinuity could be responsible for the initial overestimation of the transverse properties.

As pointed out in [START_REF] Turpin | In-situ tomographic study of a 3D-woven SiC/SiC composite part subjected to severe thermo-mechanical loads[END_REF], the infiltration of our samples is not perfect, and the tow porosity may be a little higher in bulk than near the specimen surface.

Discussion

A complex test, such as the presented corner bending test, is an excellent way to access a large set of material properties. As the loading state of the sample varies from one area to the next, most constitutive parameters influence the observed displacement fields. This loading heterogeneity should be contrasted with standard approaches where each property is evaluated with a dedicated test. Not only does the proposed procedure reduce the time and effort of a complete experimental campaign, but it also avoids sample variability, which may affect the interpretation.

The influence of each parameter can be evaluated by considering the diagonal terms of the Hessian matrix of the sensitivity matrix (Appendix D). The good conditioning of the Hessian matrix allows one to judge the relevance of the considered test to identify the sought parameters. Indeed, the conditioning quantifies the relative influences of the least and the most sensitive combinations of parameters.

The errors remaining after the identification are measured by the final residual. Two types of errors can be distinguished:

• the model error;

• the measurement uncertainty.

Model validation: considerations about model error

The model error is the gap between the actual sample behaviour and its simulated behaviour. It induces an error in the converged displacement estimation, which appears distinctly in residual fields. In the present case, the model error can be explained for the most part by the use of an ideal woven structure to build the enriched macro-scale model of the sample instead of the actual one.

The homogenisation hypotheses are a potential source of error. As evoked in Section 3.2, considering the matrix as a homogeneous media at the mesoscale is a strong assumption. Similarly, assuming that all tows have the same properties is an approximation.

Tomographic artefacts are an additional source of model error. Indeed, volumes with artefacts do not faithfully reproduce the sample microstructure and can affect DVC computation. Performing DVC, the grey levels of the image are thus expected to be an intrinsic signature (X-ray absorption coefficient) of each sample voxel. The grey level of a material point is assumed not to vary during the test. However, scattering may induce deviation from such assumptions.

Most tomographic artefacts, namely missing-angle and ring artefacts, are static in the detector frame and do not move as neighbouring material points from one step to the next. It is essential to reduce these artefacts by pre-processing the volumes [START_REF] Turpin | In-situ tomographic study of a 3D-woven SiC/SiC composite part subjected to severe thermo-mechanical loads[END_REF][START_REF] Turpin | A phase field approach to limited-angle tomographic reconstruction[END_REF]. As they do not entirely vanish, some remain visible in the residual. For instance, some ring artefacts are visible in Figure 5b in the (x, y)-plane. Nonetheless, the deviations from experimental data are low. The mismatch on the sample edges can be measured to estimate the error in displacement using the model with identified parameters. The good agreement between the model and the experiment in this case, with high thermal gradients and important microstructure variations, validates the relevance of using local homogenisation.

A way to improve the finite-element model could be to take into account the true mesostructure, obtaining textile descriptors from the tomography of the sample. In SiC/SiC composites, the contrast between matrix and fibres is poor because both are made of silicon carbide. The segmentation of the woven structure is thus difficult on fully elaborated materials. Bénézech and Couégnat [START_REF] Bénézech | Variational segmentation of textile composite preforms from X-ray computed tomography[END_REF] proposed to perform this step before the infiltration of the matrix (on the so-called woven preform). Unfortunately, in the present experiment, the woven preform tomogram was unavailable.

Influence of parameters: considerations about uncertainties

The measurement uncertainty is induced by the noise on the raw measured fields, i.e. the noise level of the tomograms and the uncertainty of the force. The noise of the tomograms is assumed to be white and Gaussian. It is estimated as the variance of grey levels in a homogeneous area of the tomogram (in the air surrounding the sample). The measurement uncertainty of the force is computed from the manufacturer's data about the acquisition chain (force sensor and acquisition device). The uncertainties displayed in Table 1 Hence, the previous conservative estimates do coincide with the true uncertainty. In contrast, the two parameters are very much correlated for the former.

The estimation of the uncertainty should take into account the coupling.

For the full problem, the uncertainty hyper-surface is a 22-dimension hyperellipsoid whose full knowledge is necessary to assess the uncertainty of any property which depends on any arbitrary combination of parameters. From an engineering point of view, such a determination is impractical and difficult to communicate. In practice, one generally aims to determine one parameter considering all others as known. The uncertainty on that parameter is then the intersection of the ellipsoid with the line describing the quantity of interest.

In a given experimental condition, with a given amount of data, the smaller the number of identified parameters, the lower the uncertainty. With that in mind, the proposed spatiotemporal approach is relevant. The material is assumed linear elastic. The material parameters are thus independent of the loading level and can be determined once for the entire test. The overall number of parameters to be identified is so substantially reduced.

The uncertainty obviously depends on the sensitivity of the displacement field on the corresponding parameter. It traduces the capability of the IDVC procedure to identify a particular parameter. Here, relative uncertainties vary Here the temperature field is treated as exact, and thus the error in the temperature measurement is not included in the uncertainty but the model error.

Limitation of the IDVC algorithm

Such an approach is demanding in terms of computation time. The convergence is slow. The IDVC itself requires about two hours for the high-temperature test. The limiting step is the determination of sensitivity fields, which necessitates as many finite-element simulations as parameters to identify. So increasing the number of parameters of the model implies higher computation times. A relatively complex thermo-elastic model is used here, and each simulation takes about one minute. Using a more complex model, e.g. including damage, could require high-performance computation setups.

Conclusion

This work opens the way to fully characterise industrial parts rather than samples of material lacking shape complexity. The proposed IDVC procedure, based on a locally homogenised model, is applied to a sample that does not fulfil the scale separation hypothesis. IDVC provides model validation, fine identification of material parameters and uncertainty estimations. A corner bending test proves to be well-suited to identify most of the thermo-elastic parameters of the model.

The identification residuals highlight a good agreement between the proposed model and experiment, proving the capability of a macroscale locallyhomogenised model to accurately describe the thermomechanical behaviour of SiC/SiC CMCs up to damage occurrence and despite the complex shape of the sample. The deformation of a 10 mm-long sample is reproduced with a precision of about 20 µm.

A set of nine material parameters is identified. Considering the gap between the initial guess and the estimated parameters, the quality of usual hypotheses about elementary properties, which is generally the weak point of homogenised models, can be assessed. Most of the identified parameters are close to the initial ones. It means, for instance, that a common homogenisation to compute tow properties already provides a good approximation of effective behaviour even if those tows present a large curvature. Nonetheless, the tow transverse properties were initially overestimated. This is likely due to neglecting intra-tow micropores. The sensitivity fields highlight the influence of the identified parameters in the given loading configuration. As expected, the matrix properties have a first-order influence on the behaviour in the elastic domain, and so do the longitudinal and transverse tow Young's moduli. On the other hand, the tow Poisson's ratios appear to have a weak effect.

The part geometry renders its manufacturing delicate. For instance, the fibre volume fraction or Si fraction in the matrix may differ from the one expected during the initial design. The identified parameters provide -for the studied sample and the considered model -the best description of the sample behaviour. The model needs to be validated by further experimental studies for design or certification purposes. This procedure -or a similar one -should be extended to other test configurations to fully validate the modelling choices (varying loading, geometry and weaving of the sample). Then, the model and the identified material parameters could be used to design and dimension parts.

Appendices

A. Image-based model and homogenisation procedure

The objectives are, on the one hand, to build a model taking the sample mesostructure into account and, on the other hand, to keep some freedom in terms of element sizes. A macroscale model is enriched by computing the material properties from the mesoscale constituent properties using a local homogenisation procedure.

A simulation of the forming of the weaving pattern provides the sample tow geometry as textile descriptors (neutral fibres and sections of the tows, using the formalism proposed by [START_REF] Bénézech | Variational segmentation of textile composite preforms from X-ray computed tomography[END_REF]), displayed in Figures A1a andA1b. Thanks to those descriptors, each tow and each tow segment are labelled. Two volume images are built using those labels as grey levels (Fig. A1c). The images represent the geometry of the weaving pattern. The labels are resp. related to a table of phases and a table of orientations.

The overall infiltrated sample shape is determined thanks to the tomography, and so is the mesopores distribution [START_REF] Turpin | In-situ tomographic study of a 3D-woven SiC/SiC composite part subjected to severe thermo-mechanical loads[END_REF]. Tomography provides the geometry of the matrix as a binarised image (Fig. A1d). A new image is built by summing the weaving pattern and the matrix images (Fig. A1e). It represents the spatial distribution of the different phases. The mesopores are considered in the model only when they do not intersect the idealised woven structure. From this image, a mesoscale mesh is formed using the CGal toolbox [START_REF] Alliez | 3D mesh generation[END_REF]. The mesh contains 345 000 nodes and is composed of tetrahedral elements.

At the mesoscale, tows are assumed to be transverse-isotropic and homogeneous. The matrix is supposed to be isotropic and homogeneous. The interfaces between tows and matrix are assumed to be perfect (no de-cohesion is considered). The interface nodes are shared by the two surrounding phases ensuring the displacement continuity between the phases. The pores are considered isotropic with a very low Young's modulus. The mesoscale properties are recalled in Table 1.

The macroscale mesh is also built using CGal, using the binarised tomogram The effective properties of each macro-element are computed from the properties of the phases it contains using an equivalent laminate model. The macro-element effective stiffness tensor, C eff , and thermal expansion tensor, K eff , are then the weighted means of the resp. tensors of each phase i (all the tensors expressed in the global frame)

C eff = τ i C i K eff = τ i K i (A1)
In practice, those properties are computed from tables containing the proportion, τ i , and orientation of each constituent of the macro-element using a dedicated Abaqus UMAT (User-defined mechanical MATerial behaviour ) [START_REF] Bénézech | Modélisation aux échelles méso-et macroscopique du com-portement mécanique de zones singulières de pièces de structure en CMC[END_REF]. This UMAT also takes into account temperature dependence. Properties are assumed to vary linearly with the temperature in the considered range. Each macro-element has thus different properties. As an illustration, Figure A2d shows the fields of some components of C eff . One can notice that the tow alignments appear on the field along their transverse direction. Mesostructure data is transported into the macroscale model. The macroscopic mesh size is a compromise between modelling and DVC constraints. On the one hand, tomography texture imposes the minimal element size for DVC. On too large a size the quality of the local homogenisation. Indeed, the hypothesis of the local equivalent-laminar model is relevant only if the element most, one weft and one warp tows. The tows have an ellipse shape with a major axis of about 600 µm and a minor axis of about 200 µm. On a comparable SiC/SiC composite, a mesh size of 252 µm, thus corresponding to the yarn thickness, is sufficient to bring to light the effect of mesostructure heterogeneity on the elastic behaviour properly [START_REF] Bénézech | Modélisation aux échelles méso-et macroscopique du com-portement mécanique de zones singulières de pièces de structure en CMC[END_REF]. This size is used to build the macroscale model. This last model has 13 680 degrees of freedom.

B. IDVC implementation

DVC is an imaging technique which aims to compute kinematic fields from volume images (typically tomograms) acquired at different loading states [START_REF] Hild | Digital image correlation: From displacement measurement to identification of elastic properties -A Review[END_REF]. It consists in finding the displacement field, u, minimising the residual, ρ, between two images, f and g

ρ (x, u) = f (x) -g (x + u (x)) (B1)
In the global formulation, the weak form of the problem is considered. The displacement field is projected on a finite element basis u(x) = a i ϕ i (x) [START_REF] Roux | Three-dimensional image correlation from X-ray computed tomography of solid foam[END_REF].

The problem is highly non-linear. It is solved using a Gauss-Newton algorithm.

The iterative correction, {δa} of the displacement field {a} is found by solving

[M ]{δa} = {b} (B2)
where [M ] is the DVC Hessian matrix

     [M ] = t ϕ t ∇f ∇f ϕ dx {b} = t ϕ t ∇f ρ dx (B3)
IDVC uses a more suited kinematic basis by integrating a model [START_REF] Bertin | Integrated digital image correlation applied to elastoplastic identification in a biaxial experiment[END_REF]. In the present case, the model presented in Appendix A is used. The parameters of the model, {p} -or a normalisation, {p}, of them (see Appendix C) -are then the new unknowns of the problem. IDVC is thus an identification procedure.

A convenient and lowly-intrusive way to integrate the model is to pass through the sensitivity field of the parameters

{S pi } = ∂{a} ∂ pi (B4)
{S pi } is the displacement field induced by an incremental variation of pi . A new Gauss-Newton procedure is set, solving at each iteration

t [S][M ][S]{δ p} = t [S]{b} (B5)
where [S] is the concatenation of all the sensitivity fields.

Other measurement modalities can be integrated into the identification procedure. In the presented case, the force is also used. The increment, {δ p} is computed by solving

[H] {δ p} = {c} t   S a S F       M 2σ 2 f 0 (N ×1) 0 (1×N ) 1 σ 2 F       S a S F   {δ p} = t   S a S F          b σ 2 f ∆F σ 2 F        (B6)
where [S a ] and [S F ] are resp. the displacement and force sensitivity fields; σ f the noise level of the images, σ F , the uncertainty on the force; and ∆F , the difference between the measured force and the force computed with the current parameters {p}.

The thermal field is also considered in the identification procedure. Weak coupling is assumed because the strains are low in SiC/SiC composites. The measured temperature field -i.e. re-projected from the infrared images using the procedure detailed in [START_REF] Turpin | Coupling tomographic and thermographic measurements for in-situ thermo-mechanical tests[END_REF] -is used as boundary conditions in the finiteelement model.

The convergence criterion to reach stationarity is based on the norm, δ p , of the increment of parameters. This norm should include the metric of the problem

δ p = t {δ p}[H]{δ p} (B7)
As [H] is the inverse of the covariance matrix of p, if this norm is inferior to one, the variation of each parameter is inferior to its uncertainty (Appendix D).

This criterion is generally stricter than a criterion on residual stationarity.

The computation of the sensitivity field is a time-consuming step. To speed up the IDVC convergence, the sensitivity field is not updated at each iteration.

In between actual updates of all sensitivity fields (outer iterations), they are not updated for several inner iterations. Finding a good balance between outer and inner iterations allows for saving computation time. The criterion to update sensitivity fields is based on the gap between the parameter value (when the corresponding sensitivity was computed) and the current one.

In practice, sensitivity fields [S a ] and [S F ] are numerically computed using the sample finite element model and using Abaqus. The sensitivity field computation is parallelised. IDVC is performed using Correli1 , namely the computation of [M ] and {b}. The computations are performed on a Debian-Linux workstation with 24 cores and 250 Go of RAM. Inner iterations take about twenty seconds, and outer ones take ten minutes (using parallel computation for sensitivity fields).

C. Sensitivity study

The sensitivity fields are the displacement fields resulting from an infinitesimal change of one parameter, keeping all the others constant. As the parameters have different natures and dimensions, the sensitivity fields exhibit broadly distributed orders of magnitude. As the identification problem is ill-posed, when considering the original set of parameters {p}, this can lead to an ill-conditioning of [H] (Eq. B6). A first step consists in normalising the parameters, such that the incremental variation of the normalised set of parameter {p} induces sensitivity fields of the same orders of magnitude. The normalisation choices depend on the parameter natures and are given in Table C1.

Then, the eigenvalues and eigenvectors of [H] should be studied. Eigenvectors provide information on the possible coupling between parameters. The components of the eigenvectors associated with the lowest eigenvalues have a very low contribution to the sensitivity field. In the considered configuration, they have an insignificant influence on the behaviour of the sample. That is why the two coefficients of thermal expansion of the tows are not considered in the identification.

It is also interesting to consider the sensitivity field for themselves. The From one parameter to the next, the intensity of the sensitivity field may vary by more than one order of magnitude. Moreover, some fields have a similar pattern (e.g. room-temperature E and high-temperature E) and are only distinguished by their intensity, leading to indetermination. Those two points result in very poor conditioning of the identification problem.

D. Uncertainty computation

If the images are submitted to white Gaussian noise of standard deviation σ f and this noise is low compared to the grey level dynamics, the covariance of

Figure 1 :

 1 Figure 1: L-shaped sample. (a) Tomography of the full sample. (b) Zone of the sample visible during the test (the short arm a); the mechanical loading is applied by the punch b, the thermal loading is applied by the SiC/SiC resistor c. (c) Thermal field at the first loading step (°C)

  Appendix A, a sample woven structure is characterised explicitly by textile descriptors: neutral fibres of tows and several sections having a polygonal geometry. A descriptive geometrical model of the preform can then be built. The present study chose to resort to an idealised description of the weaving based on a simulation of the preform shaping process. The matrix geometry (overall sample shape and mesoscale pore distribution) is extracted from the tomography and integrated into the model. The simulated weaving does not match the actual mesostructure perfectly. Nevertheless, the possibility Hi

Figure 2 :

 2 Figure 2: Microstructure of the studied SiC/SiC composite (courtesy of V. Mazars, this image is reproduced from [6]).

  identified values are the IDVC result. Comments on the computation and the meaning of the displayed uncertainties can be found in Appendix D element are computed from the properties of the constituents it contains using an equivalent laminate model using the procedure detailed in Appendix A. It results in a field of stiffness and thermal dilatation tensors different to each other. The number of macroscale parameters is huge, but for a given geometry, they depend on a limited number of mesoscale parameters.

Figure 3 :

 3 Figure 3: Model of the sample. (a) Mesostructure and the macroscale mesh (mesh size 252 µm), the colours refer to the elementary constituents. (b) Boundary conditions, the bottom surface Σ is not a free surface, and its rigid body motion and dilatation are computed from DVC. The loading applied by the punch is displayed in red and parameterised by {u, d, e, θ, γ}

FigureFigure 4 :

 4 Figure 5a corresponds to the heating step (without any mechanical loading), and Figure 6a to the first mechanical loading step (resp. step (a) and (b) ofFigure4). The remaining texture on the residual field traduces the local error on the simulated displacement field. The grey level amplitude is irrelevant per se, but the patterns provide the mismatches between the model and the experiment.In Figure6, a porosity is marked with an arrow in the (x, y)-plane. It displays

Figure 5 :

 5 Figure 5: Grey level residual field, ρ, for the heating step: (a) initial state ρ = 5.54 × 10 3 ; (b) converged state ρ = 4.28 × 10 3 . Some ring artefacts are pointed out by the arrow in the (x, y)-plane at the converged state.

Figure 6 :

 6 Figure 6: Grey level residual field, ρ, for the first loading step: (a) initial state ρ = 5.66 × 10 3 ; (b) converged state ρ = 4.95 × 10 3 . In (x, y)-planes, arrows mark the position of a mismatching pore.

Figure 5

 5 Figure 5 shows the residual of the heating step at the beginning of the test. The model adequately reproduces the displacement field induced by the thermal expansion as the residual almost exclusively reveals noise and tomographic artefacts.

Figure 6

 6 Figure 6 corresponds to the first loading step. Even though the displacement field is globally well estimated (the model captures the sample boundary motion well), the woven structure appears in the residual. The model with identified parameters does not perfectly describe the local deformation of the sample.

  are computed from the uncertainty of the experimental data as explained in Appendix D. It corresponds to the uncertainty on the parameter if there were no model errors and if all other parameters were set to their values. It is a lower bound of uncertainties. To fully characterise the uncertainty, it is necessary to consider the coupling between parameters and the full covariance matrix of the problem (or its invariants, e.g. its eigenvalues). Considering a sub-problem with two degrees of freedom, Figure 7 illustrates the coupling of parameters for two pairs of parameters: (a) room-temperature E and E 11 (matrix and tow Young's moduli, respectively) and (b) roomtemperature G 12 and G 23 (tow shear moduli). For the latter, the ellipse axes are almost parallel to the basis axes, G 12 and G 23 are only slightly correlated.

  with RT G 23 and G 12

Figure 7 :

 7 Figure 7: Uncertainty ellipses (%) for some two-parameter problems. Each parameter is normalised by a nominal value, typically its initial guess.

Figure A1 :

 A1 Figure A1: Building of the mesoscale image-based model. The textile descriptors of the fabric (a) and of the geometry of the tows (b) are used to build 3D images of the weaving pattern (c). A binarised tomography (d) gives the overall shape of the sample and so the geometry of the matrix. Addition of those two images, image (e) describes the spatial distribution of the mesoscale components.

Figure A2 :

 A2 Figure A2: Local meso-to-macro homogenisation. (a) Zoom on the mesoscale mesh, superimposed with the image of the weaving pattern; (b) Macroscale mesh superimposed with the image of the mesostructure. The mesh (c), with a mesh size of 90 µm, is conformal, whereas the macroscale mesh (d), with a mesh size of 225 µm, is not. (e) of the three diagonal components of the macroscopic effective stiffness tensor C eff (GPa) issued from the local homogenisation.

  sensitivities of the displacement field with respect to material properties are considered hereafter. To appreciate the influence of one parameter, some examples of sensitivity fields are shown in FigureC1. The corresponding sensitivity fields are relatively smooth even if the material properties are not spatially homogeneous. Sensitivities along the z-axis (S z ) have a very low magnitude for most parameters. Indeed, the boundary conditions constrain the sample displacement in this direction. In turn, S z on those boundary conditions are very high.

Figure C1 :

 C1 Figure C1: Some sensitivity fields cut in the median plane of the sample: displacement (µm) induced by a variation of the normalised parameters of 1%.

Table C1 :

 C1 Normalisation of the material parameters of the IDVC problem. ∆T is the temperature range of the test, u ref is a reference displacement, and is a characteristic length (here, is the diameter of the sample).

	nature	corresponding parameters, pi	pi
	modulus	E, E11, E22, G12, G23	pi pnom,i
	Poisson's ratio	ν, ν12, ν23	pi
	coefficient of thermal expansion k, k11, k22	∆T u ref	pi

Correli is LMPS's DIC and DVC toolbox.

Acknowledgement It is a pleasure to acknowledge Capucine Billard, Hugo Carpentier, David Damiani and André Ebel for their help during experiments and Xuyang Chang for his critical reviewing. This work was supported by Association Nationale de la Recherche et de la Technologie and Safran Ceramics (CIFRE grant); Safran group and Direction Générale de l'Aviation Civile (PRC MECACOMP); and synchrotron SOLEIL, St-Aubin, France (proposal 20181639).

Data availability

The raw data required to reproduce these findings cannot be shared at this time due to legal reasons. The processed data required to reproduce these findings cannot be shared at this time due to the same reasons.

the displacement field, a, computed by DVC writes [START_REF] Roux | Stress intensity factor measurements from digital image correlation: Post-processing and integrated approaches[END_REF]

where [M ] is the DVC Hessian matrix (Eq. B3).

Excluding the model error, which is discussed in Section 4.1, the covariance of the parameters, p, is

Indeed, the IDVC Hessian matrix [H] already includes the noise level of the images, σ f , and the uncertainty of the force, σ F (Eq. B6). In this paper, the authors consider that the standard deviation of a parameter (i.e. the square root of the corresponding diagonal term of [H] -1 ) is a good estimator of the uncertainty induced by the uncertainties in the experimental data. Those values are displayed in Table 1.


Philippe Owezarski

Patrice Abry

Julien Aussibal

Pierre Borgnat

Gustavo Comerlatto

Guillaume Dewaele

Silvia Farraposo

Laurent Gallon

Yann Labit

Nicolas Larrieu

A database of anomalous traffic for assessing profile based IDS

Keywords: Statistical evaluation of IDS, attack traces, ROC curves, KDD'99

This paper aims at proposing a methodology and the required tools for evaluating current IDS (commercial ones, as well as prototypes resulting from advanced research projects) capabilities of detecting attacks targeting the networks and their services. This methodology tries to be as realistic as possible and reproducible, i.e. it works with real attacks and real traffic in controlled environments. It especially relies on a database containing attack traces specifically created for that evaluation purpose. By confronting IDS to these attack traces, it is possible to get a statistical evaluation of IDS, and to rank them according to their detection capabilities without false alarms. For illustration purposes, this paper shows the results obtained with 3 public IDS. It also shows how the attack traces database impacts the results got for the same IDS.

I Motivation

I.1 Problematics

Internet is becoming the universal communication network, conveying all kinds of information, ranging from the simple transfer of binary computer data to the real time transmission of voice, video, or interactive information. Simultaneously, Internet is evolving from a single best effort service to a multiservice network, a major consequence being that it becomes highly exposed to attacks, especially to denial of services (DoS) and distributed DoS (DDoS) attacks. DoS attacks are responsible for large changes in traffic characteristics which may in turn significantly reduce the quality of service (QoS) level perceived by all users of the network. This may result in the breaking of SLA (Service Level Agreement) at the Internet Service Provider (ISP) fault, potentially inducing major financial losses for them.

Detecting and reacting against DoS attacks is a difficult task and current intrusion detection systems (IDS), especially those based on anomaly detection from profile, often fail in detecting DDoS attacks efficiently. This can be explained via different lines of arguments. First, DDoS attacks can take a large variety of forms so that proposing a common definition is in itself a complex issue. Second, it is commonly observed that Internet traffic under normal conditions presents per se, or naturally, large fluctuations and variations in its throughput at all scales [START_REF] Park | On the relationship between file sizes, transport protocols, and self-similar network traffic[END_REF], often described in terms of long memory [START_REF] Erramilli | Experimental queueing analysis with long-range dependent packet traffic[END_REF], selfsimilarity [START_REF] Park | Self-similar network traffic : An overview[END_REF], multifractality [START_REF] Feldmann | Data networks as cascades : Investigating the multifractal nature of internet wan traffic[END_REF]. Such properties significantly impair anomaly detection procedures by decreasing their statistical performance. Third, Internet traffic may exhibit strong, possibly sudden, however legitimate, variations (flash crowds -FC) that may be hard to distinguish from illegitimate ones. That is why, IDS relying on anomaly detection by way of statistical profile often yield a significant number of false positives, and are not very popular.

These tools also lack efficiency when the increase of traffic due to the attack is small. This situation is frequent and extremely important because of the distributed nature of current denial of service attacks (DDoS). These attacks are launched from a large number of corrupted machines (called zombies) and under the control of a hacker. Each machine generates a tiny amount of attacking traffic in order to hide it in the large amount of cross Internet traffic. On the other hand, as soon as these multiple sources of attacking traffic aggregate on links or routers on their way to their target, they represent a massive amount of traffic which significantly decreases the performance level of their victim, and of the network it is connected to. The anomaly detection is easy close from the victim, but detecting it at this place is useless : targeted resources have been wasted, and the QoS degraded ; the attack is therefore successful. It is then essential for IDS to detect attacks close from their sources, when the anomaly just results from the aggregation of the attacking traffic of few zombies hidden in the massive amount of legitimate traffic.

I.2 The KDD'99 traditional evaluation method

It exists several approaches for statistically evaluating IDS. However, they all have in common the need of an attack database which IDS are confronted to. Up to now, the most used database is KDD'99.

The principle of a statistical evaluation deals with making the IDS to evaluate analyze the attack traces, and to count the number of true positives, true negatives, false positives, and false negatives. The relations between these values can then be exhibited by mean of a ROC curve (Receiver Operating Characteristic). The ROC technique has been used in 1998 for the first time for evaluating IDS in the framework of the DARPA project on the off-line analysis of intrusion detection systems, at the Lincoln laboratory at MIT [MIT]. At that time, it was the first intelligible evaluation test applied to multiple IDS, and using realistic configurations. A small network was set-up for this purpose, the aim being to emulate a US Air Force base connected to the Internet. The background traffic was generated by injecting attacks in well defined points of the network, and collected with TCPDUMP. Traffic was grabbed and recorded for 7 weeks, and served for IDS calibration. Once calibration was performed, 2 weeks of traces containing attacks were used to evaluate the performance of IDS under study. Several papers describe this experience as Durst et al. [DCW + 99], Lippmann et al. [LFG + 00] and Lee et al. [LSM99]. This DARPA work in 1998 used a wide range of intrusion attempts, tried to simulate a realistic normal activity, and produced results that could be shared between all researchers interested in such topic. After an evaluation period, researchers involved in the DARPA project, as well as many others of the same research community, provided a full set of evaluation results with the attack database, which lead to some changes in the database, known nowadays under the name KDD'99. These changes mainly dealt with the use of more furtive attacks, the use of target machines running Windows NT, the definition of a security policy for the attacked network, and tests with more recent attacks.

Whereas the KDD'99 aimed at serving the needs of the research community on IDS, some important questions about its usability were raised. McHugh [START_REF] Mchugh | Testing intrusion detection systems : A critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory[END_REF] published a strong criticism on the procedures used when creating the KDD'99 database, especially on the lack of verification of the network realism compared to an actual one. It was followed in 2003 by Mahoney et Chan [START_REF] Mahoney | An analysis of the 1999 darpa/lincoln laboratory evaluation data for network anomaly detection[END_REF] who decided to review into detail the database. Mahoney et Chan showed that the traces were far from simulating realistic conditions, and therefore, that even a very simple IDS can exhibit very high performance results, performances that it could never reach in a real environment. For example, they discovered that the trace database includes irregularities as differences on TTL between attacking and legitimate packets.

Unfortunately, despite all the disclaimers about this KDD'99 database for IDS evaluation, it is still massively used. This is mainly due to the lack of other choices and efforts for providing new attack databases. Such limitations of the KDD'99 database motivated ourselves for issuing a new one, as we needed to compare performances of existing profile based IDS with the ones of new anomaly detection tools we were designing in the framework of the MetroSec project [MET] (project from the French ACI program on Security & Computer science, 2004-2007)

I.3 Contribution

Despite these limitations related to the DARPA project contributions to IDS evaluation, the introduction of ROC techniques remains nevertheless a very simple and efficient solution, massively used since. It consists in combining detection results with the number of testing sessions to issue two values which summarize IDS performance : the detection ratio (number of detected intrusion divided by the number of intrusion attempts) and the false alarm rate (number of false alarms divided by the total number of network sessions). These summaries of detection results then represent one point on the ROC curve for a given IDS. The ROC space is defined by the false alarms and true positive rates on X and Y axis respectively, what in fact represents the balance between efficiency and cost. The best possible IDS would then theoretically be represented by a single point curve of coordinates (0, 1) in the ROC space. Such a point means that all attacks were detected and no false alarm was raised. A random detection process would be represented in the ROC space by a strait line going from the bottom left corner (0, 0) to the upper right corner (1, 1) (the line with equation y = x). Points over this line mean that the detection performance is better than the one of a random process. Under the line, it is worse, and then of no real meaning.

Given the efficiency and simplicity of the ROC method, we propose to use it as a strong basis for our new profile based IDS evaluation methodology ; it therefore looks like the KDD'99 one. At the opposite, the KDD'99 trace database appears to us as completely unsuited to our needs for evaluating performances of IDS and anomaly detection systems (ADS). This is what our contribution is about. Let us recall here that in the framework of the MetroSec project, we were targeting attacks which can have an impact on the quality of service and performances of networks, i.e. on the quality of packets forwarding. It is not easy to find traffic traces containing this kind of anomalies. It would be required to have access to many traffic capture probes, close from zombies, and launch traffic captures when attacks arise. Of course, hackers do not advertise when they launch attacks and their zombies are unknown. We then haven't documented traffic traces at our disposal containing these kinds of anomalies, i.e. traces for which no obvious anomaly appears, but for which we would know that between two dates, an attack of that kind, and having a precise intensity was perpetrated. The lack of such traces is one of the big issues for researchers in anomaly detection.1 In addition, it is not enough to validate detection methods and tools on one or two traces which anomalies would be detected in ; it would for instance forbid to quantity detection mistakes.

I.4 Paper structure

This paper presents a new evaluation and comparison method of profile based IDS and ADS performances, and that improves and adapts to new requirements the ancient KDD'99 method. The main contribution dealt with creating a new documented anomaly database -among which some are attacks. These traces contain, in addition of anomalies, a realistic background traffic having the variability, self-similarity, dependence, and correlation characteristics of real traffic, which massively distributed attacks can easily hide in. The creation process of this trace database, as well as the description of the main components used are described in section II. Then, section III shows for a given ADS -called NADA [START_REF] Farraposo | Nada -network anomaly detection algorithm[END_REF] -the differences in evaluation results depending on the anomaly/attack trace database used. Section IV then shows by using our new evaluation method based on our new trace database -called MetroSec database -the statistical evaluation results got for 3 IDS or ADS publicly available. Last, section V concludes this paper with a discussion on the strength and weaknesses of ours new evaluation method relying on our new MetroSec anomalies database.

II Generation of traffic traces with or without anomalies, by ways of reproducible experiments

II.1 The MetroSec experimental platform

One of the contributions of MetroSec was to produce controlled and documented traffic traces, with or without anomalies, for testing and validating intrusion detection methods.

For this purpose, we lead measurement and experimentation campaigns on a reliable operational network (for which we are sure that is does not contain any anomalies, or at least very few), and to generate ourselves attacks and other kinds of anomalies which are going to mix and interact with background regular traffic. It is then possible to define the kinds of attacks we want to launch, to control them (sources, targets, intensities, etc.), and to associate to the related captured traces a ticket indicating the very accurate characteristics of perpetrated attacks. In such a context, anomalies are reproducible (we can regenerate as often as wanted the same experimental conditions). This reproductivity makes possible the multiplication of such scenarios in order to improve the validation statistics of detection tools, or the comparison accuracy of our methods with others. The trace database produced in MetroSec is one of the significant achievements of the project, and guaranties the reliability of IDS evaluation.

The experimental platform which was used for creating the MetroSec trace database uses the Renater network, the French network for education and research. Renater is an operational network which is used by a significantly large community in its professional activity. Because of its design, Renater has the necessary characteristics for our experiments :

-it is largely over-provisionned related to the amount of traffic it is transporting. Its OC-48 links provide 2,4 Gbits/s of throughput, whereas a laboratory as LAAS, having at its disposal a link whose capacity is 100 Mbits/s, generates in average a traffic less than 10 Mbits/s [START_REF] Owezarski | Laasnetexp : a generic polymorphic platform for network emulation and experiments[END_REF]. As a consequence, Renater provides a service with a constant quality. Thus, even if we want to saturate the LAAS access link, the impact of Renater on this traffic, and the provided QoS would be transparent. Experimental conditions on Renater would be all the times the same, and therefore our experiments are reproducible ; -Renater integrates two levels of security to avoid attacks coming from outside, but also from inside the network. Practically speaking, we effectively never observed any attack at the measurement and monitoring points we installed in Renater. The laboratories involved in the generation of traces are ENS in Lyon, LIP6 in Paris, IUT of Mont-de-Marsan, ESSI in Nice, and LAAS in Toulouse. Traffic is captured at these different locations by workstations equipped with DAG cards [CDG + 00] and GPS for a very accurate temporal synchronization. In addition, if we want to perform massive attacks, the target is the laasnetexp network at LAAS [START_REF] Owezarski | Laasnetexp : a generic polymorphic platform for network emulation and experiments[END_REF], which is a network fully dedicated to risky experiments. We can completely saturate it in order to analyze extreme attacking situations.

II.2 Anomalies generation

Anomalies studied and generated in the framework of the MetroSec project consist of more or less significant increases of traffic in terms of volume. We can distinguish two kinds of anomalies :

-anomalies due to legitimate traffic. Let us for instance quote in this class flash crowds (FC). It is important to mention here that such experiments can hardly be fully controlled ; -anomalies due to illegitimate traffic, as flooding attacks. This traffic, which we can have a full control on, is generated thanks to several classical attacking tools. Details about anomalies generation are given in what follows.

• Flash Crowd (FC). For analyzing the impact on traffic characteristics of a flooding event due to legitimate traffic variations, we triggered flash crowds on a web server. For realism purpose, i.e. humanly random, we chose not to generate them using an automatic program, but to ask our academic colleagues to browse the LAAS web server ( http ://www.laas.fr).

• DDoS attack. Attacks generated for validating our anomaly detection methods consist of DDoS attacks, launched by using flooding attacking tools (IPERF, HPING2, TRIN00 et TFN2K). We selected well known attacking tools in order to generate malicious traffic as realist as possible.

The IPERF tool [IPE] (under standard Linux environment) aims at generating UDP flows at variable rates, with variable packets rates and payloads. The HPING2 tool [HPI] aims at generating UDP, ICMP and TCP flows, with variable rates (same throughput control parameters as IPERF). Note that with this tool, it is also possible to set TCP flags, and then to generate specific signatures in TCP flows. These two tools were installed on each site of our national distributed platform. At the opposite of TRIN00 and TFN2K (cf. next paragraph), it is not possible to centralize the control on all IPERF and HPING2 entities running at the same time, and then to synchronize attacking sources. One engineer on each site is then in charge of launching attacks at a given predefined time, what induces at the target level a progressive increase of the global attack load.

TRINOO [Tri] and TFN2K [TFN] are two well known distributed attacking tools. They allow the installation on different machines of a program called zombie (or daemon, or bot). This program is in charge of generating the attack towards the target. It is remotely controlled by a master program which commands all the bots. It is possible to constitute an attacking army (or botnet) commanded by one or several masters.

TFN2K bots can launch several kinds of attacks. In addition of classical flooding attacks using UDP, ICMP and TCP protocols (sending of a large number of UDP, ICMP or TCP packet to the victim), many other attacks are possible.

The mixed flooding attack is a mix of UDP flooding, ICMP flooding and TCP SYN flooding. Smurf is an attacking technique based on the concept of amplification : bots use the broadcast address for artificially multiplying the number of attacking packets sent to the target, and then multiplying the power of this attack. TRIN00 bots, on their side, can only perform UDP flooding. Attacks launched with the different attacking tools (IPERF, HPING2, TRI-NOO et TFN2K) have been performed by changing frequently the attack characteristics and parameters (duration, DoS flow intensity, size and rate of packets) in order to create different profiles for attacks to be detected afterwards. Main characteristics of generated attacks are summarized in table I. For each configuration, we captured the traffic before, during and after the attack, in order to mix the DoS period with two normal traffic periods. It is important to recall here that most of the times, we tried to generate very low intensity attacks, so that they do not have a significant impact on the global traffic (and therefore be not the cause of average traffic change). This emulates the case of a router receiving the packets from a small number of zombies, and then represents the most interesting problem of our problematic, i.e. detecting DDoS attacks close from their low intensity sources.

Our trace database contains nowadays around thirty captures of such kinds of experiments.

III Comparative evaluation with different anomalies databases

NADA (Network Anomaly Detection Algorithm) is an anomaly detection tool relying on the use of deltoids for detecting significantly anomalous variations on traffic characteristics. This tool also includes a classification mechanism of anomalies aiming at determining whether detected anomalies are legitimate and their characteristics. NADA has been issued in the framework of the Metrosec project. Thanks to the full control we have on its code, it was easier for us to run experiments with such a tool. Results were also easier to analyze with a full knowledge of the detection tool. For more details, interested readers can refer to [START_REF] Farraposo | Nada -network anomaly detection algorithm[END_REF]. Anyway, as the evaluation methodology we are proposing is of the "black box" kind, it is not necessary to know how a tool is designed and developed for evaluating it. Just let us say that NADA uses a threshold k which aims at determining whether a deltoid corresponds to an anomalous variation. Setting the k threshold allows the configuration of the detection tool sensitivity, in particular to the natural variability of normal traffic. The rest of this section aims at comparing NADA's performance evaluation results with our method depending on the anomalies database used, MetroSec or KDD'99.

III.1 Evaluation with the MetroSec anomalies database

The statistical evaluation of NADA was performed by using the traces with documented anomalies presented in section II.2. This means a total of 42 different traces, each of them containing at least one DDoS attack ; some contain up to four attacks of small intensity. Six traffic traces with flash crowds were also used for the NADA evaluation. In addition, the documented traces of the MetroSec database can be grouped according to the attacking tools used for generating the attacks/anomalies, and in each group differentiate them according to attack intensities, durations, etc. Such a differentiation is important as it makes possible to measure the sensitivity of the tool under evaluation, i.e. its capability of detecting small intensity anomalies (what of course cannot be done using the KDD'99 database, only able to provide binary results). The intensity and duration of anomalies are two characteristics which significantly have an impact on the capability of profile based IDS/ADS to detect them. Whereas the detection of strong intensity anomalies is well done by most of detection tools, it is in general not the case when small intensity attacks are considered. Therefore, a suited method for evaluating anomaly detection tools performance must be able to count how many times it succeeds or failed in detecting anomalies contained in the traces, and among which some have low intensity.

Figure 1.a shows the ROC curve got by evaluating NADA with the Metro-Sec anomaly database. It shows the detection probability (P D) according to the probability of false alarms (P F ). Each point on the curve represents the average of all results obtained by NADA on all the anomalies of the MetroSec database for a given value of the k parameter, i.e. for a given sensitivity level. The curve analysis shows that NADA is significantly more efficient than a random tool, as all points are over the line y = x. Even when the detection probability increases, the NADA performance ROC curve exhibits a very weak false alarm rate. For example, with P D in [60%, 70%], the probability of false alarms is in [10%, 20%], which is a good result.

III.2 KDD'99

KDD'99 database consists of a set of traces detailed in table II. During the International Knowledge Discovery and Data Mining Tools contest [Kd], only 10% of the KDD database were used for the learning phase [HB]. This part of the database contains 22 types of attacks and is a concise version of the full KDD database. This later contains a greater number of attack examples than normal connections, and the types of attacks do not appear in a similar way. Because of their nature, DoS attacks represent the huge majority of the database. On the other hand, the corrected KDD database provides a database with different statistical distributions compared to the databases "10% KDD" or "Full KDD". In addition, it contains 14 new types of attacks.

NADA evaluation was limited to the 10% KDD database. Several reasons motivated this choice : first, despite this database is the simplest, it is also the most used. Second, our intension is to show that the KDD database is not suited for evaluating current ADS (and we will show that the reduced database is enough to demonstrate it). Last, it is a first good test for observing NADA behavior with high intensity DoS attacks. Figure 1.b shows the NADA performance ROC curve obtained with the 10% KDD database. It especially shows the detection probability (P D) according to the probability of false alarms (P F ), and its analysis shows that NADA got very good results. Applied to the KDD'99 database, NADA exhibits a detection probability close to 90%, and a probability of false alarms around 2%. These results are extremely good, but unfortunately unrealistic if we compare them with the results obtained with the MetroSec database ! DoS attacks are detected in a very reliable way, but certainly because the database is excessively simple : around 98% of attacks are DoS attacks of the same type, presenting in addition very strong intensities. The differences of NADA performances when applied to the two MetroSec and KDD'99 databases underlines the importance of the anomaly database for evaluating profile based IDS and ADS. It is obvious that the MetroSec database presents more complex situations for NADA than KDD'99. Therefore, the evaluation results got with the MetroSec database are certainly closer from the real performance level of NADA than the ones got with KDD'99.

IV Evaluation of 2 other IDS/ADS with the MetroSec database

For illustrating the real statistic evaluation efficiency of the MetroSec method proposed in this paper to distinguish between real capabilities of profile based IDS and ADS, this section shows the comparative results between NADA and two other tools or approaches : the Gamma-FARIMA based approach [SLO + 07], and the PHAD tool (experimental Packet Header Anomaly Detection) [START_REF] Mahoney | Packet header anomaly detection for identifying hostile network traffic[END_REF]. The Gamma-FARIMA approach is also one of the achievements of the Metro-Sec projects. PHAD was selected as, in addition of being freely available, it aims at both detecting and classifying anomalies and attacks similarly to what the objectives of MetroSec were, and that lead to the design of NADA and Gamma-FARIMA approach. In addition, PHAD, funded by the American NSF, is said to be the ultimate intrusion and anomaly detection tool. The argumentation of its authors mainly relies on tests lead with KDD'99 traces : on these traces, PHAD gives perfect results.

• PHAD. The evaluation of PHAD using the MetroSec database was performed by making the K threshold vary ; K also represents the probability of generating a correct alarm. Figure 2.a shows the ROC curve obtained. Its analysis shows that PHAD behaves just a little bit better than a random detection process.

Figure 3 exhibits the probabilities of detection vs. false alarms with a given threshold K. It is shown that when K increases, P D and P F increase too. Such behavior suggests that PHAD is very inefficient : it detects many anomalies, but most of the times they are false alarms. With small K values, the P D curve gets close from the P F curve, and are not far from the X axis. Such behavior is not a good sign for PHAD performances as it exhibits a problem of too much false alarms... and then certainly a problem of the underlying model or of the learning process. It was also observed that when facing low intensity attacks, PHAD detects none of them. When comparing with the performances obtained with the KDD'99 database, there is a big gap. In fact, it seems that PHAD only detects anomalies of the KDD'99, and no other. • Gamma-FARIMA.

Figure 2.b shows the ROC curve obtained for the Gamma-FARIMA approach evaluated with the MetroSec database. More than 60% of anomalies are detected with a false alarm rate close to 0.

By observing all the ROC curves, it seems that the Gamma-FARIMA approach is the most efficient among the 3 when confronted to the MetroSec database. NADA also exhibits good performances, not too far from the ones of the Gamma-FARIMA approach. These two algorithms designed and developed in the framework of the MetroSec project aim at detecting and classifying known and unknown anomalies. Both algorithms reach this goal by using nevertheless different approaches. While NADA uses simple mathematical functions, the Gamma-FARIMA approach relies on more complex mathematical analysis which are the source of its advantage. However, the NADA simplicity coupled with its high performance level can be of interest. It is particularly true if NADA has to be combined with an identification process of malicious packets.

On the other side, PHAD presents a dramatically low performance level, when confronted to the MetroSec database (but is excellent when confronted to KDD'99 one). By going into a deep analysis of the PHAD algorithm, it seems that the use of 33 different parameters, and assigning a score to each of its anomalous occurrences introduce uncertainty without improving detection accuracy. In addition, these 33 parameters only play a minor role in the detection of most of the attacks [START_REF] Mahoney | Packet header anomaly detection for identifying hostile network traffic[END_REF].

V Conclusion

This paper presented a statistical evaluation method of profile based IDS and ADS that relies on a new traffic traces database containing both legitimate and illegitimate anomalies. This paper exhibited that the anomalies database has a major impact on the evaluation results. For example, it was shown that for NADA and PHAD the results obtained with KDD'99 and MetroSec traces are completely different. Such results seems to be well known in this research community, and is part of the common beliefs, but up to our knowledge, it was never published (at least Google does not know any paper demonstrating it).

This paper also shows that the KDD'99 does not permit satisfactory results when considering the evaluation accuracy of the different detection tools. It does not confront them to realistic enough conditions (and then complex enough), and in general the different evaluated tools pass the tests with good marks... marks that are not reproducible once installed in a real environment. Indeed, the KDD'99 evaluation is kind of binary : it only shows whether high intensity attacks can be detected. The MetroSec method plays with the intensities and durations of anomalies for determining levels at which an attack can be detected.

All these observations exhibit one of the big problems. If we assume that the MetroSec database is exhaustive for the current traffic anomalies phenomenon (we tried as much as possible to define generic anomalies on all dimensions of network traffic), how would it be possible to ensure its everlastingness ? Indeed, even if anomalies classes do not radically change, their shapes and intensities (especially related to the network capacities evolutions) will change. And the database, on a more or less long term, will lose some of its realism. Given the strategic aspect of traffic traces for operators, it is not sure at all that we could continue having traffic traces in which anomalies could be injected. In addition, producing such traces containing anomalies is a very time consuming task which can hardly be supported by a single or few laboratories. It represents one of the main drawbacks against which it does not appear any solution.

The last problem exhibited by this paper is related to the role of experimental data we are exploiting. In fact, we use the same data for designing and validating/evaluating our tools. Thus, PHAD which works perfectly on KDD'99 database (it was designed for detecting anomalies and attacks by taking its inspiration in the KDD'99 database) shows incredibly low performances when tested with the MetroSec database. What would be the results of Gamma-FARIMA or NADA tools if they were evaluated with other anomalies databases than Me-troSec or KDD'99 ones (we took our inspiration from these databases when designing our tools) ? Again, the solution would be to have a large number of anomalous traces database in order to separate, at least experimentally, design and evaluation. But we then fall back in the problem previously quoted of the lack of exploitable traffic traces.

Fig. 1 .

 1 Fig. 1. Statistical performances of NADA evaluated based on (a) the MetroSec database and (b) the 10% KDD database. Detection Probability (P D) vs. Probability of false alarms (P F ), P D = f (P F ). Base DoS Scan U2R R2L Normal 10% KDD 391 458 4107 52 1126 97 277 Corrected KDD 229 853 4166 70 16 347 60 593 Full KDD 3 883 370 41 102 52 1 126 972 780 Tab. II. Characteristics of the KDD'99 database in terms of samples numbers.

Fig. 2 .

 2 Fig. 2. Statistical performances of (a) PHAD and (b) Gamma-FARIMA approach evaluated thanks to the MetroSec database. Detection Probability (P D) vs. Probability of false alarms (P F ), P D = f (P F ).

Fig. 3 .

 3 Fig. 3. PHAD : Probability of Detection (P D) and Probability False Alarm (P F ) vs. threshold parameter k, P D = f (k) and P F = g(k).

This lack is even more important as for economical and strategic reasons of carriers, or users privacy, such data relating anomalies or attacks are not made public.