Sadia Khizar
email: sadia.khizar@lip6.fr

Marcelo Dias De Amorim

Vania Conan
email: vania.conan@thalesgroup.com

Persistence of Vehicular-Augmented Mobile Edges

Keywords: Beyond edge computing, mobility, persistence, vehicular networks

Mobile edge computing (MEC) allows for the execution of delay-sensitive and context-aware applications close to the end-users while alleviating backhaul utilization and computation at the core network. A recent trend is to extend the capabilities of the MEC using the available resources of end-user devices beyond the edge, such as vehicles. Because of the highly mobile nature of such devices, the beyond-the-edge computing resources available at the time the MEC offloads a task decays over time. In this paper, we propose and investigate the persistence of groups of computational nodes in a vehicular-augmented MEC scenario. The groups are formed according to the time of arrival of vehicles and their co-location within a cell. Through the analyses of two real-world vehicular scenarios in the cities of Rome and Rio de Janeiro. On the one hand, our results show that the persistence is highly heterogeneous, depending on the vehicular traffic density and the time of day. On the other hand, we are able to identify periods during which the persistence is short and periods that show stronger stability -it becomes then possible to schedule tasks to specific time slots depending on the requirements and the expected persistence.

I. INTRODUCTION

Mobile edge computing (MEC) shifts cloud services to the radio access network to bring computing capabilities closer to mobile users [START_REF] Zhang | Joint computation offloading and resource allocation optimization in heterogeneous networks with mobile edge computing[END_REF]- [START_REF] Mach | Mobile edge computing: A survey on architecture and computation offloading[END_REF]. On the other hand, MEC offers much more limited resources and, in some situations, may not scale with the number of tasks.

One appealing idea is to extend the capacity of the MEC by leveraging the available resources at end-user devices. The particular case that we consider in this paper is the vehicular edge computing (VEC) [START_REF] Liu | Vehicular edge computing and networking: A survey[END_REF], [START_REF] Zhang | Mobile-edge computing for vehicular networks: A promising network paradigm with predictive off-loading[END_REF]. VEC integrates MEC with traditional vehicular networks. VEC aims to move part of the communication, computing and caching resources to vehicles. It may relieve the congestion problem of backhaul links and offer untapped resources by running tasks on behalf of the MEC. Existing literature in the field lists several proposals focusing on computation offloading [START_REF] Zhang | Mobile-edge computing for vehicular networks: A promising network paradigm with predictive off-loading[END_REF]- [START_REF] Chen | Efficient multi-user computation offloading for mobile-edge cloud computing[END_REF] content caching [START_REF] Guo | Cache-enabled adaptive video streaming over vehicular networks: A dynamic approach[END_REF], and security and privacy [START_REF] Cui | An efficient messageauthentication scheme based on edge computing for vehicular ad hoc networks[END_REF]. There is a consensus that the use of vehicles is very relevant for various cases [START_REF] Sasaki | Vehicle control system coordinated between cloud and mobile edge computing[END_REF]- [START_REF] Zhang | Optimal delay constrained offloading for vehicular edge computing networks[END_REF].

In this paper, we investigate the computation offloading capacity that a group of vehicles in a cell can offer to the MEC. We call the size of this group as the "potential" offloading capacity of the vehicular cloud. As vehicles are highly mobile, it is fundamental to investigate the dynamics of the potential offloading capacity. When the MEC is about to assign computing tasks to vehicles, it first needs to estimate the lifetime of the population of vehicles composing the vehicular cloud. In short, the question we consider is: "given the group of vehicles in a cell at time t, what is the expected duration of this group before its size decreases to a given percentage of its initial size?". We refer to this duration as the persistence of the potential offloading capacity.

A straightforward way to estimate the persistence is to rely on the sojourn time of vehicles in the cell. The sojourn time is a key element in the characterization of user mobility in cellular networks [START_REF] Lin | Towards understanding the fundamentals of mobility in cellular networks[END_REF], [START_REF] Baumann | How long are you staying? predicting residence time from human mobility traces[END_REF]. In the literature, only a few studies investigate the sojourn time in the vehicular context [START_REF] Becker | A tale of one city: Using cellular network data for urban planning[END_REF]. In general, vehicular mobility and traffic patterns are inferred from mobile phone connections, indicating travel patterns [START_REF] Becker | A tale of one city: Using cellular network data for urban planning[END_REF]. Other techniques, based on vehicle detectors and GPS probes, measure the residence time of cells [START_REF] Herrera | Evaluation of traffic data obtained via gps-enabled mobile phones: The mobile century field experiment[END_REF]. In this study, contrary to sojourn times which characterize the behavior of vehicles on an individual basis, we look into the behavior of groups of vehicles.

We assess the persistence of the potential offloading capacity directly from groups of nodes using vehicular mobility datasets, namely in the cities of Rome and Rio de Janeiro. We introduce a reduction threshold α to characterize the point at which we assume a group has dissolved. We evaluate the persistence of groups of nodes between their formation and their dissolution -either after a short time (low persistence) or after a long time (high persistence). We point out the main differences between the datasets and their impact on the potential offloading capacity of the vehicular clouds. The main outcome of our analysis is the characterization of periods of time that should be reserved for light tasks and periods has are keen to offload tasks that require longer computation time, thanks to a more stable potential offloading capacity.

As a summary, the contributions of this paper are:

• Persistence of a vehicular cloud. We argue that per- sistence is a crucial element for the understanding of the possibilities of using a vehicular cloud to extend the capacity of a MEC. We propose to calculate the persistence time of a cluster of resources based on their cells and their formation time.

• Persistence time over real traffic traces. We analyze the persistence of a vehicular cloud using two different datasets: (i) 320 taxi cabs in Rome, Italy [START_REF] Bracciale | CRAWDAD dataset roma/taxi (v. 2014-07-17)[END_REF], and (ii) 12,000 buses in Rio de Janeiro, Brazil [START_REF] Dias | CRAWDAD dataset coppe-ufrj/riobuses (v. 2018-03-19)[END_REF]. These datasets are inherently different and allow us a better understanding of the possibilities that a vehicular cloud offers in terms of potential offloading.

• Reduction threshold impact. We introduce the notion of reduction threshold and assess its impact on the persistence of the offloading capacity. To this end, we evaluate the evolution of persistence through a combination of controlled experiments.

II. PERSISTENCE OF A VEHICULAR CLOUD

The set of vehicles in a cell represents an offloading potential, i.e., a measure to help us estimate the computing load that the vehicular cloud can handle. While the number of vehicles is not sufficient to determine the capacity of the vehicular cloud, it is a necessary metric to characterize the dynamics of the system. Indeed, the capacity of a vehicular cloud varies over time. By understanding such dynamics, the MEC orchestrator can have a rough idea of the way and when it should assign tasks to the vehicular cloud.

We refer to the time when the MEC offloads a task as the offset. We assume that vehicles receiving tasks from the MEC must remain in the cell until the completion of the task; otherwise, the task is considered lost. For this reason, we focus on the analysis of computation offloading capacity and of the persistence of the vehicular cloud, which is the time elapsed between the offset and the time the vehicular cloud dissolves.

We model a geographical area as a set of cells C. We note g c,T the set of vehicular nodes located in cell c ∈ C at time T (offset). Our goal is to study the persistence of g c,T , which is the period between T and the time at which a predefined fraction of g c,T leaves the cell. This fraction is specified by a variable α ∈ [0 . . . 1], which we call "reduction threshold."

The closer α approaches one, the less tolerant the offloading system is to the departures of the nodes. Therefore, the MEC can choose the right time when persistence fits best with the tasks it has to assign to vehicles.

Before giving the details about the calculation of the persistence, we formalize the reduction rate R(t, T ) of a group at a time t > T as:

R(t, T ) = |g c,t | |g c,T | • (1)
We now define a step function that characterizes the time at which the set of nodes decreases below the reduction threshold:

1(g c,T , t) = 1 if R(t, T ) ≥ α, 0 if R(t, T ) < α. (2)
Finally, we define the persistence as:

P(g c,T ) = +∞ T 1(g c,T , t)dt. (3)
In Fig. 2, we illustrate the formation and dissolution of groups overtime for the case where α=0 (i.e., the persistence of a group between the offset and the time when all nodes in the group leave the cell). At t = T 1 (Fig. 2a), four nodes are co-located in cell c 1 , and they form the group g 1 c1,T1 . The persistence of this group is three-time intervals as the group vanishes at t = T 4 . In Fig. 2b, we show the configuration of the cell one-time interval later. We notice that the cell contains, at t = T 2 , five nodes, out of which two nodes come from the previous interval and three nodes that just joined the cell. This means that g 1 c1,T2 = 2 and g 2 c1,T2 = 5. The same principle applies to the remainder of the time.

It is worth noting that the persistence of g 1 c1,T1 is threetime intervals because of α = 0. For example, if α = 0.5, the persistence would have been P(g 1 c1,T1 ) = 2 time intervals, because this is the time lapsed until the number of vehicles decreases to a half of the original group size.

III. DATASETS AND PERSISTENCE ASSESSMENT

In our analyses, we use two vehicular datasets composed of taxis in the city of Rome and buses in the city of Rio de Janeiro. The study of the persistence of the vehicular clouds spans a period of 24 hours. We discretize time in 5-minute intervals. We evaluate the persistence in all cells of the two cities. For the sake of clarity, we select dense and sparse areas to give a better illustration of the results. Figs. 3 and4 pinpoint these areas in Rome and Rio, respectively. The total simulation areas are 360 km 2 in Rome and 1,829 km 2 in Rio. We divide Figs. 5 and6 show the persistence of dense cells in both cities over a period of three hours. Note that each colored curve represents the dissolution of a group over time. Recall that a group starts at each time step and that its initial size corresponds to the total number of vehicles in the cell (black dashed line in the plot).

Let us pick the specific group formed at 5:35 am and describe its dynamics. In Rome, this group initially contains 11 vehicles at T =5:35 am. Consider α=0, which leads to persistence that ranges from T until all the nodes of the group leave the cell; in this case, the persistence is 2h15. Similarly, if we consider α = 0.5, the persistence is 25 minutes, which corresponds to the period between T until half of the nodes of the group leave the cell. In Rio, this group initially contains 78 vehicles at T =5:35 am. The persistence with α=0 is 35 minutes while it is 5 minutes when α = 0.5. Notably, the persistence in the city of Rio is lower than Rome's despite the larger number of nodes. There is a faster decrease in the curves leading to a shorter persistence. Fig. 5: Persistence of a cell between 5:00 am and 8:00 am in a dense area of Rome. Fig. 6: Persistence of a cell between 5:00 and 8:00 am in a dense area of Rio.

IV. EVALUATION

In this section, we analyze the persistence distribution in the dense and sparse areas of both datasets. To cover the full range of the dynamics (from the creation to the dissolution of the groups), we focus first on α=0 for the plots and show results for other values of α in the form of tables. For readability reasons, we show in the plots the results on an hourly basis during a 24-hour period.

A. Persistence in Rome

Traffic density in a metropolitan area varies over the day. In the dense area of Rome, as shown in Fig. 7a, we observe the presence of extreme values (above the boxplot) with relatively high persistence. They are groups that are co-located for a long period. The shortest persistence is between 3:00 am and 4:00 am; despite the presence of extreme values, the median is the lowest. This interval is propitious to offload short computational tasks requiring low persistence (around five minutes). On the other hand, there is a persistence peak between 5:00 am and 6:00 am. The majority of the groups fall in this interval, and the median persistence is around one hour. A gradual decrease of persistence is notable until it stabilizes around 20 minutes, from 9:00 am to 12:00 pm. It indicates that the MEC could offload a task requiring high persistence in the early morning. There is an increase in the median during the intervals from 4:00 pm to 6:00 pm and from 7:00 pm to 10:00 pm, which implies a long persistence. These intervals coincide with the peaks of activities (leaving work, school). We find, as expected, that road loads have a strong impact on persistence time.

For the sparse area (Fig. 7b), the persistence is weak for all hours except for specific intervals such as from 10:00 am to 11:00 am, from 4:00 pm to 6:00 pm, around 8:00 pm, and from 10:00 pm to 11:00 pm, due to taxis tending to move towards the periphery. The median is low between 5:00 am and 6:00 am and between 8:00 pm and 9:00 pm. The upper quartile is equivalent to a persistence between one and three hours. For these intervals, the range is extended, implying that a majority of groups have weak persistence. We could argue that it is then better to offload a computation task requiring low persistence in a sparse area.

B. Persistence in Rio

Most buses start their services between 4:00 am and 10:00 pm and operate during the whole day. We assume that extreme values in the dense area (Fig. 8a), from 12:00 am to 3:00 am, are probably due to an end of service with bus parking, and those from 4:00 am to 7:00 am by a crossover of night services and day services. Between 6:00 am and 8:00 am, we have a peak of persistence; the majority of groups are in this interval. Persistence is about 50 minutes, which facilitates the offloading tasks of this order of magnitude. During the whole day, the persistence median is around 30 to 40 minutes, suggesting us to consider that the dense area of Rio is propitious for MEC to offload tasks. Although we have an appropriate persistence, it is essential to note the presence of extreme values with a very high persistence throughout the day. The maximum persistence is 520 minutes (nine hours) at 10:00 am; these are buses with a restricted itinerary, forcing them to remain localized in a small area. In the sparse area of the city (Fig. 8b), from 12:00 am to 6:00 am, persistence is close to zero and does not exceed 10 minutes. This interval may not be appropriate to offload a task requiring long computation time, but rather for a short one. A median elevation is visible from 7:00 am to 5:00 pm, and the persistence remains relatively stable around 70 minutes. The highest median is found at 3:00 pm and the longest persistence is at noon, with the persistence of up to three hours. We observe a small increase in the median from 7:00 pm to 10:00 pm, followed by a decrease. The persistence of buses clearly depends on road traffic and especially on the route and services of the buses. Also, more buses are in service for times such as 9:00 am, 12:00 pm, and 3:00 pm. In general, the median persistence remains low with many extreme values, which means that a majority of groups have low persistence and a minority have very high persistence (up to 16 hours).

V. VARYING THE REDUCTION THRESHOLD

After studying the geographical distribution of persistence for α = 0, we consider persistence with the following values of reduction threshold: α = {0.25, 0.5, 0.75}. Firstly, we segment the day in 6 slots. For each time interval and dataset, we compare the dense and sparse areas. We present, in Tables I and II, the maximum persistence compared to the median for the cities of Rome and Rio, respectively. Using the median and maximum persistence allows us to study the homogeneity or disparity of it, enabling a better reflection of the dispersion. We then observe the impact of the threshold on persistence.

A. Influence of the reduction threshold in Rome

We show the impact of the reduction threshold in the city of Rome in Table I. For dense areas, the impact of the reduction threshold is visible for median persistence. For example, for the interval between 12:00 am and 4:00 am, the median persistence is equal to 15 minutes when α=0.25, 10 minutes when α=0.50, and five minutes when α=0.75. Beyond a given α, the threshold no longer has an impact on the persistence. Indeed, between 12:00 am and 4:00 am, when α=0.25, the maximum persistence time is 150. For α=0.50 and α=0.75, the maximum persistence time is 115. This is explained by the nodes of a given group remaining co-located for an extended period. The highest persistence falls in the interval from 5:00 am to 8:00 am. For all intervals, the extent between the maximum and median persistence is huge, so the For the sparse area, the persistence is smaller at the periphery. Regardless of the maximum persistence and the intervals, we notice that the majority of groups have fiveminute persistence. For the intervals from 5:00 pm to 9:00 pm and from 9:00 pm to 11:00 pm, there is a small variation of persistence when α=0.25. We deduce that few groups are persistent, in the periphery, and the variation of α has no influence on the persistence time of the group. The persistence time is inhomogeneous for the city of Rome in the sparse area. We note that there is a huge maximum persistence for different α in the intervals from 1:00 pm to 4:00 pm and from 5:00 pm to 8:00 pm as long as the median remains very low.

B. Influence of the reduction threshold in Rio

The impact of the reduction threshold is less visible for the city of Rio than for Rome, as we can note when comparing Tables I andII). We observe that the maximum and median persistence are less scattered, except for the interval from 12:00 am to 4:00 am. Maximum persistence is close to the median persistence; thus, the persistence is more homogeneous for the city of Rio de Janeiro. Nevertheless, for certain intervals such as 5:00 am to 8:00 am and 1:00 pm to 4:00 pm, from a specific α (α=0.75), the reduction threshold no longer has an impact on the median persistence. Despite a huge maximal persistence, from 12:00 am to 4:00 am, the median persistence is lowest (about 5 minutes). The dispersion of this interval is much larger compared to the median regardless of α. It means that there is a multitude of groups with low persistence; it is an off-peak time when the buses are certainly mostly inactive. Whereas from 9:00 am to 12:00 pm, persistence time is more uniform across all groups. Because of its uniformity, this interval is more suitable to receive calculation tasks for the whole group (around 10 minutes). The whole median in dense and sparse areas are around 5-10 minutes, which means we can offload a short task no matter the chosen interval and area.

Table II confirms the faster decrease curves seen in Fig. 6. Sometimes, α does not have a significant impact due either to the co-location time being too short or to the nodes staying too long. We observe that, overall, α has more impact on the persistence in a dense area.

C. Persistence in Rome vs. persistence in Rio

Proportionally, there are more buses in Rio (12,000) than taxis in Rome (320); we tend to expect a much longer persistence in Rio due to the more significant resources. We average the medians of all the intervals in the dense areas of Rome and Rio, with α=0.25. We obtain an average persistence of 16.6 for the whole α=0.25 of the dense zone of Rome and 9.1 minutes for the dense area of Rio. We confirm again that, despite a large number of buses in Rio, the persistence seems to be lower than in Rome. Nevertheless, the behavior is different for the sparse areas of the two cities. We obtain, by averaging all intervals medians with α=0.25, 6.1 minutes for the sparse area of Rome and respectively 8.3 minutes in Rio. We notice the persistence is higher for the sparse area in Rio than in Rome, probably because of the type of vehicle of the two datasets. Indeed, taxis operate at the customer's request, thus have no fixed itinerary. Therefore a taxi can go from one end of the city to the other several times a day. Their mobility is not scheduled while the buses follow a defined path; the same bus line is not supposed to cross each other. Therefore, we explain a higher persistence in Rome than in Rio, for the dense area where taxis meet more often. On the other hand, in the sparse area, the taxis are concentrated in the downtown area to have more customers, while buses independently of the users make their trips in both sparse and dense areas.

VI. CONCLUSION AND PERSPECTIVES

We have explored temporal characteristics of extending MEC capabilities beyond the edge using vehicular clouds. Our work focuses on the formation of available computing groups and their spatial and temporal persistence. Our results show that the persistence of the groups follows a pattern depending on vehicular traffic density and the time of day. Analysis of the evolution of persistence suggests that peri-urban areas, which are transit zones, are well suited to short discharges (low persistence) while urban areas can handle longer tasks. Although the data analyzed are scenario-specific, we suggest dissociating high and low affluence regions to have more accurate mapping. In our future work, we will support the idea of investigating the persistence in more cities, different cells size, over longer periods, and with the same type of vehicles to improve the analysis of the evolution of persistence.

Fig. 1 :

 1 Fig. 1: Extension of the MEC beyond the edge.

Fig. 2 :

 2 Fig. 2: Formation of groups and their evolution over time.

Fig. 3 :

 3 Fig. 3: Simulation area of Rome.

Fig. 4 :

 4 Fig. 4: Simulation area of Rio de Janeiro. Rome's target area into 120 cells and Rio's into 609 cellscells in both cases have a size of 3 km 2 . The dense and sparse areas depicted in Figs. 3 and 4 contains nine cells each (thus, each target area in the figures covers 27 km 2 ).

  (a) Downtown, dense area. (b) Periphery, sparse area.

Fig. 7 :

 7 Fig. 7: Comparison of persistence between dense and sparse areas in Rome.

  (a) Downtown, dense area. (b) Periphery, sparse area.

Fig. 8 :

 8 Fig. 8: Comparison of persistence between dense and sparse areas in Rio de Janeiro. persistence time is not homogeneous for the city of Rome in the dense area.For the sparse area, the persistence is smaller at the periphery. Regardless of the maximum persistence and the intervals, we notice that the majority of groups have fiveminute persistence. For the intervals from 5:00 pm to 9:00 pm and from 9:00 pm to 11:00 pm, there is a small variation of persistence when α=0.25. We deduce that few groups are persistent, in the periphery, and the variation of α has no influence on the persistence time of the group. The persistence time is inhomogeneous for the city of Rome in the sparse area. We note that there is a huge maximum persistence for different α in the intervals from 1:00 pm to 4:00 pm and from 5:00 pm to 8:00 pm as long as the median remains very low.

TABLE I :

 I Reduction Threshold Variation for Rome

	Rome Persistence	Dense Area	Sparse Area
	Time Intervals	Max	Med	Max	Med

TABLE II :

 II Reduction Threshold Variation for Rio

	Rio Persistence		Dense Area	Sparse Area
	Time Intervals		Max	Med	Max	Med
	[12:00 -4:00 am]	0.25 0.50	265 255	5 5	20 20	5 5
		0.75	255	5	20	5
	[5:00 -8:00 am]	0.25 0.50	15 10	10 5	40 15	5 5
		0.75	10	5	10	5
	[9:00 -12:00 pm]	0.25 0.50	20 15	10 10	30 30	10 10
		0.75	10	5	10	5
	[1:00 -4:00 pm]	0.25 0.50	20 10	10 5	75 15	10 5
		0.75	10	5	10	5
	[5:00 -8:00 pm]	0.25 0.50	20 15	10 5	30 20	10 5
		0.75	10	5	10	5
	[9:00 -11:00 pm]	0.25 0.50	20 10	10 5	20 10	10 5
		0.75	5	5	10	5


Lúcio Henrik

Amorim Reis

Andrés Felipe

Murillo Piedrahita

Sandra Julieta

Rueda Rodríguez

Natália Castro Fernandes

Dianne Scherly Varela De Medeiros

Marcelo Dias De Amorim

Diogo Menezes

Ferrazani Mattos

Amorim Reis

Henrik A Lúcio

Andrés F Reis

Sandra Murillo

Natália C Rueda

Dianne S V Fernandes

Marcelo Medeiros

Diogo M F Dias De Amorim

Mattos

L H A Reis

D S V Medeiros

D M F Mattos

A M Piedrahita

S Rueda

M D Amorim

Unsupervised and Incremental Learning Orchestration for Cyber-Physical Security

Keywords: Cyber-physical security, Honeypot, Machine learning, Incremental learning. !

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

C YBER-PHYSICAL systems (CPSs) are widely distributed, large-scale heterogeneous systems in which sensors, actuators, Programmable Logic Controllers (PLCs), and other elements form a network to measure and control a physical system [START_REF] Ding | A Survey on Security Control and Attack Detection for Industrial Cyber-Physical Systems[END_REF]. The critical characteristic of CPS requires integration of ubiquitous computing, efficient network communication, and control in physical processes. As any critical networked system, CPSs are prone to security vulnerabilities that may imply severe economic losses or social disorder.

Two key challenges to assure the operational and security goals of a cyber-physical system are to anticipate the threats and to identify anomalous behaviors in both field and supervisory networks of the physical system. To address these issues, Manuscript received xxxx; revised xxxx. a possible solution is to rely on machine learning techniques. Nevertheless, although attacks against CPS are a reality nowadays, there are only a few available datasets describing physical or cyber attacks -and such datasets are required to train the learning system. As a consequence, the development of security solutions is hindered. Moreover, each CPS has its particularities, which hardens even more the design of effective security countermeasures.

In this work, to circumvent the lack of data, we propose the use of a high-interaction honeypot to gather attack data targeting the CPS infrastructure. With such data in hands, we propose to apply unsupervised and incremental machine learning techniques to detect threats. Our proposal orchestrates both zero-day threat detection through honeypot data analysis and anomaly detection through pattern discovery on regular CPS traffic. To this end, we first deploy an unsupervised one-class classification mechanism to infer anomalies on the monitored data of each sensor or actuator in the field network. Then, we deploy an incremental learning classifier, fed by the honeypot traffic, as a labeled dataset of threats. The trained incremental classifier discriminates incoming traffic from the private network of the protected CPS, as well as it enhances the training with each new sample. The proposed orchestration of learning methods generates alerts whenever either the incremental learning or the oneclass classifier emits a threat classification. We evaluate our proposal using the Secure Water Treatment (SWaT) testbed dataset, and the results show that the proposed machine learning orchestration achieves an accuracy of at least 95% and detects threats with a precision of more than 90%.

UNSUPERVISED AND INCREMENTAL LEARNING

FOR

CYBER-PHYSICAL THREAT DETECTION

Detecting threats in cyber-physical systems is challenging, as it is necessary to analyze specific features in data coming from both the communication network and sensors/actuators. Modeling such a system with a finite automaton is impractical because the number of states tends to explode. Thus, it is impractical to run a monolithic model that encompasses both the communication network and sensors/actuators. Machine learning-based models are serious candidates as these models learn patterns from the data [START_REF] Boutaba | A Comprehensive Survey on Machine Learning for Networking: Evolution, Applications and Research Opportunities[END_REF].

In this work, we identify threats in a CPS through a dual analysis of the communication network and physical sensors' monitored data. The communication network data represent the cyber features, bringing information about protocols and applications running on the system. The physical data consists of the sensor measurements and actuator commands, extracted from the application data in the packets. We orchestrate two machine learning strategies, incremental learning and unsupervised one-class classification, as shown in Figure 1. The incremental learning component implements an online mechanism to learn from previously unknown attacks. The unsupervised one-class classification, in turn, is an offline solution that focuses on detecting anomalies in the data. In a nutshell, the incremental classifier seeks for zero-day threats on the real CPS, while the oneclass device-based classifier seeks for control loop deviation for each physical process. Thus, our proposal monitors both the cyber-attacks based on zero-day threats and the sabotage on physical processes due to a deviation of the control loop.

Honeypots and Incremental Learning

One of the challenges we face is that there are very few datasets available to train the machine learning models. Furthermore, the ones available are either synthetic or contain just a few samples. To overcome this limitation, we propose to use a honeypot that emulates the real topology to gather abnormal data. As the honeypot is not intended to offer any legitimate public service, it is safe to assume that all interactions come from malicious or curious users [START_REF] Lobato | An Adaptive Real-Time Architecture for Zero-Day Threat Detection[END_REF]. Either way, we consider that the honeypot attracts unwanted activities exclusively. The honeypot runs on public, vulnerable IP addresses and we assume as ground-truth that all traffic on the honeypot is considered illegitimate. Thus, we analyze it as threat behavior.

The honeypot traffic feeds an incremental learning classifier as a labeled dataset of threats. The incremental learning mechanism updates its learning parameters to identify new cyberattacks. We adopt the incremental version of the Support Vector Machine (SVM) with the incremental step based on the Stochastic Gradient Descent (SGD). The SVM is a binary classifier based on a decision hyperplane that defines the class boundaries. A hyperplane built in a multidimensional space divides the data. The incremental SVM algorithm uses a smooth margin approach with the hinge loss, a convex function that is not differentiable, but it has sub-gradients. Thus, the basic SGD algorithm searches for the optimal maximal margin of separability between classes. The SVM is a particularly useful linear predictor for high dimensional feature spaces, which represents a computationally complex learning problem. Moreover, the SGD algorithm is useful when the data are sparse and takes less than linear time and space per iteration to optimize a system. Therefore, the SVM predictor with incremental SGD algorithm for optimizing the maximal separability margin well fits the need for an incremental learning method that does not introduce heavy computation resource requirements. Monitoring of the physical infrastructures provides normal-behavior samples for both one-class and incremental SVM. The orchestration generates alarms when a new threat is detected by any of the learning method.

Data, Anomalies, and Unsupervised Learning

Besides the lack of data, some CPS protocols used within the EtherNet/IP stack rely on device-specific I/O messages that follow nonstandard formats of fixed lengths defined by the control system vendors. As these messages are non-standardized, it becomes a challenge to develop a monitoring system based on machine learning that extracts knowledge from the network communication. In our proposal, the unsupervised one-class classification mechanism infers the probability distribution of the monitored data on each sensor or actuator in the field network. The key idea of inferring the normal behavior of the control data in the field devices derives from the predictability and closed-loop behavior of the control functions. As the field network is always generating data, from time to time, the one-class strategy updates learn normal behavior of the physical process. Any sample that does not fit inside the surface of the normal class is reported as an anomaly.

The one-class learning strategy relies on the one-class SVM method. One-class SVM is an unsupervised learning algorithm that derives a decision hyperplane for anomaly detection. New data are classified as similar to or different from the training set. In contrast with typical SVM implementations, the one-class takes into consideration a training set of samples from a single class. Any new sample that does not fit into the decision surface defined by the training set is considered an instance of a new class and, thus, an anomaly. As the one-class is more susceptible to variations on the distribution of probabilities of the features, we model a classifier for each monitored sensor/actuator.

Specific Design Choices

An essential step before data analysis is preprocessing, which refers to the organization of data in windows, the extraction of useful features, and the enrichment of the data. Both implemented learning strategies use fixedduration time windows to organize data. The key idea of organizing data in windows is to evaluate instantaneous values as well as recent variations of features values, e.g., the variation on the measure of a sensor is available when considering a set of recent measures of the sensor. Thus, means, variations, and counts of values on a time window are added to a sample from the network to enrich data.

Considering the incremental learning strategy, we deploy a single classifier for the entire network, primarily focused on retrieving features that discriminate cyber-attacks on the honeypot and the normal behavior of the infrastructure network. Thus, the incoming samples of the incremental learning component include network features, such as device identity, network protocol, type of messages, transport protocol, count of packets, and also physical-related features, such as Modbus message type, read/write information, register, and value. On the other hand, the one-class strategy applies a classifier per monitored device and considers just features that express the physical state of the device, such as the value of each device register and recent variations of these values. This dual strategy of having different features in each classifier enables monitoring of both physical and cyber threats.

CASE STUDY: WATER TREATMENT SYSTEM 3.1 Dataset

To evaluate our proposal, we use the Secure Water Treatment (SWaT) dataset [START_REF] Goh | A Dataset to Support Research in the Design of Secure Water Treatment Systems[END_REF]. This dataset comes from a realistic testbed representing a scaled-down version of a real-world industrial water treatment plant. The testbed has a sixstage filtration process corresponding to the physical and control components of the water treatment facility. Each stage has a dedicated PLC that communicates directly with the sensors and actuators of the specific stage, and with the SCADA server. In the tanks related to the first (raw water), third (filtering) and fourth (dechlorination) processes, there are Level Indicator Transmitters (LITs), which are sensors to indicate the level of the water.

The data in the SWaT testbed [START_REF] Goh | A Dataset to Support Research in the Design of Secure Water Treatment Systems[END_REF] was collected for 11 days. The resulting dataset contains both the physical properties of the plant and the water treatment process, as well as the network traffic, comprising a total of 946,722 samples. As the authors assume that no severe attacks can be launched within less than one second, data collected from sensors and actuators are recorded once every second. The network traffic concerns the communication between the SCADA system and each PLC. A total of 36 types of attacks were launched against the testbed. Unfortunately, in the SWaT dataset, the only attack that involves both the network and the physical devices is the replay attack -for this reason, in our analyses, we focus on this specific attack.

The SWaT testbed relies on the EtherNet/IP protocol stack in the supervisory system networks and on the Fieldbus [START_REF] Urbina | Attacking Fieldbus Communications in ICS: Applications to the SWaT Testbed[END_REF]. However, at each layer of the network, the encapsulated protocol is different. The Common Industrial Protocol (CIP) communicates devices in the control and supervisory network as well as in the Fieldbus network. Communication between controllers and sensors/actuators relies on device-specific I/O messages. The CIP stack meets three primary needs of cyber-physical systems: control, configuration, and data collection. CIP defines the application layer as an encapsulated and object-oriented protocol. CIP messages have rich semantics about information exchanged in the network, which helps understand the process and define the process-based machine learning models. CIP messages follow the objectoriented paradigm and allow the transmission of a variable number of data registers with distinct types. In the Fieldbus network of the SWaT testbed, device-specific I/O EtherNet/IP messages follow non-standard formats of fixed lengths defined by the vendor.

Evaluation and Results

We implemented a prototype of the proposed machine learning approaches. Our prototype is written in Python and relies on the sklearn 1 library as the substrate for the learning algorithms. Because we use the SWaT dataset, we focus on the deployment and analysis of the machine learning methods, instead of implementation details of the field network or the honeypot. To achieve a honeypot-like dataset, we fragmented the attacks on CPS on small batches that simulate attacks on a honeypot that mimics the real CPS network. We establish as ground-truth that all traffic on the honeypot is malicious. In the SWaT dataset, attacks are discriminated by the hour of the day and while an attack happens, attack flows and normal flows coexist.

We analyze the Modbus/TCP protocol to help us design the machine learning strategies. We engineer the following features: source and destination IP addresses, Modbus function code, eight registers of Modbus values, number of changes of the values of the register within a sampling window, and number of packets involved in the Modbus communication. We highlight that these features allow the detection of all attacks that influence these features in 1. Available at https://scikit-learn.org/. an unusual fashion. As stated previously, we evaluate our proposal against a replay attack.

In the SWaT dataset, the replay attacks consist on setting the value of a tank level measurement to a constant. The immediate effect is the underflow or overflow of a tank, damaging the system and causing financial loss. To cause de overflow, for instance, the attacker captures a Modbus message indicating the tank volume when the tank starts to fill and continuously replays this message, indicating that the tank has a low volume, when it is indeed being fulfilled. Hence, while the attack is happening, the number number of changes on the sensor measurement is constant, as shown in Figure 2.

We use the number of changes of the Modbus Register values as a primary feature for our attack detection proposal. Using these values as a feature of the machine learning model is the main reason for the incremental learning strategy to behave with high accuracy during the early stages. This happens because the attack differs from the remaining of the normal data previously collected. We evaluate the performance of the two machine learning strategies using well-known metrics such as precision, accuracy, sensitivity and, specificity. Precision measures how many of the predicted true elements are indeed true. The accuracy is the fraction of results correctly identified. The sensitivity is the fraction of true positives correctly identified. The specificity is the proportion of true negatives correctly identified.

Our first evaluation considers the performance of the one-class SVM on a device-based classification. We train a predictor of each sensor ("LIT x01" where x represents the tank of the corresponding process) in the field network. This assures that the SVM decision surface represents the expected behavior for each sensor/actuator. Figure 3 shows the performance metrics for the attack class, for each sensor, and the average for the three sensors, represented by "System". The precision metric is always around 0.95, while the accuracy of the classifiers is upper-bounded at 0.80. This result is due to the low specificity of the classifiers. The primary reason for obtaining high precision while having low specificity is because the attacks introduce small physical changes for the time they last, but the dataset labels the entire period of the attack as belonging to the attack class. Therefore, as the period of normal behavior is labeled as an attack, the classifiers produce a false negative flow. Nevertheless, we highlight that the precision is high, almost 1.0 for the system as a whole, which means that the identified threats are, in fact, attacks for almost all alarms. The result reveals that one-class SVM is precise at finding anomalies and, when it fails to detect the anomaly, there is no physical change on the monitored process.

The following experiment evaluates the incremental learning strategy. Figures 4(a) and 4(b) show the accuracy and the precision of the system as a function of time using three-time windows. From 0 to 10 s, there was no attack traffic on the honeypot; as a consequence, incremental learning performs poorly. This is the bootstrap phase, in which it is learning the attacks, causing the accuracy and the precision of the classifier to be low (the classifier has not been trained with an attack sample yet). After the first batch of samples from the honeypot, at 10 s, the behavior of the predictor changes, and it reaches more than 0.95 of precision and accuracy. It is noteworthy that accuracy is higher for the incremental SVM than for the one-class SVM, because the incremental considers features from the network, transport protocol, and monitored values on physical sensors/actuators, while the one-class SVM considers only the monitored values in the physical devices. Moreover, the incremental strategy learns both normal and abnormal behaviors from samples, while one-class only derives the normal behavior. Figure 4 also compares the time window size used to gather the samples. We highlight that a 1 s time window performs better than 2 s or 3 s windows because it reduces the latency on reacting to attacks while keeping enough information to promptly train the classifier and improve performance of the next step.

Considering both strategies on detecting intrusions on a CPS, we argue that the orchestration between incremental and one-class SVM approaches is essential to assure a high level of safety on the operation of a CPS. As there is no warranty that a new attack targets a honeypot, it is crucial to apply the one-class approach, which has a high precision rate detecting deviations from the normal behavior of the physical process. Also, the incremental SVM fed by the honeypot is mandatory to learn zero-day attack patterns and leads to high accuracy of attack detection even when the attacks do not imply changes on physical parameters.

CONCLUSION AND FUTURE WORK

Applying machine learning algorithms to perform intrusion detection on real CPS is a challenging task. Firstly, data used to train the classifiers must be curated appropriately, verifying that it includes not only normal operating conditions but also some conditions such as downtime caused by maintenance and even emergency stops on the CPS. Furthermore, during the data acquisition process, it is crucial to have the expertise of the CPS operators to correctly label the events in the dataset. Second, CPS systems tend to operate for several years, and the aging of the devices must be taken into consideration by the classifiers to avoid false positives. Finally, the latency of the classification system must be considered to ensure that the attack countermeasure is responsive enough.

Cyber-physical systems (CPSs) integrate ubiquitous computing, efficient network communication, and control in physical processes. Since CPSs are part of critical infrastructures, it is mandatory to assure operational and safety goals of any given CPS. In this work, we investigated the deployment of a machine-learning approach for detecting malicious behaviors on the CPS network. Our approach orchestrates a detection of attacks learned from a honeypot through an incremental learning Support Vector Machine and anomaly detection on the measurements of the physical processes through a one-class Support Vector Machine. Our results show that, for the SWaT testbed dataset, this approach reaches more than 0.95 of accuracy on detecting learned attacks and detects physical anomalies at more than 0.90 precision.

Further work includes improving the falsepositive rate of our classifier. Also, we intend to apply our detection system to other types of plants and industrial protocols. We also plan to address privacy-related questions about knowledge extracted from the CPS analytics and about leakage of the CPS topology information as an outcome for honeypot exploitation. Fig. 4. The performance metrics for the incremental SVM are closely related to the amount of attack traffic that is used as test samples, which is determined by the size of the time window. Before experiencing attacks on the honeypot, the system presents low accuracy (a) and low precision (b).

As the attacks reach the honeypot, the system learns their behavior, shown at 20 s.

Fig. 1 .

 1 Fig.1. Orchestration of two learning methods, incremental and one-class learning. A honeypot provides malicious activity data for the incremental SVM which updates the parameters. Monitoring of the physical infrastructures provides normal-behavior samples for both one-class and incremental SVM. The orchestration generates alarms when a new threat is detected by any of the learning method.

Fig. 2 .

 2 Fig.2. The key features on the identification of a replay attack are the value of the level sensor and the number of changes of this value within a window. The number of changes of the level sensor within a sampling window is constant while the replay attack happens.

Fig. 3 .

 3 Fig.3. Performance metrics for the one-class SVM. We show the results for the three sensors and the system as a whole. The low sensitivity associated with high accuracy and precision indicates that some attacks perform very close to normal behavior.

  Precision for the incremental learning strategy.

ACKNOWLEDGEMENTS

We would like to acknowledge CNPq, CAPES, FAPERJ, and RNP for the partial funding of this research. We would also like to warmly thank Álvaro Cárdenas from the University of California, Santa Cruz, USA, for his valuable contributions to this work.

Marcelo Dias de Amorim is a Research Director at the French National Center for Scientific Research (CNRS) and a member of the LIP6 laboratory of Université Pierre et Marie Curie, France, where he leads the Networks and Performance Analysis team. His scientific interests are in the area of networked systems, with an emphasis on mobile wireless systems.

Diogo Menezes Ferrazani Mattos is currently a Professor at the Universidade Federal Fluminense (Niterói, Brazil). He received his degrees of D.Sc. and M.Sc. in Electrical Engineering from Universidade Federal do Rio de Janeiro, Rio de Janeiro, Brazil, in 2017 and 2012. He received a Computer and Information Engineer degree from the same university, in 2010, awarded with Magna Cum Laude.


Clément Bertier

Farid Benbadis

Vania Conan

Marcelo Dias De Amorim

Computing Realistic and Adaptive Capacity of D2D Contacts

Assessing the performance of opportunistic networks requires a subtle understanding of both contact and intercontact patterns. While the analysis of intercontacts has attracted significant attention from the research community, surprisingly only a few works have focused on explaining what happens during a contact. In this paper, we perform an indepth analysis of contacts using both empirical measurements and reference models. We make several observations that allow us to better capture the adaptive nature of device-to-device (D2D) links. In particular, in the case of Wi-Fi 5, we show that a slight modification of the nominal modulation scheme is enough to achieve an accurate characterization of opportunistic contacts for some categories of propagation models. As a consequence, we confirm previous observations that the evaluation of protocols and algorithms for D2D networks based on links of fixed rate may lead to inaccurate results. We finally propose a tool that extends mobility traces with plausible values of per-link capacity.

I. INTRODUCTION

It is no more a debate that device-to-device (D2D) and opportunistic networking open promising expectations in wireless communications [START_REF] Ansari | 5G D2D networks: Techniques, challenges, and future prospects[END_REF], [START_REF] Jameel | A survey of device-to-device communications: Research issues and challenges[END_REF]. Designing and implementing an efficient opportunistic network is however challenging because of the highly dynamic nature of the topology. Individual nodes have their own mobility patterns, and communication opportunities appear whenever two nodes get in communication range of each other. An accurate characterization of such interactions is then a must-have step.

The literature is full of outstanding contributions that assess the underlying phenomena governing opportunistic deviceto-device communications [START_REF] Qayyum | PCV: Predicting contact volume for reliable and efficient data transfers in opportunistic networks[END_REF], [START_REF] Helgason | Opportunistic communication and human mobility[END_REF]. In particular, we have today a good understanding of inter-contact patterns in such networks. Unfortunately, there are still critical open questions regarding the contact characterization. While inter-contacts depend primarily on the mobility of the nodes, characterizing a contact in detail also depends on other parameters such as the device-to-device communication technology. In this paper, we investigate issues explicitly related to the contact between two mobile nodes.

A common limitation of existing works is that they assume either that contacts have infinite capacity, allowing the transfer of any amount of data during a single encounter, or that the communication throughput during the contact follows the nominal values of the technology (e.g., Bluetooth or Wi-Fi). This leads to a sort of fixed-rate characterization of contacts, where either nodes are in contact (with a unique characteristic), or they are not. In this paper, we advocate that, to achieve a better characterization of opportunistic contacts, we should adopt a finer representation of the relative mobility of nodes to better capture the communication possibilities.

The central premise of our work is that the distance separating two nodes is likely to vary during a contact. Because of the inherent characteristics of the wireless medium, the quality of the signal varies with the distance between the nodes. 1 The varying node-to-node distance suggests that the link throughput between the nodes varies accordingly. This variation depends on the communication technology under consideration (in Section II, we will discuss the technology we use in our experiments), but regardless of this latter, the throughput always fluctuates as a function of the distance between the transmitter and the receiver.

Fortunately, some authors have already raised some issues with the traditional fixed-rate approach. Chowdhury et al. approximated the distance-to-throughput by first fixing a path loss equation and then observing the distances covered by each modulation in the case of IEEE 802.11n standard [START_REF] Chowdhury | Data Downloading on the Sparse Coverage-Based Wireless Networks[END_REF]. The authors notably propose the contact capacity as an integral of throughput capacity over time. Qayyum et al. proposed to measure the distance-to-throughput using a mobile application in Android [START_REF] Qayyum | PCV: Predicting contact volume for reliable and efficient data transfers in opportunistic networks[END_REF]. Although sharing some goals with us, their work was restrained to short D2D links as they focused on Bluetooth links. Neto et al. proposed to estimate the contact capacity by taking into account the speed of a mobile node [START_REF] Neto | A model for contact volume prediction in DTNs[END_REF]. They transferred data, and attempt to establish a relationship between speed, RSSI, and throughput.

In this paper, we help advance the state of the art in several regards. We investigate the impact of the varying relative distance between nodes on the capacity of opportunistic links. By capacity, we mean the amount of data that can be transferred during the entire duration of the contact. Our ultimate goal is to establish a basis for more accurate design and evaluation of device-to-device communication strategies. We adopt an empirical methodology to achieve a realistic characterization of device-to-device links. Our experiments involve Android smartphones equipped with the Google Nearby API. We apply the observed characterization parameters to two mobility datasets, namely a vehicular one in the city of Luxembourg and a pedestrian one in Stockholm. We confront our observations with the traditional fixed-rate contact characterization strategy and make some observations. We confirm the fact that considering only the duration of a contact and a fixed throughput is far from enough to capture the actual capacity of the contact.

Although the quantitative analysis that we show in this paper is dependent on the communication technology, on the type of devices that we considered during our data collection campaign, and on the test environment conditions, the qualitative observations can be extended to any setup, given that the wireless technology adopts a rate-adaptive strategy. We finally propose a transformation tool that takes mobility traces as inputs and generates realistic contact capacity traces as outputs. We are hopeful that this will entice the community to compare traditional contacts with adaptive ones. As a summary, our contributions are:

• Data collection and analysis. We measure the throughput of modern Android devices according to the distance to assess the maximum communication range of D2D technologies on contemporary smartphones. We use this data as a means to compute the throughput as a function of distance and set a reference model for our work. • Adaptive contact characterization. We thoroughly characterize the contact capacity, meaning the amount of exchangeable data through a contact, when we consider a fixed-rate contact and an adaptive-rate contact. We show they are not equivalent, mostly due to many contacts happening at a near-maximum range. • Fixed parameter selection. Even though we advocate against fixed-rate contacts as a way to estimate contact capacity, we also propose a recommended fixed-rate contact value, to yield more realistic results. • Dataset contact capacity tool. We propose a transformation tool that takes mobility a dataset as an input and generates contact datasets; which include plausible contact capacity for each pairwise D2D link between nodes. The rest of the paper is organized as follows. In Section II, we state the problem, recall the traditional definition of fixedrate contact characterization, and present the methodology we follow in our work. Since the fine characterization of contacts depends on the technology under consideration, we detail in Section III our experimental campaign as well as the measurement-based adaptive contact characterization. We describe the evaluation scenarios and present all the analysis in Section IV. In Section V we explain how the opensource software we propose calculates the contact capacity. We postpone the related work to Section VI so that the reader has enough material to understand our contributions better and conclude the paper in Section VII.

II. DEFINITIONS AND PROBLEM FORMULATION

We use the common definition of contacts in an opportunistic network, which is the period during which two nodes have a valid wireless link and can exchange data. We note this duration as τ . Nodes are mobile, and a contact starts as soon as the two nodes are within communication range of each other. In this paper, we consider that all nodes have the same antenna characteristics leading to symmetric links. We also assume omnidirectional antennas. We note the distance between two nodes A and B as d AB (t).

In this paper, we are interested in the contact capacity C AB , defined as the maximum amount of data that can be transferred between A and B during a contact. The contact capacity depends on the duration of the contact and the data rate of the opportunistic link between the two nodes.

In the literature, many authors simplify the problem by considering that nodes can exchange data at a fixed rate δ fixed when within communication range. In this case, the contact capacity is simple to obtain:

C fixed AB = δ fixed × τ. (1)
Although the fixed-rate contact characterization is simple to manipulate, it falls short in capturing the actual characteristics of a contact in a real setup. Because of several physical phenomena, the throughput that we can get in a wireless link depends on several factors, including the distance separating the sender from the receiver and the propagation conditions. The consequence is that the contact capacity is seldom a linear function of the duration.

Although the wireless medium shows a continuous decreasing behavior in terms of signal delivery, existing technologies adopt a step-wise transmission data rate calculation in function of the received signal strength indication (RSSI). In Table I, we show this dependence in the case of IEEE 802.11ac (Wi-Fi 5), the one we consider in our experiments. As we can see, the ratio between the maximum and minimum achievable throughputs is higher than one order of magnitude. A contact between two nodes is likely to traverse several of these data rate levels; depending on the mobility pattern, the resulting contact capacity can be anything between τ × δ L and τ × δ H , where τ is the contact duration and δ L (resp. δ H ) is the lowest (resp. the highest) data rate authorized by the wireless technology. For these reasons, considering only the contact duration may not be enough to characterize and analyze opportunistic networks.

The rest of this paper will focus on investigating how much impact we may get from a finer characterization of contacts. The first step is to make sure that nodes do observe varying distances concerning neighbors for the same contact durationthis is precisely what we observe in practice. In Figure 1, we plot four different contacts of approximately 100 seconds in a real-world pedestrian scenario. As we can see, the four patterns show that, for the same given contact duration, the distances between the two nodes may vary unpredictably from one contact to another. We can find a case (red curve) where the nodes get very close (about 10 m) before moving away again. However, we can also find a case (blue curve) where the nodes remain very far from each other during all the duration of the contact and never approach less than 250 m.

Problem statement. The estimation of the throughput according to distance involves essentially two steps, as shown in Figure 2. The first one relates distance to RSSI based on some signal propagation model. The second step transforms RSSI into throughput, and this depends mainly on the modulation scheme. While there are common practices to determine the propagation model to fit a given scenario, finding which modulation scheme reflects best the system is more tricky. To the best of our knowledge, there is no well-defined method to transform a given RSSI into a throughput. In this paper, the main challenge will be to find models that can transform distance to throughput so that existing mobility datasets can also be extended to include information on the amount of data that can be transferred whenever two nodes meet.

A. Adaptive contact capacity

In opposition to the traditional fixed-rate contact characterization, whose contact capacity is given in Equation 1, we propose adaptive contact characterization as an alternative to better capture the behavior of opportunistic links.

We involve the two components of the system shown in Figure 2 the RSSI measured on an opportunistic link when the nodes are at a distance d AB (t) (varying distance over time) and δ adaptive (RSSI(d AB (t))) be the throughput.

The contact capacity for the adaptive contact characterization is given by:

C adaptive AB = T +τ T δ adaptive (RSSI(d AB (t)))dt. (2)
where [T, T + τ ] is the contact interval.

III. EMPIRICAL REFERENCE LINK CHARACTERIZATION

To establish a realistic reference basis, we run an experiment to observe how the relationship between RSSI and throughput behaves in off-the-shelf devices.

A. Experimental RSSI to throughput estimation

We carried out a day-long measurement campaign to collect throughput values for different RSSIs in a quasi interferencefree environment. For the communicating devices, we used two OnePlus 5T smartphones equipped with the Android 8.1 operating system and 2 × 2 MIMO antennas. We used the Google Nearby framework to establish device-to-device links between the nodes [START_REF]Nearby -Connections API Overview[END_REF]. Google Nearby is a proprietary deviceto-device library which uses Wi-Fi 5 (5 GHz band) for highspeed throughput. We initially set the devices at a onemeter distance, measure the RSSI and the throughput using Nearby, move the devices away and perform another round of measurements. We repeat the process until the two nodes lose connectivity.

Theoretical versus empirical throughput. One may believe that it suffices to use the technology's specification (e.g., table I) to obtain realistic contact capacity estimation according to distance. To verify the validity or not of this assertion, we show the results of our experiment in Figure 3. The black stepwise function represents Wi-Fi 5's theoretical data rate, and red dots show the empirical throughput we observed during our experiments. The median, shown as a blue line in the plot, represents the expected empirical throughput for a given RSSI. We refer to this median as the "empirical goodput" since it represents the observed transfer capacity of off-theshelf devices (OnePlus 5T devices in this case). We can make two main observations. Firstly, the theoretical data rate is too optimistic, especially for the highest RSSI values, due to hardware limitations as well as implementation choices in the Nearby framework. Secondly, for the BPSK modulation, corresponding to the lowest RSSI levels (below -75 dBm), the experimental curve goes down to 0 Mbps at -87 dBm. As we will see later on, the fact that the theoretical curve remains horizontal at this very last modulation mode has a significant impact on the behavior of the model.

B. Finding an appropriate modulation scheme

To assess the effects of the modulation scheme, we investigate the probability density function of contact capacity for the four different modulation schemes illustrated in Figure 4:

• Step-wise maximum. This is the theoretical step-wise function taken from the Wi-Fi 5 specification. • Step-wise linear adjusted. Almost the same as the step-wise maximum, except that the slowest modulation (BPSK) has its data-rate linearly decreasing until it reaches 0 at -87 dBm. • Step-wise fit. In this scheme, we move all of the steps from the Wi-Fi 5 specifications to the same levels as the experimental data. • Empirical goodput. For a given RSSI, the empirical goodput is the median throughput of collected samples over the RSSI (median blue curve in Figure 3). Similar to the step-wise fit, this modulation scheme requires heavy experimentation to be correctly estimated. To evaluate the influence of these modulation schemes on the capacity of a contact, we first need a mobility scenario. In this section, we consider the Ostermalm dataset [START_REF] Helgason | Opportunistic communication and human mobility[END_REF], a pedestrian mobility trace in the city of Stockholm. The trace was generated with Legion Studio [START_REF]Legion Software[END_REF], a mobility simulator meant for architects and designers to test out pedestrian flows in large infrastructures. The trace has a duration of approximately five hours, with a total of 2,400 nodes moving within a 5,872 m 2 area. The dataset covers a period of 5 hours and shows coordinate updates every 0.6 seconds. This high frequency of position updates is necessary as we need an accurate estimation of the distance between the nodes. The population does not vary significantly throughout the trace, holding a constant value around 60 nodes.

We also need a propagation model to transform distances into RSSI (recall Figure 2 and Equation 2). We consider the two-ray propagation model as it is the one that best fits our experimental scenario (we will discuss about the propagation models in Section IV-A). The results are shown in Figure 5.

Two patterns emerge. While the step-wise maximum and the step-wise linear curves show a humped behavior, the stepwise linear adjusted is the only one that succeeds to capture the behavior of the empirical data. Even though the step-wise linear adjusted overestimates the overall capacity of the system when compared to the empirical goodput, the most important observation here is the shape of the curve, as in a real-world scenario, we expect to observe lower capacity anyway due to interference from neighboring communications.

The main takeaway from this experimental evaluation is the necessity to take the effect of the modulation scheme into account when estimating the adaptive contact capacity. Most importantly, one has to model this carefully, to take into account the asymptotic behavior of throughput according to RSSI and, by extension, throughput according to distance.

C. Explaining the step-wise linear adjusted scheme

As we could see in the previous subsection, the step-wise linear adjusted scheme was the only one able to capture the stepwise max empirical goodput Fig. 6. CCDF of the total capacity of the Stockholm dataset according to the distance between nodes. For the adaptive contact capacity, we here chose a two-ray propagation model and plot the capacity using two modulation schemes. Regardless of the modulation scheme, the majority of the network capacity falls under BPSK 1/2. behavior of the experimental results, albeit a small difference compared to the step-wise maximum. Our intuition is that most contacts happen at the edge of the communication range, thus using the lowest throughput modulation (in the case of Wi-Fi 5, BPSK 1/2).

We check which of short-range or long-range contacts contribute the most, by evaluating the contact capacity of a mobility trace. To this end, we consider the two-ray ground model for the propagation. For the modulation schemes, we first assess the suitability of the step-wise maximum and the empirical goodput. In Figure 6, we show the CCDF of the total capacity of the network as a function of the distance between nodes. As we can see in this figure, regardless of the idealistic (step-wise max) or realistic (empirical goodput) modulation scheme, between 68% to 61% of the total capacity of the network happens due to communications occurring at more than 60 m, which shows the importance of long-distance communications and thus of BPSK modulation. As a result, the modulation scheme used over long distances should not be neglected. The use of a realistic modulation scheme, where the throughput decreases with distance until reaching zero, is recommended.

Part of the explanation also comes from the fact that, in the case of freespace and two-ray ground reflection models, the area "covered" by the BPSK modulation is much bigger than those covered by the other modulation schemes. In Figure 7, we illustrate the differences between the areas. The bigger the area, the more neighbors are likely to communicate through longer links. Other propagation models (especially those adapted for indoors) would lead to different observations; for this reason, we will have further insights into this problem in Section IV-A.

IV. FIXED VS. ADAPTIVE CONTACT CHARACTERIZATION

Let us now compare the capacity of contacts when they are modeled by the fixed-rate and adaptive approaches. For all contacts, we compute the capacity by applying Equations 1 and 2, respectively. To showcase the generalization of the upcoming observations, we consider two datasets, the aforementioned pedestrian Ostermalm dataset (presented in Section III-B) and the Luxembourg dataset. Luxembourg LuST [START_REF] Codeca | Luxembourg SUMO Traffic (LuST) Scenario: 24 hours of mobility for vehicular networking research[END_REF] is a vehicular mobility trace created using SUMO [START_REF] Behrisch | SUMO Simulation of Urban MObility[END_REF], a stateof-the-art micro-mobility simulator. The simulation runs over 24 hours and covers a 20 km 2 area and a total of 167,000 nodes. The trace simulates a realistic daily traffic pattern, with peaks of population during the morning and evening with approximately 2,500 simultaneous nodes.

A. Influence of propagation model

We previously investigated the impact of modulation schemes on the contact capacity, and we now propose to generalize our observations using different propagation models. We consider three propagation models: freespace [START_REF] Benkic | Using RSSI value for distance estimation in wireless sensor networks based on ZigBee[END_REF], tworay ground [START_REF] Sommer | On the applicability of Two-Ray path loss models for vehicular network simulation[END_REF], and log-distance [START_REF] Benkic | Using RSSI value for distance estimation in wireless sensor networks based on ZigBee[END_REF].

As previously explained, the minimum sensitivity of our devices is -87 dBm. As the propagation model dictates the maximum communication range, we consider contact duration along with contact capacity to justify the distributions. For the sake of reference, in our work, the maximum communication range using freespace and two-ray propagation is ≈ 300 m, and for the log-distance ≈ 45 m. We set the modulation as the step-wise linear adjusted for the rest of this section. Lastly, we also plot the contact capacity for a fixed-rate contact δ fixed = 65 Mbps (this throughput being the same data rate as the BPSK 1/2 for Wi-Fi 5).

Let us first consider the vehicular case, shown in Figure 8. The contact duration distribution, as seen in Figure 8a, exhibits two different behaviors. The freespace and two-ray propagation models behave similarly, with a mean contact duration around 30 seconds, whereas the log-distance model leads to a higher probability for contact durations closer to zero. This is a consequence of few contacts happening at a short distance (small coverage surface); even when short-distance contacts happen, the velocity of vehicles prevent the contact from lasting longer than a few seconds. When observing the contact capacity distribution (Figure 8b), as expected, the fixed-rate curves reflect pretty well the distribution of contact duration of Figure 8a. What is eyecatching in this figure is the behavior of the adaptive capacity when using the log-distance propagation model. Contrarily to freespace and two-ray propagation models, log-distance is much more restrictive and intended to reflect indoor scenarios. This means that the coverage zone of BPSK 1/2 is much smaller compared to the other modulations. In this way, the ratio of neighbors communicating through low-throughput links decreases significantly.

In the pedestrian case (Figure 9), contact duration distribution shows a more spread behavior than Luxembourg's. This is due to the shorter relative speeds between human beings compared with the vehicular case which leads to longer contact duration. As such, this yields a more spread out distribution for the freespace and two-ray models and a completely different shape for the log-distance model. In fact, for the log-distance model, the highest contact duration probability is found between 25 to 30 seconds.

The distribution of contact capacities in the Stockholm scenario, depicted in Figure 9b, has several similarities with the plots of the Luxembourg case -the fixed-rate plots follow the same shape as the distribution of contact duration, while the adaptive plot looks like that of a decreasing exponential, except for the log-distance.

The unusual shape the log-distance with a step-wise linear adjusted modulation scheme contact capacity distribution is explained by carefully observing the behavior of nodes, which act as pedestrians. Indeed, due to the much shorter communication range in the case of log-distance, there are only two sorts of contacts. Either the contact is very short, leading to poor capacity, or the contact is long with little distance between the two nodes. These two sorts of behaviors are a direct consequence of the pedestrian mobility behavior with short communication range; either pedestrians cross each other for a brief period, or two pedestrian walk next to each other for a longer duration thus yielding higher capacity.

We also confirm once again that the fixed-rate approach exhibits an unrealistic behavior, and we conclude from our results that designers willing to set up an opportunistic network based on device-to-device communications should account for the type of modulation the underlying technology relies on. The influence of the environment, represented by the propagation model, is limited compared to the modulation scheme. By adopting this strategy, they may be able to obtain much more accurate results compared to what they would obtain with the fixed-rate characterization.

B. Picking a better fixed-rate value

If for some reason, one still prefers to use a fixed-rate characterization, she ought to better select δ fixed . To select a better fixed-rate contact throughput value, we compute the vertical least squares fitting curve based on a simple linear equation for each of the distributions as shown in Figure 10. We remind the reader that in the case of contact capacity as a function of contact duration, a fixed-rate contact follows the linear equation δ fixed = ax + b = ax, since b is always equal to 0; a contact of 0 second yielding 0 contact capacity.

The boxplots in Figure 10 represent the distribution of contact capacity for a given contact duration, considering an adaptive contact. With each box having a height corresponding to 50% of the data, and the bottom (resp. top) whiskers corresponding to the 5th (resp. 95th) percentile. The curve with triangle symbols holds the arithmetic mean of all values found inside the bin.

When focusing on the vehicular case Figure 10a, we can see that the linear fit for the fixed-rate contact does not seem like a good match. For contacts of less than 40 seconds long, the spread around the empirical mean is quite small, but the contact capacity growth between one bin to the next is less than linear. This shows that most contacts under 40 seconds happen on the edge of the node communication range, where the data rates are the slowest. Knowing from the distribution of contact times in section IV that the majority of contacts in Luxembourg happen under 40 seconds, these edgecommunications concern most contacts. With this in mind, the closest recommendation for the value of a fixed-rate contact for Luxembourg we can make is 53.84 Mbits/s. For the Stockholm case, as represented on Figure 10b, the linear fitted function seems to be a better match. Since the surface in which nodes evolve inside the Stockholm dataset is significantly inferior to the Luxembourg one, making the average contact about 80 seconds long. Our recommendation for the value of a fixed-rate contact for Stockholm is 41.10 Mbits/s.

Overall, having a fixed-rate contact is more realistic in the pedestrian case than the vehicular case. We, however, remind the reader that the significant spread around the means shows fixed-rate contacts are far from being the optimal way to portray realistic contact capacity.

V. CONTACT NETWORK CAPACITY COMPUTATION TOOL

As a contribution to the community, we propose an opensource software to quantify the contact capacity of a mobility trace. 2 The software, implemented as a Python library, proposes several preset models for the propagation model and modulation scheme to meet the requirements of the user. As an incentive for users to fine-tune the software to their specific [50][51][52][53][54][55][56][57][58][59][60]. Contact capacity probability according to contact duration in the Stockholm scenario. Here, the two-ray propagation and step-wise linear adjusted modulation scheme is used. needs, we provide access to lower-level functions in case one wishes to implement customized models. The tool can handle both mobility and contact traces.

A. Mobility traces

For this type of trace, the computation is straightforward. The software takes a mobility trace as input (i.e., a sequence of GPS coordinates) and calculates the distance between nodes at each snapshot to determine if there is a contact or not. A contact exists if the distance between the nodes is below the threshold set by the model. If a contact is found, it computes the capacity using the throughput estimation based on the distance between the two nodes, until they lose connectivity.

B. Duration-based contact capacity estimation

Contact traces offer the duration of a contact but not the geographical coordinates of the nodes. Thus, we cannot handle these traces as we do with mobility traces. Recall that, in Section II, we presented Figure 1 that clearly showed that contacts of the same duration are likely to hide different mobility patterns. To circumvent this issue, we propose to rely on probability density functions that relate duration to capacity.

Let us illustrate this idea with an example. Let us assume the user chooses the two-ray propagation model along with the step-wise linear adjusted modulation scheme. Firstly, we calculate the contact capacity for each contact duration, as seen in Figure 11. This figure comes from the measured data we showed in Section III, and we expect to extend our reference dataset with other measurement campaigns in the future. The software computes then a contact capacity based on the duration of the contact directly from the appropriate probability density function.

VI. RELATED WORK

In the literature, fixing a data exchange rate for a contact has been an on-going issue for more than a decade. While it depends on the wireless technology used, as well as the mobility scenario and the environment, most often these issues are entirely overlooked.

Delay tolerant networks (DTN), or more specifically DTN routing/diffusion algorithms, is a field where contacts and inter-contact times are used as a way to quantify exchange opportunities [START_REF] Lindgren | Probabilistic routing in intermittently connected networks[END_REF]- [START_REF] Balasubramanian | DTN routing as a resource allocation problem[END_REF]. Some algorithms focus on the fact that nodes (i.e., transmitting or receiving devices) have a finite amount of memory that limits their receiving/forwarding capabilities and forces fine buffer management [START_REF] Burgess | MaxProp: Routing for Vehicle-Based Disruption-Tolerant Networks[END_REF], [START_REF] Balasubramanian | DTN routing as a resource allocation problem[END_REF]. While it is a common practice to take in consideration hardware limitation due to memory, we are surprised to see that transfer speed is ignored. In other words, it is commonly assumed that the packet transfer between two nodes always succeeds if two nodes are within communication range (though, these algorithms assume small packet size). Let us pick the example of the Opportunistic Network Environment simulator (The ONE), a state-of-the-art simulator aiming to simplify the evaluation of DTN algorithms in a realistic fashion [START_REF] Keränen | Increasing reality for DTN protocol simulations[END_REF]. For the throughput of mobile devices, they chose a conservative and simplistic estimate by setting a fixed-rate throughput for contacts. For instance, they assume that nodes using Bluetooth can exchange data at a 2 Mbps throughput within a 10 m radius and that nodes using Wi-Fi have a 4.5 Mbps throughput within a 30 m radius [START_REF] Keränen | Increasing reality for DTN protocol simulations[END_REF]. A recent example of such a practice is proposed by Zhu et al. [START_REF] Zhu | Contact-Aware Optimal Resource Allocation for Mobile Data Offloading in Opportunistic Vehicular Networks[END_REF], where a contact happens with any vehicle inside a 200 m range with an exchange rate of 20 Mbps. Our study shows that such a characterization is not very precise and that distance between communicating nodes should be taken into account to model these interactions accurately.

Fortunately, some authors shed light onto this issue. The closest work to our study has investigated the idea of tuning throughput according to the distance. For instance, Chowdhury et al. [START_REF] Chowdhury | Data Downloading on the Sparse Coverage-Based Wireless Networks[END_REF] observed that the Wi-Fi protocol adapted its rate according to the RSSI, and therefore proposed to calculate the amount of transferable data between a Wi-Fi access point and a mobile node according to the distance between them. Neto et al. [START_REF] Neto | A model for contact volume prediction in DTNs[END_REF] take this idea and empirically try to verify this model by measuring the throughput between a mobile node (car) and a base station. Last, Qayyum et al. [START_REF] Qayyum | PCV: Predicting contact volume for reliable and efficient data transfers in opportunistic networks[END_REF] take an empirical measurement of the throughput according to distance using a mobile application.

Contrary to the approaches mentioned above, in this paper, we consider several new aspects. First, instead of assuming only one of the two nodes is mobile, which is unrealistic in a pedestrian or vehicular environment, we suppose that both nodes in contact are mobile. Moreover, where the other studies simulate random positions of nodes or real traces with a small number of nodes, we use realistic traces with hundreds, even thousands, of mobile nodes to understand how the adaptive rate affects the contact capacity in a large network.

Another essential difference between our study and the previously mentioned works is the method used to estimate the throughput between two devices according to the distance separating them. Chowdhury et al. [START_REF] Chowdhury | Data Downloading on the Sparse Coverage-Based Wireless Networks[END_REF] took the theoretical link speed as specified in the Wi-Fi 4 (IEEE 802.11n) standard, and tried to fit a piece-wise and polynomial function to obtain the link speed from the RSSI. Then, they estimate the RSSI according to distance by using a log-distance propagation model. Qayyum et al. [START_REF] Qayyum | PCV: Predicting contact volume for reliable and efficient data transfers in opportunistic networks[END_REF] first empirically measure the distance to throughput by implementing a Bluetooth data transfer scheme in a mobile application, and then propose a distance to throughput model using cubic spline interpolation. Compared to our model, they report a notably lower throughput, and in their case, shorter range (≈10 m). While detailed in a companion paper, our model takes the best of these two approaches, by using a mobile application to measure the RSSI to throughput on contemporary hardware (notably, using IEEE 802.11ac instead of IEEE 802.11n) and by using an empirically verified model for RSSI estimation.

VII. CONCLUSION

In this paper, we investigated contact characterization based on the throughput between the nodes, namely fixed and adaptive. Our adaptive contact characterization relies on the principle that one should take the distance between two nodes into account to properly estimate the throughput between them. The adaptive contact characterization adopts a twostep calculation strategy: firstly, the distance is turned into a received signal strength (propagation model), then the signal strength is turned into a throughput (modulation scheme).

We applied our strategy in two mobility datasets. We observed that the most important factor when capturing the behavior of a contact is that the modulation scheme's throughput must decrease with distance until reaching zero. Also, although distant contacts have the poorest data-rate, they contribute the most in terms of global network capacity regardless of optimistic or realistic modulation schemes. By comparing the fixed and adaptive contact capacity distributions, we noticed that their distribution shapes are entirely different, thus showcasing that fixed-rate contacts are not enough to capture the essence of realistic contact capacities.

We additionally provide a piece of software that computes the contact capacity of a mobility trace, either based on the distance between the nodes or, if the latter is not available, on the contact duration with greater accuracy than fixed-rate contacts. With this tool as a means to simplify the contact capacity computation, we hope that the community will get further insights into how the varying contact throughputs impact protocols and algorithms for D2D networks.

In our future work, we intend to provide a mathematical framework to calculate the contact capacity based on the duration of contact. Additionally, we also intend to conduct more experimental campaigns so that our tool encompasses more scenarios (e.g., indoors).

Fig. 1 .Fig. 2 .

 12 Fig.1. Four contacts of ∼100 seconds each. Note that the distance between the nodes show the most variable patterns.

Fig. 4 .

 4 Fig.[START_REF] Helgason | Opportunistic communication and human mobility[END_REF]. Modulation schemes considered in this paper. They all have a null throughput under -87 dBm, being the minimum sensitivity of our receiver.

Fig. 5 .

 5 Fig. 5. Contact capacity probability density function for all modulations using a two-ray propagation model in Stockholm.

Fig. 7 .

 7 Fig. 7. Propagation and modulation on the space. The outer disk represents the coverage zone of BPSK 1/2.

Fig. 8 .

 8 Fig. 8. Contact duration and contact capacity distribution on a vehicular dataset (Luxembourg).

Fig. 9 .Fig. 10 .

 910 Fig. 9. Contact duration and contact capacity distribution on a pedestrian dataset (Stockholm).

  Fig. 3. RSSI-to-throughput experimental results. The step-wise black line represents the theoretical maximum values provided by the standard.

		700 800									Theoretical datarate Empirical goodput Original data
	Throughput (Mbits/s)	300 400 500 600	256QAM 5/6		256QAM 3/4 64QAM 5/6 64QAM 3/4	64QAM 2/3	16QAM 3/4	16QAM 1/2	QPSK 3/4	QPSK 1/2	BPSK 1/2
		200
		100
		0	40	50	60 RSSI (dBm)	70	80	90

: propagation and modulation. Let RSSI(d AB (t)) be

Of course, other parameters come at play, but in this work we focus on the distance only and avoid including environment-dependent parameters. 978-1-7281-0270-2/19/$31.00 ©2019 European Union

https://github.com/Bertier/OpportunistiKapacity