Mohamed Nassar
email: mohamed.nassar@inria.fr

Sylvain Martin
email: sylvain.martin@ulg.ac.be

Guy Leduc
email: guy.leduc@ulg.ac.be

Olivier Festor
email: olivier.festor@inria.fr

Using Decision Trees for Generating Adaptive SPIT Signatures

Keywords: C.2.3 [Computer Systems Organization]: Computer-Communication Networks-Network Operations Design, Experimentation, Management, Security Spam over Internet Telephony, SIP, VoIP, Decision Trees, Machine Learning, Autonomous Management, Adaptive Security

With the spread of new and innovative Internet services such as SIP-based communications, the challenge of protecting and defending these critical applications has been raised. In particular, SIP firewalls attempt to filter the signaling unwanted activities and attacks based on the knowledge of the SIP protocol. Optimizing the SIP firewall configuration at real-time by selecting the best filtering rules is problematic because it depends on both natures of the legal traffic and the unwanted activities. More precisely, we do not know exactly how the unwanted activities are reflected in the SIP messages and in what they differ from the legal ones. In this paper, we address the case of Spam over Internet Telephony (SPIT) mitigation. We propose an adaptive solution based on extracting signatures from learnt decision trees. Our simulations show that quickly learning the optimal configuration for a SIP firewall leads to reduce at lowest the unsolicited calls as reported by the users under protection. Our results promote the application of machine learning algorithms for supporting network and service resilience against such new challenges.

INTRODUCTION

The Internet has evolved over the recent years from a pure data network into a global medium for services and communications. We have simultaneously observed a raise of security and resilience concerns. The protection mechanisms need to be completed by continuous detection of misbehavior and adaptation of the protection policy to embrace evolution both in regular and undesired traffic, as recommended in [START_REF] Sterbenz | Resilience and survivability in communication networks: Strategies, principles, and survey of disciplines[END_REF]. In this paper, we address this question in the context of Voice-over-IP (VoIP) or IP telephony. The Session Initiation Protocol (SIP - [START_REF] Rosenberg | RFC3261: SIP: Session initiation protocol[END_REF]) is widely recognized as the standard signaling protocol of VoIP.

Experts from both research and industry expect that VoIP enterprise operators will face a variant of the email SPAM problem, so-called SPIT or Spam over Internet Telephony. The operators need to protect their subscribers against SPIT campaigns aiming at marketing or phishing attempts. However, the anti-SPAM techniques can not be simply extended to that new challenge. Unlike the email SPAM, the content of the SPIT is not unveiled until the subscriber answers the call and the disruption is done.

Since the most intrusive SPIT is generated by automated softwares, researchers propose appropriate challenge tests that are performed at the proxy level / SIP firewall and before forwarding the call to the end-subscriber. Examples of such tests are CAPTCHA using DTMF input [START_REF] Soupionis | Audio CAPTCHA for SIP-based VoIP[END_REF] and hidden Turing tests [START_REF] Quittek | Detecting SPIT calls by checking human communication patterns[END_REF]. These tests have a negative impact on the user satisfaction and the quality of service in terms of call setup delay, service resource consumption and disturbing legitimate callers. Therefore, they should be selectively applied on suspicious calls.

In this paper, we propose a protection policy composed of two types of signatures: SPIT signatures and benign signatures. Based on the policy, the SIP firewall has to decide solely based on the SIP INVITE message (the call initiation request) whether the call should be challenged or not. The performance of the policy is evaluated through the feed-back of the end-users. Real-time and adaptive refinement of the protection policy requires machine learning techniques that are both: [START_REF] Abbes | Protocol analysis in intrusion detection using decision tree[END_REF] adaptive: face to the continuous change of both the attack strategies and the legal activities, and (2) expressive: i.e. defines concrete signatures. In particular, the decision trees are known for their high expressivity but they support only slight changes over time. Although proposals for adaptive decision trees exist ( [START_REF] Preda | Adaptive building of decision trees by reinforcement learning[END_REF][START_REF] Basak | Online adaptive decision trees[END_REF]), we propose a more appropriate approach similarly to [START_REF] Hall | Combining decision trees learned in parallel[END_REF]: we extract signatures from decision trees learnt in parallel then the signatures are combined with conflict resolution.

The rest of this paper is organized as follows. In section 2, we summarize the problem statement and expose the SIP firewall configuration framework. Section 3 presents the decision trees construction, signature extraction and updating. In section 4 the experimentation and results are exposed. Section 5 reviews the related works. In section 6 we conclude the paper and mention future works.

SIP FIREWALL CONFIGURATION FRAMEWORK

The goal of the proposed framework is to protect the VoIP subscribers from incoming SPIT calls. The problem statement can be summarized in the following points:

• The identification of SPIT should be prior to answering the call, hence no information about the call content is available.

• SPIT can be generated by a botnet, that is spread over hundred or thousands of IP addresses and blacklisting does not scale.

• SPIT calls can be routed together with legal calls through the same VoIP peer network, that is blocking all the traffic incoming from that peer is not feasible.

• Applying active tests for identifying SPIT contributes to the call setup delay and consumes server resources. Only a small subset of incoming calls should undergo these tests.

The only information available previously to routing the call is the content of the SIP INVITE message. We define the signature of a group of INVITE messages as a logical expression of sentences where each sentence is composed of a feature, a value and a logical operator. This logical expression needs to be true for all the SIP messages it represents. A feature can be any field in any SIP or SDP 1 header as shown in Figure 1. Other features may reflect the count or the position of a field, for example, the number of Via headers, or the position of the Call-ID within the message. Fields from routing and transport layers can also be used (i.e. the IP source, the transport protocol).

The strength of our approach comes from the diversity of SIP user agents, servers, configurations and implementations in the market which results in differently structured and assigned INVITE messages. The attackers have only partial information on the content of the benign messages 1 SDP: Session Description protocol is coupled with SIP and is responsible of media negotiation [START_REF] Handley | RFC2327: SDP: Session Description Protocol[END_REF] Figure 1: Example of a SIP message and possible features and therefore can not simulate their signatures. Our framework for mitigating the SPIT threat is shown in Figure 2 and consists in the following components:

A SIP firewall has for mission to inspect the incoming INVITE messages based on the protection policy. A classifier recognizes the SPIT signatures and challenge the callers by a Captcha-like test before forwarding the calls. In case the challenge system is flooded with SIP INVITES known to trigger the classifier, a rate-limiting component directly drops the call requests.

The end user-agent is equipped with an exporter for labeling received calls. For example, after the call hang-up the user presses a button or indicates in a pop-up window (for softphones) that he received a SPIT. This is usual in IP telephony since many providers pops-up a window for a satisfaction query about the quality of the last call. If no button is pressed, the exporter labels the message as benign. A particular type of end-users would be a honeypot user agent where every received call is considered as SPIT. For this paper, we assume all the user feedback is trustworthy. We plan to incorporate a trust model in future works.

The collector matches the spit/benign information given by the exporters and the challenged/not challenged information given by the firewall. This information is used to provide a labeled training data-set for the supervised learning algorithm.

The supervised machine learning component is responsible of processing the labeled data and generating the benign and SPIT signatures. The conflicts with old signatures are then resolved and the protection policy is updated. The protection policy has three kind of rules: SPIT rules apply when a SPIT signature is recognized, normal rules apply when a normal signature is recognized and default rules apply when neither is found.

DECISION TREES

Decision trees are a widely used class of methods for learning and classification. The instances presented as arguments for these methods are represented as collections of attributevalue pairs. A decision tree represents a disjunction of conjunctions of constraints on the attribute values of the instances. Each node from the tree represents a test regarding the value of an attribute, each path starting from the root node to a leaf node represents a conjunction of attribute tests and the tree synthesizes the disjunction of these conjunctions.

Our problem is reduced to decision trees with categorical Since the different categories of a string attribute are practically infinite, we limit the categories to those we found in the current training data-set.

The learning of a decision tree starts by the question: "What constraint should be tested in the root of the decision tree?". Then it evaluates the available constraints in accordance with a statistical test to select the best one. A descendant of the root node is created for each value of this constraint and the entire process is repeated for each descendant. The two most used statistical tests are the information entropy and the Gini index. The C4.5 tree generation algorithm [START_REF] Quinlan | C4.5: programs for machine learning[END_REF] is based on the information gain. The information gain is the difference of two entropy quantities:

• inf o(L) is the entropy of the set L relative to the kwise classification (in our case k=2: Spit and benign), that is before making any split.

• inf oT (L) is the weighted sum of the entropies over the n subsets obtained by applying a test T (i.e. choosing an attribute for splitting the data).

gain(T ) = - k i=1 p(ci)log2(p(ci)) + n i=1 p(ti) k j=1 p(cj/ti)log2(p(cj/ti))
The information gain criterion selects a test that maximizes the information gain function. We use J48 which is an open source Java implementation of the C4.5 algorithm from the WEKA machine learning library [START_REF] Hall | The weka data mining software: an update[END_REF].

Signature Extraction

The next step is to extract the signatures from the learnt decision tree. In Figure 3, we have this SPIT signature:

To=v1 and From=v6 and (Via = v9 or Via= v10)

The signature extraction is based on the following procedure: For each leaf node, we identify the class ("spit" or "normal") and the data instances it represents.

2. At each level of the tree, we group the leaf nodes into two groups based on their classes. We ignore all the leaf nodes that do not represent any data instance.

3. We calculate the entropy for each of the two groups: (-i∈categories p(i) log 2 p(i)).

4. We generalise over the class of the group having the largest entropy.

5. The tree is then translated into if-else rules and the conditions leading to SPIT form the signature.

For the example in Figure 3 2 , this procedure gives:

if (To==v1): if (From==v2): if (Via== v9 or Via ==v10):
return "spit" else:

return "normal" else:

return "normal" else:

return "normal"

The procedure may lead to extract normal signatures as well.

The generalisation heuristic (step 4) helps configuring the default rules in the protection policy. In case the two measured entropies have a small difference, the generalisation is not possible and the two kinds of signatures are simultaneously generated. Also in this case, the default rules are set to increase the protection based on the user feedback.

Other ways of generalisation are inherent to the J48 tree construction options. By default, J48 generalises over the class having the largest number of instances in the training data-set. This generalisation is misleading in our case because normal messages may outnumber SPIT messages in the training set. 2 The pseudo-code is written in Python-like style Another option is to construct binary trees. In binary mode when we choose an attribute to be a split node the data are split into two classes depending on wether the attribute's value is equal to or different than one chosen value. Also in this mode, the same attribute can be chosen at different levels of the tree.

Two modes of tree pruning are also available: by subtree replacement and by subtree raising. Subtree replacement consists in transforming a node into a leaf while subtree raising consists on moving a node upwards towards the root of the tree. The pruning is controlled through a confidence factor. J48 has an additional pruning method called reduced-error pruning. This method reserves a given proportion of the dataset for testing, builds the tree over the remaining data and tries to minimize the error rate over the testing subset. Finally, J48 allows to put a constraint on the minimum number of instances that can constitute a leaf. Predicting which options would give the best classification accuracy is difficult and dependent on the available dataset.

We note that optimizing the protection policy may need some aggregation functions over the signatures, for instance aggregation of IPs into a subnet, aggregation of geographic locations into one geographic region or aggregation of strings having the same prefix or suffix.

Protection Policy Update

We assume that the best protection policy at time t comes from a decision tree trained over all the data since t = 0. Thus our problem turns into building a decision tree for a very large data-set. Many solutions to this problem in the literature propose to convert the decision trees into rules and the rules are combined into a single rule set [START_REF] Hall | Combining decision trees learned in parallel[END_REF][START_REF] Provost | Scaling up: Distributed machine learning with cooperation[END_REF]. The combination process is based on an approach, suggested in [START_REF] Williams | Inducing and Combining Multiple Decision Trees[END_REF], in which rules that match one or more examples but assign them to different classes are resolved. Rules which are similar are combined into more general rules.

Dealing with categorical variables simplifies the combination process since no decomposition is needed. We suggest that the protection policy at time t may be obtained by merging of two other policies:

• the old policy calculated at time t -T representing the previous experience, all the data prior to t -T having been deleted;

• and the new policy calculated over the data-set stored in the interval [t -T, t].

In case of conflict, we consider that recently learnt rules have more weight than old ones (e.g. because of a SPIT signature that became used by benign users or vice versa).

In online mode, we define two FIFO buffers: one for SPIT messages and one for normal messages. At any moment we have two trees: the "final" tree, and the tree under construction. We also define two parameters : w 0 and w1. w0 represents the smallest number of SPIT messages required to build a decision tree (e.g. w0 = 100). Each time we have new w0 SPIT messages, we build a decision tree using all the messages in the SPIT buffer and a number of messages 10 times greater from the normal buffer (e.g. 1000 INVITE messages). Then we combine this tree with the final one. The advantage to set w0 to a small number is to trigger a fast response against new forms of attacks. w1 represents the number of SPIT messages required to consider the learnt tree as final, combine it with the last final one, free the SPIT buffer and start learning a new one (e.g. w1 = 1000 messages). This setting ensures that (1) two different final trees are learnt over two different sets of SPIT messages and (2) our combined knowledge of signatures is directly activated for protection.

Since SPIT messages are usually conducted in form of campaigns, an example of the process in online mode is shown in Figure 4. When we start receiving SPIT messages, we activate the last final tree, start learning a new one and combine the results. When no more SPIT messages are received for a time w2, we open the system and store the final tree for later use.

Discussion on the Online Parameters

The choice of the different parameters of the online system is subject to a number of constraints. The first one is the Number of attributes versus w0 (number minimum of SPIT messages required to build a tree): w0 must be at least larger than the number of used features, because the J48 algorithm is designed for the cases where the number of instances is larger than the number of attributes. Choosing a large number of attributes builds a better signature but delays the time-to-signature hence the time to apply suitable protection. Minimizing the number of used attributes reports to a problem of feature selection. It is difficult however to estimate which attributes may give a better accuracy. We suggest that the set of attributes may change periodically in order to deflect adversarial learning attacks.

The second constraint is the unbalanced"normal" vs. "spit" sets: The tree is built based on w0 SPIT messages and 10 times that number of normal messages. Although this setting avoids overfitting small segments of the normal traffic, it produces an unbalanced training set. To alleviate this problem, one can assign weights to the SPIT messages in the dataset. Even so, each time we increase the number of buffered normal messages the number of categories increases as well. That is, using a weighting scheme remains constrained by the size of the memory buffer and by the number of categories that J48 can support. The latter depends on the dedicated Java heap memory size.

EXPERIMENTATION AND RESULTS

SIP Parser and Data-Set

Our SIP parser is developed using the Jain-SIP Java library [START_REF] O'doherty | JAIN SIP Tutorial: Serving the developer community[END_REF]. According to [START_REF] Hess | Automatic adaptation and analysis of sip headers using decision trees[END_REF], more than 274 attributes per message are available. For our experiments we extract 16 SIP and SDP attributes as shown in Table 1. Fields that are randomized in normal messages such as Call-Ids, tags and branches are excluded. We notice however that these fields may distinguish some attack tools using constant message templates.

Our data set is composed of one SPIT-free trace coming from a real VoIP provider, one trace obtained at a deployed instance of a SIP user-agent honeypot3 and 3 traces obtained by running 3 SPIT tools in a local test-bed 4 .

The normal trace represents 4 hours of calls (5609 IN-VITE) obtained under a privacy agreement, hence we hide the values of the fields for the normal messages. To better characterize this trace, we show the number of categories found and the corresponding information entropy for each SIP attribute in Table 1 (the attributes are sorted based on their entropies). The SPIT tools we use are:

• Warvox 5 (80 INVITEs) • Spitter/Asterisk 6 (870 INVITEs) • SIP Bots 7 (1861 INVITEs)
We adapt the IP of traces by randomly peeking IPs from the normal trace and replace the IPs in the 3 SPIT traces. That is, we assume that the attackers use the same IPs as the legal users. This is the case where IP-based filtering would not be efficient. The trace obtained at the honeypot (24 INVITEs) does not necessarily represent SPIT since no audio was received.

SPIT Signatures

We perform a 10-fold training of J48 decision trees using the Weka default parameters (pruning with a confidence factor of 0.25 and a minimum of two instances by leaf). Our extraction tool takes then the learnt decision tree as input and generates the signatures. The results are shown in Table 2. The accuracy is defined as the number of correctly classified instances over the total number of instances.

The results show that even if the disjunction of the rules learnt from each training set is not equivalent to the rules learnt from the overall training set, we have practically the same accuracy results.

Adversarial Attack Experiments

Our method is expected to be robust against adversarial attacks. Whenever the attacker changes the SPIT INVITE messages to bypass the firewall, the end-users label them as SPIT in nearly real-time (i.e. after the call hang-up). The learning component finds then new signatures and replace the old ones. Assuming that the attacker has not access to the benign traffic and can not handle the end-user feedback, it is hard for him to create messages that can not be distinguished from the legal ones. However, we assume that the attacker may use two "obfuscation" techniques:

Random generation of values: The attacker has identified the feature as important to obfuscate, but in absence of additional information, he blindly generates a large amount of values.

Cloning of values from normal messages: The attacker knows the values of some features in the normal traffic, but he does not know which values appear together in a normal message and the occurrence frequency of each value.

We evaluate 17 different scenarios where the attributes of the SPIT messages are divided accordingly into two sets, C and G. We assign values to the attributes of the set C by peeking randomly one of the corresponding values in the normal trace. For the attributes in set G, the values are assigned by a random string generation function. In each experiment, the training set is composed of the normal trace (5609 messages) and 5600 generated SPIT messages. In the first scenario (n = 0), we assume that the attacker knows the values for all the attributes, that is no randomization is used. In the 16 subsequent scenarios (n = 1, ..., n = 16), we hide the n attributes from the top of the tree (having the lowest entropies in Table 1). The attacker randomizes the values of these n attributes.

The results are shown in Table 3. we focus on 4 variables: the tree size and depth indicating the tree complexity, the information gain of the root node, the 10-fold J48 accuracy and the 10-fold accuracy of the rule-set formed by the extracted signatures.

The results can be interpreted as follows: in the first scenario, the values of the attributes are the same for the SPIT and the normal messages. However, the occurrences of these values are equally proportional in SPIT and more biased in the normal messages which allows the decision tree to accomplish good accuracy. In the subsequent scenarios, the attributes having the lowest entropies in the normal messages are randomized in the SPIT messages. So, these attributes have high information gains but a large number of (m codec ="PCMA/8000" and user agent ="Twinkle-v1.1") or (m codec = "PCMU/8000" and o user = "root") or (m codec in ["L16/8000", "GSM/8000"])

Figure 5: Layout of Messages in an Emergent Attack Scenario

different categories. What happens is that the J48 algorithm decides to avoid overfitting and moves to the next attributes having lower information gains but a smaller number of different categories. We obtain a slightly lower accuracy and complex trees in terms of depth and size. Starting from scenario n = 5, even the non-randomized attributes have a large number of different categories (the smallest one is 82 for the IP src attribute). Therefore, the J48 algorithm stops avoiding overfitting and picks again the attribute with the greatest information gain, that is regardless the number of distinct categories. At the same time, we notice a sudden decrease in the J48 accuracy. In fact, all the random values at the root node that appears in the testing time and were unseen in the training time are considered normal. This is due to the default generalisation of J48 (the normal class has slightly more occurrences in the training set). Our alternative generalisation heuristic classifies correctly the unseen data instances and accomplishes full accuracy. J48 has a similar accuracy if trained and tested with the whole dataset.

Online Adaptivity Experiments

The goal of these experiments is to evaluate the online behavior of our approach: upon undergoing a new attack, how long does it take to generate a signature and with which accuracy? In other words, how many labeled SPIT messages are needed before converging to a good protection policy? The setting of these experiments is shown in Fig. 5: a history of h normal messages is used as reference, which is followed by a 50/50 mixture of one (new) SPIT attack and normal messages uniformly drawn from our dataset. The tree is built after w0 SPIT messages have been reported and is trained over all the messages seen since the beginning. the remaining normal and SPIT messages are used for testing.

Experiments with different options for the J48 algorithm (n-ary and binary modes) show that directly activating the learnt decision trees as a protection policy has its limitations. Our approach consists rather on extracting the signatures from the n-ary tree by transforming it into a generalised rule-set. Fig. 6 compares our approach to binary and nary trees (for w0 = 80). It plots, for each given level of accuracy, the percentage of experiments that successfully reach the required level. The generated rule-set outperforms both binary and n-ary trees. The approach shows similar performance under differently unbalanced training sets as controlled by the h parameter. More than 99% accuracy is also obtained using smaller values of w0 down to 16 messages and in some cases down to 5.

RELATED WORKS

The SPIT problem has retained attention of research and industry in the last few years. Quittek et. al. [START_REF] Quittek | Detecting SPIT calls by checking human communication patterns[END_REF] applied hidden Turing tests on the caller side and compare their results to typical human communication patterns. For passing these tests, significant resource consumptions at the SPIT generating side would be required which contradicts the spammer's objective of placing as many SPIT calls as possible. Nassar et. al. [START_REF] Nassar | Risk Management in VoIP Infrastructures using Support Vector Machines[END_REF] have proposed a set of safeguards that can be activated/deactivated progressively based on a risk model and an anomaly detection system. Quinten et. al. [START_REF] Quinten | Analysis of Techniques for Protection Against Spam over Internet Telephony[END_REF] surveyed the anti-SPAM techniques and advised to use complementary approaches. Many systems (e.g. [START_REF] Schlegel | Spam over Internet Telephony (SPIT) Prevention Framework[END_REF][START_REF] Wu | Spam detection in voice-over-ip calls through semi-supervised clustering[END_REF]) proposed user feed-back among other modules such as Decision trees are a machine learning technique that has been extensively used in many domains including networks and services security. Abbes et. al. [START_REF] Abbes | Protocol analysis in intrusion detection using decision tree[END_REF] addressed protocol analysis for network-based intrusion detection. They defined for each protocol a set of features and used the characteristics of the traffic to build an optimal decision tree. The inputs of their program are a training file (attack, nonattack), a feature set and one criterion for feature selection. Constructing decision trees for sparse categorical attributes as in our case has required attention in [START_REF] Lo | Inference based classifier: Efficient construction of decision trees for sparse categorical attributes[END_REF]. The authors proposed a new algorithm that outperforms other classification algorithms for data-sets where only few attributes are major discriminating attributes. Hess et. al. [START_REF] Hess | Automatic adaptation and analysis of sip headers using decision trees[END_REF] used decision trees for increasing the rate of acceptance for SIP messages by the SIP parsers. Their approach so-called Babel-SIP is a filter that is put in front of a SIP parser and analyzes incoming SIP messages. When a SIP message is classified as rejected by the decision tree, Babel-SIP suggests an adaptation of the header information which should finally force the acceptance of the message. Their approach can not be applied for SPIT prevention since their decision trees are only based on numerical attributes and the presence/absence of headers.

CONCLUSION AND FUTURE WORKS

In this paper, we have addressed the problem of SPIT from a new and unprecedented perspective. Based on the nearly real-time end-user feedback, we have proposed a scheme for generating SPIT signatures in the SIP INVITE messages. Hence it is possible to filter the next SPIT calls before ringing their destinations. The generated SPIT signatures are adaptive to the benign signaling traffic and robust against the adversarial malicious one. The generation of signatures is based on supervised machine learning techniques. We namely investigated decision trees with categorical attributes obtained by parsing the SIP messages. Other techniques inspired from the document classification arena will be studied and compared to our approach in future works. The paper detailed the batch and online modes of our approach. The batch mode consists on training the decision tree over a labeled (spit, normal) data-set and then transforming the tree into an if-else rule-set. In online mode, the successive learnt signatures are aggregated and the possible conflicts are resolved. Experimentation on off-the-shelf SPIT tools showed the efficiency of our approach to find the good signatures. However, experiments show that the J48 decision tree is easily defeated using some obfuscation techniques. Our proposed generalisation approach shows instead good robustness against such attacks. The overall framework provides suitable performance for operational deployment in terms of learning time, required memory, size of the rule-set and the call setup delay. The different parameters of the system (i.e. size of the different buffers and windows) are easily configurable.

Different SPIT signatures may imply different SPIT capabilities. For example, a spitter may break a Captcha test by brute-forcing a DTMF guess. Another spitter may start the call by a human-like congratulation in order to bypass a Turing test. One of the goals of our approach is to provide a framework for applying reinforcement learning techniques hence increasing the efficiency of the filtering process. The reinforcement learning aims at selecting the best rewarded challenge (including drop and accept) when a given signature (spit or normal) is detected. Basically the reinforcement learning maintains a table matching each signature with the best challenge response discovered so far. The table is continuously updated using a trial and error scheme. We will investigate learning by reinforcement techniques in this context in future works.

Figure 2 :

 2 Figure 2: A Framework for Self-Protection against SPIT

Figure 3 :

 3 Figure 3: Extracting a SPIT Signature from a Decision Tree

Figure 4 :

 4 Figure 4: Online Policy Building and Merging

Table 1 : SIP attributes extracted for experimenta- tion

 1

	Attribute	Field	Categories Entropy
	uri host	Request Line	10	0.36
	from host	From (SIP)	9	0.39
	to host	To (SIP)	9	0.44
	o user	Origin(SDP)	16	0.92
	m codec	Media (SDP)	13	1.27
	via host	Via (SIP)	64	2.3
	ip src	IP Header	82	2.33
	user agent	User Agent (SIP)	13	2.67
	contact host Contact (SIP)	87	2.74
	c host	Connection (SDP) 86	2.74
	o host	Origin (SDP)	161	6.26
	from user	From (SIP)	400	7.45
	contact user Contact (SIP)	455	7.65
	to user	To (SIP)	1398	9.88
	uri user	Request Line	1404	9.88
	m port	Media (SDP)	3467	10.96

Table 2 : SPIT signatures

 2

	Training set	10-fold J48 Accuracy	Signature
			o user = "root" and
	Normal vs. Warvox	100%	m codec = "PCMU/8000"
			o user = "root" and
	Normal vs. Spitter	100%	m codec = "GSM/8000"
			m codec = "PCMA/8000" and
	Normal vs. SIP bots	99.96%	user agent = "Twinkle-v1.1"
			from host in ["74.206.180.162", "194.28.112.29",
	Normal vs. Honeypot	100%	"174.123.134.242"]
	(Real attack IPs)
			o user = "sip" or
	Normal vs. Honeypot	100%	(o user = "root" and m codec = "L16/8000")
	(adopted IPs)
	Normal vs. All	99.96%

Table 3 : Results for synthetic data

 3

	Scenario	Tree size Tree depth Information gain 10-fold J48	10-fold Ruleset
				(root)	Accuracy(%) Accuracy(%)
	n=0 (#C=16, #G=0)	58	4	0.66	98.68	98.58
	n=1 (#C=15, #G=1)	4645	3	0.62	97.51	98.22
	n=2 (#C=14, #G=2)	4665	2	0.61	93.43	98.34
	n=3 (#C=13, #G=3)	4786	3	0.61	94.39	97.97
	n=4 (#C=12, #G=4)	9451	2	0.53	90.71	97.69
	n=5 (#C=11, #G=5)	4624	1	1	65.23	100
	n=6 (#C=10, #G=6)	4594	1	1	64.99	100
	n=7 (#C=9, #G=7)	4619	1	1	64.78	100
	.	.	.	.	.	.
	.	.	.	.	.	.
	n=16 (#C=0, #G=16) 4188	1	1	66.61	100

Number of Satisfying Experiments in Function of The Required Accuracy white

/black list, simultaneous calls, call rate and URI's IP/domain correlation. To our knowledge, no approach really addressed exploiting the user feed-back in order to generate adaptive SPIT signatures from the signaling messages.

http://artemisa.sourceforge.net/

Only INVITE messages towards the SIP firewall are filtered

http://warvox.org/

http://www.hackingvoip.com/sec_tools.html

http://voipbot.gforge.inria.fr/

Acknowledgment

Mohamed Nassar and Olivier Festor acknowledge the financial support of the EU project Scamstop, FP7-232458. Sylvain Martin (Post-Doctoral Researcher) acknowledges the financial support of the Belgian National Fund of Scientific Research (FNRS). This work is also partially funded by EU project ResumeNet, FP7-224619


Charles-Henri Hage

Bertrand Kibler

Christophe Finot
email: christophe.finot@u-bourgogne.fr

Fiber-based device for the detection of low intensity fluctuations of ultrashort pulses

We describe a fiber-based device that can significantly enhance the low intensity fluctuations of an ultrashort pulse train to detect them more easily than with usual direct detection systems. Taking advantage of the Raman intrapulse effect that progressively shifts the central frequency of a femtosecond pulse propagating in an anomalous dispersion fiber, a subsequent spectral filtering can efficiently increase the level of fluctuations by more than one order of magnitude. We show that attention has to be paid to maintain the shape of the statistical distribution unaffected by the nonlinear process.

Introduction

Detecting low power fluctuations with an easy-to-implement device is of practical interest for many applications such as optical pulse characterization, jitter measurements or biophotonics.

Several solutions have already proved their efficiency such as synchronous detection [START_REF] Burdett | Amplitude Modulated Signals -The Lock-in Amplifier[END_REF], radio-frequency analysis [START_REF] Von Der Linde | Characterization of the noise in continuously operating mode-locked lasers[END_REF] or autocorrelation measurements of the pulse train [START_REF] Fatome | All-optical measurements of background, amplitude, and timing jitters for high speed pulse trains or PRBS sequences using autocorrelation function[END_REF]. However, they require the use of dedicated and onerous instruments. In this context, nonlinear effects acting in a single-mode optical fiber can constitute a simple and efficient alternative. It has been recently

proposed to take advantage of the self-phase modulation undergone by picosecond pulses to alloptically magnify the amplitude fluctuations of a pulse train at telecommunication wavelengths [START_REF] Finot | All-optical fiber-based ultrafast amplitude jitter magnifier[END_REF]. Quite remarkably, it has been shown that the statistical distribution of the amplitude fluctuations is maintained after magnification.

We discuss in this contribution a novel experimental scheme based on the soliton selffrequency shift (SSFS) experienced by a femtosecond pulse evolving into a photonic crystal fiber (PCF). We first present the principle of our method and the associated setup. Next we describe how the statistical distributions are reshaped. Finally we provide experimental results assessing the optical jitter magnification and the ability to increase detection margins.

Principle of operation and experimental setup

The principle of our jitter magnifier is illustrated in Fig. 1 and relies on the transfer function (TF) that links the incoming power to the output power. In a previous work [START_REF] Finot | All-optical fiber-based ultrafast amplitude jitter magnifier[END_REF], it has been outlined that if the TF can be locally approximated at a working power P 0 by a linear function having a xintercept P C , then the relative level of output fluctuations ∆P out / P C is linked to the input relative fluctuations ∆P in / P 0 by the following relationship :

0 0 1 , 1 / out in C C P P P P P P ∆ ∆ = - (1)
with P out being the output power and ∆P out and ∆P in being the output and input levels of fluctuations respectively. From this simple law, amplification of the relative amplitude jitter requires P C strictly between 0 and 2 P 0 so that a strictly proportional TF (P C = 0) is prohibited.

One of the simplest TF shapes that fulfills this requirement is comprised of two linear segments and is illustrated in Fig. 1.

The main experimental issue is to realize a TF having properties close to this ideal shape.

The scheme proposed in Ref. [START_REF] Finot | All-optical fiber-based ultrafast amplitude jitter magnifier[END_REF] has validated the use of the non-proportional TF by demonstrating a 10 times amplitude jitter magnification: the central optical bandpass filtering of a spectrum expanded by self-phase modulation has led to a transfer function that can be locally approximated by a linear increasing segment. We explore here the use of soliton self-frequency shift affecting a femtosecond pulse evolving in a PCF with anomalous dispersion. Thanks to the intrapulse Raman contribution of the silica, the central frequency of the pulse progressively shifts towards longer wavelengths, this frequency shift being basically controlled by the peak power of the initial pulse [START_REF] Mitschke | Discovery of the soliton self-frequency shift[END_REF]. Such a spectral shift has been previously used for a wide range of photonics applications such as wavelength-tunable ultrashort sources [START_REF] Chan | 1.2-to 2.2-um Tunable Raman Soliton Source Based on a Cr-Forsterite Laser and a Photonic-Crystal Fiber[END_REF], optical sampling [START_REF] Yamada | 640-Gb/s OTDM signal measurement with highresolution optical sampling system using wavelength-tunable soliton pulses[END_REF], coherent anti-Stokes Raman scattering bioimaging [START_REF] Andresen | Tunable light source for coherent anti-Stockes Raman scattering microspectroscopy based on the soliton selffrequency shift[END_REF] or analog-to-digital converters [START_REF] Xu | Photonic analog-to-digital converter using self-frequency shift and interleaving spectral filters[END_REF]. Here, we combine the SSFS process with a long-pass filter blocking the low-wavelength components, thus acting as an optical thresholder that efficiently discriminates the pulses according to their initial power. Indeed, the pulses having a peak-power not high enough to be sufficiently frequency shifted are vanished whereas the other pulses pass through the filter. Interestingly, the transition between the two regimes is rapid and close from being linear, which is obviously beneficial for the targeted application.

More precisely, the experimental setup we implemented is depicted in Fig. 2. A femtosecond pulse train is delivered by a passively mode-locked oscillator (Amplitude Systems t-Pulse laser with 48-MHz repetition rate and 190-fs pulse duration) at the initial wavelength of 1033 nm. The PCF input power is controlled with an electro-optic modulator (EOM) driven by an electrical arbitrary function generator so that the transmission level of the EOM can be dynamically changed at a repetition rate from several Hz up to several tens of kHz. The fiber under test is typically a 2-m long solid-core highly nonlinear photonic crystal fiber [START_REF] Russell | Photonic-Crystal Fibers[END_REF] having a zero-dispersion wavelength well below the pumping wavelength (in our case, we have tested two PCFs, called fibers A and B, with zero-dispersion wavelengths estimated to 710 nm and 765 nm respectively). In order to favor the existence of a single soliton, fibers with high dispersion have been chosen [START_REF] Pant | Characterization and optimization of photonic crystal fibers for enhanced soliton selffrequency shift[END_REF][START_REF] Hage | Optimization and characterization of a femtosecond tunable light source based on the soliton self-frequency shift in photonic crystal fiber[END_REF]. At the fiber output, a long-pass filtering (with a cutoff wavelength at 1200 nm, transmission function is provided on the inset of Fig. 3) enables to realize the aforementioned thresholding/magnification function. The spectrally filtered signal is then collected by an InGaAs photodiode and monitored by a standard oscilloscope. The electronic bandwidth of both photodiode and oscilloscope is not high enough to resolve the fine temporal details of the femtosecond pulse. The recorded fluctuations correspond to the pulse energy jitter, which can be directly linked to the jitter of the pulse peak power [START_REF] Lafargue | Direct detection of optical rogue wave energy statistics in supercontinuum generation[END_REF]. The output average power is also monitored as well as the optical spectrum (when the optical filter is removed).

Experimental results

Spectral pulse dynamics

An experimental example of the spectral evolution of the pulse into the PCF as a function of the initial average power is provided in Fig. 3. As expected, we clearly notice a soliton evolving towards longer wavelengths, the frequency shift being controlled by the power launched into the PCF [START_REF] Reid | Soliton selffrequency shift effects in photonic crystal fibre[END_REF][START_REF] Druon | Selfcompression and Raman soliton generation in a photonic crystal fiber of 100-fs pulses produced by a diode-pumped Yb-doped oscillator[END_REF]. For fiber A and the studied power range, a single frequency-shifted soliton is observed [START_REF] Hage | Optimization and characterization of a femtosecond tunable light source based on the soliton self-frequency shift in photonic crystal fiber[END_REF]. For an input average power P 0 of 40 mW (injection ratio ~35%), half of the soliton has passed through the 1200-nm cutoff wavelength of the filter.

Thresholding transfer function

The resulting transfer function is plotted in Fig. 4(a) (solid black line). We can distinguish three different stages of the process that can be easily understood (see also Fig. 3). Indeed, for initial powers below P 1 , the SSFS is too low so that no part of the soliton passes through the filter. On the contrary, for input powers above P 2 , the whole soliton passes through the filter and we observe a plateau. Between P 1 and P 2 , the soliton progressively passes through the filter so that the output energy continuously increases and a close to linear behavior is empirically observed. This is of course in this transition region that the optical magnifying will occur. In order to accommodate the highest range of input fluctuations, it is beneficial to work in the middle of this linear segment, i.e. at the working power P 0 . From the slope at this point, one can anticipate a magnifying factor of 20 as it will be confirmed in next section.

TFs have also been experimentally recorded for cutoff wavelengths of the optical filter ranging from 1050 nm to 1250 nm. Results are summarized in Fig. 4(a) and clearly confirm that longer the cutoff wavelength of the filter is, higher the threshold is, which is fully consistent with the analysis reported in Fig. 3. We can evaluate the magnification factor undergone by the signal when the working power is chosen in the middle of the linear rising part of the TF (note that the amplitude jitter gain may vary over the TF according to the working power). This magnification factor has been found to be close to constant about 20 ± 2 for the different cutoff wavelengths.

We can note that for low detunings of the filter (cutoff wavelengths of 1050 nm, grey dotted line) the resulting TF does not present a high linear part, which may be detrimental to maintain the statistical probability distribution of the fluctuations. However, in all cases the largely monotonic behavior of the TF helps to avoid some potential confusions that may arise from the oscillating structure of the typical TF used in [START_REF] Finot | All-optical fiber-based ultrafast amplitude jitter magnifier[END_REF].

The fiber properties can also highly affect the transfer function and the working power needed to obtain the switching. Indeed, fibers with lower dispersion and higher nonlinearity coefficient increase the soliton self-frequency shift and thus lead to a lower thresholding power [START_REF] Hage | Optimization and characterization of a femtosecond tunable light source based on the soliton self-frequency shift in photonic crystal fiber[END_REF]. Such an effect can be seen on Fig. 4(b) for which we have compared two fibers with the same output filter (cutoff wavelength of 1150 nm). The fiber with the lowest dispersion (fiber B, dashed black line) has led to a significant reduction of the input power required to the thresholding. Therefore, input pulses with energies as low as a few hundreds of pJ (a few kW of peak-power) can be suitable.

Magnification or reshaping of statistical distributions

In the rest of this paper, we focus on the configuration based on the fiber A combined with the filter having a cutoff wavelength of 1200 nm (TF plotted in Fig. 4(a) with solid black line). In order to assess the ability of our device to efficiently magnify the input fluctuations, we applied stochastic fluctuations having Gaussian probability distribution generated by our electric arbitrary generator. The statistical distribution recorded after magnification and the associated electrical eye diagram are plotted on Fig. 5(a) for the magnifier working at power P 0 . The initial 1.06 % rms fluctuations (corresponding to a distribution with a full width at half maximum of 2.5 %) are increased at the output to a level of 21 % rms. As assessed by the Gaussian fit (dashed line), the general shape is preserved and a magnifying factor close to 20 is obtained, which is in agreement with the prediction based on the TF. Complementary results have been recorded for another probability distribution, i.e. a uniform distribution with an initial variation of 2.5 % (full width at half maximum). Results recorded after the jitter magnifier (Fig. 5(b)) highlight the preservation of the distribution shape and confirms the amplification factor of 20.

Additional measurements have pointed out the crucial importance of the working power.

Indeed, as highlighted by Fig. 6(a), working with a lower initial power close to the threshold power P 1 (see Fig. 4(a)) leads to the generation of heavily tailed statistics that strongly differ from the original Gaussian input stochastic field (a Gaussian fit of the output distribution is not able to reproduce the wings of the distribution). Rare pulses having amplitude more than 60 times higher than the most likely event have therefore been recorded at the output of the device, as also illustrated by the electrical eye-diagram of Fig. 6(a). This confirms the major role that may play the long-pass filter in analyzing statistics as it is done frequently in recent articles dealing with optical rogue waves and optical solitons with extreme red shifts. In particular the results obtained from the rude analysis of the filtered pulse train have to be interpreted with care [START_REF] Lafargue | Direct detection of optical rogue wave energy statistics in supercontinuum generation[END_REF][START_REF] Solli | Optical rogue waves[END_REF][START_REF] Erkintalo | On the statistical interpretation of optical rogue waves[END_REF] (see also Fig. 1 for an illustration of the action of the filter on the statistical distribution when working close to the threshold power). Note that an inverse long tail distribution with a tail towards lower powers can also be generated when working close to the plateau of the device (power P 2 ). The physics that is here involved is completely different from the dynamics reported in [START_REF] Solli | Rare frustration of optical supercontinuum generation[END_REF] and can be once again easily understood by considering the action of the TF on the initial probability distribution. We expect that the flexibility brought by our device to provide on demand extreme statistics may be helpful to study the evolution of such extreme statistics in additional nonlinear environment.

Magnification of small fluctuations

We have finally investigated the ability of the device to efficiently discriminate two levels. For this purpose, we have applied periodic levels with a peak-to-peak fluctuation as small as 1.5%.

For such a fluctuation, before the magnifier, the fluctuations are below the noise level of the electronics detection chain (standard photodiode and oscilloscope) and cannot be measured.

After the magnifier working at power P 0 , results are plotted on Fig. 7(a) and we can clearly make out the fluctuations that are now spaced by 29.5 %, in agreement with the magnifying factor that has been previously demonstrated. Therefore, the optical level difference can now be detected in a straightforward way. We also changed the relative weight of the different levels, as shown on

Conclusion

We have proposed and experimentally demonstrated the principle of a new optical amplitude jitter magnifier based on the power dependence of the Raman soliton self-frequency shift. A typical transfer function exhibiting a marked thresholding behavior and a linear transition between two states is demonstrated. Moreover, thanks to the quasi-linear transition both high magnifying factor and shape-preserving statistical distribution amplification are achieved.

Magnification by a factor above 20 of the fluctuations has been demonstrated based on the TF, which is a twofold improvement compared to the previous method described in Ref. [START_REF] Finot | All-optical fiber-based ultrafast amplitude jitter magnifier[END_REF].

Additional measurements have confirmed the increase by more than one order of magnitude of the fluctuations. The choice of the working power is crucial and for input powers which do not lie in the linear part of the TF, a strong reshaping of the statistical distribution can be observed, leading to heavily tailed statistics.

Our results have been demonstrated at 1030 nm for input pulse energies below 1 nJ and were based on silica fibers, but the same technique can be applied in the infrared by pumping a soft-glass fiber in the anomalous dispersion regime [START_REF] Hu | Maximizing the bandwidth of supercontinuum generation in As2Se3 chalcogenide fibers[END_REF]. Moreover, we can expect that the progress in highly nonlinear waveguides may enable this function to be embedded on a photonic chip in a close future [START_REF] Judge | Soliton selffrequency shift performance in As2S3 waveguides[END_REF] and to decrease the input pulse energies. The negative oscillation on the right side of the eye-diagrams is due to the electronics of the photodiode. Probability and amplitude are normalized to 1 for the most likely event. The initial periodic sequence of amplitude modulation of the peak powers of the pulses is plotted in inset. Probability and amplitude are normalized to 1 for the most likely event. The initial periodic sequence of amplitude modulation of the peak powers of the pulses is plotted in inset.

List of figure captions

Fig. 7 (

 7 Fig. 7(b) and the recorded results reproduce the relative weight of the pulses. Note that the

Fig. 1 .Fig. 2 .Fig. 3 .

 123 Fig. 1. Principle of the optical jitter magnifier.

Fig. 4 .

 4 Fig. 4. Experimental transfer functions: output average power according to the input average

Fig. 5 .

 5 Fig. 5. Statistical distribution of the fluctuations (probability and amplitude are normalized to 1

Fig. 6 .

 6 Fig. 6. Statistical distribution of the fluctuations (probability and amplitude are normalized to 1

Fig. 7 .

 7 Fig. 7. Statistical distribution of the fluctuations (left, plotted on a linear scale) recorded at the

Fig. 1 .Fig. 2 .Fig. 3 .

 123 Fig. 1. Principle of the optical jitter magnifier.

Fig. 4 .

 4 Fig. 4. Experimental transfer functions: output average power according to the input average

Fig. 5 .Fig. 7 .

 57 Fig. 5. Statistical distribution of the fluctuations (probability and amplitude are normalized to 1

Acknowledgements

We thank the support of the Agence Nationale de la Recherche (ANR SOFICARS and MANUREVA, grants ANR-07-RIB-013-03 and ANR-08-SYSC-019). C-H. Hage acknowledges the support of the Conseil Regional de Bourgogne through his grant "jeune chercheur entrepreneur" scheme. B. Kibler also thanks the support of the Conseil Régional de Bourgogne through the Photcom PARI grant. We thank Hervé Rigneault, Esben Andresen, Kamal Hammani, Julien Fatome and Guy Millot for stimulating discussions.

for the most likely event) and electrical eye diagram of the output pulse train. Results obtained for the working power P 1 (subfigure (a)) are compared with the results obtained for the working power P 2 (subfigure (b)). The experimental statistical distributions are compared to Gaussian fits (dashed lines) and the results are plotted with a logarithmic scale for the x-axis. The rms amplitude jitter of the initial pulse train is 10.5% for subplots (a) and (b).


Keywords: Fiber optics, Raman amplifiers, extreme statistics

In this work, we experimentally investigate several temporal and spectral methods to highlight extreme fluctuations which can develop during the Raman amplification of an ultrashort pulse train. Forward and backward pumping schemes are compared to dual pass configurations.

Experimental signatures of extreme optical fluctuations in lumped Raman fiber amplifiers Kamal Hammani * and Christophe Finot

Laboratoire Interdisciplinaire Carnot de Bourgogne, UMR 5209 CNRS-Université de Bourgogne, 9 avenue Alain Savary, BP 47870, 21078 Dijon Cedex, France

Introduction

The study of extreme statistics in nonlinear fiber optics is a topic that has recently stimulated much attention. Following the pioneering work of Solli and coworkers [START_REF] Solli | Optical rogue waves[END_REF] that have reported the observation of statistics analogous to hydrodynamic rogue waves in the formation of optical supercontinuum, most of the initial works have focused on the passive propagation of picosecond pulses in photonic crystal fibers [START_REF] Dudley | Extreme events in optics: Challenges of the MANUREVA project[END_REF]. Those different studies carried out in the anomalous dispersion regime have highlighted the specific role played by modulation instability, Akhmediev breathers [START_REF] Akhmediev | Waves that appear from nowhere and disappear without a trace[END_REF][START_REF] Kibler | The Peregrine soliton in nonlinear fibre optics[END_REF] as well as Raman frequency shifted solitons that are also affected by third-order dispersion and resulting pulse-to-pulse interactions [START_REF] Taki | Third-order dispersion for generating optical rogue solitons[END_REF][START_REF] Hammani | Emergence of rogue waves from optical turbulence[END_REF]. However, observation of statistics that strongly deviate from a Gaussian distribution is absolutely not restricted to supercontinuum generation and can also be observed in telecommunication applications in the context of transmissions [START_REF] Peleg | Log-normal distribution of pulse amplitudes due to Raman cross talk in wavelength division multiplexing soliton transmission[END_REF][START_REF] Chung | Strongly non-Gaussian statistics of optical soliton parameters due to collisions in the presence of delayed Raman response[END_REF][START_REF] Vergeles | Optical rogue waves in telecommunication data streams[END_REF], Raman fiber lasers [START_REF] Turitsyna | Optical turbulence and spectral condensate in long-fiber lasers[END_REF][START_REF] Churkin | Extreme value statistics in Raman fiber lasers[END_REF] as well as discrete amplification [START_REF] Hammani | Emergence of extreme events in fiber-based parametric processes driven by a partially incoherent wave[END_REF][START_REF] Hammani | Optical rogue-wave fluctuations in fiber Raman amplifiers[END_REF]. More precisely, in this latest field, it has been shown that under certain conditions, statistical distribution of an amplified signal can be strongly reshaped during the amplification process.

Examples of this deleterious degradation have been discussed for parametric amplifiers [START_REF] Hammani | Emergence of extreme events in fiber-based parametric processes driven by a partially incoherent wave[END_REF][START_REF] Hammani | Soliton generation in a microstructured fiber by fourth order scalar modulation instability[END_REF][START_REF] Xu | Gain statistics of a fiber optical parametric amplifier with a temporally incoherent pump[END_REF] and for Raman amplifiers [START_REF] Hammani | Optical rogue-wave fluctuations in fiber Raman amplifiers[END_REF][START_REF] Finot | Selection of extreme events generated in Raman fiber amplifiers through spectral offset filtering[END_REF][START_REF] Hammani | Extreme statistics in Raman fiber amplifier : from analytical description to experiments[END_REF]: in both cases, a quasi-instantaneous gain and a low walk-off between the signal and a partially coherent pump lead to a dramatic transfer of fluctuations from the pump to the signal in a co-propagating configuration. In a previous work, we have numerically and analytically described the evolution of a continuous signal in a copropagating amplifier in the presence of a low walk-off and pump depletion [START_REF] Hammani | Extreme statistics in Raman fiber amplifier : from analytical description to experiments[END_REF]. We have also

shown that an adequate frequency shifted optical bandpass filter can isolate the most extreme structures [START_REF] Finot | Selection of extreme events generated in Raman fiber amplifiers through spectral offset filtering[END_REF].

In this contribution, we focus our attention on experimental results outlining the drastic consequences of the transfer of intensity fluctuations from the pump to a pulsed signal in a lumped Raman amplifier. Indeed, due to their scarcity and their high amplitude, characterization of the impact of extreme statistics remains a tricky task. Contrary to widespread quantitative techniques such as the measurement of the optical noise signal ratio (OSNR) or the relative intensity noise (RIN) [START_REF] Baney | Theory and measurement techniques for the noise figure of optical amplifiers[END_REF], we have chosen to present here a set of alternative qualitative methods that show the emergence of extreme fluctuations in a 10 GHz pulse stream. More precisely, this paper will successively present statistical records using photodiodes, optical auto-/cross-correlations, RF spectrum and optical spectrum. Forward and backward pumping schemes will be compared to dual-pass configurations.

Experimental Setup

Our experimental setup is sketched in Fig. 1a. An actively mode-locked erbium-doped fiber laser delivers a train of 2.9 ps pulses at a repetition rate of 10 GHz and with an initial average power of 10 mW (corresponding to a peak power of ~300 mW) at a wavelength of 1550 nm. Let us note that our previous works [START_REF] Hammani | Optical rogue-wave fluctuations in fiber Raman amplifiers[END_REF][START_REF] Finot | Selection of extreme events generated in Raman fiber amplifiers through spectral offset filtering[END_REF] or [START_REF] Schröder | Observation of high contrast, fast intensity noise of a continuous wave Raman fiber laser[END_REF] involved much lower repetition rates as the signal source was a MHz passively mode-locked fiber laser. The pump is delivered by a Raman continuous wave fiber laser centered at 1455 nm with an average power up to 2 W. An essential point is that this pump is a partially incoherent wave (~20 GHz of spectral width) that exhibits high contrast, fast intensity fluctuations [START_REF] Schröder | Observation of high contrast, fast intensity noise of a continuous wave Raman fiber laser[END_REF]. Indeed, its intensity autocorrelation signal (plotted in Fig. 1b) presents a characteristic contrast of one half [START_REF] Hammani | Optical rogue-wave fluctuations in fiber Raman amplifiers[END_REF][START_REF] Vanholsbeeck | The role of pump incoherence in continuous-wave supercontinuum generation[END_REF] with a temporal width of 25 ps. This temporal duration is a characteristic time of the shortest pump fluctuations and is much larger than the picosecond signal to be amplified while being shorter than the temporal separation between two successive pulses.

The amplification is performed in a 1-km long highly nonlinear fiber (HNLF). The low normal dispersion (0.7 ps.km -1 .nm -1 ) enables us to avoid solitonic or modulation instability effects. The high nonlinearity (10 W -1 .km -1 ) leads to a high Raman gain coefficient whereas linear losses and third-order dispersion are limited (0.70 dB.km -1 and 0.01 ps.nm -2 .km -1 respectively at 1550 nm). We have compared several pumping schemes: backward pumping (Fig. 1a1), forward pumping (Fig. 1a3) and two bi-directional pumping (Figs 1a2 and1a4)

relying on the use of optical circulators. Moreover, several pump powers ranging from 500 to 1500 mW have been tested, leading to integrated gains from 5 to 15 dB in single pass configurations and gains from 10 to 22 dB in dual-pass configurations. Several characterizations of the optical properties of the amplified signal have been carried

out. In the temporal domain, we have recorded the output pulse train and its associated statistics thanks to a high speed digital sampling oscilloscope (Tektronix TDS CSA 8200) combined with a photodiode having a 30 GHz bandwidth. We have complemented our study by using an optical intensity autocorrelator (Femtochrome, FR-103HS) to investigate pulse-to-pulse fluctuations.

Radio frequency spectra as well as optical spectra were also recorded and further insights on the spectral stability were gained by mapping the spectral evolution into the temporal domain.

Oscilloscope observations and statistical records

The most intuitive and straightforward way to explore and evaluate signal variation at the output of the Raman amplifier is the direct observation on a high-speed oscilloscope. Indeed, the eyediagram enables us to visualize the variations of the signal level in the various experimental configurations. Given the finite bandwidth of the electronics under use (typically 30 GHz, much below the optical bandwidth of our pulses), we do not resolve the details of the temporal intensity profile of the picosecond pulses. Therefore, we do not monitor rigorously the peak power of the pulses, but rather the fluctuations of their energy. As a first approximation and given the fact that the amplified pulses do not exhibit any pulse splitting in our normally dispersive fiber, we can however consider that those energy fluctuations are directly proportional to peak power variations [START_REF] Lafargue | Direct detection of optical rogue wave energy statistics in supercontinuum generation[END_REF].

The choice of the pumping configuration has a strong impact on the amplifier performance as can be readily noticed in Fig. 2. When the signal and the pump counter-propagate in the fiber, the output pulse train exhibits a low level of fluctuations (Fig. 2b) and maintains a quality comparable to the initial mode-locked signal (Fig. 2a). On the contrary, in a copropagating scheme, the stability of the output pulse train is drastically affected (Fig. We took advantage of the statistical functions embedded in the oscilloscope to get more quantitative data on the statistical distribution of the pulse energy fluctuations (Fig. 3). Results obtained for different pumping schemes (with a pump power of 1 W) are summarized in Fig. 3a and confirm the previous qualitative conclusions. In a backward pumping scheme, the statistical distribution of the pulse energy is quite narrow and can be compared to the initial pulse distribution. It heavily contrasts with the results recorded in a co-propagating scheme where the output statistical distribution presents heavy tails [START_REF] Hammani | Optical rogue-wave fluctuations in fiber Raman amplifiers[END_REF]. Events with pulse energy more than 30

times the median energy have indeed been recorded, illustrating the completely unusual amplitude of those fluctuations. Dual pass configurations exhibits slightly less degraded results, the most extreme events being less frequent compared to the single pass co-propagating scheme.

This can be mainly explained by the impact of gain saturation of the amplifier that ultimately limits the maximum energy that can be reached. We have also investigated in more details the influence of the pump power in a forward pumping scheme (Fig. 3b). Increasing the pump power impacts the tail of the statistical distribution by increasing the level of fluctuations: measurements carried out for pumping values between 500 and 1500 mW show that the probability of observing an event between 2 and 12 times the median energy increases with pump power. However, for larger gains and given the high repetition rate of the signal to be amplified, pump depletion effects and gain saturation become important, which leads to an upper limit of the pump energy and rapidly falling probability. Such a behavior is in full agreement with the numerical and analytical conclusions discussed in a previous article dealing with a continuous seed [START_REF] Hammani | Extreme statistics in Raman fiber amplifier : from analytical description to experiments[END_REF].

Optical correlations

The electrical bandwidth of our oscilloscope is not high enough to resolve the details of the pulse structure and to get access to the duration of the picosecond pulses. Even if optical sampling oscilloscopes with a THz bandwidth [START_REF] Andrekson | Nonlinear optical fiber based high resolution all-optical waveform sampling[END_REF] are nowadays available to resolve accurately the temporal profile of periodic pulse trains, we have based here our measurements on a standard, widely spread intensity autocorrelator. Intensity autocorrelations have already been used in previous works in Raman or parametric amplifiers [START_REF] Hammani | Emergence of extreme events in fiber-based parametric processes driven by a partially incoherent wave[END_REF][START_REF] Hammani | Optical rogue-wave fluctuations in fiber Raman amplifiers[END_REF][START_REF] Hammani | Extreme statistics in Raman fiber amplifier : from analytical description to experiments[END_REF]] using a continuous seed, providing indirect evidence of the existence of spikes of light.

Results obtained with a 10-GHz picosecond pulse train are plotted in Fig. 4. For single-pass amplifiers, no major modification of the temporal intensity autocorrelation can be noticed compared to the initial pulses. Similar output durations can be recorded in co-and counterpropagating configurations. This has to be linked to the weak dispersion of the highly nonlinear fiber that leads to a dispersion length (defined as the distance for which the initial pulse broadens by a factor 2 due to dispersion [START_REF]Nonlinear Fiber Optics, Fourth Edition[END_REF]) above 5.5 km, which is much higher than the fiber length.

However, let us note that the output duration obtained in the forward pumping scheme is slightly higher. Indeed, in this configuration, the pulse experiences more self-phase and cross-phase modulation [START_REF] Finot | Selection of extreme events generated in Raman fiber amplifiers through spectral offset filtering[END_REF][START_REF] Headley | Raman amplification in fiber optical communications[END_REF] (this point will be experimentally discussed in section 6 of this paper) so that the expanded spectrum leads to a slightly enhanced dispersion-induced temporal broadening.

Differences are much more marked when comparing the results obtained in dual-pass configurations. More precisely, the scheme where forward pumping is followed by backward pumping leads to significantly broadened output pulses. Such a broadening can once again be attributed to the large spectral expansion undergone in the first pass of the amplifier.

Figure 4: (a) Initial autocorrelation signal (blue solid line) is compared with autocorrelation for a counter-propagating configuration (dashed grey line) and for a counter-propagating pass followed by a co-propagating pass (dotted grey line). Results are compared to (b) autocorrelation for a co-propagating configuration (dashed grey line) and for a co-propagating pass followed by a counter-propagating pass (dotted grey line). Results obtained for an initial pump power of 1 W.

We have also recorded the autocorrelation over a larger temporal span in order to observe the cross-correlation peaks between a pulse and its preceding pulse delayed by 100 ps. Such measurements were not possible in the previous published studies due to the low repetition rate of the passively modelocked source [START_REF] Hammani | Emergence of extreme events in fiber-based parametric processes driven by a partially incoherent wave[END_REF][START_REF] Hammani | Optical rogue-wave fluctuations in fiber Raman amplifiers[END_REF][START_REF] Finot | Selection of extreme events generated in Raman fiber amplifiers through spectral offset filtering[END_REF] (requiring therefore a delay of several tens of ns). Interestingly, the level of this cross-correlation peak can provide pertinent information on the amplitude jitter degradation that affects the pulse train [START_REF] Fatome | All-optical measurements of background, amplitude, and timing jitters for high speed pulse trains or PRBS sequences using autocorrelation function[END_REF][START_REF] Vo | Simultaneous multi-impairment monitoring of 640 Gb/s signals using photonic chip based RF spectrum analyzer[END_REF][START_REF] Dinu | Optical performance monitoring using data stream intensity autocorrelation[END_REF]. Experimental results are summarized in Fig. 5. The initial pulse train exhibits a level of the central peak identical to the level of the cross-correlation peak, confirming the regime of mode-locking of the source. Such low pulse-to-pulse amplitude jitter is maintained in a backward amplification scheme. On the contrary, when pump and signal co-propagate, the peak of cross-correlation falls drastically, which highlights the significant change of amplitude between two successive amplified pulses. This is fully consistent with the typical duration of the fluctuations of the pump as measured by autocorrelation measurements (25 ps, see Fig. 1b), which is lower than the repetition rate that we considered. In this context, using higher repetition sources (80 GHz or above) could provide some additional useful information: the typical duration (25 ps) of a high fluctuation of the Raman pump being shorter than the pulse separation (100 ps), our 10-GHz signal does not fully sample all the pump fluctuations and can be quite affected by the relative delay between the pump structure and the temporal pulse position [START_REF] Finot | Selection of extreme events generated in Raman fiber amplifiers through spectral offset filtering[END_REF][START_REF] Schröder | Observation of high contrast, fast intensity noise of a continuous wave Raman fiber laser[END_REF].

Using the temporal width of the cross-correlation peak, one could also evaluate the timing jitter [START_REF] Fatome | All-optical measurements of background, amplitude, and timing jitters for high speed pulse trains or PRBS sequences using autocorrelation function[END_REF]. We have found in our experiments that there was no significant increase of timing jitter in the amplification process, confirming therefore that the main source of degradation was amplitude jitter. Measurements carried out on dual pass configurations have shown that a similar signature of the high degradation of the amplitude stability is observed.

Records made according to the pump power in a co-propagating configuration (Fig. 5c) confirm the conclusions drawn in section 3 (Fig. 3b). Indeed, increasing the pump power first leads to an increase of the number of extreme events, i.e. of the pulse-to-pulse fluctuations, translating into a lower cross-correlation peak. On the contrary, for higher gain, gain saturation reduces the fluctuations and the cross-correlation peak amplitude increases. is compared with cross-correlation for a counter-propagating configuration (dashed grey line) and for a counter-propagating pass followed by a co-propagating pass (dotted grey line). Results are compared to (b) cross-correlation for a co-propagating configuration (dashed grey line) and for a co-propagating pass followed by a counter-propagating pass (dotted grey line). Results are obtained for an initial pump power of 1 W. (c) Influence of the pump power in a co-propagating configuration for various initial pump powers: 500 mW (dashed grey line), 1 W (dotted blue line) and 1.5 W (solid red line).

Radio frequency spectrum

We complement our measurements by recording the radio frequency (RF) spectrum of the pulse train. Note that ideally, this data is linked to the autocorrelation signal we have previously described through the Wiener-Khinchine theorem. However, in practice, the finite temporal duration of analysis of the autocorrelator and the frequency bandwidth limitation of the optoelectronic of the usual radiofrequency spectrum analysers (as long as optical radiofrequency analysis is not used [START_REF] Pelusi | Photonic-chip-based radio-frequency spectrum analyser with terahertz bandwidth[END_REF]) lead to a truncation of the signal, so that it is of interest to consider experimentally both records separately. Therefore, RF spectra are intensively used to characterize the optical amplifier properties: the measurement of the relative intensity noise (RIN) has indeed become a standard analysis to discuss the performance of optical amplifiers [START_REF] Baney | Theory and measurement techniques for the noise figure of optical amplifiers[END_REF]. Other authors have also proposed to extract from the comb-like RF spectrum the amplitude and timing jitters of the periodic signal [START_REF] Von Der Linde | Characterization of the noise in continuously operating mode-locked lasers[END_REF]. However, this latest application is not relevant to our experiment as it requires the analysis of a large number of harmonics peaks (we are limited by the RF bandwidth to the analysis of two 10 GHz harmonic components) and as it is based on the strong assumption of small variations having a Gaussian probability distribution, which is clearly not our case in the described experiments.

In the context of this work, modestly, we show that depending on the configuration, the noise level significantly changes (Fig. 6). As predicted by the theoretical work of Fludger [START_REF] Fludger | Pump to signal RIN transfer in Raman fiber amplifiers[END_REF],

we check that the backward pumping scheme exhibits significantly better performance than the forward pumping. What is striking on the signal obtained in this latest configuration is the presence of clear additional peaks in the vicinity of the 10 GHz components. Those peaks are attributed to the transfer of intensity noise from the pumping laser to the pulsed signals and the use of a high-repetition rate (10GHz instead of a few tens of MHz typical of modelocked sources) has facilitated their unambiguous detection. Note that these peaks are already present in the initial pump (Fig 6c) and are characteristic of the pumping laser used [START_REF] Babin | Experimental demonstration of mode structure in ultralong Raman fiber lasers[END_REF][START_REF] Babin | Relative intensity noise in cascaded-Raman fiber lasers[END_REF]. The modal properties of this Raman fiber laser are quite complex and depend on the output power as can be seen from Fig. 6 (c): for output power of 1 W, the noise is structured with spikes spaced by 0.6 GHz whereas for 500 mW, spikes are randomly spaced up to 0.5 GHz. Detailed study of the properties of the pumping laser exceed by far the scope of the present work, but these RF measurements suggest that the simplified assumptions made for modeling the behavior of the Raman amplifier (Gaussian optical spectrum with a random phase [START_REF] Hammani | Optical rogue-wave fluctuations in fiber Raman amplifiers[END_REF][START_REF] Hammani | Extreme statistics in Raman fiber amplifier : from analytical description to experiments[END_REF][START_REF] Vanholsbeeck | The role of pump incoherence in continuous-wave supercontinuum generation[END_REF]) are not fully sufficient to retrieve the details of the RF spectrum. In both cases, the initial RF spectrum of 10 GHz-laser (solid dark blue line) is compared to RF spectra obtained for an initial pump power of 500 mW (solid light blue line), 1500 mW (solid green line) and 1500 mW in dual-pass configuration (solid red line). Subplots (a2) and (b2) magnify the central part of spectra (between 9 and 11 GHz) respectively in (a1) and (b1). Results are compared to (c) RF spectra of the pump for two initial powers: 500 mW (solid dark blue line) and 1000 mW (solid green line) over 2 GHz.

Optical Spectrum

We also performed a spectral analysis by recording the output optical spectra. Indeed, we expect the rogue events to also significantly alter the phase of the pulses, which cannot be easily monitored using the previously described methods. Noticeable changes affecting the optical spectrum are summarized in Fig. 7. Two frequency spans were considered: a 150 nm span in order to observe the spectral broadening of the pulses and the cascading of the Raman process and a 5 nm span in order to observe the details of the spectral structure of the optical field.

From the 150-nm span records, we can first make out the significant spectral expansion that is experienced by the pulse train during its amplification in all the various pumping schemes.

However, the level of spectral broadening differs significantly according to the setup. Indeed the broadening is increased for a co-propagating configuration, as a consequence of the longitudinal peak-power evolution over the fiber amplifier resulting for a forward pumping in a higher integrated self-phase modulation [START_REF] Headley | Raman amplification in fiber optical communications[END_REF][START_REF] Finot | Influence of the pumping configuration on the generation of optical similaritons in optical fibers[END_REF]. The impact of cross-phase modulation of the pump on the signal may also in a lesser extend increase the spectral broadening [START_REF] Finot | Selection of extreme events generated in Raman fiber amplifiers through spectral offset filtering[END_REF]. We have checked that filtering with a frequency offset optical band pass filter may offer an interesting way to isolate rarest and most intense pulse obtained in a co-propagating scheme [START_REF] Finot | Selection of extreme events generated in Raman fiber amplifiers through spectral offset filtering[END_REF]. On the contrary, for pulses amplified in a back-pumping scheme, the pulse train obtained after the same offset spectral filtering remains periodic with low peak-to-peak fluctuations.

We can also note a strong impact on the cascading of the Raman process. Contrary to a counter-propagating configuration where for a single pass amplifier, no cascading is observed, we can notice the emergence of a Stokes in a forward pumping scheme: the most powerful rogue structures have reached a peak power high enough to generate their own Raman Stokes. We therefore anticipate that filtering this Raman Stokes may offer an alternate solution to isolate rogue events. Such a Stokes wave may further be amplified in a second pass counter-propagating segment. Regarding the closer view of the central part of the spectra, we should ideally obtain a spectrum of lines spaced by the repetition rate, i.e. 10 GHz. Our initial spectrum (see Fig. 7)

clearly exhibits such a comb structure although we are limited in some extent by the finite resolution (0.02 nm) of our optical spectrum analyzer (OSA). Note that the resolution used in this setup does not match the resolution with which OSNR measurements are usually performed in the optical domain [START_REF] Baney | Theory and measurement techniques for the noise figure of optical amplifiers[END_REF], but such measure is not our aim here. The comb feature is maintained during the propagation in a counter-propagating configuration (Fig 7a2). However, we find that in a forward pumping scheme, the contrast of line spectrum falls dramatically (Fig 7b) and one can hardly guess the initial 10-GHz lines. This indicates clearly the existence of significant fluctuations which breaks the 10-GHz periodicity of the optical field. We note also that in a dualpass configuration, due to the changes in the co-propagating segment, the contrast is very poor.

Spectrum observations based on wavelength-to-time mapping

The optical spectra presented in the previous section are intrinsically averaged so that they cannot provide any information on the pulse-to-pulse spectral fluctuations. In order to get some insights of the spectral stability, we have added before detection on the photodiode a segment of dispersion compensating fiber (DCF with a dispersion of -100 ps/km/nm). The amplified signal under investigation has been attenuated so that the linear propagation essentially imposes a large parabolic spectral phase. The length of the DCF fiber has been chosen so that the dispersionbroadened pulses do not overlap with the neighboring pulses, the 100 ps pulse spacing therefore represents a limit of the temporal broadening we induce.

The interest of this additional highly dispersive segment lies in the possibility it offers to translate the spectral shape into the temporal domain, which is a technique known as time stretch

Fourier transform [START_REF] Jalali | Real-time measurements, rare events and photon economics[END_REF]: when the pulses are sufficiently dispersed, one can benefit from a one-toone mapping of the optical frequency into time. In other words, the fluctuations of the optical spectrum will be converted into fluctuations in the temporal domain and the eye diagram will enable to easily monitor those fluctuations. Note here that we focus exclusively on the eye diagram without trying to see each pulse individually. In this sense, we're going less far than B.

Jalali and coworkers who have initially proposed this technique in order record individually optical rogue events [START_REF] Solli | Optical rogue waves[END_REF][START_REF] Jalali | Real-time measurements, rare events and photon economics[END_REF]. Let us also stress that the configuration we study should not be confused with the Raman amplification scheme used to improve the sensitivity of the time stretch Fourier transform [START_REF] Chou | Real-time spectroscopy with subgigahertz resolution using amplified dispersive Fourier transformation[END_REF]. Results are summarized in Fig. 8 for the different pumping configurations. In the backward pumping scheme (Fig. 8a), stability is conserved, in agreement with the previously discussed results. In the other pumping configurations (Fig. 8 (b-d)), very large fluctuations of the temporal width are recorded revealing the dramatic pulse-to-pulse changes of the spectral extent of the pulses before this wavelength-time mapping process. This therefore confirms the interest of carrying spectral filtering with a frequency offset optical band pass filter to isolate the rarest and most intense pulses [START_REF] Finot | Selection of extreme events generated in Raman fiber amplifiers through spectral offset filtering[END_REF].

Conclusions

We have presented in this paper several non-standard characterization methods which highlight qualitatively the specific nature of fluctuations observed in a lumped Raman amplifier pumped in a co-propagating way. Similar events may also be found in other devices like waveguides as it has been shown by Borlaug et al. [START_REF] Borlaug | Extreme value statistics in silicon photonics[END_REF]. All the various effects highlighted here are mainly related to the transfer of pump noise on the amplified signal. In other words, there are not linked to accumulation of amplified spontaneous emission in the amplifier nor by the beat noise-noise or noise-signal nor by multi-interference pattern. Therefore, several widely-spread methods used to perform optical performance monitoring and determine optical signal to noise ratio [START_REF] Pan | Optical performance monitoring for the next generation optical communication networks[END_REF] may fail to efficiently take into account all those highly damaging impairments.

All the trends described in this work have been confirmed by intensive numerical simulations (not detailed here) based the integration of a set of two coupled nonlinear Schrödinger equation including the Raman amplification [START_REF] Hammani | Optical rogue-wave fluctuations in fiber Raman amplifiers[END_REF][START_REF] Finot | Selection of extreme events generated in Raman fiber amplifiers through spectral offset filtering[END_REF][START_REF] Hammani | Extreme statistics in Raman fiber amplifier : from analytical description to experiments[END_REF] with the assumption of a pump having a Gaussian statistics. Note however that this assumption fails in reproducing the results obtained by RF measurements, highlighting the complex nature of the output of the Raman fiber pump laser.

We expect our results to be expandable to other amplifiers such as parametric amplifiers.

The physical principle of parametric amplifiers may however lead to additional points to be discussed such as the consequences of the phase-sensitive nature of those devices.

MANUREVA project: ANR-08-SYSC-019) and by the Conseil Régional de Bourgogne (PARI Photcom). The experimental work has benefited from the PICASSO Platform equipment.

Figure 1 :

 1 Figure 1: (a1-a4) Various experimental setups under investigation (b) Intensity autocorrelation of the pump.

  scheme, the stability of the output pulse train is drastically affected (Fig.2c) and striking

Figure 2 :

 2 Figure 2: Eye diagrams in several cases: a) initial mode-locked laser, b) counter-propagating configuration, c) co-propagating configuration d) dual pass configuration.

Figure 3 :

 3 Figure 3: Probability distribution of the amplified signal energies. The results are normalized by the median value. (a) Impact of the pumping configurations for a fixed initial pump power of 1000 mW. Results obtained in a counter-propagating scheme (dotted grey line) are compared to results recorded in co-propagating, co + counter-propagating and counter + co-propagating schemes (solid light blue line, dashed black line, solid black line respectively). (b) Impact of the pump power in a co-propagating configuration. Results obtained for a 1 W pump power (solid light blue line) are compared with results obtained for pump powers of 0.5 and 1.5 W (solid dark blue line and dotted grey line respectively).

Figure 5 :

 5 Figure 5: Cross-correlation showing signal degradation. (a) The initial cross-correlation (solid blue line)is compared with cross-correlation for a counter-propagating configuration (dashed grey line) and for a counter-propagating pass followed by a co-propagating pass (dotted grey line). Results are compared to (b) cross-correlation for a co-propagating configuration (dashed grey line) and for a co-propagating pass followed by a counter-propagating pass (dotted grey line). Results are obtained for an initial pump power of 1 W. (c) Influence of the pump power in a co-propagating configuration for various initial pump powers: 500 mW (dashed grey line), 1 W (dotted blue line) and 1.5 W (solid red line).

Figure 6 :

 6 Figure 6: RF spectra for (a) a counter-propagating case are compared with spectra for (b) a copropagating case.In both cases, the initial RF spectrum of 10 GHz-laser (solid dark blue line) is compared to RF spectra obtained for an initial pump power of 500 mW (solid light blue line), 1500 mW (solid green line) and 1500 mW in dual-pass configuration (solid red line). Subplots (a2) and (b2) magnify the central part of spectra (between 9 and 11 GHz) respectively in (a1) and (b1). Results are compared to (c) RF spectra of the pump for two initial powers: 500 mW (solid dark blue line) and 1000 mW (solid green line) over 2 GHz.

Figure 7 :

 7 Figure 7: Optical Spectra for (a) a counter-propagating configuration and (b) a co-propagating configuration. In both cases, the initial spectrum of 10 GHz-laser (solid blue line) is compared to spectra obtained for an initial pump power of 500mW (solid black line), 1500mW (solid grey line) and 1500 mW in dual-pass configuration (solid light grey line). Subplots (a2) and (b2) magnify the central part of spectra respectively in (a1) and (b1).

Figure 8 :

 8 Figure 8: Eye diagrams for several configurations: (a) counter-propagating, (b) Dual pass starting by a counter-propagating pass (c) co-propagating and (d) Dual pass starting by a co-propagating pass. Results obtained for an initial pump power of 1.5 W.

Acknowledgements

We would like to thank Guy Millot, Antonio Picozzi, Bertrand Kibler and Julien Fatome for fruitful discussions. This research was supported by the Agence Nationale de la Recherche (ANR