Hao Liu

Baoshu Yin

Numerical investigation of nutrient limitations in the Bohai Sea

Keywords: P ratio, algae bloom, a coupled biogeochemical-physical model, Bohai Sea

River discharges are the important freshwater and nutrient sources for Bohai Sea (BS), and have a profound impact on the local marine environment. In this paper, the annual cycles of nutrient and phytoplankton dynamics in 1980s were reproduced using a coupled biogeochemical-physical model. Based on the validated simulations, the nutrient limitation characters were further investigated by running the model with the riverine nutrient altered, first enriching nitrogen and then phosphorus. It was found that although the riveine N:P ratios in Yellow and Haihe Rivers were much higher than the Redfield number, the nitrogen enrichment was still able to enhance the algae bloom in Laizhou and Bohai Bays. On the other hand, the response of algae growth to phosphorus enrichment was not thus obvious, which suggests the local phytoplankton dynamics was characterized by the nitrogen limitation. Simulations also show that the nitrogen enrichment is generally accompanied by the phosphorus consumption, so a shift from nitrogen limitation to phosphorus limitation may occur if such a trend continues.

Introduction

As several kinds of nutrient coexist in an aquatic environment, the phytoplankton dynamics is always limited by the one whose amount is most closely approaching the critical minimum required to sustain the algae growth [START_REF] Zou | In situ nutrient enrichment experiment in the Bohai Sea and Yellow Sea[END_REF]. In the marine systems, nitrogen and phosphorus are generally thought to be two kinds of basic nutrient essential for phytoplankton photoproduction, though silicate and some other trace metal (like iron) may play a considerable role in certain regions [START_REF] Shen | Nutrient structure of seawater and ecological responses in Jiaozhou Bay, China[END_REF][START_REF] Falkowski | Biogeochemical controls and feedbacks on ocean primary productivity[END_REF][START_REF] Chai | Origin and maintenance of high nitrate condition in the Equatorial Pacific, a biological-physical model study[END_REF]. The concentrations of nitrogen and phosphorus and their elemental ratios of are known to have a straightforward effect on the local phytoplankton communities. Empirical expression of the nutrient limitation is the Redfield ratio (atomic ratio of N:P::16:1), which is the stoichiometric requirement for algae having a balanced growth [START_REF] Redfield | The influence of organisms on the composition of seawater[END_REF][START_REF] Turner | Future aquatic nutrient limitations[END_REF]. Strong deviation from this ratio indicates that the nutrient in lesser supply becomes limiting for phytoplankton growth if a minimal amount is available.

During the past decades, the controversy about which nutrient is the major limiting factor to the net organic production never ceased [START_REF] Smith | Phosphorous versus nitrogen limitation in the marine environment[END_REF]. Since nitrogen deficits can be abated by the biological fixation of atmospheric nitrogen, one viewpoint argued that nitrogenous compounds can accumulate until phosphorus is utilized in the sea [START_REF] Smith | Phosphorous limitation of net production in a confined aquatic ecosystem[END_REF][START_REF] Smith | Low nitrogen to phosphorous ratios favor dominance by blue-green algae in lake phytoplankton[END_REF]. On the other hand, some marine biologists suggested that nitrogen may be more limiting in coastal waters, since nitrogen fixation there is not as effective as in open oceans, and more importantly, phosphorus is generally regenerated in a faster manner in these environments [START_REF] Ryther | Nitrogen, phosphorous, and eutrophication in the coastal marine environment[END_REF][START_REF] Zhang | Waters characteristics of nutrient limitation[END_REF][START_REF] Liu | Phosphorus cycling in sediments of the Bohai Sea and Yellow Sea[END_REF]. Nutrient enrichment experiment is an operational tool for examining the potential nutrient limitation, in which one or several nutrients are added to a given volume of water to determine if algae growth is stimulated [START_REF] Zou | In situ nutrient enrichment experiment in the Bohai Sea and Yellow Sea[END_REF]. However, such in situ experiments can only be conducted on a short-time scale at several discrete sites, so it could not reflect the long term response of marine ecosystems.

Numerical nutrient enrichment experiment may be a potential substitute as it can be conducted optionally.

Bohai Sea (37º10´~41º10´N,117º35´~122º10´E) is a typical semi-enclosed shallow sea, which is located on the northwest of Pacific Ocean. Just as Figure 1 shows, it has three bays, namely Laizhou, Bohai and Liaodong Bays. The biogeochemical environment of BS is strongly influenced by tides, East Asia Monsoons and riverine inputs. Among over 40 rivers flowing into BS, Yellow, Haihe, Daliaohe and Luanhe are four major ones. [START_REF] Cui | Study on status of bio-physic-chemical environment in the Bohai Sea[END_REF] reported that the hydrochemistry feature in BS had changed significantly in the past decades, which was characterized by the moderate increase of nitrogen, the moderate decrease of silicate, and the drastic decrease of phosphorus, respectively. How the variation in riverine nutrients influence the phytoplankton dynamics invites our interests. Therefore, by virtue of a coupled biogeochemical-physical model, two numerical experiments were conducted first to examine the response of algae growth to the variations of riverine inputs, and further to investigate its influence on the nutrient limitation characters in BS.

Model description

The scheme of the biogeochemical model is given in Figure 2. This model belongs Figure 1 to the Nutrient-Phytoplankton-Zooplankton-Detritus (NPZD) type, and it is coupled to a 3-dimensional baroclinic coastal ocean model developed by [START_REF] Blumberg | A description of a three-dimensional coastal ocean circulation model[END_REF].

The physical model is conventionally called Princeton Ocean Model (POM), which uses the curvilinear orthogonal coordinates in the horizontal and the sigma coordinate in the vertical, respectively. The level-2.5 Mellor-Yamada turbulence closure scheme (1982) and the Smagorinski scheme are used to simulate the vertical mixing and horizontal diffusion, respectively. Advection is simulated using a one-order upwind scheme with anti-dissipation treatment, which is monotonic and positive-definite (does not permit negative values), a feature essential for the biogeochemical tracers [START_REF] Christian | Advection in plankton models with variable elemental ratios[END_REF].

After some improvements, POM can be used to simulate the hydrodynamic features in BS. For example, by adding a surface wave mixing parameter to the turbulence closure model, [START_REF] Lin | A well-mixed warm water column in the central Bohai Sea in summer: effects of tidal and surface wave mixing[END_REF] captured the well-mixed warm water column apparent in summer in the central basin; by adding a surface heat budget model, [START_REF] Liu | Annual cycle of stratification and tidal fronts in the Bohai Sea: A model study[END_REF] Solar radiation is used by phytoplankton for photosynthesis, and it is an important parameter for the ecosystem modeling. Therefore, a sound real-time irradiation model was developed to calculate the light intensity both on the sea surface and in the water column (Liu and Yin, 2006b). On the sea surface, solar radiation is a function of solar height and cloud parameter. Beneath the sea surface, it is not only depth-dependent, but as will be shown in equation A.10, it is also the function of pigment concentrations in the water column.

Riverine input is the important external nutrient source for BS, so a reliable river discharge model is necessary to reproduce the proper transportation of river-borne nutrient in seawaters. Following [START_REF] Kourafalou | River plume development in semi-enclosed Mediterranean regions: North Adriatic Sea and Northwestern Aegean Sea[END_REF], each river mouth is taken as a point source, from which freshwater flows into the top grid cell, inducing the sea surface height variation, so it can be written as

( ) d Q t dt x y η σ = ∆ ∆ ∆ (1)
Where, η is sea surface elevation; x ∆ and y ∆ are the length and width of the top grid cell at the point source, respectively; σ ∆ is the height of that grid cell; ( ) Q t is the time-variable runoff.

Similarly, river-induced variation in nutrient concentration and other scalars like temperature or salinity at the point source can also be expressed as

( ) d Q t dt L x y ϕ φ σ = ∆ ∆ ∆ (2)
Where, L H η = + is the real water depth; φ indicates the nutrient concentration, temperature or salinity in rivers; ϕ denotes those variables in the ambient seawaters.

The climatological runoff of four major rivers in 1980s is given in Figure 3. Four rivers are seasonal and the freshwater inputs mainly concentrate in the wet season (from July to October). Therefore, the riverine nutrient may have relatively little influence on the algae growth in spring. In addition, Figure 3 also shows that Yellow River accounts for more than 60% freshwater inputs to BS.

Table 1 lists the dissolved inorganic nitrogen and phosphate concentrations in four rivers. Data in the standard case column are from [START_REF] Zhang | Dynamics of inorganic nutrient in the Bohai seawaters[END_REF], and data in the other two columns are adapted to the nutrient enrichment experiments. In the nitrogen enrichment experiment, the concentration of river-borne nitrogen was set to be 1.5 times that of the standard case, whereas in the phosphorus enrichment experiment, the Figure 3 concentration of riverine phosphate is set to be about one order higher than that in ambient seawaters. Sediment release is another external nutrient source for the BS ecosystem, and the sediment-water nutrient flux was estimated by [START_REF] Zhang | Dynamics of inorganic nutrient in the Bohai seawaters[END_REF].

The detailed description of the biogeochemical model is given in Appendix A. For the convenience of estimating the N:P ratio directly, we take the dissolved inorganic nitrogen (including nitrate, ammonium and nitrite) as a single material. to the transportation of sediment-borne nutrient into the euphotic zone. The detailed boundary and initial conditions are described in Appendix B.

Horizontal resolution was 5´ by 5´, and 15 sigma layers were divided in the vertical.

Time steps prescribed to the external and internal mode of the physical model were 15 seconds and 450 seconds, respectively, and the biogeochemical processes were updated every 30 minutes. The model was run for 2 years, and the results of the second year were presented for analysis.

Model results and analysis

Validation of simulations

The annual cycle of the primary productivity and f-ratio have been successfully

reproduced by Liu and Yin (2006a) using the original version of the coupled biogeochemical-physical model in which inorganic nitrogen was separated into nitrate and ammonium. In this study, much attention was paid to the nutrient limitation characters, so the simulated nutrient and phytoplankton dynamics need to be examined firstly. Figure 4 compares the simulated and observed annual cycles of nitrogen and phosphorus at the surface layer of BS, in which observations are basin wide data derived from the MABHE datasets [START_REF] Chen | Marine Atlas of Bohai Sea, Huanghai Sea, East China Sea[END_REF]. It was found that both nutrients are characterized by the lowest level in summer and the highest level in winter. Previous investigations in BS have shown that the seasonal variation in the phytoplankton community exhibits a double-peak structure, corresponding to spring and autumn bloom, respectively [START_REF] Fei | The study on the primary productivity in the Bohai Sea-chlorophyll a, primary productivity and potential fisheries resources[END_REF][START_REF] Wei | Plankton dynamics in the Bohai Sea-observations and modeling[END_REF]. It is the typical feature in the North

Hemisphere. The onset of algae bloom is always at the cost of consumption of much nutrient, so it is not surprising to see that nutrient concentration at the surface layer has declined to a very low level as the second bloom occurs in early autumn. In winter, the nutrient stock can rapidly resume due to the algae inertia in cold waters. As for what extent the nutrient stock can return to, it mainly depends on the load of external nutrient sources and the nutrient regeneration characters.

Following the conventional method, the phytoplankton biomass is expressed using the chlorophyll-a stock. Figure 5 shows the comparison of the simulated and observed annual cycle of chlorophyll-a at the surface layer, in which observations are basin wide data derived from [START_REF] Fei | The study on the primary productivity in the Bohai Sea-chlorophyll a, primary productivity and potential fisheries resources[END_REF]. Three bays are the direct receivers of river discharge the BS strait [START_REF] Liu | Annual cycle of stratification and tidal fronts in the Bohai Sea: A model study[END_REF]. As a result, the vertical material exchange is effectively blocked, and the phytoplankton biomass begins to accumulate in a rapid manner in the Figure 5 euphotic zone. Therefore, it is sure for us to suggest that the evolution of thermal stratifications may be an important reason for the spring bloom to occur later in the central basin than in shallow bays.

It is interesting to note that in BS the most intense algae bloom generally occurs in spring, not in summer when is characterized by the highest level of primary productivity [START_REF] Wei | Plankton dynamics in the Bohai Sea-observations and modeling[END_REF][START_REF] Fei | The study on the primary productivity in the Bohai Sea-chlorophyll a, primary productivity and potential fisheries resources[END_REF]Liu and Yin, 2006a). This phenomenon may be ascribed to the strong grazing pressure from zooplankton [START_REF] Bai | Studies on the fluctuation of zooplankton biomass and its main species number in the Bohai Sea[END_REF][START_REF] Zhao | Winter and summer chlorophyll-a and nutrient distribution and characteristics in the Bohai Sea[END_REF]. In addition, the drastic reduction in nutrient stock due to the onset of spring bloom may also limit the intensity of the second bloom to some extent.

Since summer is the most productive season in BS, the primary productivity profiles along a cross section (see Figure 1 for position) in august are presented to check the model results, which also could be used to examine the irradiation simulation to some extent. The observations are estimated by [START_REF] Zhao | The influence of physical factors on the variation of phytoplankton and nutrients in the Bohai Sea[END_REF] using the conventional chlorophyll-a method. Figure 6 shows that although the simulated euphotic zone is somewhat overestimated compared to observations, the similar patterns are achieved with the higher productivity to be centered on the top of the stratifications. The highest productivity appears between 119º30´ and 120º00´E, a position within the well-mixed warm water column reported by [START_REF] Lin | A well-mixed warm water column in the central Bohai Sea in summer: effects of tidal and surface wave mixing[END_REF] who suggested that both tide and wind-wave induced mixing contribute to such a distinct warm water structure. Therefore, more benthic nutrient can be brought into the euphotic zone, which is essential for the algae's photo-production.

Horizontal distribution of inorganic nitrogen and phosphate

The simulated nitrogen and phosphorus at the surface layer of BS are given in Figure 7. In winter, the high level of nitrogen mainly distributes in three bays, and the central basin shows the lower nitrogen concentration (Figure 7a). Such a pattern is not surprising, because there are approximately 4.96×10 9 , 7.78×10 8 and 3.50×10 8 mol nitrogen annually discharged into Laizhou Bay, Bohai Bay and Liaodong Bay through YR, HR and DR, respectively [START_REF] Zhang | Dynamics of inorganic nutrient in the Bohai seawaters[END_REF]. Most of the newly inputted nutrients are firstly consumed by phytoplankton, and then through a series of biogeochemical-physical processes they are ultimately released into the local water column in winter. Contrary to the situation in winter, the nitrogen concentration has declined markedly in summer (Figure 7b). Nitrogen is almost exhausted in the central basin, whereas three bays can maintain a relatively high level of nitrogen due to the continuous riverine inputs.

For a clear specification of the influence of riverine inputs, Figure 8 gives the simulated sea surface salinity distribution in the wet season, which represents the evolution of river plume under both tide and wind forcings. As shown in Figure 8, the 30 psu contour can be approximately regarded as a partition between the river water and the ambient seawater, namely the freshwater front. It is these fronts that effectively limit the river-borne nutrients to spread into the central basin. Although the central basin lacks the riverine inputs, it has a well mixed warm water column due to both wind wave stirring and tidal mixing [START_REF] Lin | A well-mixed warm water column in the central Bohai Sea in summer: effects of tidal and surface wave mixing[END_REF], thus more sediment-borne nutrients can be transported to the euphotic zone to sustain the second algae bloom.

Phosphorus shows a different distribution pattern compared to that of nitrogen,

Figure 8 since the relatively high level of phosphate concentrates in the central basin rather than in the Laizhou Bay which is the direct receiver of riverine phosphate from Yellow River.

The climatological N:P ratio in YR is about 350.7 (far higher than the Redfield ratio), at the meanwhile its runoff accounts for 60% of the freshwater inputs for BS, which means that much more phosphorus from the ambient seawater is consumed by phytoplankton for a balance growth. Therefore, the lowest level of phosphate appears in the Laizhou Bay no matter in winter or in summer, just contrary to the situation of nitrogen. Although the N:P ratio in Haihe River can also reach 82.2, its small runoff would not induce the over-consumption of phosphorus in the Bohai Bay. The highest level of phosphorus distributes in the Liaodong Bay, since the N:P ratio in Daliaohe River is lower than 16, meaning that newly inputted phosphorus may be surplus for algae to maintain the normal growth. In addition, the algae inertia in cold waters may play a minor role, which is correlated with the relatively low level of chlorophyll-a stock in the Liaodong Bay.

Figure 3 has shown that the N:P ratio is not constant in an annual cycle. From

Figure 7 it can be further inferred that in winter, the highest N:P ratio appears in coastal waters, especially in the YR estuary where the phytoplankton dynamics shows somewhat phosphorus limitation based on the Redfield ratio. In summer, the nitrogen stock was almost depleted due to the intense onset of spring bloom and its weak regeneration mechanism compared to that of phosphorus. On the other hand, phosphorus shows a strong regeneration mechanism that maintains a moderate variation in the annual cycle.

Therefore, in summer, the nitrogen limitation may be dominant throughout BS except the mouth of YR, where the riverine nitrogen is still able to maintain the relatively high N:P ratio. It can be further suggested that the riverine inputs play an important role in shaping the nutrient distribution patterns in BS, and that any drastic variations in nutrient concentrations, in N:P ratio or in river discharges will inevitably exert a profound influence on the local nutrient and phytoplankton dynamics.

Numerical nutrient enrichment experiments

Based on the validated simulations, we would investigate the influence of riverine inputs on the local nutrient and phytoplankton dynamics. Two nutrient enrichment experiments were conducted. By running the coupled biogeochemical-physical model with riverine nitrogen and phosphorus altered in turn, we can examine the response of algae growth and nutrient limitations.

Figure 9, 10 and 11 respectively give the annual cycles of chlorophyll-a, nitrogen and phosphorus at four regions of BS. It was found that although the N:P ratios in YR and HR rivers have already been as high as 350.7 and 82.2 respectively in the standard case, the enriched river-borne nitrogen is still able to enhance the phytoplankton biomass in the Laizhou and Bohai Bays. On the contrary, as river-borne phosphate was enriched, the chlorophyll-a stock in these two bays did not display an obvious response though the concentration of riverine phosphate has increased 10 times relative to the standard case.

Therefore, it can be suggested that the phytoplankton dynamics in the Laizhou and Bohai bays are still nitrogen limited by and large.

Figure 10 shows that in the nitrogen enrichment experiment, the nitrogen stock in Laizhou and Bohai Bays increased significantly compared to the standard case especially in winter. As a consequence of nutrient limitation, the phosphorus stock experienced some decreases (see figure 11). This phenomenon was particularly apparent in the wet season as more phosphorus was consumed to sustain the autumn algae bloom. In the phosphorus enrichment experiment, the nitrogen stock in the Laizhou Bay decreased a bit, whereas it was not that apparent in the Bohai Bay, since riverine phosphate flowing into the Laizhou Bay through YR was much more than that flowing into the Bohai Bay

Figure 9 through HR.

The Liaodong Bay shows a different situation from two other bays, as the chlorophyll-a stock did not change very much compared to the standard case, no matter the nitrogen enrichment or the phosphorus enrichment was performed. Similarly, nitrogen and phosphorus contents were also kept at a relatively constant level in two numerical experiments. The Liaodong Bay is the largest in area among three bays, whereas the nitrogen load through DR is the lowest among four rivers. Although the phosphate concentration in DR is the highest, the river-borne phosphate seemed not to enhance the phytoplankton biomass in a nitrogen-limited environment. In addition, the riverine nutrients through DR were basically confined to the northern end of the bay due to the evolution of river plume (see Figure 8), thus the response of algae to the variation in riverine nutrients is not significant in terms of the whole bay. The central basin also displayed some nitrogen limited characters, as the enriched nitrogen can lead to the higher chlorophyll-a stock during two algae blooms whereas the enriched phosphorus does not.

Figure 10 Although the BS ecosystem is nitrogen limited as a whole, it won't prevent the appearance of phosphorus limitation in certain regions or at certain times, especially in the YR estuary. Our simulations indicate that the increase of one nutrient stock is always accompanied by the decrease of the other one. Therefore, it can be suggested that the local nutrient limitation characters are changeable, largely depending on the composition and load of external nutrients.

Discussion

Observations at different times [START_REF] Kang | Distribution and seasonal variation of phytoplankton in the Bohai Sea[END_REF][START_REF] Wei | Plankton dynamics in the Bohai Sea-observations and modeling[END_REF] have shown that diatom is always the dominant algae species in BS, so silicate may play an important role in the phytoplankton dynamics. Although the silicate stock has decreased a lot since late 1950s, it is still high enough to avoid from becoming the limiting nutrient (Cui et al., 1991;[START_REF] Zhang | Dynamics of inorganic nutrient in the Bohai seawaters[END_REF]. Therefore, we did not take it into account in the present modeling. However, if the river discontinuity, which is generally thought to be the major reason for the reduction of silicate in BS, is not ameliorated, or if there is no other Figure 11 makeup mechanism yet, the continuous decrease in silicate stock will enable it a potential limiting factor in the future.

Despite phosphorus inputs through river discharge did not change very much in past decades, the nitrogen inputs increased in a rapid manner at the meanwhile. Therefore, we thought it is the mutual competition and limitation between two nutrients that lead to the continuous decrease in phosphorus stock in BS, as one nutrient increases more quickly, the other one will suffer from the ultimate decrease. Accordingly, the nutrient limitation characters may undergo a corresponding shift in the long term as a response to the changes in N:P ratios. In fact, [START_REF] Zou | In situ nutrient enrichment experiment in the Bohai Sea and Yellow Sea[END_REF] has detected phosphorus limitation in the middle of Laizhou Bay in spring 1999 by means of in situ nutrient enrichment, whereas it only occurred within the YR estuary in our modeling (not shown).

Except the riverine input and sediment release, the atmospheric dropping and sewage diffuser may be other potential external nutrient sources, since diversified chemicals or fertilizers are widely utilized in recent years with the rapid development of the regional economy around BS. However, in view that our job mainly focus on the situation early in 1980s, the nutrient sources from atmospheric dropping and sewage are not considered due to their negligible load compared to that of riverine inputs and sediment release.

Conclusion

A relatively simple biogeochemical-physical model was used to reproduce the seasonal variation of nutrients and chlorophyll-a in BS. Compared to the complicated model studies [START_REF] Wei | Plankton dynamics in the Bohai Sea-observations and modeling[END_REF][START_REF] Zhao | The influence of physical factors on the variation of phytoplankton and nutrients in the Bohai Sea[END_REF], our simulations seemed more consistent with observations, especially in revealing the nutrient and phytoplankton dynamics. It is not surprising, as the complex model generally needs to handle more biological parameters, whose uncertainty may deteriorate the model quality by and large.

Similar situation has been found by [START_REF] Radach | Review of three-dimensional ecological modelling related to the North Sea shelf system. Part II: Model validation and data needs[END_REF], who suggested that more complexity in the model does not necessarily improve the simulations.

Based on the validated simulations, the nutrient limitation characters were further investigated by running the model with the riverine nutrients altered, first enhancing nitrogen concentration and then phosphorus. The nutrient enrichment experiments show that the BS ecosystem dynamics was mainly limited by nitrogen as a whole early in 1980s, though phosphorus limitation seems apparent in certain regions like the estuary of Yellow River due to the much more external inputs of riverine nitrogen. Numerical experiments also show that the increase of nitrogen stock was at the cost of phosphorus reduction, implying that a shift from nitrogen limitation to phosphorus limitation may occur if the nitrogen enrichment continues.

D p p w D d D G m P M D diff D dt L γ ε σ ∂ = - + + - - + ∂ (A.5) In which , n p
N N represents the concentration of dissolved inorganic nitrogen (mmol N m -3 ) and phosphate (mmol P m -3 ), respectively, and , , P Z D represents the biomass of phytoplankton (mg Chl-a m -3 ), zooplankton (mmol N m -3 ), and biological detritus (mmol N m -3 ), respectively. Diatom is the dominant algae species in BS, and the ratios of carbon to chlorophyll-a and to phosphate in diatom are about 38 g C/g Chl-a and 0.97 g C/ mmol P, respectively [START_REF] Wei | Plankton dynamics in the Bohai Sea-observations and modeling[END_REF]. Following the Redfield assumption, we further obtained the ratios of phosphate and nitrogen to chlorophyll-a, which are about 39.14 mmol P/g Chl-a and 0.626 mmol N/mg Chl-a, respectively. These values can be used to convert the unit of phytoplankton biomass between mmol N (P) m -3 (integration process)

and mg Chl-a m -3 (initial condition and model result).

The absolute derivative and diffusion terms are respectively expressed as

1 i i i i i dC C uC vC C dt t x y L ω σ ∂ ∂ ∂ ∂ = + + + ∂ ∂ ∂ ∂ (A.6) 1 ( ) ) ( ) ( ) i i H i H H C C C K diff C A A x x y y L L σ σ ∂ ∂ ∂ ∂ ∂ ∂ = + + ∂ ∂ ∂ ∂ ∂ ∂ (A.7)
Where, ( 1...5) As nitrogen and phosphorus coexist in an aquatic ecosystem, the algae growth is generally limited by the insufficient one. The term min{ , } n p P P is used to reflect this case, and the consumed nitrogen n P and phosphorus p P can be respectively expressed as exp(0.05 ) exp 1

i C i = corresponds to , , , ,
n n p opt opt DIN n N I I P V T P I I K N   = ⋅ - ⋅ ⋅     +   (A.8) 4 exp(0.05 ) exp 1 p p p opt opt PO p N I I P V T P I I K N   = ⋅ - ⋅ ⋅     +   (A.9)
where T is seawater temperature.

Dissolved C: N: P generally changes at the ratios of 106: 16: 1 due to biological processes in seawaters [START_REF] Redfield | The influence of organisms on the composition of seawater[END_REF], a link generally used in marine ecological modeling. If p n P P < , the calculation follows the phosphorus flow, which means that the consumed phosphorus is determined first, and then the consumed nitrogen is16 times the consumed phosphorus. Otherwise, the integration follows the nitrogen flow, which means that consumed nitrogen is obtained first, and then the consumed phosphorus is calculated by dividing the consumed nitrogen by 16. The N:P ratios in phytoplankton respiration and zooplankton excretion processes also abide by the Redfield assumption.

In equation (A.8) and (A.9) the solar radiation in the water column I is expressed as 0 0 exp( )

w chl z I par I k z k Pdz - = ⋅ - - ∫ (A.10)
Where, z is the distance to the sea surface; 0 I denotes light intensity on the sea surface, and is calculated through a real-time irradiation model (Liu and Yin, 2006b).

The G term reflects the process of zooplankton grazing on phytoplankton based on the first type of the Michaelis-Menten equation [START_REF] Steele | The role of predation in plankton models[END_REF], as exp(0.01 )

Phy ZP G T K P γ = + (A.11)
It should be stressed that the impact of fish grazing on zooplankton is also implicitly included in the present modeling by defining zooplankton mortality as a function of temperature, as follows:

exp(0.03 ) z M m Z T = (A.12)
Such a model design is proved to be crucial for reproducing the second algae bloom [START_REF] Yu | A pelagic ecosystem model and Simulation of the Northern Part of Jiaozhou Bay: 1. Introduction to pelagic ecosystem Model[END_REF].

, n p S S denote river-borne nitrogen and phosphorus, respectively.

Appendix B: Boundary and initial conditions

At the sea surface, the model was forced by the monthly SST and SSS climatology, respectively, which were derived from historical observations [START_REF] Chen | Marine Atlas of Bohai Sea, Huanghai Sea, East China Sea[END_REF]. The nutrient loads via atmospheric deposition were assumed negligible compared to riverine inputs. Therefore, the surface and bottom boundary conditions were written as

M a s p n H K u v C U V U V L N N K T S P Z D L ρ σ σ ω σ σ σ σ σ σ σ  ∂ ∂     = - +      ∂ ∂     =   ∂   ∂ ∂ ∂ ∂ ∂ ∂  =    ∂ ∂ ∂ ∂ ∂ ∂ ∂    0 σ → (B.1) 1/ 2 2 2 , ( , ) ( 1) 0 , , , , 0 , ( , )
M b b b b b H p n H n p K u v C u v u v L K T S P Z D L N N K F F L σ σ ω σ σ σ σ σ σ σ ∂ ∂      = +      ∂ ∂    -=   ∂ ∂ ∂ ∂ ∂    =    ∂ ∂ ∂ ∂ ∂    ∂    ∂ =    ∂ ∂    1 σ → - (B.2)
where S denotes sea water salinity; M K is the vertical kinetic viscosity; a ρ is air density; were estimated using an upstream advection scheme (Palma and Matano, 2002) owing to the unavailability of the investigated data.

The initial concentrations of nitrogen, phosphate, zooplankton and detritus were set to be 4.21 mmol N m -3 , 0.5 mmol P m -3 , 0.2 mmol N m -3 , 0.2 mmol N m -3 , respectively, and the phytoplankton biomass is set to be 1 mg chlorophyll-a m -3 , which are the mean values in winter [START_REF] Zhao | Winter and summer chlorophyll-a and nutrient distribution and characteristics in the Bohai Sea[END_REF].

Acknowledgement

This study was supported by the key subject fund of Shanghai Education Committee (J50702) and the Innovation Project of Chinese Academy of Sciences (KZCX2-YWQ07-01, KZCX2-YW-BR-215-3)

  simulated the annual cycle of stratifications; in addition,[START_REF] Liu | Model study on the influence of wind and tide on the evolution of river plumes[END_REF] also reproduced the development of river plume in BS by introducing a river discharge model. Understanding the above physical features is essential for illustrating the biogeochemical processes.

Figure 2

 2 Figure2

Figure 4 and

 4 Figure 4

Figure 5

 5 Figure 5 also shows that the spring bloom first occurs at shallow bays and then

Figure 6

 6 Figure 6

  the horizontal and vertical diffusivity, respectively. L H η = + in which , H η indicates the water depth and surface elevation, respectively.

  the wind speed 10 m above the sea surface along the , x y direction, respectively; , b b u v are the bottom friction velocity along the , x y direction, respectively; s C , b C are the sea surface and bottom drag coefficient, respectively; , n p F F are nitrogen and phosphorus flux between sediment and water exchange, respectively. The Flather and Orlanski radiation conditions (Palma and Matano, 2000) were used on the open lateral boundary for the normal component of the external and internal velocity field, respectively. The latter allows the internal wave to pass through the BS strait with little reflection. The temperature, salinity, nitrogen, phosphate and chlorophyll-a were restored toward the monthly climatology (Chen et al., 1992) on the open lateral boundary, whereas the open boundary values of zooplankton and detritus

FigFig. 4

 4 Fig.1 Bohai Sea. Four major river discharges: YR-Yellow River, HR-Haihe River,

Fig. 5 Fig. 6

 56 Fig.5 Annual cycles of simulated (solid line with open circles) and observed (error

Table 2

 2

	lists all

Table 1

 1

Table 2

 2

Table 1 Concentrations (µM) of nitrogen and phosphorus in four rivers

 1

		Standard case	Nitrogen enrichment Phosphorus enrichment
	River
		nitrogen phosphorus nitrogen phosphorus nitrogen phosphorus
	Yellow	126.26	0.36	189.39	0.36	126.26	3.6
	Haihe	114.2	1.39	171.3	1.39	114.2	4.17
	Luanhe	74.2	0.51	111.3	0.51	74.2	4.08
	Daliaohe	23.2	1.71	34.8	1.71	23.2	3.42

Appendix A: Biological Model

The coupled biogeochemical-physical processes are formulated as follows


Dr Peter Bede
email: bedepeter@hotmail.com

David Oliver
email: drdjoliver@gmail.com

Dr James Stodart
email: james.stodart@hotmail.com

Leonard Van Den Berg

Prof Zachary Simmons
email: zsimmons@psu.edu

Doiminic Ó Brannagáin
email: d.obrannagain@maile.hse.ie

Gian Domenico Borasio
email: borasio@med.uni-muenchen.de

Orla Hardiman

Dr David Oliver Bsc

Prof Leonard Van Den Berg

Dr Doiminic

MICGP, FRCPI Brannagáin Mbbch

Prof. Dr. med Domenico Gian

MD Dippallmed Borasio

Prof Hardiman Orla
email: orla@hardiman.net

MD, FRCPI, FAAN Bsc

Palliative Care in Amyotrophic Lateral Sclerosis -A Review of current international guidelines and initiatives

Keywords: Amyotrophic Lateral Sclerosis, Motor Neuron Disease, Palliative Care, Dementia, Cognitive Impairment

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

Expansion of palliative care into non malignant conditions has contributed to improvements in quality of life, symptom control and caregiver burden in neurodegenerative conditions like amyotrophic lateral sclerosis (ALS) [START_REF] Veronese | Specialist palliative care service for people severely affected by neurodegenerative conditions: does this make a difference to palliative care outcomes? Results of Nepal -an explorative randomized controlled trial[END_REF] . The point at which referral to palliative services occurs varies considerably across different countries. Early involvement and a dynamic model of intervention have been repeatedly suggested for ALS, but few countries have developed integrated pathways of care. The objective of this review is to identify and examine the existing guidelines for palliative care in ALS, focusing on time of referral, triggers of referral and coordination of care.

METHODS

Publications were searched during a 4 month period between April 2010 and July 2010. Only articles published in English were reviewed. Further articles were identified through reviews of the references of these articles. Reports from meetings were also used if they presented relevant information.

The literature search was performed using Pub Med and Medline with the following keywords:

Motor Neuron Disease (MND), Amyotrophic Lateral Sclerosis (ALS), Neurodegenerative disorder, Symptomatic management, Palliative care, Guideline, Pathway, Framework, Policy and Algorithm.

RESULTS

PALLIATIVE CARE IN ALS

It is generally recognized that optimal ALS management should adopt a multidisciplinary approach that includes palliative care [START_REF] Chio | Interdisciplinary ALS Centres: effect of survival and use of health services in a population-based survey[END_REF] . There is considerable evidence that multidisciplinary care improves both survival and quality of life in ALS 3 4 . It is also recognized that effective communication between the multidisciplinary ALS team (MDT), the primary care physician and the palliative care team is essential, as patients with end stage ALS frequently develop distressing symptoms over a short period of time. [START_REF] Ganzini | The final month of life in patients with ALS[END_REF]

TIMING OF SPECIALIST PALLIATIVE CARE INTERVENTION IN ALS

The European Federation of Neurological Sciences (EFNS) taskforce [START_REF] Andersen | EFNS task force on management of amyotrophic lateral sclerosis: guidelines for diagnosing and clinical care of patients and relatives; An evidence-based review with good practice points[END_REF] recommends that a palliative care approach should be adopted from the time of diagnosis and that palliative care should be available within the local community. Early referral to palliative services in advance of the terminal phase of ALS is recommended, as sufficient time is required to establish relationships with the staff and to address end of life issues. This is of particular importance as speech and communication are often limited in the later stages of disease.

In practice however, these recommendations are rarely observed and there is currently no widely accepted international standard for the initiation of palliative care intervention. Management of the terminal phase of ALS have been reported to be unsatisfactory in 33% of cases in northern Europe and in 61% of cases in southern Europe [START_REF] Borasio | Standards of palliative care for patients with amyotrophic lateral sclerosis: results of a European survey[END_REF] . In the UK, only 30% of palliative units provide ALS care, and only 8% are involved from the time of diagnosis. [START_REF] Oliver | The involvement of specialist palliative care in the care of people with motor neuron disease[END_REF] In the USA, stringent criteria are applied by Medicare for access to hospice-based palliative care.

The criteria include critically impaired breathing, rapid progression and severe nutritional impairment or rapid progression with life-threatening complications. These guidelines have been widely criticized [START_REF] Elman | Palliative Care in Amyotrophic Lateral Sclerosis, Parkinson's Disease, and Multiple Sclerosis[END_REF] as many patients who do not meet the Medicare hospice criteria die in less than 6 months. In one study 10 only 5 of 97 ALS patients who were accepted into hospice care from a multidisciplinary ALS centre met the Medicare criteria.

The US-based ALS Peer Workgroup 11 has suggested a number of specific triggers for hospice referral of ALS patients (Table 1). Referral triggers tend to be based on the more typical symptoms of ALS, such as respiratory and nutritional compromise. Rare, but distressing complications of ALS such as severe pain of uncertain etiology, frozen shoulder, painful mouth ulcers are frequently omitted from these guidelines, despite the fact that palliative teams have considerable experience in alleviating these symptoms.

Most ALS patients die at home. Where available, community palliative care programs can provide valuable home based services and short term respite in the later stages of the disease. These services are not ubiquitous, and many ALS patients have no interaction with palliative services during their illness. [START_REF] Hardiman | Models of Care in Motor Neurone Disease: Setting Standards ALS and Other Motor Neurone[END_REF] In a survey of 215 Irish patients with ALS, only 28% successfully accessed palliative services. [START_REF] Corr | Access to Palliative Care Services by Irish ALS patients ALS[END_REF] Perceived barriers to specialist palliative management of patients with non-malignant and neurodegenerative conditions include limited resources, and lack of familiarity of providers with the disease trajectory of ALS. [START_REF] O'leary | Survey of specialist palliative care services for noncancer patients in Ireland and perceived barriers[END_REF] Other important differences across healthcare systems have been noted in the management of ALS [START_REF] Oliver | End-of-life care and decision making in ALS/MND: A crosscultural study[END_REF] (Table 3). These are primarily a function of complex local financial, legal and cultural factors. 3. Cross-cultural differences in ALS management by Oliver et al.

There is evolving evidence that access to additional assistive equipment might sometimes be limited once the patient is formally receiving palliative care. Ideally, palliative care should be integrated into the larger multidisciplinary care, and initiation of hospice care should not limit availability of supportive treatment such as gastrostomy and non invasive ventilation.

END OF LIFE AND ADVANCE DIRECTIVES

Advance directives provide patients with the option to exercise autonomy regarding preferred end of life management strategies. The legal validity of advance directives varies from country to country.

Advance directives require a level of intellectual competence that enables processing of relevant information and appreciation of the consequences of decision making. Advance planning is considered in 3 main formats: (a) an advance statement, made by the person when still competent.

(b) an advance statement refusing treatment -this is legally binding in many jurisdictions (c) a lasting power of attorney, which defines a proxy to make decisions.

Advance directives are believed to be useful in 78% of European centres, although only 30% of patients actually complete them. [START_REF] Borasio | Standards of palliative care for patients with amyotrophic lateral sclerosis: results of a European survey[END_REF] CAREGIVER SUPPORT

Effective palliative frameworks need to address caregiver needs. There is evolving evidence that structured caregiver support including counselling, support groups and a crisis management system should be available for caregivers 16 . Key barriers to comprehensive carer support include the time constraints of healthcare professionals and caregivers, lack of administrative support, lack of trained personnel and financial barriers 17 .

Few studies have approached the optimal timing of hospice referral from the carers' point of view. A prospective interview-based study [START_REF] Kapo | Are We Referring Patients to Hospice Too Late[END_REF] showed that the shorter the length of the stay in a hospice, the more likely the families felt that enrolment to the hospice had occurred too late.

IMPACT OF COGNITIVE AND BEHAVIOURAL IMPAIRMENT ON ALS MANAGEMENT

Up to 40% of patients with ALS have evidence of cognitive impairment 19 20 . Despite the published consensus criteria [START_REF] Strong | Consensus criteria for the diagnosis of frontotemporal cognitive and behavioural syndromes in amyotrophic lateral sclerosis[END_REF] for the diagnosis of cognitive and behavioural syndromes in ALS, the practical application of the criteria can be problematic. Formal neuropsychological testing may be particularly difficult due to disease specific factors such as dysarthria, physical disability, hypercapnia and medication effects. Currently, different batteries of neuropsychological tests are used in different centres. Most experts agree that a specialist clinical neuropsychologist should be available as part of the multidisciplinary ALS team 22 . Short cognitive screening tests have been generated recently, but

have not yet been validated [START_REF] Flaherty-Craig | A rapid screening battery to identify frontal dysfunction in patients with ALS[END_REF] .

Recognition of cognitive impairment is important, because survival is significantly shorter among ALS patients with frontotemporal dementia [START_REF] Olney | The effects of executive and behavioral dysfunction on the course of ALS[END_REF] and ALS patients with executive dysfunction [START_REF] Elamin | Executive Dysfunction is a Negative Prognostic Indictor in ALS Patients without Dementia -submitted for publication 26[END_REF] . Those with mild cognitive changes are also less likely to choose long-term mechanical ventilation 26 . Compliance with non-invasive ventilation is adversely affected by cognitive impairment. [START_REF] Olney | The effects of executive and behavioral dysfunction on the course of ALS[END_REF] Chio et al. [START_REF] Chiò | Neurobehavioral symptoms in ALS are negatively related to caregivers' burden and quality of life[END_REF] have recently demonstrated that behavioural deficits in ALS have a significant negative impact on caregivers` quality of life and increase carer burden considerably. ALS patients with executive dysfunction are also at higher risk of falls, choking episodes and injuries. They show poorer compliance with walking aids, PEG or RIG feeding tubes and other safety devices.

It is likely that the concepts learnt from the palliative management of other neurodegenerative conditions such as advanced dementias can be applied in ALS. Insistence on non-invasive ventilation and feeding tube placement in the presence of significant behavioural and cognitive deficits can be inappropriate and should be carefully considered on individual bases. Recent data indicate that cognitive change must be considered when approaching difficult decisions about management in the later stages of the disease. 28 However, the full implications of ALS-related cognitive decline on disease management remain to be formally established.

TIMING OF "END OF LIFE DISCUSSIONS"

The optimal timing of end-of-life discussions in ALS is relatively well defined in the international literature. "Trigger points" for discussion of end-of-life Issues in ALS have been suggested by a number of authors 29 11 . These include the presence of patient distress, the evolution of disease or the expressed desire of the patient to discuss these issues. (Table4.) International evidence based palliative models for ALS can be developed by integration of successful regional initiatives and identification of areas requiring further research. Although access to palliative services, referral habits and coordination of care vary considerably from country to country, common themes and principles can be identified.

Netherlands

The Dutch protocol for ALS management has been recently published [START_REF] Van Den Berg | Development and implementation of the Dutch protocol for rehabilitative management in amyotrophic lateral sclerosis[END_REF] (Table 5.). Coordination of care is clearly defined in the different phases of ALS. The protocol divides the disease into Diagnostic, Rehabilitation and Terminal phases and designates a care coordinator for each. In the diagnostic phase, the neurologist is the care coordinator; in the rehabilitation phase the consultant in rehabilitation medicine is the care coordinator; while the general practitioner is the main care coordinator in the terminal phase.

In a prospective Dutch study [START_REF] Van Den Berg | Multidisciplinary ALS care improves quality of life in patients with ALS[END_REF] , patients treated by multidisciplinary ALS care teams had a significantly better psychological quality of life than those looked after by a general care group.

1. Autonomy of the ALS patient 2. Medical information should be given in time for adequate decision making 3. The consultant in rehabilitation medicine should guarantee optimal symptomatic rehabilitation care through to palliative care in the terminal phase 4. Advance health directives should be repeatedly discussed. More recently, the MND Association has produced the "Year of Care Pathway" 33 which describes the specific care and services that may be required with the disease progression.

United States of America

The current system in the USA is highly decentralised, and there are no national guidelines. Palliative care is not nationally or regionally coordinated, but rather consists of a mix of different services which differ by locality. For patients in the community who do not attend multidisciplinary ALS clinics, the availability of specialist palliative care is often limited. Hospice services are organized locally, receive Medicare funding, and are geared toward end-of-life care. Palliative care, takes place in the patient's home -approximately 20% of patients receive hospice services in an inpatient hospice facility. [START_REF]National Hospice and Palliative Care Organisation (NHPCO) Facts and Figures: Hospice Care in America 2009 Edition 35 Guideline on ALS by the German Neurological Society[END_REF] Home health agencies provide short-term care in the patient's home for those patients meeting specific eligibility requirements. Longer-term care in the home usually is overseen at the state level but administered locally. Hours of care available and eligibility rules differ state to state and by the administrating agency.

Germany

The ALS guidelines of the German Neurological Society 35 specifically suggest early referral to palliative care. However in practice, ALS patients are usually managed by their practicing neurologists and family practitioners. Access to palliative care and hospice services occurs late in the course of the disease, if at all. A network of neuromuscular centres in all major cities offers tertiary care, but not all patients are referred to these centres. Although a nationwide network of specialist palliative home care teams has recently been introduced, there is limited collaboration between ALS centres and palliative care teams. The role of the General Practioner in the terminal stages of illness remains underdeveloped [START_REF] Kühnlein | Palliative care and circumstances of dying in German ALS patients using non-invasive ventilation[END_REF] .

Australia

A "Map for Integrated Care" 37 has been generated, showing the role of key service providers in meeting specific patient needs at different stages. The pathway of the Motor Neurone Disease Association of England, Wales and Northern Ireland was identified as the framework that best describes the triggers for referral, the role and costs of service providers at specific patient milestones.

Ireland

There is no established national care pathway nor are there clearly defined triggers for activation of palliative care services for ALS patients. A single multidisciplinary clinic, incorporating palliative care, provides services to up to 80% of the ALS population. [START_REF] Traynor | Effect of a multidisciplinary amyotrophic lateral sclerosis (ALS) clinic on ALS survival: a population based study, 1996-2000[END_REF] ALS services are coordinated primarily by hospital based neurologists, with direct referral to community-based palliative care services.

Management in the later stages of the disease is undertaken collaboratively between the specialist hospital-based services and community care, with limited involvement of the general practitioner.

MEASUREMENT TOOLS

Existing and proposed frameworks require rigorous auditing and validation prior to implementation.

Because palliative care shifts the emphasis from disease modification to symptom management, outcome measurements are primarily centred around quality of life (QoL) rather than disease progression.

QoL is a concept of emotional, spiritual and physical well-being within the individual`s specific social, cultural and medical context. Poor quality of life in ALS correlates with hopelessness and lack of social support [START_REF] Ganzini | Correlates of suffering in amyotrophic lateral sclerosis[END_REF] . Several studies 39 40 41 in ALS have demonstrated that QoL is independent of physical disability and is frequently a function of complex psychosocial and existential/spiritual factors. This evidence provides the rationale for a QoL orientated palliative intervention in ALS and measurement of QoL as a marker of successful multidomain palliative care intervention.

Palliative measurement tools can be divided into assessment scales and QoL measurement instruments.

A. Assessment tools -Comprehensive Palliative Diagnosis

Formal palliative assessment is particularly important in neurodegenerative disorders where underreporting of pain and discomfort is not uncommon. A structured diagnostic palliative approach identifies areas of distress and discomfort across multiple domains: physical, emotional and spiritual.

The Memorial Symptom Assessment Scale (MSAS), the Rotterdam Symptom Checklist (RSCL), the Edmonton Symptom Assessment Scale (ESAS) and The Disability Distress Assessment Tool (DisDAT) [START_REF] Regnard | Understanding distress in people with severe communication difficulties: developing and assessing the Disability Distress Assessment Tool[END_REF] represent some of the more widely used comprehensive assessment tools with potential in nonneoplastic palliative medicine.

The Disability Distress Assessment Tool (DisDAT) may be of particular use in neurodegenerative conditions such as ALS, as it is adapted for people with severe communication difficulties. DisDAT documents the patients own 'vocabulary' of distress signs and behaviours in a so-called "Distress Passport".

B. Quality of Life measures

QoL measurement in ALS is challenging due to communication barriers. The use of generic instruments (Sickness Impact Profile -SIP / SF-36 Health Survey) is limited in the assessment of QoL in ALS. Memory and cognitive deficits may make testing even more difficult. A number of observational rating scales have been developed to overcome these challenges, many of them using composite scores from carers and patients.

The Schedule for the Evaluation of Individualized Quality of Life-Direct Weighting (SEIQoL-DW) [START_REF] O'doherty | Measuring life quality, physical function and psychological well-being in neurological illness, Amyotrophic Lateral Sclerosis[END_REF] is a useful tool in ALS taking individual value priorities into account. In the SEIQoL-DW, patients rate their satisfaction in areas of life which are most important to their QoL. The most relevant domains of QoL in ALS are family, friends/social life, health, and profession based on the SEIQoL-DW studies [START_REF] Neudert | Individual quality of life is not correlated with health-related quality of life or physical function in patients with amyotrophic lateral sclerosis[END_REF] .

Longitudinal QoL studies in ALS demonstrated that while health-related QOL and functional status showed relentless decline, the SEIQOL-DW total score remained stable. Longitudinal studies also concluded that patients' QoL priorities change over time.

The Schedule for Meaning in Life Evaluation (SMiLE) [START_REF] Fegg | The Schedule for Meaning in Life Evaluation (SMiLE): validation of a new instrument for meaning-in-life research[END_REF] is used successfully in ALS where satisfaction is weighted against the relevance of individually named domains. The most often highlighted areas of Meaning of Life (MiL) [START_REF] Fegg | Meaning in life in patients with amyotrophic lateral sclerosis[END_REF] in ALS were family (82%), partnership (61%), leisure activities (53%) and friends (39%).

The McGill QoL Questionnaire (MQoL) [START_REF] Cohen | The McGill Quality of Life Questionnaire: a measure of quality of life appropriate for people with advanced disease. A preliminary study of validity and acceptability[END_REF] addresses 5 domains: physical well-being, physical symptoms, existential well-being, psychological symptoms and support through a 20 items questionnaire.

The ALS Specific QoL (ALSSQOL) [START_REF] Simmons | The ALSSQOL -Balancing physical and nonphysical factors in assessing quality of life in ALS[END_REF] The use of these instruments in ALS is currently limited and many of these tests were developed and validated for Alzheimer's dementia rather than the frontotemporal cognitive deficits typical of ALS.

However, with the emerging evidence of relatively high incidence of cognitive impairment in ALS, the development of ALS specific QoL insturments for patients with cognitive impairment is desirable.

COMMON THEMES OF INTERNATIONAL INITIATIVES

The appropriate timing of palliative intervention is essential and confers important quality of life benefits. Despite cultural and financial differences worldwide, a number of common principles can be identified to ensure high quality palliative care in ALS (Table 6).

Requirement for a national framework and patient pathway Nomination of a single person to coordinate ALS care in a given phase of the disease Multidisciplinary ALS care (incorporating hospital-and community-based palliative care services)

Formal cognitive testing prior to advance directives Early and local palliative care involvement Structured caregiver support (Grief support, counselling, support groups, crisis management system)

Qualitative and Quantitative measurement scheme to assess benefits of palliative care interventions

Need for development of international consensus guidelines for the palliative management of ALS

  -life and Advance directive discussions Timing of discussion (mean number of months prior to death)

(

  NCPC) to evaluate good practice examples and to identify effective service models. Gaps in coordination between different services and an overlap in their activities have been identified and a patient pathway has been established 31 . This describes specific indicators for referral and introduces the concept of neuro-palliative-rehabilitation. Based on this work, the Royal College of Physicians, the National Council for Palliative Care and the British Society of Rehabilitation Medicine have published a national guideline on the interface between neurology, rehabilitation and palliative care 32 . These guidelines have not yet been fully implemented.

Table 1 .

 1 Suggested triggers for hospice referral by the ALS Peer Workgroup

	1. FVC : 60% predicted [or rapid decline in FVC (more than 20%) over 2-3 months]
	or
	2. Clinical signs or clinical symptoms of respiratory insufficiency
	or
	3. Respiratory weakness requiring non-invasive positive pressure ventilation (NIPPV)
	or
	4. Nutritional decline requiring enteral feeding
	or
	5. Severe pain or psychosocial distress requiring intensive palliative care interventions (including
	opioid medication)
	or
	6. Rapidly progressive paralysis (over 2 to 3 months) in two body regions.

Table 2 .

 2 Key barriers to palliative care intervention in non-malignant conditions in Ireland.

  1. The patient opens the discussion -for end-of life information and/or interventions (elicited or spontaneous, verbal or non-verbal) 2. The presence of severe psychological, social or spiritual distress or suffering 3. The presence of pain requiring high dosages of analgesic medications 4. The presence of dysphagia requiring feeding tube 5. The presence of dyspnoea, symptoms of hypoventilation or a forced vital capacity of 50% or less 6. Loss of function in two body regions (regions include bulbar, arms and legs).

Table 4 .

 4 Triggers of end-of-life Discussions in ALS

COORDINATION OF ALS CARE IN DIFFERENT HEALTHCARE SYSTEMS

Table 5 .

 5 The governing principles of the Dutch protocol for ALS management

	United Kingdom

A Neurological Conditions Policy Group was set up in 2004 by the National Council for Palliative Care

  rating instrument is based on the McGill QoL Questionnaire and takes religiousness, spirituality and psychological well-being into account. Evaluating QoL in the presence of cognitive impairment is poorly studied in ALS. In a cross-sectional QoL study 47 of 31 ALS patients, QoL scores correlated positively with social and emotional support and correlated negatively with the presence of everyday cognitive difficulties. Several QoL scales had been developed for patients with dementia and these could be modified for use in patients with ALS and cognitive impairment. The Psychological Well-Being in Cognitively Impaired Persons (PWB-CIP, Burgener et al. 2002), the Dementia Care Mapping (DCM, Brooker et al. 1992) and the the Cornell-Brown Scale for Quality of Life in Dementia (CBS, Ready et al 2002) are either observer rated assessment instruments or incorporate the caregivers perspective.

Table 6 .

 6 Common themes of palliative initiatives in ALS care CONCLUSIONS ALS management requires clear communication and cooperation between different medical specialties, hospital and community based services. Patients and caregivers should be linked in early to specialist palliative care services through multidisciplinary ALS clinics. A dynamic, evidence based framework for integrating palliative care into the management of ALS is urgently required, and would be best achieved in the context of an international consensus. Effective symptom management, advance discussion of care preferences and continued caregiver support are important governing principles. Disease specific quality of life measurement tools should be applied to assess and validate the role of palliative intervention in ALS. A successful palliative model in ALS will in turn assist in the development of palliative care models for other neurodegenerative conditions.


Jérôme François

Shaonan Wang

Radu State

Thomas Engel

BotTrack: Tracking Botnets using NetFlow and PageRank

Keywords: Botnets, PageRank, Network security

 with an additional clustering process in order to efficiently detect stealthy botnets using peer-to-peer communication infrastructures and not exhibiting large volumes of traffic. The key conceptual component in our approach is to analyze communication behavioral patterns and to infer potential botnet activities.

Introduction

The ever-continuing struggle between malware operators and security officers is a perpetual and parallel development of new attack tools and mitigation techniques. Botnets are known to be a major threat [START_REF] Buxbaum | The fog of cyberwar -to defend[END_REF]. The recent trend in malware design leverages peer-to-peer communication infrastructures and state-of-the-art cryptography that significantly raises the stakes in their detection [START_REF] Hund | Towards next-generation botnets[END_REF]. While bots participating in denial of service attacks and spam campaigns can be easily detected by traffic analysis, it is much harder to detect stealthy bots deployed for information stealing and espionage purposes. We address this specific type of botnet in our paper. The contributions of our paper are threefold:

1. We propose a NetFlow [START_REF] Claise | Cisco Systems NetFlow Services Export Version 9[END_REF] monitoring framework that leverages a simple host dependency model for tracking communication patterns. 2. Linkage analysis and clustering techniques that identify groups of hosts sharing similar behavioral/communication patterns 3. Experiments using real NetFlow data in order to assess the performance of detecting botnet traffic in NetFlow data.

This work is related to our previous one [START_REF] Wang | Riskrank: Security risk ranking for ip flow records[END_REF] but the construction of the dependency does not need any prior knowledge about potential risks in this paper. Thus, it leads to additional clustering techniques for being suitable. Unlike our previous work, this paper tries to detect large-scale shared behavior and particularly botnets.

We start the paper with an introduction to botnets in section 2. Section 3 describes the underlying building blocks of our approach by detailing the host dependency model and data mining techniques. Comprehensive experiments are discussed in section 4. We address related work in section 5 and conclude the paper in section 6.

Structured Botnets

Overview

A botnet is a network of compromised hosts usually called bots or zombies. The botnet owner, also known as the botmaster or controller manages the bots. Currently, botnets make themselves known via the threats they pose as for example: highly distributed denial of service attacks, data stealing or large spam campaign. By not involving all available bots, spam [START_REF] Xie | Spamming botnets: signatures and characteristics[END_REF] can be generated more stealthily in order to avoid detection. Another feature of bots is the permanent multiplication effort: bots attempt to scan and infect other machines and so grow the network. Attacks are strongly also linked to financial interests [START_REF] Holz | Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm[END_REF].

Botnet architectures

The botmaster manages her bots through a Command and Control (C&C) channel. In the past, this was generally a pseudo-centralized architecture based IRC [START_REF] Oikarinen | rfc 1459: Internet relay chat protocol[END_REF] (Internet Relay Chat) channel [START_REF] Mclaughlin | Bot software spreads, causes new worries[END_REF]. Since distributed architectures are more scalable and robust, attackers also chose this kind of architecture for constructing botnets. Slapper [START_REF] Arce | An analysis of the slapper worm[END_REF] was the first botnet worm in this category, but structured peer-to-peer (P2P) protocols followed due to their underlying scalability and robust communication facilities [START_REF] François | Towards malware inspired management frameworks[END_REF]. In structured P2P architecture, a huge ID space is defined, a typical value being N = 2 160 . Each host (corresponding to an IP address and a UDP port) has a node ID in this space and a routing table corresponding to hosts that can be directly reached. Each node is also Fig. 1: BotTrack architecture responsible for data information (files) having a key (hashed value) close to its own. For other nodes, a routing process is employed and the main advantage of structured P2P is that reaching a node is guaranteed in a maximal number of hops. Chord [START_REF] Stoica | Chord: A scalable Peer-To-Peer lookup service for internet applications[END_REF] was one of the pioneering works and guarantees a routing in log(N ) hops. Koorde [START_REF] Kaashoek | Koorde: A simple degree-optimal distributed hash table[END_REF] is an optimization of Chord which provides a routing complexity equal to O(log(N )/log(log(N )). Storm/Peacomm [START_REF] Porras | A Multi-perspective Analysis of the Storm (Peacomm) Worm[END_REF] is a infamous real worm using both cryptographic protection and peer-to-peer communication models [START_REF] Hund | Towards next-generation botnets[END_REF]. Storm is based on the Kademelia [START_REF] Maymounkov | Kademlia: A peer-to-peer information system based on the XOR metric[END_REF] protocol usually used for file sharing. Storm bots look for specific keys within the P2P network corresponding to systems where the botmaster provides necessary information for connecting to a webserver publishing orders to execute. The Kademelia protocol has a searching algorithm that finds these hosts in O(log(N )). We argue in this paper that analyzing communication patterns in network traffic can reveal botnets relying on such communication models. By studying Chord which can be seen as the generic protocol for DHT (Distributed Hash Tables) and some extensions in different directions (Kademlia with a high redundancy and Koorde with a very small one), it is enough representative of most of P2P botnets.

Bot Detection

Architecture

Figure 1 highlights the main components of our approach. Routers monitor the traffic and export NetFlow records to a collector. BotTrack then analyzes this data. The first step identifies the interactions between systems by creating a dependency graph between hosts. This graph is then automatically analyzed by a module running the PageRank algorithm [START_REF] Page | The pagerank citation ranking: Bringing order to the web[END_REF] to extract the nodes (IP addresses) which are strongly linked to each other. These linkage levels provide authority and hub scores on which a clustering algorithm is applied to find nodes with similar roles within the network. However, nodes playing the same role may not necessarily be P2P nodes or P2P bot nodes. For more precision, data from a honeypot is also leveraged. Hence, some nodes are known a priori to be bots and clusters including such points are considered to be groups of bots to which mitigation techniques can be applied.

Flow Monitoring

IP flow [START_REF] Quittek | Requirements for IP Flow Information Export (IPFIX)[END_REF] is a standard tool for today's large-scale network monitoring.

A flow is a series of IP packets sharing the same source, destination address, associated ports, and protocols. For high speed networks, flow monitoring is well used because, firstly, network traffic analysis via flow records is much more efficient than via individual packets (less data to analyze), and secondly, flow records require only a fraction of the storage space needed for full packet capture. The flow collecting architecture consists of probes and collectors. Probes or sensors are devices deployed in different network locations, and are responsible Fig. 3: simplified ranking distribution after 1st iteration for capturing flow data and forwarding it to the collector. Almost all modern commercial-grade routers support flow record export. In this paper, we use without any distinction the terms IP flow [START_REF] Quittek | Requirements for IP Flow Information Export (IPFIX)[END_REF] and NetFlow [START_REF] Claise | Cisco Systems NetFlow Services Export Version 9[END_REF] which reflects different standards.

Host Communication Model

Because of its wide availability and intrinsic host communication information we utilize flow data and link analysis to detect structured botnets. The rationale behind our approach is that P2P structured botnets exhibit a distinguishable communication pattern among bots. Our communication dependency graph engine (see figure 1) generates a directed "who talks to whom" host communication graph. Figure 2 shows a trivial example of a host communication graph of 8 nodes. Each node represents a host, and a directed link from node A to B indicates there is at least one IP flow from host A to host B. It is obvious that nodes 1, 2, 3, and 4, which represent bot nodes, exhibit more intense communications among themselves than with other nodes. The following sections will explain how to leverage the PageRank link analysis algorithm bounded by clustering techniques to detect bots via host communication graphs. The terms host communication graph and dependency graph are used interchangeably in this paper.

PageRank

The PageRank algorithm [START_REF] Page | The pagerank citation ranking: Bringing order to the web[END_REF] is a link analysis algorithm used by the Google web search engine to weight the relative importance of web pages on the Internet. PageRank ranks each web page according to a a score depending on the hyperlink structure of the Internet. A web page is referred to by other pages if other pages contain a hyperlink pointing to it. Intuitively, a frequently-referred page is important, and pages referred to by few important pages are also considered important. For instance, if a web page is linked by only one web site, but this web site is Yahoo, then this page should be considered as important as well. The outstanding scalability and efficiency of PageRank makes it an ideal candidate to analyze the link structures among communicating hosts on large scale networks.

PageRank is computed in an iterative fashion. At each iteration, the current score of each node is distributed through its outgoing links to the nodes it points to. The new rank of each node is the sum of the scores its incoming edges bring. For example, assuming an initial value of each node in Figure 2 of 1, the ranking distribution following the first iteration is shown in Figure 3. Node 1 has three outgoing links, thus each outgoing link takes 1 3 ranking to its destination node. Node 1 receives two incoming links from node 4 and node 5, thus the new score of node 1 is 1 3

+ 1 1 = 1.33.
The iterations continue until the score changes are sufficiently small or the maximum number of iterations is reached.

Based on some knowledge, important nodes scores can be increased by prior defined weight. In the botnet context, it corresponds to nodes that are known to be bots and should have a higher impact on the score calculation and propagation.

Let P t (i) denote the PageRank score of node i for iteration t, (j, i) denotes a directed edge from node j to node i, O j represents outgoing link number of node j, and E is the set of directed edges on the whole graph. Based on some knowledge, a subjective preference can be assigned to certain nodes. This is useful in the context of bot detection in the sense that we can promote the rankings of hosts known to be bots. The subjective influence functions via the W component and the impact of this weight and the propagated scores can be adjusted by tuning the d parameter:

P t (i) = (1 -d) n k=1 W (k) + d (j,i)∈E P t-1 (j) O j (1)
For flow monitoring, it is interesting to consider both edge directions. When edges point from source to destination hosts, the ranking scores distribute towards the final destination of traffic, and is named hub rank in this paper; when edges point from destination to source hosts, the ranking scores distribute towards the root cause, and we name this root-cause-selecting ranking authority rank. For the latter, PageRank algorithm is executed again with the graph where the edge directions have been inverted. Obviously, the PageRank algorithm can be seen as a set of matrix computations and theoretical details may be found in [START_REF] Page | The pagerank citation ranking: Bringing order to the web[END_REF].

Clustering

PageRank output is composed of two values: authority and hub. Both are useful for detecting P2P bots since peers in such network have to initiate connections with many others and are also destinations of many connections. A simple approach should consider as a P2P bot a host associated with a high ranks for these two metrics: authority > θ and hub > γ

Although defining two thresholds is not easy, section 4 shows that neither can be excluded since good results are obtained only when both are used. Furthermore, infected machines can be clustered in disjoint clusters that are not necessarily adjacent in terms of their traffic flows. This is illustrated in figure 4 by showing the distribution of ingoing and outgoing node degrees. In brief, defining only a simple threshold is not sufficient and investigators should define different ranges of authority and hub values for which the hosts should be considered as bots.

Finally, defining such ranges is often dependent of the P2P protocol used (see section 4). For example, figure 4 clearly highlights such ranges for bots, although a minority of normal hosts may have higher values, even though the majority of normal hosts is associated with very low values.

Main bots clusters

Noise

Fig. 4: Kademelia authority and hub values for normal hosts and bot hosts Therefore, applying a clustering technique may be helpful, and limits the number of parameters that must be chosen. Different techniques could be applied but the following criteria have to be considered:

1. few parameters to set 2. no knowledge about the number of clusters, since different kinds of machines could be infected 3. clusters can have irregular shapes because normal communications are also considered 4. since non-infected hosts are also diverse, authority and hub values can be very different.

Several algorithms fulfill these requirements and our method is based on DB-SCAN [START_REF] Berkhin | A survey of clustering data mining techniques[END_REF] because only two parameters have to be tuned, and the complexity of this algorithm is acceptable especially when using specific data indexation [START_REF] Berkhin | A survey of clustering data mining techniques[END_REF]. In our case, the runtime is slightly above linear. Moreover, there are many extensions for speeding up the clustering process [START_REF] Kryszkiewicz | Faster clustering with dbscan[END_REF] and for using parallel computing [START_REF] Xu | A fast parallel clustering algorithm for large spatial databases[END_REF]. All these works show that DBSCAN is quite fitted for huge databases like usual NetFlow database of real networks.

DBSCAN is a density-based algorithm where the key idea is to consider that each point of a cluster has to be enough close to a minimal number of points, M inP ts, which represents the neighborhood defined by a maximal distance ǫ. Such a point is qualified as a core point and all points whose the distance from it is lower than ǫ are also included in the cluster and are qualified as a border point if they are not core points. Thus, points which are isolated (neither core nor border) are considered to be noise. More precisely, the algorithm iterates over every point p and does the following for each point that is not yet classified:

1. compute the neighbors: neighbor = {p2, dist(p, p2) < ǫ} . In this paper, we use the Euclidian distance. 2. if |neighbor| ≥ M inP ts, create a new cluster containing p and all points of neighbor. 3. go back to step 1 by taking previous neighbors as the original node to compute the neighbors and by excluding previously assigned points.

Thus, DBSCAN has only two parameters to tune but we assume M inP ts = 4 since botnets can sometimes contain only hundreds of hosts and so clusters of bots can be relatively small. However we expect few of them to share similar hub and authority values. Thus, the main parameter to tune in our experiments was ǫ.

Experimental Result

Methodology and datasets

Our evaluation was made on a real dataset provided by a major Luxembourg Internet operator. We extracted 13.7GB of data described in table 1. Following the approach of [START_REF] Nagaraja | BotGrep: Finding p2p bots with structured graph analysis[END_REF], we added synthetic botnet flow records without taking into account the duration or the size of flows since our approach does not rely on them. This is the only viable solution since getting a labeled dataset at an operator level is not possible. Hence, the corresponding characteristics are always the same in table 1. To evaluate the robustness of our system with a stealthy botnet, we extracted only 1% of IP addresses for constructing the botnet. As we relies exclusively on IP addresses, other features like timing or the number of bytes are randomly generated for the botnet flows. So, the attack scenario may be simply explained as adding bot to bot communications at the end of the capture by examining routing table entries of each bots.

Moreover, we assume a random distribution of bot IP addresses. By this way, the IP addresses selected as bots can be considered indifferently as the whole botnet or as a part of bigger botnet containing IP addresses also outside form the monitored network. Hence, there is no need to define different scenarios when having a global view of the botnet is unavailable.

Kademlia topology entails many links between hosts since by design it aims to improve performance for file sharing based on multiple paths. Therefore, this topology exhibits the highest number of flows in table 1. Chord is a more compact topology (no multiple paths from a node to a space partition) which implies lower performance. Neighbor node in Koorde ID space share links in order to contact far-distant nodes. Thus each individual node has only to maintain a few links and the number of flows is reduced.

Table 1 also presents general statistics about PageRank results. Just 1% of bots does not impact highly on average values, but the extreme values indicate that there are some changes in the graph topology.

Our evaluation is based mainly on the Receiver Operating Characteristic (ROC) [START_REF] Fawcett | An introduction to roc analysis[END_REF] which is well-suited for measuring the efficiency of two classes of classification. The curve measures the True Positive Rate (TPR) against the False Positive Rate (FPR). The TPR is the number of bots correctly identified as bots (also called True Positive or TP) divided by the total number of bots. The FPR is the number normal hosts identified as bots (also called False Positive or FP) divided by the total number of benign hosts.

Pure link analysis

Figure 5 illustrates the simple threshold-based method to detect bot links in equation [START_REF] Aguilera | Performance debugging for distributed systems of black boxes[END_REF]. However, in order to measure the efficiency of both metrics (authority and hub), these are considered separately. Hosts with a value higher than a threshold are considered to be bots. Figure 5 displays the ROC curve when the threshold varies. The results are good, particularly for hub detection. This suggests the server role of P2P hosts is more discriminative than the client role. Due to the different linkage level of topologies and so on in the volume of flow records highlighted in table 1, the Kademlia based botnet is the easiest to discover, and Koorde is the best topology for avoiding detection.

Even if the number of false positives is quite low in most of cases, 0.02 was equivalent to more than 6400 FPs. Thus, taking steps to discard them is essential to avoid blocking too many benign hosts.

Clustering

In this experiment, clustering was applied to the link analysis results to improve the results by creating clusters of IP addresses. However, once the clusters have been created, it is not clear how to decide which one is a botnet. Hence, we consider that if a cluster contains at least one bot, all points included within it are also bots. This means that we need to know at least one bot for each cluster of bots. This knowledge can be obtained by using intrusion detection systems or honeypots. Meanwhile, it may lead to many false positives but the results described below show that botnet clusters are quite consistent. The difficulty of this task clearly depends on the number and the structure of clusters. Figure 6 highlights good results when applying clustering to the different topologies (curves entitled "0% bots known"). For Kademelia in figure 6a, the results are greatly improved (the original curve is very close to 0 in figure). This means that clustering allows also allows a high TPR to be reached with fewer FP. The same observations can be made for other topologies (figures 6b and 6c) but the only difference is that after a certain threshold of false positive rate, the true positive rate is better without clustering. This is due to bot points which are less distinguishable with such topologies and which are not clustered, because these are considered as noise. Finally, we consider the inflection point as a good configuration for reducing false positives. It corresponds to the values in table 2, which highlights a large reduction of false positives compared to the threshold-based method, in particular for Kademelia and Chord with about 90% of false positives discarded. Table 2 also highlights that the setting of the parameter ǫ is clearly dependent on the topology. Hence, including a new topology is not straightforward and a priori parameter estimation is needed.

The various performance measures are quite acceptable, except in the case of Chord. From a general point of view, clustering is able to eliminate many false positives, especially in the left part of the curves. However, the results are still acceptable in the right hand part, even if lower than without clustering. However, sometimes it could be better to detect only a subset of a botnet in order to avoid blacklisting too many benign hosts at the same time.

Impact of the number of known bots

In this experiment, we assumed that some individual bots had already been detected by other programs such as a honeypots. We influenced PageRank algorithm by such knowledge by personalizing the initial weights on nodes. Figure 6 shows the results when 5 or 20 percent of bots are known. The results are improved significantly. Hence, Chord botnet-based detection is more acceptable when applying clustering with such knowledge. Considering Koorde and Kademlia, clustering always provides the best results as it was also the case without bot knowledge. For instance, detecting around 99% of bots is possible with a FPR of only 0.001. Compared to 0.002 (the FPR without bots known), this means that FP, were halved, representing 320 FPs discarded.

Cluster analysis

In our previous experiments, we considered that we were able to identify one bot per created cluster by deploying a probe, such as a honeypot. It can be very easy to obtain good results just by creating small clusters with a minimal number of points. The extreme case is one point per cluster. Such points are considered as noise by DBSCAN and will not be considered further. Figure 7 [t] Fig. 8: Kademlia -Small cluster exclusion

shows that a high TPR is possible with few clusters. Having too many clusters does not produce the best results, and the TPR increases considerably when the number of clusters is reduced. Obviously, the reader has to refer to figure 6 for the FPR since it is possible to detect all bots with only one big cluster, but this implies a high FPR. For instance, we can consider the configurations in table 2, showing that for Kademlia and Koorde, the number of bots clusters is very limited. Hence, in Kademlia, 22 bots must be known. The number of clusters in Chord is quite high for this particular configuration. Assuming the second inflection point in figure 6 (TPR = 0.96, FPR = 0.04), the number of clusters is reduced to 21.

Unfortunately knowing around 20 bots from different clusters is not always possible. This occurs when some clusters are very small and only contain a limited number of bots. However, in this case, discarding them has a limited impact on TPR. The final experiments assume that clusters with only a minimal number of bots can be detected. As highlighted in figure 8, the TPR is not impacted positively since it slightly decreases. For instance, considering that we have clusters with at least 50 bots yields only 2 clusters while keeping a TPR of 92%. This case correspond to only discovering the main clusters. (See figure 4). Besides, the FPR is more greatly affected and decreases, particularly in the early phases.

Related Work

Monitoring of IP flow records was first addressed in [START_REF] Sperotto | Anomaly characterization in flow-based traffic time series[END_REF] by providing statistics on traffic volume and underlying IP addresses in order to apply time-series based anomaly detection. Follow-up works [START_REF] Sperotto | Hidden markov model modeling of ssh brute-force attacks[END_REF] employs Hidden Markov Models (HMM) for traffic modeling. The obvious way to observe a botnet is to deploy a honeypot in order to be infected. This is very efficient with IRC botnets for tracking the servers based on the IP addresses and the DNS (Domain Name System) names [START_REF] Abu Rajab | A multifaceted approach to understanding the botnet phenomenon[END_REF]. Many detection methods rely on first detecting malicious activities such as spam or scanning activities [START_REF] Karasaridis | Wide-scale botnet detection and characterization[END_REF]. Some approaches aim to correlate these malicious activities with C&C detected communications [START_REF] Gu | Bothunter: detecting malware infection through ids-driven dialog correlation[END_REF][START_REF] Gu | Botminer: clustering analysis of network traffic for protocol-and structure-independent botnet detection[END_REF]. Crawling a P2P botnet is an alternative way to detect it [START_REF] Holz | Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm[END_REF]. When the P2P botnet employs a normal P2P network, abnormal ID or IP addresses variation can be used as discriminating features [START_REF] Wang | Actively measuring bots in peer-to-peer networks[END_REF]. Connecting components of a graph representing host interactions is presented in [START_REF] Collins | Hit-list worm detection and bot identification in large networks using protocol graphs[END_REF] and analysis methods can be found in [START_REF] Iliofotou | Exploiting dynamicity in graphbased traffic analysis: techniques and applications[END_REF]. Building service-level or host-level dependencies has been addressed in the past [START_REF] Chen | Automating network application dependency discovery: Experiences, limitations, and new solutions[END_REF][START_REF] Kandula | What's going on?: learning communication rules in edge networks[END_REF][START_REF] Reynolds | Wap5: blackbox performance debugging for wide-area systems[END_REF][START_REF] Aguilera | Performance debugging for distributed systems of black boxes[END_REF][START_REF] Jian-Guang | Mining dependency in distributed systems through unstructured logs analysis[END_REF] for supporting network management tasks. BLINC [START_REF] Karagiannis | BLINC: multilevel traffic classification in the dark[END_REF] also leverages inter-host communication relationships for traffic classification, which is also well-studied in [START_REF] Kim | Internet traffic classification demystified: myths, caveats, and the best practices[END_REF]. The closest related work is [START_REF] Nagaraja | BotGrep: Finding p2p bots with structured graph analysis[END_REF], which is based on random walk and clustering techniques to isolate interaction subgraphs related to P2P communications. Our previous work has leveraged link analysis algorithms on flow dependency graphs [START_REF] Wang | FlowRank: Ranking netflow records[END_REF][START_REF] Wang | Mining netflow records for critical network activities[END_REF] and host dependency graphs [START_REF] Wang | Riskrank: Security risk ranking for ip flow records[END_REF] for tracing the root cause flow records corresponding to the malicious traffic. They help to select PageRank as the much suitable algorithm for this paper. Flow dependency graphs [START_REF] Wang | FlowRank: Ranking netflow records[END_REF][START_REF] Wang | Mining netflow records for critical network activities[END_REF] do not consider hosts as nodes but flows as nodes and try to build causal connections between them based on timing analysis. Besides, our current work differs from the previous works in that we enhanced the link analysis result with clustering techniques to reveal the bots on large-scale networks.

Conclusion and Future Work

In this paper we have addressed the automated detection of P2P based botnets. Our approach is based on processing NetFlow-related information to build a host dependency model that captures information about which host is talking to which other host. Linkage analysis on this host dependency model is coupled with a clustering algorithm in order to build clusters of similarly behaving nodes. We show in this paper that bot-infected systems tend to belong to the same cluster. Additional information sources, such as honeypots, can be also used for tagging specific clusters. This will help to distinguish benign P2P applications from botnets. We have shown the viability of our method on large datasets from a major Internet service provider in Luxembourg. Because no labeled datasets exist in the research community, we had to follow a similar approach to [START_REF] Nagaraja | BotGrep: Finding p2p bots with structured graph analysis[END_REF] and inject synthetic data into the ISP-sourced datasets. We plan to do a complete complexity studies about our solutions for defining optimizations since the current implementation on a single machine handles 18min of Netflow records in around 160 seconds.

Fig. 2 :

 2 Fig. 2: Sample host communication graph example (trivial example bots on nodes 1,2,3 and 4)

Fig. 5 :

 5 Fig. 5: ROC curves without clustering

Fig. 6 :

 6 Fig. 6: Clustering impact (without clustering is the results of the simple method based on a threshold and the hub values)

Fig. 7 :

 7 Fig. 7: Number of bot clusters

Table 1 :

 1 Flow record statistics (original data + botnet traces)

	chord	Kademlia	Koorde
	Flow# 2133887	2399032	1997049
	Host# 323610	323610	323610
	Bytes# 13.7G	13.7G	13.7G
	Duration 18min23sec 18min23sec 18min23sec
	Max HR 0.0472	0.0436	0.0442
	Min HR 1.264e-08	1.185e-08	1.185e-08
	Avg HR 3.0901e-6	3.0902e-06 3.0902e-06
	Max AR 0.022897	0.022534	0.023161
	Min AR 1.3229e-08 1.1429e-08 1.19e-08
	Avg AR 3.090145e-06 3.090138e-06 3.0901e-06

Table 2 :

 2 Clustering impact in best cases (inflexion point)

	Topology	ǫ	TPR FPR FP reduction #clusters
	Kademlia 2.5e-05 0.97 0.0019 5945 (90.1%)	22
	Chord 4e-07 0.38 0.002 6087 (90.3%)	13
	Koorde 1e-04 0.76 0.06 32037 (59.1%)	227

Acknowledgment The authors would like to thank S. Nagaraja for discussions and advice on our work, especially on how to generate realistic datasets [25].