Olivier Jacq

Xavier Boudvin

David Brosset

Yvon Kermarrec

Jacques Simonin

Detecting and Hunting Cyberthreats in a Maritime Environment: Specification and Experimentation of a Maritime Cybersecurity Operations Centre

Keywords:

The vast majority of worldwide goods exchanges are made by sea. In some parts of the world, the concurrence for dominance at sea is very high and definitely seen as a main military goal. Meanwhile, new generation ships highly rely on information systems for communication, navigation and platform management. This ever-spreading attack surface and permanent satellite links have grown a concern about the potential impact of cyberattacks on a ship at sea or on naval shore infrastructures. Therefore, on top of the usual cyberprotection measures taken for safety reasons, it is essential to implement an ongoing cyber monitoring of ships in order to detect, react accordingly, and stop any incoming threat.

In this paper, we explain the specific constraints when trying to assess the cyber situation awareness of maritime information systems. As we will demonstrate, those systems combine physical and logical constraints which complexify their cyber monitoring process and architecture. Gathering valuable data while having a limited and controlled impact on the satellite bandwidth, maintaining a high level of integrity on remote systems in production are, for instance, thriving challenges for both civilian and military ships. We have designed and set up a research platform which fulfils those specifications to streamline the cyber monitoring process. We will then describe the architecture used to detect cyber-threats and collect potential Indices of Compromise from naval systems, as well as the results we have currently achieved.

I. INTRODUCTION

C OVERING 71 percent of the Earth's surface, oceans have historically been a centre of interest for trade, oil and gas industry as well as passenger traffic. Transferring large amount of goods from one part of the world to another is often cheaper by sea than by any other means. Ensuring a free access to the sea as well as maintaining secured sea lanes are often top priorities for industrial countries which have developed naval military capacities to achieve these objectives. 90 percent of global world trade is operated by the shipping industry [START_REF]Internal Chamber of Shipping. Ics -key facts[END_REF]. For most of us, the importance of the sea in our daily life cannot be seen. It is even often forgotten. However, an enormous part of the goods we buy and consume has had a link with the sea during its industrial life cycle. Throughout history, the use of the sea for goods exchange has developed and became a priority for local, regional and worldwide trading, growing together with ships capacities and navigation reliability. Ships provide a cost-efficient delivery of goods for most industries as well as for agriculture or human needs. The remarkable progress of the naval industry has given the capacity to build larger and faster ships. Today, the largest container ships, which are 400-metre long, can carry over 21,000 Twenty-foot Equivalent Units (TEU) [START_REF]10 world's biggest container ships[END_REF] while being operated by a crew of 20 people only.

The development of civil aviation from 1960s has signed the quick decline of ocean liners for passengers intercontinental travels. However, commuting via ferry boat is still a daily reality for workers and tourists in many parts of the world, on short distances or when competing with aircraft makes no sense economically. The tremendous interest for cruising over the last twenty years has greatly increased the commercial offers -and the size of cruise vessels. Those built nowadays are the largest ever, welcoming nearly 9,000 people on board including passengers and crew [START_REF]Symphony of the seas fact sheet[END_REF].

Ever since the start of trading over the ocean, piracy has been an immediate concern. Competition for importing goods, discovery of new sea lanes, protection of national territories and fish resources, safe sailing on sea lanes and straights such as Panama, Suez, Hormuz, Bab el-Mandab or Malacca are of highest concerns for most countries. The will to protect national interests and establish naval leadership has led to the development of navies. Developed and developing economies are today upgrading their naval capacities with last generation surface ships and submarines to respond to modern threats at sea and secure their vital imports of goods. With the ability to operate in most parts of the oceans, a powerful navy multiplies the possibilities to deter, anticipate, protect and take a decisive role in modern conflicts.

The ability to build and operate the so-called 'megaships' for industry or cruising highly relies on their digitalization. The effectiveness and power of our navies depend on accurate and secure information systems. The use of industrial control systems and information systems to drive naval engines, ship-to-shore communications or weapons systems has never been higher, simplifying their operation and leveraging their capacities [START_REF] Dombrowski | Cyber war, cybered conflict, and the maritime domain[END_REF]. Those ships, as well as naval shore infrastruc-tures, are no more built as they used to be just a decade ago. Things have radically changed, forever. The shift from analogical to digital has been drastic, spreading sensors, computers, networks as a replacement for buttons, meters and analog displays. Even on small fishing or sailing vessels, digital devices such as sounders, radars, Global Positioning System (GPS), Electronic Charts Display and Information System (ECDIS), satellite systems and radios are now interconnected.

While this has dramatically improved ships and shore infrastructures performance and safety, the attack surface has similarly grown over the last few years, drawing new weaknesses and threats to the maritime sector. This growth will become even higher over the next decades, as digitalization will completely transform the way ships, ports and offshore infrastructures will operate [START_REF] Oliver Fitton | The future of maritime cyber security[END_REF]. Reflections and projects are also on their way to build fully autonomous and unmanned ships, drawing a new era of maritime evolution. Setting a high priority on cybersecurity is therefore paramount to ensure maximum integrity and resilience of the underlying information systems [6][7].

In this paper, we present an architecture we have designed and built to generate the real time cyber situational awareness for naval systems and the initial results and outcomes we have obtained. In the first section, we present the rationale and the specific characteristics of naval systems. In the second section, we describe the solutions which are currently available through the usual triad: People, Process, Technologies. In the third section, we describe the design constraints and demonstrate that the existing recommendations and architectures do not fully meet the requirements in terms of naval systems. In the fourth section, we highlight all parts of the architecture we have designed to fully meet our objectives. The fifth section describes the results we have currently achieved. In the final section, we conclude with a survey of our current activities and the future plans we have as perspectives to enhance our current implemented platform.

II. CYBER-THREATS TO THE MARITIME SECTOR AND

CHARACTERISTICS OF MARITIME INFORMATION SYSTEMS

Naval systems can be of high interest for both state actors, non-state actors, and cyber-criminals. The high level of onboard digitalization has greatly improved operations but, in the meantime, has dramatically increased the number of vulnerabilities and threat vectors [START_REF] Burton | Cybersécurité et marétique, un enjeu européen ? Centre d'études stratégiques de la marine[END_REF].

Large civilian ships and navy vessels usually share a overall common architecture for their digital onboard architecture. All modern ships are linked to the shore via satellite links, providing Internet and phone connexions onboard. The bridge uses computers for ECDIS, navigation and collision avoidance, closed circuit television (CCTV). The bridge also controls and manages Platform Management Systems (PMS), for instance to drive the ship's engine and rudder. If naval IT systems share vulnerabilities and threats with usual Information Technologies (IT) and Operational Technologies (OT) systems, the addition of this common background with the specificities of the maritime world makes it a specific domain to secure. We have found out that the naval sector combines the following unique specifications:

• Industrial Control Systems (ICS) with Programmable Logical Controllers (PLCs), ECDIS, communication systems, collision avoidance, navigation and platform management, entertainment, traditional IT and, for the navies, combat systems are networks which can be found on board. If most systems use proprietary protocols and software, convergence is also growing and those installations are increasingly using Commercial Off The Shelf (COTS) protocols, software and equipment and tend to be interconnected, sometimes using wireless protocols.

Securing such networks is a tedious task and security equipments are usually non existent;

• high constraints are set on the satellite link: the bandwidth is costly and often limited to a specific value, ranging from tens of kbit/s for a small vessel to Mb/s for a large or military vessel [START_REF]Executive summaries of market trends and opportunities in key market segments and regions worldwide, the maritime satellite market[END_REF]. Ships can also be isolated from shore, on a short or medium period, due to poor satellite coverage, antenna masks or failures: remote control and administration to mitigate a security issue is therefore complicated;

• the ship has to remain highly resilient even in case of failure of one of her IT systems: human lives, safety at sea, environmental issues are concerned: patching systems in a timely way is usually not possible;

• while autonomy at sea is paramount, if an ashore expertise support is needed, it can only be organized during a port of call, by phone or via a network access;

• no or very few cyber or IT-aware crew members are present aboard on a continuous shift: on the cyber part as well as on the embarked IT/OT systems expertise, the knowledge is usually low to non-existent;

• the maritime company supervises its ships as a whole fleet. This also means an interconnection between ships at sea or ashore: if no isolation is set, this can be an easy vector for a viral spreading;

• the deployment of security patches on those systems when at sea is complex. The various companies involved in developing and integrating embarked systems as well as the lack of pre-production platforms complicate security updates integration: evolutions made on the IT/OT systems traditionally have to go through a full certification process prior to any deployment;

• limited space and physical constraints on board ships spread the use of embedded systems and wireless networks, creating new attacks vectors while the integration of cyber-security assets remains a complicated task;

• finally, when ashore, ships highly rely on shore infrastructures, for instance to disembark their merchandise or for power and cooling supply: the IT and OT managing those infrastructures should not be forgotten in the cybersecurity process.

Most guides and articles cited in this article share the overall concern of the low cyber-security awareness of the maritime sector. They also confirm that maritime information and communication technologies are complex, due to the variety and criticality of most information systems used, combining vulnerabilities of IT and OT systems. Target systems, whether ashore or aboard, may be of high interest for attackers; impacts could be massive, leading to material or ship loss, pollution, casualties, death. The fact that attackers profiles on the maritime sector could go from a wide prism from cybercrime to non-state or state attackers is also of high concern. Finally, cyber-attacks targeting the maritime sector [10][11] or causing collateral damage to the maritime sector [START_REF] Maersk | Cyber-attack update[END_REF], have already been being reported publicly.

The unique characteristics we exposed, combined with the specific threat vectors lead us to think that the most feared cyber-scenario is probably a network intrusion, enabling a remote takeover of the ship for sabotage or piracy, leading to high damages to the crew, shipping or the environment [START_REF] Michael | Pirates exploiting cybersecurity weaknesses in maritime industry[END_REF] [START_REF]er trimestre[END_REF]. The ongoing developments on autonomous ships and drones underline the likelihood of this scenario. We can also add to the list the spreading of ransomware ashore and aboard IT/OT naval systems, due to phishing, spear-phishing or viral infection during maintenance operations or via the use of personal devices. Using various Denial of Service (DoS) attacks, the disruption of essential services, such as satellite localisation or telecommunication and collision avoidance systems, Automatic Identification System (AIS) [START_REF] Alincourt | Méthodologie d'extraction de signatures issues des signaux ais[END_REF], mapping technologies (ECDIS) or bridge and conning is also a main feared issue [START_REF] Marsh | The risk of cyber-attack to the maritime sector[END_REF] [START_REF]Ncc group -preparing for cyber battle ship[END_REF]. Onboard cargo management systems [START_REF] Jones | Threats and impacts in maritime cyber security[END_REF] and shore infrastructures are also at risk: their digitalization over the last years has been very important and major ports are now using PLCs and interconnecting their information systems to get closer to the smart port design and to smooth the complex processes of logistics [START_REF] Eichenhofer | In-depth software vulnerability assessment of container terminal systems[END_REF]. Due to the amount of valuable merchandise in transit, container terminals (CT) are especially of interest for attackers [START_REF] Beaumont | Cyber-risks in maritime container ports: An analysis of threats and simulation of impacts[END_REF]. Finally, in some cases, and especially in the navy sector, sabotage and espionage techniques could have critical consequences for naval operations.

Cyber-security of those naval systems to cope with multiple and advanced threat vectors presents challenges of all types.

III. SOLUTIONS TO MARITIME CYBER-THREATS

As we know, a proper integration of cyber-risks highly relies on human cyber awareness and efficient cyber-regulation driven processes. So we have investigated the usual triad of People, Process, Technologies (PPT) to find specific issues and solutions for the maritime sector.

A. People for maritime cyber-security

Largest container megaships, such as Maersk's E-Class 400meter long vessels, operate with only 22 people aboard [START_REF] Maersk | The world's largest ship[END_REF]. IT operations are mostly automated and often assigned to one of the deck officers, usually the Electro Technical Officer (ETO), who has a basic operating and maintenance level on different systems, but is no cyber or IT expert [START_REF] Škrlec | Maritime cyber defense[END_REF]. Some naval training centres now offer continuous education programs on cybersecurity (for instance the French Ecole nationale supérieure maritime, ENSM) and shipping companies and crews are increasingly aware of cyber-security risks and trained on crisis management. But at sea, they would probably be unable to detect and react accordingly during an advanced cyber-attack, and also unable to recover the harmed system. Depending on the quality and experience of the company and crew, the level of cyber awareness can also be very different, due to cultural, educational or management and communication issues. To cope with this issue, the International Maritime Organisation (IMO) recently asked maritime companies to integrate cyber risks management within safety management by January 1st, 2021 [START_REF]Maritime cyber risk management in safety management systems[END_REF].

On military ships, the analysis which can be made from official documents is somehow different. Due to the possible impact on vessels or shore infrastructures, espionage possibilities or other risks, States and Ministries of Defence of most countries have been strengthening their defence systems over the last years. While it is hard to gather public figures on the subject, depending on the type, complexity and mission of the navy ship and its digitalization level, IT people aboard may represent between 2 and 10 percent of the whole crew. Most of the time, they are not cyber experts, but have an internal or external diploma in IT, as well as in telecommunications or messaging systems maintenance. Modern navies educate their officers and crew to cyber-security during their education period. For non-IT staff, this education is mainly on a very short period and tackles their specific responsibilities as end users. This process is sometimes mandatory, as well as a meeting with their cyber-security officer during in-and-out assignment process, called in and out processings. Cyber awareness is a matter of continuing education and procedures, like in and out processings, but also onboard training: once assigned on board a ship or shore units, IT people are regularly trained, together with the whole crew and headquarters to react properly to realistic cyber-attacks, whether on dedicated platforms or during typical red team/blue team exercises [START_REF] Us Navy | Fleetwide cyber awareness challenge training update[END_REF] [START_REF] Brosset | A platform for raising awareness on cyber security in a maritime context[END_REF]. Some Ministries or Departments of Defence also organize major cyber-defence exercises, targeting the naval sector amongst others such as, for instance, DEFNET or other exercises in France [START_REF]Centre d'études stratégiques de la marine. The french navy and maritime cyberdefense[END_REF]. This shows that the level of preparation to cope with cyber crisis is now taken seriously and on a formal and regular basis, just like any other kind of navy training.

However, even in that case of maturity, personnel on board ships are not cyber experts, at least on small and medium vessels. In case of a real cyber event, they would have to escalate the event to shore cyber expertise centres for support, analysis or intervention. Due to the lack of cyber experts, and the impossibility to have them onboard on a permanent basis, this situation is unlikely to change soon.

B. Processes for maritime cyber-security

In history, the maritime sector has experienced a number of accidents, leading to casualties, shipwrecks and high impact on environment. This has lead to the regulation of the sector being mainly based on safety, registration and certification, insurance processes and a number of regulations. Two of the most known regulations are the International convention for the safety of life at sea (SOLAS) and the Global Maritime Distress and Safety System (GMDSS).

Concerning cyber, the following guidelines have been issued specifically to the attention of the maritime sector and are usually taken as references in France:

• ANSSI [START_REF]systèmes d'information. Best practices for cyber security on board ships[END_REF], with a best practise guide for cyber security on board ships;

• IMO [START_REF]Guidelines on maritime cyber risk management[END_REF] and its recommendations on maritime cyber security;

• BIMCO, CLIA, ICS, INTERCARGO, INTERTANKO, IUMI, OCIMF [START_REF] Bimco | Guidelines on cyber-security onboard ships[END_REF], with the cyber security guidelines they issued for ship owners and operators;

• ENISA [START_REF] Cimpean | Analysis of cyber security aspects in the maritime sector[END_REF] and its analysis on specific cyber threats to the maritime sector and the recommendations the agency issued. However, in those guides, recommendations remain high level and mostly identical to generic best practices for cybersecurity issued for most IT or industrial sectors [START_REF] Christopher R Hayes | Maritime cybersecurity: the future of national security[END_REF]. The maritime sector is wide and global: those many guidelines may also prove to be conflicting with other national regulations or even between each other [START_REF] Jensen | Challenges in maritime cyber-resilience[END_REF]. As we read them today, they prove to be years behind what they would need to be to cope with the high level of attackers, the wide attack surface and the potential impacts on the sector. If we take the detection process as an example, it is defined as an essential part of the NIST framework (Identify, Protect, Detect, Respond, Recover) [START_REF]Framework for improving critical infrastructure cybersecurity[END_REF]. The recommendation also exists for other industrial or critical sectors, where requirements are clearly established to connect remote systems to a central Security Operations Centre (SOC). But specific recommendations or regulations on cyberdetection for the maritime sector are non existant. While, like other critical sectors, the maritime transportation and the navies would certainly have to report incidents to a regulation authority, there is no current precise regulation protecting the maritime sector and requiring a clear monitoring and detection process. This lack could be explained by a low maturity level in this sector to implement this kind of complex architecture. We have also noticed that, if alerting processes exist for the maritime sector, for instance for piracy prevention and alerting, they do not include cyber. Given the time needed to achieve those long-term evolutions and the progressive increase in maritime cyber-awareness, it seemed to us that this work has to be started as a matter of urgency.

C. Technologies for maritime cyber-security

Cyber-security may be seen as an efficient combination of networked and host-based secured technologies from the physical to the application layer. It also relies on external security techniques, from the human security to the avoidance of environmental incidents which could impact IT/OT assets. Most quoted guides and articles do not issue specific technological requirements for the maritime sector and rely on common usual guides, issued as standards or recommendations. Securing a maritime information system should of course rely on common and usual requirements and recommendations as can be seen in traditional IT and OT systems. But we have seen that they have specific characteristics which make it difficult to ensure an up-to-date cyber-security level. For instance, the integration of multiple navigation and management technologies and brands at the bridge level requires interoperability between those systems and therefore relies on exchange protocols which are often unsecured. This is, for instance, the case of many navigation information distribution systems, where the data frame broadcasting the latitude, longitude, course and speed of the ship to several instruments on board the ship is unsecured, allowing for many attack vectors [START_REF]Crashing ships by hacking nmea sentences[END_REF]. Even if new and secured protocols are on their way [START_REF]An ip/ethernet interface standard for marine electronic devices[END_REF], the life cycle is so long that those types of systems will take a very long time to get enhanced and changed aboard.

This life cycle problem and the great difficulty to patch-intime and secure those systems is common to other OT systems, for instance in the nuclear or oil industry. For the information security officer, this means: the longer those systems live, the higher the number of vulnerabilities exploitable on his systems [START_REF] Tucci | Cyber risks in the marine transportation system[END_REF]. This explains why the use of cyber-monitoring infrastructures to support embarked and ashore IT and OT systems is essential to provide a quick and appropriate response: cyber-monitoring has a direct role to play in the assessment of risk exposure. The use of such techniques on maritime systems together with a combined situation awareness can greatly enhance the cyber-security level. This choice has been made for instance by the European SAURON [START_REF]Scalable multidimensionAl sitUation awaReness sOlution for protect-iNg european ports. Sauron project, the concept[END_REF] project for port infrastructure monitoring.

However, our goal is to be able to monitor not just one harbour but many harbours as well as ships at sea, with higher constraints. The result will be a proper and wider cyber situational awareness on a whole fleet and port infrastructures which can be used by a navy or a national agency to monitor a complete maritime sector, where cyber also acts as a convergence factor for IT and OT sectors.

IV. DESIGN CONSTRAINTS FOR A MARITIME CYBER-MONITORING PLATFORM

Designing a cyber-monitoring architecture and building a Security Operations Centre (SOC) is a long term project with plenty of pitfalls.

Most existing and helpful guides for building a SOC, such as MITRE's [START_REF] Zimmerman | Ten strategies of a world-class cybersecurity operations center[END_REF] focus on the organizational processes of a SOC to make it reliable and perform as expected. The French Agency for Information Security (Agence Nationale de Sécurité des Systèmes d'Information, ANSSI) issued a complete guide of requirements for cyber-detection specialized Managed Security Service Providers (MSSP). This guide [START_REF]systèmes d'information. Security incident detection service providers -requirements reference document[END_REF] proposes an overall cyber-detection architecture we have been following, enabling the data to be shipped to a central site (SOC) to be processed, normalized and analysed, while enabling the distant site to have an overview of the possible incidents detected in its IT premises. While describing network requirements, this middle-level guide does not suggest a precise architecture for cyber detection pipelines or sensors.

Collecting event logs, network/host detections and traditional useful metadata for cyber-detection is not a real problem for traditional SOCs, because of the large bandwidth capacities which are available in modern data centres or offered over WAN by Internet Service Providers. The traffic is heavy, but the capacity to absorb it is mainly there, both on the network side and during the ingestion process, thanks to the use of big data software suites for log processing, analysis and storage. The case we have studied may also be encountered in industries using remote production sites, such as oil industry, electricity or drinkable water production sectors.

However, those sectors do not reach the complexity of naval systems architecture and constraints. The characteristics we are talking about, combined on naval systems, complexify the cyber-monitoring architectures which could be set up. We have synthesized those constraints as follows. They fix the network and software requirements for the remote side of cyber-monitoring infrastructure. First of all, cyber-monitoring system must prove to be isolated from supervised systems: it should not impact them and we should be able to observe without interrupting them (Safety is paramount). Cyber-sensors, one for each network/information system, must keep isolated networks safe and cope with high integration constraints and specific features of each system. The bandwidth used by the cyber-surveillance process must be controlled and monitored at all time to ensure that it is limited to a value coherent with the operational bandwidth and costs. Satellite link up and down times must also be automatically managed to avoid data loss while still allowing a local monitoring. Finally, even if the network flow analysis is run on board by sensors, alerts and metadata flows have to be carefully selected to avoid useless data being sent to shore.

Researchers at ANSSI issued an article [START_REF] Chifflier | Architecture système sécurisée de sonde de détection d'intrusion réseau[END_REF] which describes the system and network levels of a safe Network Intrusion Detection Sensor (NIDS). The architecture describes a local sensor capable of monitoring several networks, without interconnecting them physically, and with the possibility to have specific sets of detection signatures and protocol processors (such as specific processors for industrial systems [START_REF] Diallo | Détection d'intrusion dans les systèmes industriels: Suricata et le cas de modbus[END_REF]) for each of them. The collected data can then be shipped to be ingested in a central SOC. This article was useful to set up the needed custom NIDS systems in our naval detection architecture. However, once again, the complete data pipeline is not described in the given article and the naval characteristics we have summed up in the previous sections are not fully met by the architecture description.

The five constraints aforementioned, taken one by one, seem to be quite easy to cope with, but their combination highly complexifies the final architecture.

V. OUR ARCHITECTURE FOR A FULLY CAPABLE MARITIME CYBER-MONITORING OPERATIONAL CAPACITY

As we have presented earlier in this paper, no off-the-shelf solution meets the high requirements of a cyber-monitoring architecture for naval systems. In this section, we describe the functional blocks which were chained to achieve our goals. The architecture, shown in figure 1, could also be useful for other industrial cases with similar requirements.

A. The remote site

The shore infrastructure can be on a remote site from the central SOC, linked to it via a reliable WAN or satellite connexion. The medium to large size merchant, passenger, oil or gas production platform or military ship is linked to the shore via a standard satellite link. We have designed six functional blocks to fully meet our requirements.

The first block is Network Connexion Safety (NCS), which ensures a high level of harmlessness on the supervised system. As we have seen, the monitoring sensors must be safely connected to the supervised systems. When dealing with network sensors, the solution provided enables to have one to many capture ports on the network. On board, this block is achieved by using usual capture technologies, such as port mirroring on traditional or industrial network switches and the use of dedicated Test Access Ports (TAP).

The second block is Network Probe Isolation (NPI). Each sensor is isolated from the others, so each sensor, while being hosted on the same server, can have its own engine, preprocessor and detection schemes and signatures. It also enables the possibility to configure the probe to fetch specific metadata and metrics depending on the kind of system supervised. Those features are essential for a proper hunting of cyberattacks.

The third block is a Local Preprocessor (LP). The LP synchronizes timestamps between all metadata, normalizes the inputs, adds filters or transforms the data if necessary, and correlates events and alarms to limit the impact on the satellite uplink.

The fourth block it the Local Engine (LE). The LE stores events on premises, allowing for long term read-only retention for legal purposes and local alerting.

The fifth block is the Ship Shore Manager (SSM): it acts both as a cache and processor to ensure data is properly sent to shore. It can also prioritize data being sent depending on tags, for instance to send alerts first and metadata/logs afterwards to take into account the latency of satellite links. In case the satellite link is not available, data is cached in memory or disk to provide a backlog which is automatically and timely sent when the link is back on duty. This engine also manages the bandwidth, allowing to set up a precise throughput to use only the allowed portion of the satellite link. The available throughput can be manually set up to a limit or depend on the real activity of the link. While called Ship Shore, this item can also be set up on remote shore sites, mainly depending on the quality and bandwidth of the link between the remote site and the central SOC.

Finally, the sixth block is the Cyber Situational Awareness Console (CSAC). Using this console, the crew of the ship has a simplified yet complete overview of the onboard cyber situation, giving operational and technical knowledge about the impacted systems and the details associated, together with immediate tasks to achieve. Apart from operational dashboards, this console gives an impact assessment of the cyber event on the ship's capabilities, which we call Cyber Battle Damage Assessment (CBDA). This console also propagates a common cyber situational awareness between the crew and the SOC. Sharing the same information is essential to gain time and help the ship's captain to take the good decisions.

The link between the remote sites and the SOC has to be secured as it carries critical information and should not be corrupted nor captured. Depending on the company or national information security policies, it can be encrypted to avoid interception and also provide a logical isolation from the other ship/shore network flows with the use of specific virtual links and crypto material. This feature, which seemed essential to us, can be mitigated due to the additional cost on bandwidth when using layer 3 or lower network encryption protocols.

While cyber-monitoring of remote sites highly relies on satellite link quality, which means that the central site can be blind in case of failure, the quality of those links, the presence of efficient resilient satellite links or installations on board ships reduce the risk of link loss. The design of our architecture also allows for a local alarming capacity even in case of satellite link loss.

The only drawback of the architecture is its security level. Having a full isolation from the monitored systems means the SOC cannot react on the remote systems after a detection. While this can be mandatory due to national regulations, this is also safer. The immediate intervention can easily be handled either to the remote site to take proper measures, or to the network operations centre or IT/OT operations managers.

B. The maritime SOC

On the shore side, the network flows usually either exit at the fleet management centre or at the SOC, either hosted or at the sub contractor premises. After the possible crypto equipment used for deciphering, the first block is the Ship Shore Manager (SSM). It completes the specific channel between SSMs, ensuring all collected data on board properly exits on the shore side as expected, in a timely and ordered manner, and within the specified bandwidth limits. Then, the second block is the Central Processor (CP). All metadata, logs and alerts flowing from remote sites are centralized on the CP where they are pipelined, filtered, normalized or transformed as needed by the SOC. The third block is the Data Store (DS). Traditionally, this can be a big data engine, enabling the secured storage of data and its indexing for efficient queries. Finally, the fourth block is the Bandwidth Manager (BM), used to set up and monitor the bandwidth configuration for distant sites.

The other assets of the maritime SOC are quite common with what can be found in modern SOCs for analysis, display and common services. The Cyber Awareness Toolchain (CAT) is primarily used by SOC level 1 and 2 maritime experts for cyber detection engines and signature tuning, big data analytics, automated searches and graphs, as well as alerting and displaying. We also use this tool chain to link the maritime SOC with Threat Intelligence sources, Digital Forensics and Incident Response (DFIR) as well as Security Incident Response Platform (SIRP) platforms to boost its efficiency on threats, analyse malwares or phishing, and follow the incident response process and reports to the management level. Maritime Cyber Situational Awareness (CSA), short and long term, is processed this way. We also hope one day, that with such tools, specific naval or generic Threat Intelligence (TI) and IoCs sharing between fleet managers will become a reality. The fleet / maritime RCP Recognized Cyber Picture (RCP) is used to ensure a proper display of the individual ship and fleet cyber overview, which is needed to help the SOC engineers and managers giving directions to their cyber-related decisions or to help for crisis management and risk assessment. Finally,

VI. RESULTS OF THE PROPOSAL FOR A MARITIME SECURITY OPERATIONS CENTRE

The design and tuning of each functional block has been a real challenge, especially when working on networks where data flows or even assets are sometimes unknown. One of the biggest issues when writing signatures was to cope with specific proprietary data formats, which we had to capture, analyse, understand, formalize, test, and retest, to make sure our detection scheme and signatures, up to the application level, were precise and good enough to avoid false positives as much as possible.

As shown in Figure 2, data flows on the distant networks are monitored by the sensors in the NPI (2) through the corresponding NCS [START_REF]Internal Chamber of Shipping. Ics -key facts[END_REF]. The NPI extracts valuable data from the network flows, called metadata. Depending on the signature rule sets, when a malicious flow is detected, the NPI also sends an alert, together with the relevant metadata. The flows from the NPI are sent to the LP (3) to be synchronized and normalized, before being stored on the LE (4). In case of an alert, the CSAC on board the ship will display the corresponding data [START_REF] Oliver Fitton | The future of maritime cyber security[END_REF]. When there is no alert, usual graphing tools are used to give the crew a cyber situational awareness of the network activity for both OT and IT. The LP pipelines the data to be sent to shore to the onboard SSM [START_REF] Ørnulf | Secure communication for enavigation and remote control of unmanned ships[END_REF], acting as a memory buffer and flow control asset. Alerts are passed first, followed by metadata. When the link between the SSMs is not effective, the whole data is stored on the distant SSM and the link failure is displayed on the CSAC and shore CSA. If the link is functional, alerts and metadata from all sites go through the SSM [START_REF] Tam | Cyber-risk assessment for autonomous ships[END_REF] and are gathered by the CP [START_REF] Burton | Cybersécurité et marétique, un enjeu européen ? Centre d'études stratégiques de la marine[END_REF]. The CP treats the flowing documents, merging, filtering, formatting or enhancing their fields so the data stored on the DS if of highest quality [START_REF]Executive summaries of market trends and opportunities in key market segments and regions worldwide, the maritime satellite market[END_REF]. The alerting tools on the CAT [START_REF] Bullguard Blog | Cyber-attacks and underground activites in port of antwerp[END_REF] are permanently querying the DS with generic or specific requests on the indexed metadata. For instance, the alerting framework periodically searches the DS for specific values in fields, to detect cyber events in logs, such as repetitive failed Secure Shell (SSH) connexion attempts as root. In such case, the alerting tool automatically creates an incident in the SIRP, enriched with the relevant metadata it gathered [START_REF] Direnzo | The little-known challenge of maritime cyber security[END_REF]. When a new threat is known trough the use of TI feeds [START_REF] Maersk | Cyber-attack update[END_REF]. SOC experts following the feeds can also task the DFIR tools for specific analysis of the data stored in the DS [START_REF] Michael | Pirates exploiting cybersecurity weaknesses in maritime industry[END_REF]. Finally, CSA and RCP are used to display the present cyber situational awareness, the trends and the impact of cyber on global operational naval activities for risk assessment [START_REF]er trimestre[END_REF][START_REF] Alincourt | Méthodologie d'extraction de signatures issues des signaux ais[END_REF].

The quality of each functional block as well as the overall performance of the architecture has been thoroughly tested. First of all, with the help of professional red team experts to ensure a high level of confidentiality, integrity and availability of the cyber-monitoring platform. This process has also been used to confirm the total harmlessness of the cyber-monitoring process on the monitored systems as well as between them.

The tests also confirmed the high quality of cyber-detection by the design of specific preprocessors on proprietary systems, as well as of the quality of the detection signatures written for the maritime systems.

Large simulated interruptions or limitations on the satellite bandwidth have also been tested to check that no data is lost and that, when the satellite is back, data is properly ordered, prioritized, collected and sent to its destination; those tests also confirmed the good working of the CSAC on board the ship, even in case of loss of the link to the SOC.

Finally, we have confronted the system with cyber-attacks simulations to ensure a highly beneficial balance between the metadata and logs being sent ashore with the detection quality and with the bandwidth clipping. The bandwidth is now optimized and fullfils our requirements.

VII. FUTURE WORK

Three and related steps have yet to be developed on a deeper basis to finalize an overall excellent cyber-situational awareness. First of all, the creation of time-related graphs on the data lake would assist SOC analysts understanding and "fighting" against cyber events over a large amount of data. This is essential, but difficult, due to the amount of data collected, the potential high number of sensors and the risks of mis-interpretation of graphs (for instance, some local networks share common IP address plans). Another plan is to study and implement proper graphing and displaying methods for metadata depending on their type and features to create rich, dynamic and still efficient dashboards for ship commanders, SOC, and headquarters/fleet managers. Finally, we plan to integrate the Cyber Situational Awareness with other situational awareness tools to ensure a better overall risk management and to provide more complete and richer information to build the situation awareness. For instance: intrusion detection, CCTVs, fire detection and cyber events could be efficiently linked and displayed together to ensure a high level efficient common picture of the situation.

VIII. CONCLUSION

In this paper, we have presented the context of maritime information systems, whether ashore or onboard, with the various types and characteristics they share. Whether civilian or military, we have described their unique characteristics.

We have demonstrated that those unique characteristics require a dedicated detection and data pipeline architecture that common SOC and cyber-detection architectures do no provide.

In addition, we have described the remote and central functional blocks we have designed and integrated to meet our requirements.

The overall is a summary of the characteristics of a maritime cyber Security Operations Centre compared to a traditional one, and why a proper cyber-detection architecture has to be taken into account during the engineering process of modern ships, naval infrastructure, and fleet management centres.

Our current platform is still heavily and daily tested to check its performance on huge data sets, as well as to verify that its cyber detection is at the highest expected level and reacts properly even in a "crisis situation". The results currently achieved are highly positive. Our platform has been presented to officials and experts, raising enthusiasm amongst cyber experts and maritime commanders and executives, both civilian and military. The exchanges with those experts were extremely valuable, enabling us to add new features or updating the platform characteristics to meet new or updated requirements and address the feedback. We are now challenging the platform with real-life and real-time situations at sea and ashore on complex systems to collect more results and achieve success.

Fig. 1 .

 1 Fig. 1. Overall architecture of the maritime cyber-monitoring capacity with the distant site (left) and the maritime SOC ashore (right).

Fig. 2 .

 2 Fig. 2. Metadata and alerts processing in the maritime cyber-monitoring capacity with the distant site (top) and the maritime SOC ashore (down).


Vicente Almonacid
email: almonacid@ies.univ-montp2.fr

Laurent Franck
email: laurent.franck@telecom-bretagne.eu

An Asynchronous High-Throughput Random Access Protocol for Low Power Wide Area Networks

Keywords: LPWAN, Random-access, multiple access, ALOHA, IoT, M2M

Among the design aspects that limit the network capacity of low power wide area networks (LPWAN), the adoption of an appropriate random access (RA) medium access control (MAC) protocol plays a fundamental role. Recently, ultra narrow band (UNB) networks, which operate over Time-and Frequency-Asynchronous ALOHA (TFAA), have emerged as a novel alternative to spread spectrum communications for LPWAN applications. While the UNB TFAA approach fulfills with the primary requirements of LPWANs, namely low power consumption, low terminal cost and long range communication capabilities, its throughput and packet error rate (PER) performance is rather poor. In this paper, we propose Contention Resolution Time-and Frequency-Asynchronous ALOHA (CR-TFAA), an enhancement of TFAA which is in line with recent advances on asynchronous RA schemes, such as Asynchronous Contention Resolution ALOHA (ACRDA). Numerical results show that the proposed technique provides a remarkable throughput-PER performance. Moreover, compared to ACRDA under similar conditions, CR-TFAA provides better PER performance over practical channel loads.

I. INTRODUCTION

Low Power Wide Area Networks (LPWAN), also known as Low Throughput Networks, are currently taking increasing relevance in the development of the Internet of Things (IoT) and Machine-to-Machine (M2M) communications. According to recent forecasts, by 2020 LPWANs will represent 26% of the total IoT connectivity, with an expected compound annual growth rate of 90% over the period 2016-2020 [START_REF] Research | Low Power Wide Area Networks for IoT Applications[END_REF], [START_REF]Low Power Wide Area Network (LPWAN) Market, Technologies, Industry Verticals, Regions, Competitive Landscape, End-User Analysis -Global Market Drivers, Opportunities, Trends, and Forecasts[END_REF].

Unlike mobile networks, the design of LPWANs has been oriented to low data rates and low-consumption technologies, which allows for extremely low overall service costs (including both terminal and network access) and at the same time brings up new perspectives for the development of novel IoT applications. The lack of a leading industrial LPWAN standard, together with the inability of current mobile networks to provide cost-effective and low-consumption M2M services, has given space to the development of several proprietary solutions, among which we may mention LoRaWAN, Weightless, On-Ramp and Sigfox. According to the underlying physical (PHY) layer, the radio access techniques adopted by these systems can be generally classified into two main groups: spread-spectrum (SS) and narrow band/ultra narrow band (UNB) transmission (generally speaking, UNB differs from conventional narrow band systems because in the first the transmission bandwidth is comparable to the oscillator instability range. For a more detailed description of the UNB technique, the reader is referred to [START_REF] Goursaud | Dedicated networks for IoT: PHY / MAC state of the art and challenges[END_REF]). While SS techniques have been widely studied over the last decades, the UNB approach has only gained attention recently due to the rapid expansion of Sigfox networks, which are based on this radio access technique.

Regardless of the PHY layer design, the Media Access Control (MAC) layer of LPWANs typically relies on random access (RA) schemes. Indeed, RA is sometimes the more efficient MAC solution considering the low traffic duty cycles and the short packet sizes that characterize typical LPWAN applications. Further, the use of asynchronous RA schemes is appealing because it avoids the requirement for slot time synchronization, which has implications in terms of terminal cost and power consumption, and may also reduce the overall network capacity if the use of external reference signals (e.g. GPS) is impractical or unfeasible.

Asynchronous RA schemes have been introduced more than three decades ago with the well-known ALOHA protocol [START_REF] Abramson | The ALOHA System -Another Alternative for Computer Communication[END_REF]. In ALOHA, packets are transmitted as soon as they are generated without following any type of coordination. Despite its simplicity, ALOHA provides a poor throughput performance, achieving a maximum of T =1 /(2e) ≃ 0.18 packets/slot under the collision channel model. Soon after the introduction of ALOHA, it was shown [START_REF] Roberts | ALOHA packet system with and without slots and capture[END_REF] that by simply accommodating packet transmissions into time slots it was possible to increase the ALOHA throughput, getting a maximum of T =1/e ≃ 0.36 packets/slot. Thus, slotted ALOHAbased protocols have being widely employed in many common systems, including mobile (terrestrial) and satellite networks, where the use of a RA channel is always required (e.g. for connection set up or demand assignment).

With the recent advances on signal processing and the devel-opment of cross-layer RA design approaches, a new generation of slotted RA protocols capable of providing high throughputs at low packet error rates (PER) is emerging. In general, these protocols are characterized by the use of time diversity-which is achieved by transmitting two or more replicas of a packet over a frame structure spanning several time slots-, low-rate forward error correction (FEC) and successive interference cancellation (SIC) at the receiver side (see for instance [START_REF] Casini | Contention Resolution Diversity Slotted ALOHA (CRDSA): An Enhanced Random Access Schemefor Satellite Access Packet Networks[END_REF][START_REF] Liva | Graph-Based Analysis and Optimization of Contention Resolution Diversity Slotted ALOHA[END_REF][START_REF] Paolini | High Throughput Random Access via Codes on Graphs: Coded Slotted ALOHA[END_REF]).

Based on the same principles, high-throughput RA schemes of the asynchronous type have also been proposed recently.

One of the first contributions in this area appeared with the introduction of Contention Resolution ALOHA (CRA) [START_REF] Kissling | Performance enhancements for asynchronous random access protocols over satellite[END_REF]. Based on the Contention Resolution Diversity Slotted ALOHA (CRDSA) [START_REF] Casini | Contention Resolution Diversity Slotted ALOHA (CRDSA): An Enhanced Random Access Schemefor Satellite Access Packet Networks[END_REF] framework, CRA relaxes the synchronization requirements of CRDSA by allowing packet replicas being freely transmitted within the boundaries of a frame. Hence, synchronization is still required but at frame level instead of slot level. By contrast, in [START_REF] Gaudenzi | Asynchronous Contention Resolution Diversity ALOHA: Making CRDSA Truly Asynchronous[END_REF], Asynchronous Contention Resolution Diversity ALOHA (ACRDA) is presented as a fully asynchronous version of CRDSA, yielding even higher performances. Proposed as the access method for a satellitebased M2M network, the Enhanced-Spread Spectrum ALOHA (E-SSA) protocol [START_REF] Del Rio Herrero | High Efficiency Satellite Multiple Access Scheme for Machine-to-Machine Communications[END_REF] probably achieves the highest performance among the asynchronous RA schemes reported in the literature. However, as the name implies, it relies on spread spectrum techniques.

In this paper, we introduce a novel RA protocol that combines Time-and Frequency-Asynchronous ALOHA (TFAA) [START_REF] Almonacid | Throughput Performance of Time-and Frequency-Asynchronous ALOHA[END_REF]-the access method employed in UNB LPWANs-with state-of-the-art signal processing techniques implemented in the modern high-throughput protocols cited above. The proposed protocol, named Contention Resolution Time-and Frequency Asynchronous ALOHA (CR-TFAA), also achieves a remarkable performance and looms as an interesting alternative to SS techniques to provide high-throughput RA in power constrained scenarios such as LPWAN and M2M communications.

II. OVERVIEW OF TFAA

The TFAA access approach appears naturally in UNB LPWANs. Since the bandwidth occupied by a single transmission is comparable to the oscillator frequency uncertainty, it remains difficult to respect tight channel boundaries. Hence, the use of a Frequency Division Multiple Access (FDMA) approach is inefficient, as guard bands become significantly larger with respect to the signal bandwidth. Similarly, the use of a slotted time reference is not practical because of the heterogeneous propagation delays experimented by different terminal nodes, which entail additional synchronization complexity. As a consequence, in UNB TFAA packets are transmitted without coordination in both frequency and time domains.

Although having been only considered within the UNB context, there is in principle no reason why TFAA cannot be extended to other application scenarios. Some of the general advantages of TFAA include:

1) Frequency synchronization requirements are significantly relaxed. Packets can be transmitted over any random frequency within the system bandwidth. Frequency synchronization is handled at the receiver side. Thus, by avoiding the requirement for accurate oscillators, cheaper radio transmitters may be considered. 2) Robustness to Doppler shifts. Since the system is already designed to support a high amount of frequency uncertainty, relatively high Doppler shifts should be managed transparently. However, high Doppler effects may entail additional issues in UNB operation, as we discuss below. 3) Increased FEC collision resolution capabilities. The Multiple Access Interference (MAI) in TFAA can more easily be coped with the help of low-rate FEC. While this aspect was already identified in time-asynchronous schemes [START_REF] Kissling | Performance enhancements for asynchronous random access protocols over satellite[END_REF], it is also apparent when frequency-asynchronism is introduced [START_REF] Almonacid | Throughput Performance of Time-and Frequency-Asynchronous ALOHA[END_REF]. 4) Resilience to power imbalance. Unlike SS systemswhose throughput drops quickly in the presence of power unbalance [START_REF] Del Rio Herrero | High Efficiency Satellite Multiple Access Scheme for Machine-to-Machine Communications[END_REF], the throughput performance of TFAA increases in such conditions. This is an important feature in heterogeneous environments, such as LPWANs, specially in the absence of tight power control mechanisms. In addition, a UNB TFAA radio interface allows to either increase the communication range or to reduce the required transmission power significantly, by reducing the transmission bandwidth below the levels required in conventional FDMA systems. This is one of the main reasons why UNB TFAA is interesting for LPWAN applications. However, TFAA introduces additional issues that must be taken into account. In particular, since there is an extra degree of uncertainty in the demodulation process, the receiver complexity is increased with respect to a typical ALOHA-like system. UNB TFAA has also gained attention within the context of satellite M2M systems. In [START_REF] Anteur | Ultra Narrow Band Technique for Low Power Wide Area Communications[END_REF], its application on low Earth orbit satellite systems is studied considering a collision channel model. In this scenario, it is shown that when the transmission rate is low compared to the Doppler rate, timing issues may also impact the MAC performance.

A. Throughput Performance of TFAA

Under the collision channel definition given in [START_REF] Almonacid | Throughput Performance of Time-and Frequency-Asynchronous ALOHA[END_REF], a TFAA packet is assumed to be successfully transmitted over a timefrequency point (t i ,f i ) if and only if no other packet is transmitted over the region 1), where T p and B are the packet duration and bandwidth, respectively. With this definition, and considering a total available system bandwidth W , W>B , it can be easily shown [START_REF] Almonacid | Throughput Performance of Time-and Frequency-Asynchronous ALOHA[END_REF] that the TFAA throughput T for a given channel load G approaches

[f i -B, f i + B] × [t i -T p ,t i + T p ] (see Figure
T = G • exp [-4G] (1)
as B/W → 0. Equation ( 1) is sketched in Figure 2, where the throughput of ALOHA is also included for comparison. While ALOHA clearly outperforms TFAA under the collision Figure 1. A two-dimensional representation of TFAA. The gray-shaded area corresponds to the set of points (t, f ) over which any transmitted packet will interfere with packet i. For the collision channel model, the overlap of packets i and i -2 results in both packets being lost. channel model, this gap is significantly reduced when the packet error probabilities are computed taking into account the actual signal waveform [START_REF] Almonacid | Throughput Performance of Time-and Frequency-Asynchronous ALOHA[END_REF].

B. Scalability Issues of UNB/TFAA Systems

From the results evoked above it is clear that the use of TFAA in its simplest form does not provide an efficient RA operation. In addition, a major drawback of LPWANs is that frequency reutilization is difficult due to the important area covered by a single access point. Exploiting collision resolution techniques at the receiver side is therefore an interesting alternative to improve the traffic capacity in UNB/TFAA LPWANs.

III. CR-TFAA SYSTEM MODEL

In this section we provide a high-level description of the proposed CR-TFAA protocol. In order to facilitate the comparison with other relevant high-throughput RA schemes, the design approach we present here follows the main guidelines given in [START_REF] Casini | Contention Resolution Diversity Slotted ALOHA (CRDSA): An Enhanced Random Access Schemefor Satellite Access Packet Networks[END_REF], [START_REF] Gaudenzi | Asynchronous Contention Resolution Diversity ALOHA: Making CRDSA Truly Asynchronous[END_REF]. In particular, the underlying PHY layer is based on turbo FEC and M -PSK modulation. Also, a slidingwindow SIC receiver architecture is considered.

We consider an infinite population RA system with one central receiving node. The overall packet arrival process is Poisson with rate λ packets/s. The total available system bandwidth is W . By contrast, a packet transmission is contained within a bandwidth B and has a fixed duration T p ,a s shown in Figure 1 (in general, B should be much smaller than W for a UNB signal). Each packet carries a payload of L b information bits. The aggregate number of packet arrivals during T p , that is, the offered traffic over the full band W , is noted G a = λT p . Note that G a is typically greater than 1 since in TFAA several packets can be transmitted and decoded simultaneously. Therefore, the normalized throughput is defined as

T (G) G × (1 -P e ), (2)
where G = G a × B/W is the normalized average channel load and P e the PER. Thus, G represents the average offered traffic over a band B.

Packet transmissions are organized in virtual frames (VF), following the framework introduced in [START_REF] Gaudenzi | Asynchronous Contention Resolution Diversity ALOHA: Making CRDSA Truly Asynchronous[END_REF] for ACRDA. A VF has a duration T F = N slots × T p , where N slots is the number of time slots per frame. When a new packet is generated at the MAC unit, a new VF is built and N rep replicas of the packet are generated and placed in random locations within the VF, i.e. at random time slots and at random carrier frequencies, but taking care of selecting non-overlapping positions among the packet replicas. Assuming that the replicas' energy is fully contained within a bandwidth B, and that the system spectrum is centered at f =0, the carrier frequencies must be selected within the interval

[f m ,f M ], where f m = -B([W/B] -1)/2 and f M = B([W/B] -1)/2.
In CR-TFAA we define the frame size N t×f as the number of time-frequency points over which replicas can be placed without overlapping. It follows that N t×f = N slots ×⌊W/B⌋. VFs are generated and transmitted asynchronously by each user terminal and thus arrive at the receiver with random time offsets. The main difference between the VF structure in ACRDA and CR-TFAA is that in the latter the VF spans a bandwidth much greater than the packet bandwidth, so that replicas can be freely transmitted within W . Figure 3 shows an example where the VFs from four different users are transmitted using N rep =2 , W/B =1 0and N slots =5 . Along with the L b payload bits, each replica also contains a few extra bits where the relative position of the other N rep -1 replicas is indicated. Note that in the diversity scheme adopted here the VF time axis is divided in a discrete number of slots, while the frequency axis is not slotted. The reason for this is that defining frequency slots demands a certain amount of frequency synchronization and oscillator stability, which cannot be achieved with UNB signals as discussed earlier 1 . The replicas' bits are FEC encoded, modulated using M -PSK and filtered using a square root rise cosine (SRRC) filter g(t) with roll-off factor β. Thus, the signal associated with some replica k is modeled as

r(t)=a k Lp-1 l=0 d k (l)g(t -lT )e j(2πf k t+φ k ) , (3)
where L p is the packet length in symbols, a2 k the channel gain, the sequence {d k (l), 0 ≤ l<L p } represents the replica's symbols, T is the symbol duration, f k ∼U [f m ,f M ] is the carrier frequency and φ k ∼U[0, a random phase offset. It is assumed that the replicas are affected by a log-normal flat fading process of mean μ and standard deviation σ dB, and additive white Gaussian noise (AWGN). Doppler effects are not taken into account (all nodes are assumed to be in fixed positions).

At the receiver side, the incoming signal is sampled using a sliding window approach as in [START_REF] Gaudenzi | Asynchronous Contention Resolution Diversity ALOHA: Making CRDSA Truly Asynchronous[END_REF]. The sliding window spans W VF 2 VFs with a step size ∆W VF , expressed as a fraction of one VF. The SIC process starts by scanning the sliding window samples over the whole system bandwidth in order to detect the presence of replicas. When a replica is correctly located, it is demodulated through a matched filter detector and then turbo decoded. If the replica is successfully decoded, its interference contribution is removed from the sliding window buffer. The interference from other replicas of the same packet present in the sliding window is removed next. If not all of the packet replicas are fully contained in the sliding window, the packet information is stored until the remaining incoming replicas are received and removed. The SIC process is repeated a number of times up to a maximum of N it iterations. Then, the sliding window is shifted in time by ∆W VF T F seconds and the process is repeated. Finally, since our goal in this paper is to study the performances that can be achieved by CR-TFAA, we consider an ideal SIC receiver that is able to locate the replicas and estimate the signal parameters perfectly 3 .

IV. NUMERICAL RESULTS

A. Simulation Approach

A computer simulator closely following the model described in the previous section has been developed in order to test the performance of the CR-TFAA protocol. The packets of fixed length L b = 100 bits are encoded through a turbo encoder of rate ρ ≃ 1/3 and modulated using M -PSK. The turbo encoder architecture follows the 3GPP standard also employed in [START_REF] Gaudenzi | Asynchronous Contention Resolution Diversity ALOHA: Making CRDSA Truly Asynchronous[END_REF]. For the SRCC filter roll-off factor, we have considered β =0 .2. The number of samples per symbol at the output of the SRRC filter is LW/B, where L =8 .W e assume that packet arrivals can occur at any instant within the symbol duration T with a granularity of LW/B samples per symbol. In order to limit the simulation time, we consider relatively small values for the W/B ratio (i.e. W/B =5, 10). It is noteworthy that these values are not representative of practical UNB LPWANs, for which the ratio W/B is in the order of 100 or greater. Thus, the results presented here are somewhat pessimistic since the use of higher values of W/B provides slight performance improvements. For the SIC receiver configuration we considered a sliding window length and step size W VF =3VF and ∆W VF =0.15 VF, respectively, and a maximum number of SIC iterations N it =1 5 .I n the absence of fading effects, the signal-to-noise ratio per symbol is set to E s /N 0 =10dB. For the log-normal process affecting the channel gains a 2 k 's, we consider two general cases: (μ, σ)=( 0 , 0) dB, for perfect power control and (μ, σ)=( 0 , 3) dB for power imbalance conditions. The simulation results are expressed in b/s/Hz taking into account an underlying spectral efficiency given by η = ρ log 2 (M ) 4 .

B. Semi-analytical Approach

It is also possible to approximate the CR-TFAA performance by extending the semi-analytical framework developed for ACRDA in [START_REF] Gaudenzi | Asynchronous Contention Resolution Diversity ALOHA: Making CRDSA Truly Asynchronous[END_REF]. The procedure can be resumed as follows. First, one has to take into account that the intensity of packet arrivals that collide with a given test packet is approximately doubled in CR-TFAA. Also, when computing the loop probabilities, the parameter N slots should be replaced by the CR-TFAA frame size N t×f . Finally, we observe that the method employed in [START_REF] Gaudenzi | Asynchronous Contention Resolution Diversity ALOHA: Making CRDSA Truly Asynchronous[END_REF] to compute the error probabilities for a given number of colliding packets-which assumes a Gaussian distribution of the interference plus noise powerdoes not hold in CR-TFAA, specially when short packets are considered. Hence, the error probabilities for a given modulation and coding schemes have been obtained through computer simulations.

C. CR-TFAA without diversity

When the repetition degree is set to N rep =1 , the VF notion is no longer required (i.e. N slots =1 ) and, from the transmitter point of view, the protocol operates as pure ALOHA. This configuration is interesting because 1) it can be readily implemented in existing UNB systems since most of the additional signal processing is performed a the receiver side and 2) it provides advantages in terms of demodulator complexity as the need for replica channel estimation and interference cancellation is avoided. In addition, since in this case T F = T p , the sliding window only spans W VF times the packet length, which is also beneficial in terms of demodulator complexity. In the simulations we considered BPSK modulation and W/B =10. The rest of the parameters are those detailed in Section IV-A. The performance results obtained under this scenario are shown in Figure 4. We observe that a PER below 10 -2 can be guaranteed for channel loads up to G ≃ 0.8 b/s/Hz under power imbalance conditions and G ≃ 0.6 b/s/Hz for perfect power control. For a maximum PER of 10 -3 , the achievable load is around G ≃ 0.4 b/s/Hz in both cases. This suggests that the performances reported for TFAA in [START_REF] Almonacid | Throughput Performance of Time-and Frequency-Asynchronous ALOHA[END_REF] can be significantly improved by the use of simple SIC techniques and without requiring the transmission of additional packet replicas, which is explained by the fact that frequency randomization provides already a certain amount of diversity.

D. CR-TFAA with time-frequency diversity

Our interest in this section is to evaluate the performance of CR-TFAA exploiting time-frequency diversity and to contrast these results with those obtained with ACRDA. We observe that if the W/B ratio is set to 1, then f m = f M =0 .I n this case, all replicas are transmitted over the same frequency f =0and the protocol operates exactly as ACRDA (thus, CR-TFAA can be considered as a generalization of ACRDA). Simulation results for CR-TFAA were obtained using W/B = 5 and N slots =2 0 , while for ACRDA W/B =1and N slots = 100. In both cases, N rep =2and QPSK modulation is adopted. Note that, in order to provide a fair comparison, the same frame size has been considered for the two schemes (N t×f = N slots × W/B = 100). The results are presented in Figure 5, where it can be observed that both protocols provide very similar performances. In particular, the critical points (i.e. the values of G over which the system performance drops quickly) are very close. In terms of maximum achievable throughput, CR-TFAA is slightly below ACRDA under power imbalance conditions and is practically identical under perfect power control. It is worth noting, however, that CR-TFAA provides a PER performance that is at least about one order of magnitude below that of ACRDA for channel loads below G ≃ 0.8 b/s/Hz and G ≃ 1.4 b/s/Hz for σ =0and σ =3 dB, respectively. In other words, the PER performance of CR-TFAA is superior over practical channel loads (i.e. below the critical points).

To further validate these results, in Figure 6 given by the semi-analytical method for the perfect power control regime. As for ACRDA, we observe that the semianalytical approach provides a lower bound for the PERwhich is probably due to the simplifications in the loop probability analysis-but provides a good description of the protocol behavior. Also, it confirms that the CR-TFAA PER is improved with respect to ACRDA.

V. C ONCLUSION

In this paper, we have proposed and evaluated the use of SIC techniques in combination with TFAA, a pure ALOHA access approach where the packet transmissions are random in both frequency and time domains. The novel protocol, named CR-TFAA, can be regarded as a generalization of ACRDA and aims to improve the performance of LPWANs based on UNB. Numerical results for two main scenarios have been presented, namely with and without time-frequency diversity. In both cases, it is shown that CR-TFAA significantly improves the performance of TFAA. For the scenario including timefrequency diversity, the CR-TFAA performances were also compared with those of ACRDA.

  Time Asynchronous (pure) ALOHA Time and Frequency Asynchronous ALOHA

Figure 2 .

 2 Figure 2. Normalized throughput versus MAC load for TFAA and pure ALOHA under the collision channel model.

Figure 3 .

 3 Figure 3. Frame structure in CR-TFAA. Virtual frames from four different users are represented with different colors.

Figure 4 .

 4 Figure 4. Throughput and PER performance of CR-TFAA without timefrequency diversity (W/B =1 0 , Nrep =1 , N slots =1 , BPSK modulation, Es/N 0 =10dB and turbo FEC ρ =1/3).

  σ=0 [dB] CR-TFAA σ=3 [dB] ACRDA σ=0 [dB] ACRDA σ=3 [dB]

Figure 5 .

 5 Figure 5. Throughput and PER performance of CR-TFAA with timefrequency diversity (W/B =5 , Nrep =2 , N slots =2 0 , QPSK modulation, Es/N 0 =10dB and turbo FEC ρ =1/3) and ACRDA (only two parameters are changed in this case, namely W/B =1and N slots = 100).

Figure 6 .

 6 Figure 6. Simulation vs semi-analytical performance of CR-TFAA with timefrequency diversity (W/B =5 , Nrep =2 , N slots =2 0 , QPSK modulation, Es/N 0 =10dB and turbo FEC ρ =1/3).

In practice, the use of frequency slots-even if oversized-is convenient as it allows to minimize the signaling overhead. In either case, the relative frequency position of a replica can only be given approximately in UNB.

In[START_REF] Gaudenzi | Asynchronous Contention Resolution Diversity ALOHA: Making CRDSA Truly Asynchronous[END_REF] the sliding window length is denoted W . Here we add the subindex VF to avoid ambiguity with the system bandwidth W

Note that the ideal channel estimation hypothesis is commonly adopted in the related literature (see for instance[START_REF] Casini | Contention Resolution Diversity Slotted ALOHA (CRDSA): An Enhanced Random Access Schemefor Satellite Access Packet Networks[END_REF],[START_REF] Kissling | Performance enhancements for asynchronous random access protocols over satellite[END_REF],[START_REF] Gaudenzi | Asynchronous Contention Resolution Diversity ALOHA: Making CRDSA Truly Asynchronous[END_REF]).

The pulse shaping filter roll-off factor is not included for fair comparison with related works.

ACKNOWLEDGMENT

This study has been achieved thanks to the financial support of the VAN ALLEN foundation.


Emmanuel Menier

Michele Alessandro Bucci

Mouadh Yagoubi

Lionel Mathelin

Marc Schoenauer

Michele Alessandro

Continuous Methods : Hamiltonian Domain Translation

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Domain translation is the process of transforming elements from one domain to another. One can think of applications such as neural style transfer [START_REF] Gatys | Image style transfer using convolutional neural networks[END_REF] which is for example used to apply a certain painter's style to photo-realistic images. A common problem encountered in domain translation applications is that, in many cases, paired data is not available during training, which means that the problem has to be formulated in an unsupervised setting. Unsupervised learning is very common in the field of generative modeling, and several architectures have been proposed to deal with the problem of Unsupervised Domain Translation. In this work, we focus on the Cycle-GAN [START_REF] Zhu | Unpaired image-to-image translation using cycle-consistent adversarial networks[END_REF] architecture, which has proved successful in various applications of Unsupervised Domain Translation * . Despite its success, the formulation of the Cycle-GAN method has been questioned and shown to be ill-posed. Using results from [START_REF] Chen | Advances in Neural Information Hamiltonian Domain Translation Processing Systems[END_REF], it can be shown that when considering two distinct domains, there exist an infinity of pairings between the two domains which satisfy the Cycle-GAN objective. This is an issue as the model could get stuck trying to learn wildly inefficient mappings, leading to unsatisfactory optima. This conditioning problem has been explored in depth by [START_REF] De Bézenac | Cyclegan through the lens of (dynamical) optimal transport[END_REF], as they proposed to use a regularized residual network to learn the mapping between two given domains. Borrowing ideas from optimal transport and dynamical systems, they showed that pushing the training towards simple, low-energy, transformations in latent space leads to learning a sensible and trivially invertible mapping between the two domains of interest.

The study of the links between dynamical systems theory and deep learning is still to this day a major topic of interest. One can for example cite the identification of residual networks as first order approximations of a time-continuous process which has led to the development of ground-breaking approaches such as neural ordinary differential equations (Neural ODE (Chen et al., 2018)) or invertible neural networks [START_REF] Behrmann | Invertible residual networks[END_REF].

Building on this existing connection, as well as the work of de Bezenac et al., we propose a formulation of unsupervised domain translation as a continuous time process with conservation guarantees which ensure invertibility by construction. The proposed architecture learns the dynamics of the transformation as a Hamiltonian dynamical system. Hamiltonian systems are typically used in General Mechanics to describe the evolution of conservative systems. They preserve a quantity, called the Hamiltonian, along their trajectory. Using neural networks to learn Hamiltonian dynamics is an earlier idea that was proposed in Greydanus et al. (2019). However this work proposes to use them to ensure invertibility of the generative process which is a desirable property to ensure the domain translation problem is well-posed. Learning conservative transformations is in fact critical to other generative modeling approaches, such as normalizing flows [START_REF] Rezende | Variational inference with normalizing flows[END_REF].

Method

Invertibility and CycleGAN

Formally, we can look at the two domains as two separate sets A, B ⊂ R d , where d is the dimension of the space, i.e. the pixel space for images, or any latent representation space. The goal of unsupervised domain translation is to learn the forward mapping F : A → B as well as the reverse map R : B → A so that the pair (F, R) generates semantically meaningful samples of each domain. That is to say, the generated samples should be indistinguishable from samples in the target domain, while remaining coherent with their corresponding sample in the original domain.

CycleGan proposes to enforce these constraints by using a combined loss: L = L adv + L cyc . The first term L adv = D(F (A), B) corresponds to an adversarial loss which measures the distance between the generated samples and the target domain. This term ensures that generated samples are indistinguishable from the target domain. In CycleGAN, D is implemented using Generative Adversarial Networks (Goodfellow et al., 2014).

The second term in the loss is called the cyclic loss,

L cyc = F • R(x A ) -x A + R • F (x B ) -x B .
This term promotes transformations F that are invertible and such that R = F -1 . Intuitively, this pushes the CycleGAN architecture towards learning minimal transformations of the samples, so as to retain a maximum of information from the initial sample and simplify the reconstruction R • F . This second term is used to ensure coherence between the translated and initial samples. In addition, learning an invertible (thus bijective) map between the two domains is critical at the conceptual level. Indeed, one sample from a given domain should not map to multiple samples in the target domain as only one sample in the target domain should optimally satisfy the trade-off between coherence with the original sample and similarity with the target domain.

Continuous models and Hamiltonian Neural Networks

The previous paragraph outlined the importance of ensuring the translation map is invertible to relax the learning problem. In fact, this is not specific to the domain translation problem, as invertibility of learned maps has been linked to classical deep learning problems such as vanishing/exploding gradients in recurrent neural networks [START_REF] Pascanu | On the difficulty of training recurrent neural networks[END_REF], or the training of other generative models like normalizing flows [START_REF] Rezende | Variational inference with normalizing flows[END_REF]. Several approaches have been proposed to push learned models towards invertibility [START_REF] Miyato | Spectral normalization for generative adversarial networks[END_REF][START_REF] Rosenblatt | Remarks on a Multivariate Transformation[END_REF], however, they often impose significant constraints on the structure and expressivity of the models, leading to important training costs.

In this work, we propose to use a natural formulation for invertible transformations. Exploiting the parallel between the residual networks used in numerous image processing approaches, and ordinary differential equations, we propose to define domain translation as a continuous system. Starting at t = 0 with samples from one domain x t=0 ∈ A, we learn a transport flow f θ so that, at t = T , x t=T ∈ B:

dx dt = f θ (x), s.t. x 0 ∈ A, x T ∈ B (1)
This formulation is not enough to ensure invertibility of the transformation, as the flow f θ could be dissipative, or even unstable. To enforce invertibility, we express the flow f θ as a conservative operator using Hamiltonian neural networks inspired from Greydanus et al. (2019). To do so, the samples are divided into two vectors of equal length x = [p, q], (we assume d to be even as a modeling choice). In general mechanics, p and q would respectively describe the position and momentum of the studied entities. In our setting, their significance is more abstract and is defined by another function, called the Hamiltonian H θ (p, q) : R d/2 × R d/2 → R, which we parameterize using a neural network, hence:

f θ (x) = dp dt = -∂H θ ∂q dq dt = ∂H θ ∂p (2)
Using Neural ODEs and automatic differentiation, the function H θ can be trained to satisfy the transport objective, i.e.

x T ∈ B given x 0 ∈ A. Moreover, this formulation is invertible by design as it preserves the quantity H θ (x) along its trajectory. We show below that learning the transformation f θ with this formulation allows for the generation of semantically correct samples, without using the cyclic loss required in CycleGAN. Thanks to the conservation properties of the flow f θ , the inverse map is trivially obtained by integrating the flow backward in time:

x B = x A + T 0 f θ (x)dt ⇐⇒ x A = x B + 0 T f θ (x)dt
(3)

Results

Generative results

We apply our Hamiltonian domain translation approach to image generation tasks. As proposed in de Bézenac et al. ( 2021), we train an encoder E and a decoder G to map images from both domains to a latent space of size d = 128. This is a common approach in many image processing approaches, as the intrinsic dimension of a given image processing problem is often much lower than the dimension of the pixel space. Thus, encoding images to a low-dimensional latent space reduces the domain translation problem complexity, as well as training costs.

Once the pair (E, G) is trained, it can be used to generate low-dimensional encoded vectors of images of the dataset at hand. We then use our approach to learn the transport flow f θ . The Hamiltonian H and discriminator D are implemented as multi layer perceptron with 3 hidden layers. The continuous flow is learned using the optimise-then-discretise version of NeuralODEs. We apply the architecture to the task of translating male samples of the celebA [START_REF] Liu | Deep learning face attributes in the wild[END_REF] dataset to females. Figure 1 presents samples generated with this approach. As shown on Figure 1, decoding the transported samples along the transformation trajectory shows that the flow f θ progressively transforms the male samples to females. As expected, the conservative nature of the model promotes transformations that retain non gender-specific features, as we observe that attributes such as pose, skin tone, face shape and background are preserved during the transformation. Figure 2 demonstrates an additional interest of the Hamiltonian architecture as we are able to generate males from female samples by simply integrating the flow backward (see Eq. 3). One should note that these results were obtained without ever training the model to map females to males as we do not compute the cyclic loss used in CycleGAN. These results are similar to the results of de Bézenac et al. ( 2021) while no penalization of the magnitude of the flow applied by the model is used but invertibility is enforced instead.

Excessive Integration

An interesting feature of using a continuous flow to carry out domain translation is that one can gain some insight in the way the model transforms samples. If a flow f θ has been trained to map two domains in one time unit (t.u.), T = 1, it can be integrated for a longer period, pushing the transformation further. This is one of the major differences between learning continuous transformations and discrete residual blocks. While residual blocks approximate the flow in specific regions of the latent space, the continuous flow is defined over the whole space. Any trained model starts losing performance once it drifts too far from its training conditions but we observed interesting results when integrating our model for several t.u.. Figure 3 shows that transported samples retain semantic meaning for up to about one and a half t.u., as the model progressively adds more and more gender-related features such as beards, wider jaws, shorter hair, etc. This generalisation performance can be linked to the conservative architecture of the model which prevents it from diverging to unknown conditions. It also adds to the interest of the approach as it supports the idea that the model is consistent with the structure of the latent space.

Training

It should be noted that, once the autoencoder is trained, learning the flow f θ is very inexpensive. The model starts generating semantically coherent samples after a single epoch, and does not require fine tuning between the training of the discriminator D and the flow f θ . More formal benchmarking against comparable domain translation methods are planned for the future.

Conclusion

This work proposes a novel and improved formulation for domain translation. By using a time-continuous approach, we are able to leverage results from general mechanics to obtain a model that is invertible by construction. We show that this model can quickly learn to map two domains of interest, even in a latent space learned prior to training the domain translation architecture.

With the recent success of diffusion models [START_REF] Nichol | Glide: Towards photorealistic image generation and editing with text-guided diffusion models[END_REF][START_REF] Rombach | High-resolution image synthesis with latent diffusion models[END_REF], which are based on successive transformations in a pre-defined space, the analogy between generative models and dynamical systems becomes more and more relevant. In this context, the comparison of our proposed method with existing approaches such as normalizing flows and latent diffusion models constitutes the next step to this work, for instance exploring the potential extension of our continuous generative approach to stochastic differential equations [START_REF] Li | Scalable gradients for stochastic differential equations[END_REF].

Figure 1 .

 1 Figure1. Selected samples of the male to female transport process using the proposed continuous domain translation approach. The transported encodings are decoded at regular time intervals, to illustrate the transformation applied by the model.

Figure 2 .

 2 Figure2. Selected samples of the reverse male to female generation process. NB : These samples are generated using equation (3) as transport flow was solely trained to map male to females.

Figure 3 .

 3 Figure3. Results of excessive integration of the transport flow. A model trained to map males to females in 1 t.u. is integrated backward for more than twice the map horizon. We observe that the generated samples retain semantic sense for up to about 1.5 times the training horizon.

TAU, Inria / LISN, Université Paris-Saclay / CNRS, Orsay, France

IRT -SystemX, Palaiseau, France

LISN, Université Paris-Saclay & CNRS, Orsay, France. Correspondence to: Emmanuel Menier <emmanuel.menier@inria.fr>.

://junyanz.github.io/CycleGAN/


Agnès-Elisabeth Petit

Jean-Stéphane Venisse

Philippe Label

Nadia Goué
email: nadia.goue@uca.fr

Creation of an integrated molecular dynamics workflow on the Galaxy platform : measure of aquaporin pores

gm x check estim ate sub-trajectories cut trajectory calculate pore diam eter concatenate results graph results Use of HPC cluster of the Clerm ont Auvergne M esocenter.

1,28

ArR-ArR distance

  rotom er 2 P rotom er 3 P rotomer 4The envelope represents the standard deviation.Average distance ArR-ArR by protom er (2 aquaporins) tim e depends on the saturation of the com puting structure.Workflow duration as a function of the CPUs number for cut tim e depends on the saturation of the com puting structure.Workflow duration as a function of the CPUs number for cut trajectoryBenchmark.xtc : trajectory from GROMACS ; .gro : structure from GROMACS(Abraham et al. 2015(Abraham et al. , 10.1016(Abraham et al. /j.softx.2015.06.001) .06.001)

Acknowledgements

This work was supported by a travel grant from the Société Française de Bioinformatique. This internship was supported by a grant from DOSI, Clermont Auvergne University. Trajectory calculations were performed on IDRIS HPC cluster under the GENCI allocation 2019-A0060710751. I-SITE CAP 20-25 (ANR grant 16-IDEX-0001) Emergence 2017 from the Clermont Auvergne University. SCUSI 2019 (grant P010O003) from the Clermont Auvergne University and the AURA Region.