Giulia De Santis
email: giulia.de-santis@inria.fr

Abdelkader Lahmadi
email: abdelkader.lahmadi@inria.fr

Jérôme Franc
email: jerome.francois@inria.fr

Olivier Festor
email: olivier.festor@inria.fr

Internet-Wide Scanners Classification using Gaussian Mixture and Hidden Markov Models

Keywords: Network scanning, ZMap, Shodan, Darknet, Gaussian distribution models, Hidden Markov Models

Internet-wide scanners are heavily used for malicious activities. This work models, from the scanned system point of view, spatial and temporal movements of network scanning activities, related to the difference of successive scanned IP addresses and timestamps, respectively. Based on real logs of incoming IP packets collected from a darknet, Hidden Markov Models (HMMs) are used to assess what scanning technique is operating. The proposed methodology, using only one of the aforementioned features of the scanning technique, is able to fingerprint what network scanner originated the perceived darknet traffic.

I. INTRODUCTION

Network Scanning Activities (NSAs) are "reconnaissance techniques able to determine open ports and services" [START_REF] Panjwani | An Experimental Evaluation to Determine if Port Scans are Precursors to an Attack[END_REF]. They are used by attackers as first steps of exploitation attempts, to take control over the host [START_REF] Ghiëtte | Remote Identification of Port Scan Toolchains[END_REF], exploit vulnerabilities [START_REF] Durumeric | An Internet-Wide View of Internet-Wide Scanning[END_REF] and gather information about the system that will be targeted by an Advanced Persistent Threat [START_REF] Chen | A Study on Advanced Persistent Threats[END_REF]. To ensure efficient defense, threats need to be mitigated during the scanning activities [START_REF] Ghiëtte | Remote Identification of Port Scan Toolchains[END_REF]. Models describing scanning techniques can help experts to assess if and what scanning technique is faced by the network.

In [5], authors used Hidden Markov Models (HMMs) to model the scanning intensity of Shodan [START_REF] Bodenheim | Evaluation of the Ability of the Shodan Search Engine to Identify Internet-Facing Industrial Control Devices[END_REF] and ZMap [START_REF] Durumeric | ZMap: Fast Internet-Wide Scanning and its Security Applications[END_REF] using logs collected by a darknet. Their work is here extended, covering spatial and temporal movements of a single execution of the scanner using the same modeling tools. These models are then used to efficiently identify what scanning tool is used by attackers. We use, as in [5], real logs of probing packets of the scanners collected by a darknet. Since it has no active hosts, all incoming traffic is undesired. Collected datasets cover long intervals of time, containing logs of multiple executions of the scanning technique. We split then each dataset into samples containing logs of a single execution by considering time lapses between two consecutive scanned IP addresses: when it is an outlier, an execution ends and the following begins. Once these samples are available, they are used to learn mixture distribution models, and their respective HMMs. Mixture models create clusters of logs contained in each sample and assign to each cluster a Gaussian distribution. HMMs, whose states are the clusters provided by the mixture model, are built and then applied to test samples to assess what scanning technique has been used to generate the collected logs.

To summarize, we firstly build Gaussian mixture models and HMMs of scanning activities by considering differences of destination IP addresses and timestamps of their successive probing packets perceived by a darknet. Secondly, we use the obtained HMMs to classify probing packets according to the network scanner that generated them.

The remainder of the paper is structured as follows. Section II reviews scanning methods, existing work on detection of NSAs and models. Section III details how to build and validate HMMs of the considered scanner. Section IV provides an excursus on the obtained experimental results and section V concludes the work and outputs future work.

II. RELATED WORK

NMap1 , ZMap [START_REF] Durumeric | ZMap: Fast Internet-Wide Scanning and its Security Applications[END_REF], Shodan2 [START_REF] Bodenheim | Evaluation of the Ability of the Shodan Search Engine to Identify Internet-Facing Industrial Control Devices[END_REF] and Masscan [START_REF] Graham | MASSCAN: Mass IP Port Scanner[END_REF] are among the most known and used network scanners. Their usage varies around the world: ZMap is mainly used in western countries whereas Masscan and Unicorn3 are popular in South East Asia [START_REF] Ghiëtte | Remote Identification of Port Scan Toolchains[END_REF]. Also the services they commonly target vary: one third of probes of ZMap are directed to port 22, whereas NMap mostly scans port 23 and Masscan mainly scans uncommon non-privileged ports [START_REF] Ghiëtte | Remote Identification of Port Scan Toolchains[END_REF].

Approaches to detection of NSAs are split into two main categories: single-source and distributed approaches [START_REF] Bhuyan | Surveying Port Scans and their Detection Methodologies[END_REF]. The former relate to single-source NSAs, that consist of a host collecting information about one (one-to-one) or multiple (oneto-many) hosts. The latter relates to detection of distributed NSAs, which exploit various hosts to gather information about one (many-to-one) or multiple (many-to-many) hosts. Since in this work we fingerprint both ZMap [START_REF] Durumeric | ZMap: Fast Internet-Wide Scanning and its Security Applications[END_REF] and Shodan [START_REF] Bodenheim | Evaluation of the Ability of the Shodan Search Engine to Identify Internet-Facing Industrial Control Devices[END_REF], which are distributed scanners, we focus on the latter.

Coordinated NSAs, i.e., multiple single source scans such that, all together, cover a large portion of the targeted space and the overlap between portions of the space scanned by each scan is as small as possible, are detected by Gates [START_REF] Gates | Coordinated Scan Detection[END_REF]. This approach firstly detects single-source scans, and then merge them into coordinated ones if they act in an orchestrated manner. The tool used during a scanning campaign is identified by Ghiëtte et al. [START_REF] Ghiëtte | Remote Identification of Port Scan Toolchains[END_REF], who focus on analyzing scanned ports and use inspections of source code of scanners to find characteristic patterns in scan traffic, applied then to identify the used scanning tool. This approach works then only when the source code of the scanner is available, which is not always the case (as for Shodan [START_REF] Bodenheim | Evaluation of the Ability of the Shodan Search Engine to Identify Internet-Facing Industrial Control Devices[END_REF]). We solve this issue, sharing the same goal (i.e., to detect the tool used by coordinated NSAs), by applying machine learning techniques: more in details, it relies on HMMs.

HMMs are a statistical tool [START_REF] Rabiner | An Introduction to Hidden Markov Models[END_REF] initially applied in speech recognition [START_REF] Juang | Hidden Markov Models for Speech Recognition[END_REF]. They have also been used to detect multistage network attacks [START_REF] Ourston | Applications of Hidden Markov Models to Detecting Multi-Stage Network Attacks[END_REF], and compared with neural networks decision tree algorithm. HMMs can be applied to model complex Internet attacks, consisting of several steps that may need an extended period of time to occur, and enhance current intrusion detection methods since the latter can only identify individual stages of complex and elaborated attacks, whereas HMMs can describe correlation and order of steps forming a complex attack, and need fewer training examples to provide good descriptions of the attack, if compared to decision tree algorithms and neural networks. HMMs have been also used to describe malicious traffic and attacks targeting SSH port 22 [START_REF] Sperotto | Hidden Markov Model Modeling of SSH Brute-Force Attacks[END_REF], with the purpose of modeling behaviors of attackers. Our work aims to model first steps of complex attacks. The models we build can then be used by intrusion detection systems and also SIEMs (Security Information and Event Management) to improve their detection capabilities and to prevent complex and targeted attacks before they succeed.

III. CLASSIFICATION METHODOLOGY

Our goal is to assess what scanner originated logs gathered by a scanned network. Figure 1 provides an overview of the processing steps of the methodology to achieve this goal. Our approach consists in learning models of logs generated by each scanning tool, and applying these models to identify those tools in real traces. We leverage HMMs because they are able to easily handle observations from various unknown groups. We also aimed to answer the question "Is the scanning technique behaving differently according to the scanned port?".

A. From logs to samples

To accomplish these aforementioned tasks, we used real network logs of ZMap and Shodan, respectively. After ordering them in an increasing chronological order, we computed differences of 2 consecutive destination IP addresses and differences of timestamps. Then, common ports below 1024 between the two datasets are identified, and datasets split into (sub-)datasets, one for each considered common port and scanner. Finally, for each (sub-)dataset, we extracted a "learning" dataset and analyzed its time gaps: when an outlier appears, an execution of the considered scanning technique has terminated and a new one starts. This leads to split the (sub-)dataset into sub-sets. Consecutive sub-sets are then merged into samples S i when their mutual Jaccard index is ≤ 0.1 (i.e., the overlapping between the two is small). This merging makes us sure that each sample S i contains logs of a single execution of the scanning technique. Data corresponding to time difference outliers in each sample are removed. Each sample is then labeled by its scanner type and targeted port, "scanner-port". The result is a set of labeled samples scanner-port-S i (i.e., zmap-22-S i ).

Figure 2 shows the number of packets (black) and of unique scanned IP addresses (red) contained in each sample generated by ZMap scanning port 80. Small size samples are discarded by considering only the ones whose length is greater than the average length of the obtained samples.

B. Learning models of scanning techniques

This work models spatial and temporal movements of scanners, i.e., differences of destination IP addresses and of timestamps, with mixtures of Gaussian distributions and HMMs. We used Gaussian distributions for both observations because time-gaps are continuous and discrete distributions based on large samples can be easily approximated by the Gaussian distribution thanks to the Central Limit Theorem [START_REF] Berry | The Accuracy of the Gaussian Approximation to the Sum of Independent Variates[END_REF].

Since one single Gaussian distribution is not sufficient to model logs in samples (see Figure 3), mixture distribution models are required, which cluster logs and provide a probability to each cluster. Transition probabilities between clusters are 1) Mixture distribution models: Samples contain logs from the scanned network. Since logs are in unobserved groups, each with its own Gaussian distribution, and the selection of one group is independent from the previous choice, independent Gaussian mixtures distribution models are needed. They consist of m groups or clusters, each with its own Gaussian distribution p 1 , p 2 , . . . , p m , and a mixing distribution δ = (δ 1 , δ 2 , . . . , δ m ) which selects one of the clusters. The selection of the group is established by a random variable performing the mixing. The distribution p i , i = 1, 2 . . . , m, being active when the observation was done is unknown.

2) Hidden Markov Models (HMMs): Probabilities to move between clusters are provided by HMMs, that consist of an unobserved parameter process {C t : t = 1, 2, . . . , m} satisfying the Markov Property: Pr(C t |C t-1 , . . . , C 1 ) = Pr(C t |C t-1 ), and a state-dependent process {X t : t = 1, 2, . . . } such that its distribution depends only on the current state of C t : Pr(X t |X (t-1) , C (t) ) = Pr(X t |C t ) [5]. C t establishes the cluster of the observation. It is possible to go from a state to another with transition probabilities, associated with each pair of states [START_REF] Ourston | Applications of Hidden Markov Models to Detecting Multi-Stage Network Attacks[END_REF]. The state remains unknown: only the observation is visible.

An HMM is generated from logs of each learning sample. Once all the HMMs are available, the question "What is the set of good candidate models for the considered observation?" needs to be answered. For this, each sample S i was fitted to the HMM built on sample S j , HMM j and its log-likelihood computed. Figure 4 shows the normalized matrix of all the obtained log-likelihoods where rows represent samples and columns their associated HMMs. A normalized log-likelihood value close to 1 (i.e., color close to blue in Fig. 4) states for a good model for the considered sample. The obtained HMMs are then grouped using DBSCAN [START_REF] Ester | A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise[END_REF] cluster, gathers pairs of points whose distance is less or equal to the chosen and if one of them is surrounded by a sufficient number of other points. Then, once groups are formed, a model is selected from each one to be the searched candidate model for the considered cluster. Indeed, all models within a single group can be considered as equivalent to describe the underlying samples, but only a single one is required.

The result is a list of candidate models M i for each combination "scanner-port" (i.e., zmap-23-M i ).

C. Fingerprinting of scanning techniques

All the candidate models are validated on test samples. For each of them, it is known the originating scanner and the targeted port: the corresponding couple "scanner-port" is the true label of the considered test sample. Each of them is fitted to each candidate model, and the log-likelihood computed: the model with the highest one best describes logs of the test sample, and its label "scanner-port" is stored as the predicted label of the test sample. Finally, we investigated if the proposed method is able to identify the scanner that originated the test sample, and eventually the scanned port, i.e., if true label and predicted label are equal.

IV. EXPERIMENTAL RESULTS

In our experiments, we used one dataset for ZMap and one Shodan, both containing logs of real IP traffic perceived by a darknet. Table I shows inner characteristics of the two scanners: ZMap being horizontal and fast when scanning one single port [START_REF] Durumeric | ZMap: Fast Internet-Wide Scanning and its Security Applications[END_REF], and Shodan being more massive and targeting various ports [START_REF] Bodenheim | Evaluation of the Ability of the Shodan Search Engine to Identify Internet-Facing Industrial Control Devices[END_REF].

Each dataset is split according to destination ports. Only (sub-)datasets related to the 17 ports in common between the two scanners and lower than 1024 are taken into account. So, in total, 34 (sub-)datasets have been analyzed. For each of them, disjoint learning and test datasets are selected, each with a randomly selected initial log and a number of temporally consecutive logs equal to 10% and 5%, respectively, of the A). Then, differences of destination IP addresses and of timestamps are modeled with mixtures of Gaussian distributions and HMMs. The latter are then clustered using the DBSCAN [START_REF] Ester | A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise[END_REF] method, and a model of each cluster is selected randomly to be the candidate model for the group. The result is a list of candidate models for each pair "scannerport", that are then validated. Accuracy of the classification is computed by counting how many times predicted labels are equal to true labels. In other words, when looking at Figures 5, 6, 7 and 8, rows of the matrices are reserved for true labels and columns for predicted labels. Elements of the each row count how many times a sample, whose true label is the one of the corresponding row summed, has been labeled with each predicted label (one for each column). Let us look at Fig. 5, and more in detail at the row labeled "zmap-443": 1 test sample generated by ZMap scanning port 443 has been labeled with the predicted label "zmap-995", 9 with label "zmap-22", 3 with "zmap-21", etc. Only 8 have been correctly labeled with the predicted label "zmap-443". Row "zmap-443" of Figures 5 and7, respectively, also shows that the number of test samples generated by ZMap targeting port 443 are more than the others. Accuracy is then computed by summing elements of the diagonals and by dividing the result by the number of all samples (i.e, the sum of all elements of the matrices).

A. Differences of scanned IP addresses

This section shows results obtained applying the aforementioned methodology to model spatial movements of scanners, i.e., differences of consecutive targeted IP addresses. 91,3% of the candidate HMMs have 2 different states: logs are clustered into 2 groups, corresponding to backward or forward spatial movements over destination IP addresses, respectively.

Figures 5 and6 show how many test samples have been correctly and wrongly labeled when fingerprinting scanning activities. The presented method correctly detects what scanning technique generated the test samples (see Fig. 6), but is not able to detect what port is targeted (see Fig. 5).

Accuracy of the selected candidate models is tested as detailed in Section III-C. When assessing both the scanning technique generating the sample and the targeted port, accuracy is really low (0.06). But, when focusing only on the detection of the scanning technique, it reaches 0.952. More in

B. Time gaps

Differences of timestamps of logs (i.e., temporal movements) have been modeled following the methodology detailed in Section III. Selected candidate HMMs for differences of timestamps have between 1 and 7 states, with 92.2% having up to 4 states, and have been learned from the same learning samples used to learn HMMs for differences of IP addresses. A selection of candidate models for each combination "scannerport", that are then tested on test samples, is then obtained.

Accuracy of models has been computed, both to detect only the scanning technique generating logs of test samples, and the scanned port together. In the first case, accuracy is 98%. We are thus able to model and fingerprint ZMap and Shodan. But, accuracy for the pair "scanner-port" is low (16%). ZMap and Shodan thus don't change their behavior when targeting a particular port. Figures 7 and8 show how many samples have been correctly/wrongly labeled. Only 10 test samples have been wrongly assigned to the scanner Shodan while they are truly generated by ZMap (see Fig. 8), and all the samples generated by Shodan have been correctly classified.

Fig. 1 .

 1 Fig. 1. Processing steps of the proposed methodology

Fig. 2 .

 2 Fig. 2. Number of unique IP addresses over number of packets of a ZMap execution targeting port 80

Fig. 3 .

 3 Fig. 3. Mixture of Gaussian distribution of differences of IP addresses for a ZMap execution targeting the port 80

Fig. 4 .

 4 Fig. 4. Normalized log-likelihood matrix of learned HMMs models and 73 samples for a ZMap scanning activity over port 80

  which, requiring only two parameters, and the minimum number of points in each

	1	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31	32	33	34	35	36	37 zmap-80 38 39 40 41 42 43 44 45 46	47	48	49	50	51	52	53	54	55	56	57	58	59	60	61	62	63	64	65	66	67	68	69	70	71	72	73	1
	2
	3
	4
	5
	6
	7 8																																																																	0.9
	9
	10
	11
	12
	13
	14
	15 16																																																																	0.8
	17
	18
	19
	20
	21
	22 23																																																																	0.7
	24
	25
	26
	27
	28
	29 30																																																																	0.6
	31
	32
	33
	34
	35
	36
	37 38																																																																	0.5
	39
	40
	41
	42
	43
	44 45																																																																	0.4
	46
	47
	48
	49
	50
	51 52																																																																	0.3
	53
	54
	55
	56
	57
	58 59 60																																																																	0.2
	61
	62
	63
	64
	65
	66 67																																																																	0.1
	68
	69
	70
	71
	72
	73																																																																	0

TABLE I DETAILS

 I OF SCANNING DATASETS FOR ZMAP AND SHODAN

	Dataset	ZMap	Shodan
	# Sources	253	13
	# Destinations	4096	4096
	# Ports	28	244
	Duration (days)	533.69	12
	# packets	7992496	708160
	length of the dataset. Learning datasets are used to learn
	HMMs, whereas test ones to validate them. Each learning or
	test dataset is split into samples, each corresponding to one sin-
	gle execution of the considered scanning technique, according
	to outliers of time gaps between consecutive received packets
	(see Sec. III-

https://nmap.org/

https://www.shodan.io/

http://sectools.org/tool/unicornscan/

ACKNOWLEDGEMENT

This work was partially funded by HuMa, a project funded by Bpifrance and Region Lorraine under the FUI 19 framework. It is also supported by the High Security Lab hosted at Inria Nancy Grand Est (http://lhs.inria.fr).

zmap-443 zmap-995 zmap-21 zmap-502 zmap-993 zmap-80 shodan-80 shodan-110 zmap-25 zmap-22 zmap-110 shodan-21 shodan-443 shodan-102 shodan-25 shodan-587 shodan-53 shodan-995 shodan-123 shodan-993 shodan-143 shodan-500 zmap-102 zmap-465 zmap-500 zmap-53 zmap-587 shodan-22 shodan-23 shodan-465 shodan-502 zmap-123 zmap-143 zmap-23 zmap-443 zmap-995 zmap-21 zmap-502 zmap-993 zmap-80 shodan-80 shodan-110 zmap-25 zmap-22 zmap-110 shodan-21 shodan-443 shodan-102 shodan-25 shodan-587 shodan-53 shodan-995 shodan-123 shodan-993 shodan-143 shodan-500 zmap-102 zmap-465 zmap-500 zmap-53 zmap-587 shodan-22 shodan-23 shodan-465 shodan-502 zmap-123 zmap-143 zmap-23

Confusion Matrix

V. CONCLUSIONS AND FUTURE WORK

Having accurate models of scanning tools is essential for early detection of larger and more impacting attacks. To build such models, we investigated spatial (differences of consecutive destination IP addresses) and temporal (differences of consecutive timestamps between two consecutive received packets) movements of scanners. To build log clusters we used mixtures of Gaussian distributions, and to establish transition probabilities between clusters HMMs.

We considered two predominant Internet-wide scanners, ZMap and Shodan, and 17 ports. For each pair "scanner-port", we extracted a bunch of learning samples, each modeled with an HMM. Resulting models are then clustered and a selection of candidate models outputted. All the selected models for all pairs "scanner-port" have been validated on test samples. Both for spatial and temporal movements, selected HMMs can be well used to identify what scanning technique originated logs in samples with an accuracy greater than 95%, but aren't able to detect the scanned port. We conclude that the behavior of scanners is not related to the scanned port and that attackers use the same configurations when scanning various ports.

This work can be enhanced by building HMMs able to model both kinds of movements, and can be used to assess if and what scanning technique is currently faced by the system. More future work will consist also in testing various NSAs detection methods on the same dataset, and in including the models produced here for early warning of cyber attacks and advanced persistent threats, since scanning activities are often used in their reconnaissance phase [START_REF] Chen | A Study on Advanced Persistent Threats[END_REF].


Dan Xu

Shaoqing Wen

Formation of a "Mixed Language" in Northwest China -The Case of Tangwang

Introduction

Gansu Province borders Qinghai to the southwest and Xinjiang to the west; it is crossed by an anthropological and linguistic corridor where several ethnicities and languages are found. Known as the Hexi [west of the Yellow River] Corridor, it partially coincides with the famous Silk Road. At least nine ethnic groups are found in this corridor: Han (Chinese), Hui (Muslim), Dongxiang (Santa), Bao'an, Monguor (Tu), Eastern Yugur, Western Yugur, Salar, and Amdo Tibetan. These peoples speak languages belonging to two large language families: Chinese and Amdo Tibetan belong to the Sino-Tibetan family, and the Mongolic and Turkic languages belong to the Altaic family (the term "Altaic family" is taken in its traditional reading even though the debate on it continues).

Tangwang is located inside the autonomous district of Dongxiang (Santa) which belongs to Linxia Hui Autonomous Prefecture in the province of Gansu, China. Its longitude is 103º32', and its latitude is 35º47'. Its geographic conditions are suitable for human habitation: it is a relatively flat region along the downstream section of the Tao River, situated between mountains. The altitude is high, ranging from more than 1,000 meters to 1,700 meters. Tangwang has a total area of 46 square kilometers, and is 8 kilometers from east to west and 10 kilometers from north to south. The Tangwang language was first described in an article by Chen Yuanlong (1985, Ibramhim) in the journal Minzu Yuwen [Non-Han languages]. Why has this language generated great interest in the linguistic community? In China, it has been described as a "mixed language" (Sun et al. [eds.] 2007) based on the Minzu Yuwen article. In the West, this language was almost unknown because not all linguists read articles in Chinese. The Tangwang language should actually be divided into two varieties, one spoken by converts to Islam (called Hui in Tangwang), and the other by non-Muslims, the remaining Han people. Actually, the Tangwang language often refers to that spoken by Hui people 2 . It shares the characteristics of other languages in this region, having predominantly Chinese vocabulary with some words borrowed from Arabic and Mongolian. The word order is predominantly SOV (subject-objectverb), an order which is common to all Altaic languages, while SVO is also accepted in some cases (recall that the word order in Chinese is SVO). The languages in this region all borrowed their case system from Mongolic languages (or dialects), while Chinese is a morphologically poor language with no case system. The languages in this region are in the process of losing their tones, and the degree of loss varies from region to region, while Standard Chinese has four tones. The Dongxiang (Santa) language has surrounded the Tangwang people for some hundreds of years, and Dongxiang language influence is inevitable.

Within the historical context of East-West exchanges, present-day populations in this area show a high level of both linguistic and genetic diversity, indicating that their languages and genetic makeup may be associated with complex processes of linguistic contact and population admixture. Our article deals with the Tangwang language and the formation of the Tangwang people. In presenting Xu Dan's field work and research (2014) along with Wen Shaoqing's genetic analysis of the main families in Tangwang, we are reporting on the first results of our studies of this language and people.

According to our preliminary research, a solely linguistic approach is insufficient; an interdisciplinary approach is required. We have attempted to combine a linguistic approach with a biological one, to better understand the coevolution of language and genes. The Tangwang language has been investigated in our previous linguistic studies [START_REF] Xu | Tangwang hua yanjiu [Studies of the Tangwang language[END_REF], and there are relatively clear historical records of the origins of the Tangwang people; thus the Tangwang people and their language are an ideal model for studying language contact and formation of a new population.

In this study, we first collected 151 male samples from 5 family clans (with surnames Tang, Wang, Zhang, Yang and Zhao) in the town of Tangwang in Linxia Hui Autonomous Prefecture, Gansu Province, to trace the origin and demographic history of the Tangwang people, and then investigated 96 linguistic features of the Tangwang language and other reference languages in China.

Our results show that: 1) the Tangwang language is not yet a mixed language, even though its Chinese syntax structure shows some influence from the Dongxiang (Santa) language, 2) Almost all the clans have dominant paternal lineages associated with different origins; the times to most recent common ancestor of the 5 clans coincide with the local records of historical settlement; 3) based on 96 linguistic features, the Tangwang language tends to cluster with Sinitic languages rather than with non-Sinitic languages. Overall, we can employ the principle of coevolution of language, Y chromosome and clan to reconstruct the formation of a mixed population and their languages, and to further study the relationships between language contact and population admixture.

The historical and ethnic context of Tangwang

To better understand the people of Tangwang, it is necessary to briefly present the Dongxiang people, whose language exerts a strong influence on the Tangwang language. In both the linguistic and genetic domain, Dongxiang merits attention. We [START_REF] Xu | The Dongxiang language and people[END_REF] have shown that the Persian, Arabic and Turkic lexical elements in the Dongxiang (Santa) language are not loanwords, but are rather relics from the substratum language spoken by their forefathers, who were related to the people of Central Asia. Historical and cultural evidence also tells us that some of the Dongxiang people's ancestors came from Central Asia, and some from Western Asia; they may have come from different branches and ethnic origins. The Dongxiang language is the result of contact between different languages and cultures. The biological tests and analyses converge with linguistic and historical data.

In Tangwang, the two major families are Tang and Wang. Some minor family names are Zhang, Yang and Zhao. Historical documents such as Tang Hanqing's Memoirs, (manuscript) 1987, and the chronicles of the Zhang Family (2004), indicate that the Yang and Zhao families were earlier inhabitants of Tangwang. The Tang clan settled in this region around late Yuan dynasty (1206-1368) when some members of the Tang family converted to Islam. Today those who have not adopted Islam have stayed in Xiachuan (which is also called Sanhe), while those who did convert have gathered in Shangchuan, which is considered the center of Tangwang (where the township government is located). The Wang clan arrived after the Tang family, no later than in early Ming dynasty . The members of the Wang family helped the Tang during the repression of Muslims by the Qing government in 1781, and since that event, the two families have formed an alliance and have led a friendly coexistence into the present day.

The distribution of Muslim and Han people is important to understanding the mentalities of the Tangwang people. 3 In 2010, the Dongxiang population made up 45.2% of the population, the Hui people (Muslim) 12.8%, Han 41.92%, and some people belonging to peripheral ethnicities 0.046%. The Dongxiang and Hui are both Muslim, and together they account for 58% of the total. Xu's field work (2014) reveals that the proportion of Han (Chinese) to Muslim has undergone some changes over the past three decades. Observe the following charts drawn from Xu ( 2014 The Dongxiang population did not actually increase so quickly. The most reasonable explanation is that a significant number of Hui Muslims declared themselves to be of the Dongxiang nationality. Tang Zhi (a native of Tangwang) reveals (2011:19) that some Hui people change their nationality to Dongxiang in order to get advantages such as the right to have more children and other benefits awarded to minorities by the Chinese government 4 . Still according to him, people declare their nationality as they want; it sometimes happens that brothers or sisters in the same family have different ethnic identities, one Hui and the other Dongxiang. This means that the Dongxiang people of Tangwang did not necessarily originate from Dongxiang people, whose ancestors, as we have mentioned, came from Central and Western Asia. Numerous Dongxiang women have settled in Tangwang through intermarriage. Some Muslim people have changed their nationality to Dongxiang. This situation is so common in Tangwang that we have to use the term Muslim rather than Dongxiang to study populations located in Tangwang. Muslim populations have formed a core group in Tangwang. Han people and Muslims are in harmonious relationships due to their common history. However intermarriages only 3 Tang Zhi' statistics (2011) based on those of the Office of the Tangwang Government in 2011 are slightly different from those collected by Xu Dan in 2010 from the Family Records Department of the Tangwang Public Security Bureau. The proportion is almost the same, but the total number is smaller; for example, the population in Tangwang was 14107 according to the Office of the Tangwang Government, while it was 15093 according to the Family Records Department of the Tangwang Public Security Bureau. Here we take the data provided by Xu in 2010. 4 China's one-child policy began in the 1980's, but it does not apply to minorities. occur between Muslims, never with Han people, for religious reasons. It is easy to imagine that since many Muslim people in Tangwang have changed their nationality to Dongxiang, most Muslim people were non-Muslim in the past. Local elders unanimously recognize that their forefathers were Han but not Muslim. This specific historical factor prevents ethnic or religious conflicts among the people of Tangwang.

There are various legends about the origin of the Tang family. [START_REF] Tang | Huigu tongnian shidai Tangwang chuan[END_REF] Memoirs, the common ancestor of the Tang family was a retired military official of the Mongolian Army who was the first Tang immigrant in this region, where the Yang and Zhao families were older inhabitants. Still according to Tang Hanqing, the Yang, Zhao and Zhang families were Han. Our genetic analysis reveals that their origins are different from what people have believed, but at least the manuscript of Tang Hanqing suggests that these populations were already Sinicized. As for the Mongolian military official, two versions of the story of his marriage circulate among the Tang family: one is that he married a woman named Zhao, and the other is that he took a Mongolian woman as his wife. These two legends do not exclude the possibility that his first wife was named Zhao while his second wife (the order may be different) indeed was a Mongolian woman. The oral legends have to be taken seriously, since they often provide us traces of their ancestors' origins. One thing is particularly amazing: almost all people of the Tang family told us that this Mongolian Army official had a Han origin and came from Sichuan, but no one doubts that his origin is Mongolian. See analysis about their genes in section 4.

Linguistic situation in Tangwang

The Tangwang language, a language island in Dongxiang County, should be classified within Hezhou (or Linxia) dialect. The geographical range of Hezhou dialect includes several districts and cities west of the Taohe River in Gansu: Linxia district and Linxia city, Hezheng, Guanghe, Yongjing, and some locations in Qinghai such as Ledu, Minhe, Xunhua and Tongren. The Tangwang language is isolated from other Chinese dialects (separated from Chinese dialects by the Tao River to the east and surrounded by the Dongxiang (Santa) language. Language contact in Tangwang has been and still is intensive, and the languages in contact belong to two unrelated language families: Chinese, which is in the Sino-Tibetan family, and Dongxiang of the Altaic family. Although the Chinese language is in a dominant position, it has begun to change and to absorb some alien elements. The Tangwang language, which apparently originated from Mandarin, clearly shows parallel and regular evolution in phonology with other Chinese dialects (see Xu Dan 2015a). It is becoming a language with morphological case, while contemporary Chinese languages do not use case at all (though in Old Chinese, traces of case use are attested). What happened in this area is quite remarkable. Some other languages show scenarios similar to Tangwang: borrowing is not limited to words and word orders, but also includes morphology and even parts of the phonological system. At a syntactic level, these languages have changed from SVO word order to SOV order. Morphologically, these languages have begun to develop a case marking system, and mark plurality regardless of a noun's human feature. These new morphological and syntactic means are clearly different from other Sinitic languages. As for the phonological system, which is in general the most resistant to change, some languages in this region have begun the process of simplification of tones, or have even lost the tone system, while tones are phonemic in Chinese. Charles N. [START_REF] Li | Languages in contact in western China[END_REF], Chen Yuanlong 1985[START_REF] Dwyer | Altaic Elements in the Linxia dialect: Contact-Induced Change on the Yellow River Plateau[END_REF][START_REF] Janhunen | On the hierarchy of structural convergence in the Amdo Sprachbund. The Typology of Argument Structure and Grammatical Relations[END_REF][START_REF] Janhunen | Wutun[END_REF], Xu Dan 2011 among others reveal that in Northwest China, the Chinese language has undergone important changes due to language contact. The influence is not a one-way process; both the Chinese language and non-Han languages are undergoing profound changes in this region.

The Tangwang phonological system contains eight basic vowels: i,y,u,e,ə,ɛ,ɔ,a and 23 consonants: p, ph, t, th, k, kh, m, n (ȵ), f, v (ʋ), s, ʂ, ʐ, ɕ, x (χ), ts, tsh, tʂ, tʂh, ʨ, ʨh, l, j (ʑ). The symbols in parentheses are allophones and are not counted as distinct phonemes. More concretely, v and ʋ, n and ȵ, j and ʑ, and x and χ are allophones. In these four pairs, the first symbol is the basic phoneme and the second is its allophone. ʋ and χ are free allophones with v and x, while ȵ and ʑ are phonetically conditioned ones (see details in [START_REF] Xu | Tangwang hua yanjiu [Studies of the Tangwang language[END_REF]. Several phonetic characteristics are salient. (1) The friction is stronger than that in Mandarin. When a bilabial 'p' precedes a close front vowel, 'p' almost becomes 'ps'. The alveolars 't, th' in Standard Mandarin are systematically converted into the affricates 'ʨ, ʨh' when they are followed by close front vowels. This phonetic change is also attested in Linxia (cf the reference on Linxia dialect) and Urumqi dialects (Liu Lili 1989), and in the Donggan language (Lin Tao 2010). When 't' or 'th' precedes other vowels (non-front, non-close vowels), it remains 't' or 'th' in Tangwang. The aspirated plosives 'ph' and 'th' behave differently depending on the following vowel. This is also attested in other dialects in Gansu. (2) The Mandarin diphtongs ai, ao, ei become ɛ, e, ɔ in Tangwang. This phenomenon is widely attested in Chinese dialects in Gansu and Qinghai provinces (see Ma Shujun 1988 for Hezhou dialect, Zhang Chengcai 2006 for Qinghai dialects among others). (3) Nasals do not occur at the end of a word; nasalization takes place in the preceding vowel. (4) Under influence from the Dongxiang language, tone is almost lost in young Muslim speakers when reading single words, while in the Han population the tone system is simplified (see Chen Qiguang 1999, Xu 2014 among others). At the morphological and syntactic levels, the Tangwang language possesses case markers (accusative/dative, ablative, instrumental/ commutative). Some morphological suffixes which typically belong to Mongolic languages are attested in Tangwang among the Muslim population and have not yet been adopted by Han settlers, i.e. people in Tangwang who have not converted to Islam. The syntax is similar to Mongolic languages with OV order and converbs used to link two sentences. The vocabulary is mainly Chinese scattered with a few words from Arabic, Persian and Turkic sources, specially used in Muslim religious contexts. Apparently these words have entered through the Dongxiang language.

Based on our own field research, we believe that the language has not yet completed the mixing process, although some grammatical means such as case markers, and some suffixes which are alien to Chinese languages and dialects, are well-attested in the Tangwang language. The vocabulary remains Chinese with some co-existing syntactic doublets (Chinese and non-Chinese).

Here we present some examples, first illustrating different word orders, then showing case marking. For a full description of the Tangwang language, readers are invited to consult the monograph on the Tangwang language by Xu ( 2014).

-Word order

The most frequent word order is O (object)+V (verb), just as in other Sinitic languages in this region (Linxia, Xining among others). VO order is also attested, but mainly in fixed expressions. Now let us observe some OV sentences:

( in Standard Mandarin, can mark a noun with the inanimate feature. This kind of plural marking is impossible in Mandarin except in fairy tales. In a double object construction such as in (3), both objects can be marked. In the corpus collected by [START_REF] Xu | Tangwang hua yanjiu [Studies of the Tangwang language[END_REF], the indirect object is marked in a double object construction, while the direct object can dispense with the marking. This phenomenon is also found in Qinghai dialect (see [START_REF] Ren | Xining fangyan de qianzhi binyuju [Preverbal object structures in Xining dialect[END_REF]).

-Case marking

Case marking is one of the most striking characteristics of the Tangwang language when compared to Mandarin. The case markers include ones which are attested in almost all Mongolic language groups. In the Tangwang language, the nominative marker takes the null form (just as in other Mongolic languages) while the accusative and dative markers take the same phonetic form [xa] which is also a homophone with an aspectual particle and the topic marker. This is quite different from Mongolic languages in which dative and locative markers share the same morpheme. The Tangwang language also has an ablative marker [ɕiɛ], which is also used in comparative sentences, and [la] which is employed as an instrumental marker after a noun with the [-Animate] feature, or as a comitative marker when used after a noun with the [+A] feature. We continue with some examples:

( According to our research, the Tangwang language developed among Han people and some Sinicized Mongolian people (in the Tang family), but not from Dongxiang (Santa) people, who learn the Chinese language as a target language. Some scholars have confused the Dongxiang population with those in Tangwang who have declared their own identity as Dongxiang. Our studies clearly show that the Tangwang people and the Dongxiang population do not share the same Y-chromosome haplogroups (see next section).

According to our previous studies [START_REF] Xu | The Dongxiang language and people[END_REF], genetic distance calculations show that of 93 populations on the Eurasian continent, the ethnic groups with the closest affinity to the Dongxiang are the Tajik (Khojant), Tajike (Xinjiang), Salar, Ishkashimi, Kirghiz (Xinjiang), and Bartangi. In other words, Dongxiang's ancestors mainly came from Central Asia (some from West Asia) while in Tangwang, neither from the two most important families Tang and Wang, nor from other less significant clans, the Central Asia contribution is substantial (0,6% in the Tang family, 2,6% in the Zhang family). Judging by their Y-chromosomes, some Dongxiang people in Tangwang are among those who have recently declared themselves to be Dongxiang.

Genetic origins of the people of Tangwang -Materials and Methods.

A clan-based genetic investigation had been carried out in the town of Tangwang in Linxia Hui Autonomous Prefecture, Gansu Province. 151 saliva samples of Tangwang residents, including 30 males with the surname Yang, 30 males with the surname Zhao, 31 males with the surname Zhang, 30 males with the surname Tang and 30 males with the surname Wang, were collected and analyzed in this study, with informed consent. Our study was approved by the Ethnic Committee of the School of Life Sciences, Fudan University.

-Y chromosome haplogroup profile.

As shown in figure 3, except for the Zhao clan, each clan has its own dominant paternal lineage: D3a-P47 (33.33%) in the surname Yang, H-M69 (60%) in the surname Zhang, C3*-ST (53.33%) in the surname Tang and O3a1c-002611(73.33%) in the surname Wang. Haplogroup D is comprised of subclades D1-M15 and D3-P99 in continental East Asia, and is especially frequent in Tibetan Haplogroup D1-M15 [START_REF] Shi | Y chromosome evidence of earliest modern human settlement in East Asia and multiple origins of Tibetan and Japanese populations[END_REF], which is seen as a widely distributed Paleolithic genetic legacy among most Tibeto-Burman, Tai-Kadai, and Hmong-Mien populations [START_REF] Shi | Y chromosome evidence of earliest modern human settlement in East Asia and multiple origins of Tibetan and Japanese populations[END_REF][START_REF] Qi | Genetic evidence of paleolithic colonization and neolithic expansion of modern humans on the tibetan plateau[END_REF]. Haplogroup D is only found once in the Wang clan, while D3a-P47, exclusively distributed in Tibeto-Burman populations [START_REF] Shi | Y chromosome evidence of earliest modern human settlement in East Asia and multiple origins of Tibetan and Japanese populations[END_REF] is prevalent in the Yang (33.33%), Zhao (25.81%), Zhang (13.33%) and Tang (10%) clans. As the Yang and Zhao clans were the earliest settlers in the town of Tangwang according to historical records, this distribution of frequencies among the different clans reflects the early influence of Tibeto-Burman populations.

Haplogroup C may represent one of the initial groups of migrants to East Eurasia and Australia. Haplogroup C3-M217 is the most widespread subclade, and reaches the highest frequencies among Altaic-speaking populations, e.g. Mongol, Manchu, and Kazakh [START_REF] Zhong | Global distribution of Y-chromosome haplogroup C reveals the prehistoric migration routes of African exodus and early settlement[END_REF]). However, it is worthwhile to note that Haplogroup C3 comprises two clades: one is the northern clade, defined by SNP F1396, which is frequently found in Mongol and Manchu populations; the other is the southern clade, defined by SNP F2613, which is found mainly in Han Chinese (Yan S et al. 2014). In this study, four F2613-derived individuals were found in the Zhao clan, suggesting a recent gene flow or migration from Han Chinese populations; other C3 samples (16.67% in the Yang clan, 53.33% in the Tang clan and 3.33% in the Wang clan) belong to downstream haplogroups of the northern clade, especially star-cluster (C3*xC3c), which is abundant in the steppe ethnicities and is even hypothesized to consist of Genghis Khan's descendants [START_REF] Zerjal | The genetic legacy of the Mongols[END_REF], indicating a substantial genetic contribution from Mongolian-speaking populations. This result coincides with the written records, as mentioned above, which say that the common ancestor of the Tang clan was a retired general in the late Yuan dynasty.

Haplogroup O-M175 and its brother haplogroup N-M231 are the dominant Y chromosome macrohaplogroups in Han Chinese. The former covers a quarter of the males in the world today. O3a1c-02611, O3a2c1-M134, and O3a2c1a-M117 are three main subclades of O3-M122 (a downstream marker of O-M175), each accounting for 12-17% of the Han Chinese population [START_REF] Wang | Inferring Human History in East Asia from Y Chromosomes[END_REF]. Significantly, they exhibit various frequencies in the five clans. Haplogroup O3a1c-002611 reaches its highest frequency (73.33%) in the Wang clan, but is nearly absent in the other four clans, which means that the ancestors of the Wang clan might have been recent Han immigrants. Haplogroup O3a2c1*-M134 accounts for about 20% of the samples in the Yang clan and 12.9% of the Zhao clan, respectively, but is nearly absent in other clans. Similarly, Haplogroup O3a2c1a-M117 only exhibits modest frequencies (6.67%) in the Yang clan. So, haplogroup O3a2c1*-M134 and O3a2c1a-M117 are prevalent in Yang clan, while haplogroup O3a1c-002611 is frequent in Wang clan. This difference might be caused by the various origins of Yang and Wang clans, as modern Sino-Tibetan populations share the dominant haplogroup O3a2c1*-M134 and O3a2c1a-M117 [START_REF] Wang | Genetic structure of Qiangic populations residing in the Western Sichuan corridor[END_REF] while Eastern Han Chinese display relatively high frequencies of haplogroup O3a1c-002611 [START_REF] Wang | Inferring Human History in East Asia from Y Chromosomes[END_REF]. The rest of the Y chromosomes were identified as haplogroups G-M201, H-M69, J-P209, and R-M207, and we define these haplogroups as West Eurasian related haplogroups because they occur preferentially in West populations [START_REF] Wang | Inferring Human History in East Asia from Y Chromosomes[END_REF]. It is noteworthy that haplogroup H-M69 occurs with high frequency only in the Zhang clan. The haplotypes of H-M69 individuals in the Zhang clan are more similar to samples from the surrounding Muslim populations (unpublished data), such as Hui, Dongxiang and Bao'an, who were Persian and Arab immigrants from Central Asia during Yuan Dynasty (approximately 700 years ago).

Status of the Tangwang language with respect to other languages in China

As has been indicated in the previous sections, the Tangwang language is a Chinese variety influenced by the Dongxiang language, but it is not the result of imperfect acquisition of the Mandarin language by Dongxiang people. The Tangwang language is classified as a "mixed language" in Languages in China (Sun et al. [eds.] 2007). Linguists do not yet possess a universally adopted method to define "mixed language". [START_REF] Thomason | Language Contact, Creolization, and Genetic Linguistics[END_REF] have established a borrowing scale including five degrees or categories; but as these authors indicate: "The boundaries between any two borrowing categories on our scale are of course fuzzy" (p77). In our field investigations, the real linguistic data often presents much more intermediate phases. In their highest category of borrowing scale, i.e. degree five, they describe the following: 5) Very strong cultural pressure: heavy structural borrowing; structure:

Major structural features that cause significant typological disruption: …loss of phonemic contrasts; change in word structure rules (e.g. adding prefixes in a language that was exclusively suffixing… (p76).

In the Tangwang language, some phenomena correspond to these criteria but some do not. As for typological change in heavy structural borrowing, the Tangwang language has changed from VO word order to OV word order. In our experience, this is not very significant, since word order is one of the most easily changed features in language contact. As we have mentioned in section 2, the Tangwang language has begun to lose tone in single words, which is Thomason and Kaufman's loss of phonemic contrasts. It is well known that contemporary Chinese does not appeal to morphology as do European languages. However the Tangwang language, which is spoken by people who have converted to Islam 5 , has begun to use morphological suffixes-more precisely, grammatical suffixes. This is completely alien to Sinitic languages, even in the linguistic area around the border between Gansu and Qinghai. In ( 12), the suffix nə refers to the subject of the sentence, meaning "my own home". The suffix ȵi closely following a noun indicates "his". In Dongxiang as in other Mongolic languages, this slot can be filled by mini (my), ʧini (your) and ni (his). We will not give more examples in this paper due to space limitations. Be aware that this kind of suffix has been completely absorbed by those Tangwang people who now self-identify as Muslim. The source of these suffixes is actually the Dongxiang language.

Chart 3 Reflexive and possessive suffixes

It is useful to know that the Dongxiang language has simplified the reflexive suffixes compared to Mongolian, which possesses four forms due to vowel harmony. Only nə is attested in Dongxiang, and the Tangwang language has copied the same use. As for possessive suffixes, the Tangwang language has only borrowed the 3 rd person form from the Dongxiang language, which has three forms just like in other Mongolian dialects.

Another suffix attested in all Mongolic languages is the terminative [thala], which has different phonetic forms due to vowel harmony, and expresses "until". One example from Tangwang: This suffix is frequently attested in Gansu-Qinghai Sinitic languages even though the neighboring languages are quite different. Qinghai is more strongly influenced by Amdo Tibetan and Gansu by Mongolic languages. Compared with Thomason and Kaufman's borrowing scale, the language of Tangwang already presents some features of the highest degree of borrowing. Can we then confirm that the Tangwang language is a "mixed language"? How can linguists measure the degree of typological change? Can we quantify the changes that occur due to language contact? In this study we have tried to find a more reliable method to face these problems encountered by many linguists. First of all, we have chosen 10 languages in the Sino-Tibetan family and 10 languages in the Altaic family. These two language families cover our target region, the border between Gansu and Qinghai. 96 linguistic features have been selected including 39 phonetic, phonological and morphological criteria, and 57 syntactic features. We have made all of these language features computable, converting them into a binary system. In this way the research will be based on algorithmic statistics instead of on experience-like studies. Here is the result of the work in a form which is easier to visualize.

Figure 4: Classification of different languages with 96 linguistic features Some comments are necessary. Most of these languages are presented in four major groups (branches). What is interesting is that the Tangwang language undoubtedly clusters with the Sinitic group but not at all with Tibetan group, nor with the Altaic language family branch. This is also the case for Linxia, Gangou and Wutun languages. Before calculating these statistics, the Wutun and Tangwang languages were expected to be an isolated subgroup. But the chart shows the opposite. The Linxia language is still considered a Chinese dialect, while the status of Gangou has not been clearly defined. However the Wutun language is openly categorized as a mixed language (Sun et al. [eds.] 2007) by Chinese linguists. Nevertheless the authors of Wutun (Janhunen et al. 2008: 7) consider that "Wutun has occasionally been quoted as an example of a 'mixed' language, perhaps even an actual 'creole'. We know today that it is best classified as an independent and highly aberrant variety of Northwest Mandarin". The situation in Wutun is actually rather complex and requires its own discussion (Dan Xu forthcoming). Based only on linguistic criteria, [START_REF] Xu | Tangwang hua yanjiu [Studies of the Tangwang language[END_REF] has also declared that the Tangwang language is a Chinese variety but not yet a "mixed language". The group consisting of Wutun, Tangwang, Linxia and Gangou form a sub-group of the main trunk of the Sinitic language group. Generally speaking, members of the Sino-Tibetan family appear less closely linked together than those of the Altaic family.

In the latter, it is clear that the Turkic group shows a higher affinity between different languages than Mongolic group.

In conclusion, the Tangwang language, like Linxia, Gangou, may be considered a Chinese variety instead of a mixed language or creolized language. We do not mean to imply that our method can resolve all problems with criteria for classifying languages, but quantified data is always better than intuitive, experimental data.

Conclusion

Since the 1950s, and especially over the past few decades, language contact research has begun to draw the attention of many linguists, while the field of molecular biology only started developing in the 1980s. Since Cavalli-Sforza's series of articles, geneticists and linguists have joined their efforts to establish and improve genetic and linguistic trees to better understand their correlations. It is taken for granted now that human languages and genes are correlated in most parts on the planet. However, this parallelism is broken in several parts of the Gansu-Qinghai area. This situation is reflected in the dispersal of small language units on the Hexi corridor. In this paper, we have tried to trace back the origins of these people to better understand their language.

All research requires approaches of varying scale, ranging from microscopic to macroscopic. Progress in human sciences research must be informed by other disciplines; efforts from different fields are required in order to break any new ground. This viewpoint reveals much room for improvement in the human sciences, and many avenues ripe for advancement. Combining linguistic and archaeological evidence, for example, might lead us to a new way of understanding the history of different peoples and their languages.

A comparison of language distance with ethnic genetic distance can help us to reconstruct the spread of different languages by dispersed populations, having diverse genes, over different historical periods. Such a comparison leads us to the question of why there are matches and mismatches in language-gene correlations at certain points in time and in certain locations. This sort of combination of natural sciences with human sciences lets us move beyond the limitations of traditional diachronic linguistic methodology.

Figure 1 :

 1 Figure 1: Linxia Hui autonomous prefecture in Gansu, China

Figure 3 :

 3 Figure 3: Sample collections in Tangwang

  (14) ȵi pa ʨiɛ ̃ thala ʦu ma tʂɛ 2SG eight o'clock TERM do what INTER 5 Those who have not converted to Islam do not completely accept these suffixes. 'What are you doing until 8 o'clock?'

  In the above examples, the word order is OV. The accusative marker [xa] marks the preverbal object. It is clear that the object can be either definite or indefinite. The plural marker [mu], equivalent to[mən]

	1) 羊们哈赶着进来给。
	jɑ ̃ mu xa kɛ ̃ tʂə ʨĩ lɛ kɪ
	sheep PL ACC pursue CONV enter CAUS
	'Herd these sheep into the pen.'
	(2) 阿訇两个鸡哈宰哈了。
	axũ liɑ ̃ ke ʨi xa ʦɛ xa liɔ
	imam two CL chicken ACC kill RES PRF
	'The imam has killed two chickens.'
	(3) 我你哈花哈给一个。
	və ȵa xa xua xa kha ʑi ke
	1SG 2SG+DAT flower ACC give one CL
	'I gave you one flower.'

  ), the nominative [lɑ ] 'wolf' is unmarked while the object [jɑ ] 'sheep' must be marked by[xa]. The same analysis is applied to (5) in which two nouns with the [+A] feature require a marker to distinguish the agent from the patient. Notice that case marking affects the pronunciation of the 1 st and 2 nd person pronouns:

	3SG who COM go INTER
	'With whom did he go?'
	4) 羊哈狼吃上了。
	jɑ ̃ xa lɑ ̃ tʂhʅ-ɑ ̃ liɔ
	sheep ACC wolf eat RES PRF
	'The sheep has been eaten by the wolf.'
	(5) 小王小李哈打哈了。
	ɕiɔ vɑ ̃ ɕiɔ li xa ta xa liɔ
	Xiao Wang Xiao Li ACC beat RES PRF
	'Xiao Wang has beaten Xiao Li.'
	In (4(6) 你我看来了?
	ȵi va kɛ ̃ lɛ liɔ
	2SG 1SG+ACC see come PRF
	'Did you come to see me?'
	(7) 我你说。
	və ȵa ʂuə
	1SG 2SG+DAT say
	'I speak to you.'
	When the first person pronoun is used in subject position, it is pronounced [və], while when it is
	used in object position (in Tangwang the object is preverbal), it becomes [va]. The second person is ȵi
	in subject position and ȵa in object position, respectively. Now look at additional case marking such as
	ablative/comparative and instrumental/comitative.
	(8) 我家里些来了。
	və ʨia li ɕiɛ lɛ liɔ
	1SG home POST ABL come PRF
	'I have come from my home.'
	(9) 马驴些快。
	ma ly ɕiɛ khuɛ
	horse donkey COMP fast
	'The horse runs faster than the donkey.'
	(10) 那蒙古话拉讲。
	nə mə ku xua la ʨiɑ ̃
	3SG Mongol speech INST speak
	'He speaks Mongolian.'
	(11) 那 ake 拉走了?
	nə ake la ʦəu liɔ

Acknowledgements : The authors of this paper express their thanks to Yao Hongbing and Wang Hua in helping Wen Shaoqing with sample collection in Tangwang, to Zhang Menghan for his statistics propositions and discussions, and to those who performed digitization: Saiyinjiya Caidengduoerji (for Mongolic languages and Manchu), Li Ting (for Tibetan languages), Barbara Kozhevina (for Turkic languages), Liu Keyou, and Wang Cong (for Sinitic languages).

Abbreviations