Sara Davies
email: sara.davies@strath.ac.uk

Laura Polverari
email: laura.polverari@strath.ac.uk

R58 -Regional Development Policy < R5 -Regional Government Analysis

Keywords: Financial accountability, Audit Accountability, Financial management, Audit, Cohesion policy, Structural Funds

Many changes in EU Cohesion policy since the late 1990s have been driven by the need to ensure and demonstrate financial accountability. This paper examines how the increased emphasis on financial management, control and audit in relation to the EU budget is re-shaping the governance of Cohesion policy, as well as the instruments of financial accountability. It also assesses the effects of these new instruments on financial flows and considers how these changes are perceived by policy-makers.

Last, it explores the difficulties of assessing the impact of administrative changes on financial accountability in Cohesion policy.

INTRODUCTION

The European Union (EU) has made significant changes in its approach to the management, control and audit of its budget, including Cohesion policy [ENDNOTE 1], since the late 1990s. Studies of this process have focused primarily either on political shifts and tensions [START_REF] Bauer | Organizational change, management reform and EU policymaking[END_REF][START_REF] Kassim | Mission impossible', but mission accomplished: the Kinnock reforms and the European Commission[END_REF] or on the administration of these approaches [START_REF] Öir | Study on the efficiency of the implementation methods for Structural Funds[END_REF]WOSTNER, 2008). This paper instead examines these changes as part of a broader shift in governance (HOOD, 1991;FERLIE et al., 2007) and, specifically, as indicative of a stronger focus on accountability in the use of public resources (BRINKERHOFF, 2004;[START_REF] Benz | Introduction[END_REF]. Although some dimensions of accountability in Cohesion policy have been studied (notably in terms of its economic impact [START_REF] Rodriguez-Pose | Between development and social policies: the impact of European Structural Funds in Objective 1 regions[END_REF][START_REF] Bradley | Evaluating the impact of European Union Cohesion policy in less-developed countries and regions[END_REF][START_REF] Martin | Evaluating the impact of the Structural Funds on Objective 1 regions: an exploratory discussion[END_REF]) and effectiveness [START_REF] Kelleher | The thematic evaluation of the partnership principle[END_REF][START_REF] Bachtler | Ex post evaluation of Cohesion policy programmes 2000-2006 co-financed by the ERDF (Objective 1 and 2): Management and implementation systems for Cohesion policy[END_REF]), there are gaps in the literature concerning the Cohesion policy approach to financial management, control and audit; the effects of the increased focus on financial accountability in the 2000s; and interactions between accountability and other goals such as policy effectiveness and efficiency.

This paper seeks to investigate, first, how EU financial management, control and audit are changing the governance of Cohesion policy (who is responsible to whom for specific aspects of financial accountability) [START_REF] Oliver | Government in the United Kingdom: The Search for Accountability, Effectiveness and Citizenship[END_REF][START_REF] Romzek | Cross pressures of accountability: initiative, command, and failure in the Ron Brown plane crash[END_REF][START_REF] Bovens | Analysing and assessing accountability: a conceptual framework[END_REF] and, second, the types of instrument that are being employed to ensure financial accountability [START_REF] Mulgan R | Holding Power to Account: Accountability in Modern Democracies[END_REF]DEMKE et al., 2007). Third, it examines the effects of increased control and audit on financial spending. Fourth, it considers the difficulties involved in assessing the impact of regulatory changes on the level of financial irregularities in Cohesion policy and explores how these changes are perceived by staff involved in programme administration, not least in terms of the interactions between financial accountability and other policy goals, such as administrative efficiency and policy effectiveness [START_REF] Mulgan R | Holding Power to Account: Accountability in Modern Democracies[END_REF]GREGORY, 2007).

The remainder of the paper is structured as follows. The following section examines the literature on financial accountability, drawing key questions in relation to Cohesion policy which are explored in subsequent sections. The third section examines methodological issues, while the fourth describes the allocation of responsibilities between authorities in relation to financial accountability in Cohesion policy. The fifth section examines the implementation of financial accountability, assessing the impact of the so-called 'n+2 rule' on financial absorption, as well as the effect of audit procedures on the scale of irregularities. The sixth section considers whether there are tensions between financial accountability and other goals, notably efficiency and effectiveness. The final section discusses the research findings, as well as methodological challenges and areas where further research is needed.

FINANCIAL ACCOUNTABILITY AND COHESION POLICY

Accountability as a policy tool

Although an extensive literature has developed on accountability [START_REF] Benz | Introduction[END_REF][START_REF] Bovens | Analysing and assessing accountability: a conceptual framework[END_REF]BRINKERHOFF, 2004;[START_REF] Mulgan R | Holding Power to Account: Accountability in Modern Democracies[END_REF][START_REF] Oliver | Government in the United Kingdom: The Search for Accountability, Effectiveness and Citizenship[END_REF], little has been written on this theme in relation to Cohesion policy (but see POLVERARI, Forthcoming). The term 'accountability' is generally used to imply that actors are required to account for the discharge of their duties or conduct, that they are constrained by external mechanisms and internal norms, and that they must suffer the consequences if errors have been made [START_REF] Bovens | Analysing and assessing accountability: a conceptual framework[END_REF][START_REF] Koppell | Pathologies of accountability: ICANN and the challenge of 'multiple accountabilities disorder[END_REF][START_REF] Oliver | Government in the United Kingdom: The Search for Accountability, Effectiveness and Citizenship[END_REF]. The emphasis on accountability in recent decades can be seen as part of broader reforms aimed at enhancing the efficiency and effectiveness of public sector activity (HOOD, 1991;cf. FERLIE et al., 2007), which range from the privatisation of public functions, to the introduction of performance measurement techniques, the establishment of audit and regulatory authorities, and the decentralisation of functions to non-governmental agencies and sub-national bodies [START_REF] Modell | Performance measurement myths in the public sector: a research note[END_REF][START_REF] Pollitt | Public Management Reform: A Comparative Analysis[END_REF].

Studies identify a number of dimensions of accountability, notably financial correctness and efficiency, the quality of policy interventions, and the achievement of political goals (BRINKERHOFF, 2004). The first of these, financial accountability, relates to the control and elimination of waste and corruption and involves compliance with legal procedures, as well as the use of external audit mechanisms. In contrast, performance accountability emphasises improvement and learning, drawing partly on legal, regulatory and policy frameworks but also on instruments such as benchmarking, monitoring and evaluation. Lastly, political accountability encompasses efforts to ensure that governments meet election promises and respond to societal concerns, partly via the electoral process, but also through broader efforts to build trust in governmental ethics and shared societal values.

Within each of these dimensions, the literature suggests that there is a need to analyse a number of aspects of accountability, notably how accountability operates and which actors are responsible to whom [START_REF] Bovens | Analysing and assessing accountability: a conceptual framework[END_REF][START_REF] Oliver | Government in the United Kingdom: The Search for Accountability, Effectiveness and Citizenship[END_REF][START_REF] Romzek | Cross pressures of accountability: initiative, command, and failure in the Ron Brown plane crash[END_REF], as well as the kinds of instrument used to ensure accountability, for example, administrative rules, procedures and practices (DEMKE et al., 2007;[START_REF] Mulgan R | Holding Power to Account: Accountability in Modern Democracies[END_REF]. A final set of concerns relates to the tensions that can emerge between accountability and other values, such as policy effectiveness and efficiency (GREGORY, 2007;[START_REF] Mulgan R | Holding Power to Account: Accountability in Modern Democracies[END_REF]. [START_REF] Bachtler | Challenges, Consultations and Concepts: Preparing for the Cohesion Policy Debate[END_REF].

Financial accountability in EU

One of the challenges of ensuring financial accountability is that EU policies -not least Cohesion policy -involve multi-level and networked forms of governance ( [START_REF] Marks | European integration from the 1980s: state-centric v. multi-level governance[END_REF]BACHE and FLINDERS, 2004 [START_REF] Benz | Introduction[END_REF]. Where policy-making is based on complex formal and informal relationships between multiple levels and actors, there is a need for different types of accountability mechanism than those employed in simpler, hierarchical systems [START_REF] Rhodes R | Understanding Governance: Policy Networks, Governance, Reflexivity and Accountability[END_REF]. Nevertheless, financial accountability has not been the subject of studies relating to Cohesion policy, even though issues relating to performance accountability [START_REF] Kelleher | The thematic evaluation of the partnership principle[END_REF][START_REF] Bachtler | Ex post evaluation of Cohesion policy programmes 2000-2006 co-financed by the ERDF (Objective 1 and 2): Management and implementation systems for Cohesion policy[END_REF] and political accountability [START_REF] Rodriguez-Pose | Between development and social policies: the impact of European Structural Funds in Objective 1 regions[END_REF][START_REF] Bradley | Evaluating the impact of European Union Cohesion policy in less-developed countries and regions[END_REF][START_REF] Martin | Evaluating the impact of the Structural Funds on Objective 1 regions: an exploratory discussion[END_REF]) have been explored. There has been little questions, as well as the opinions of interviewees (Ibid.). In this case, the interviews were used to explore how managing, certifying and audit authorities met EU requirements on financial accountability; how their work was affected by changes in the Cohesion policy approach to financial accountability; and their views of the effects of these changes. The researchers used structured interview schedules as a means of increasing the validity of data collected [START_REF] Lindlof | Qualitative Communication Research Methods[END_REF].

MARKS

Moreover, the interview results presented in this paper are fully consistent with the findings of other studies (e.g. [START_REF] Öir | Study on the efficiency of the implementation methods for Structural Funds[END_REF]WOSTNER, 2008) and are supported by the formal statements of governmental authorities, including the EU Committee of the Regions (COMMITTEE OF THE REGIONS, 2010) and national and regional governments (DG REGIONAL POLICY, 2008b).

RESPONSIBILITIES AND FINANCIAL ACCOUNTABILITY IN EU COHESION POLICY

A complex web of relations between EU, national and regional authorities underpins different organisations to act as checks and balances within the system of financial accountability (EUROPEAN COUNCIL, 2006, Articles 58-62) . This results in a complex system, as can be seen from a description of the core financial control and audit procedures. A first set of tasks is undertaken by the programme managing authority and includes administrative checks on the information submitted by projects, as well as on-the-spot visits to a sample of projects to ensure that they are respecting EU rules (IBID, Article 60). The managing authority can delegate some project checks to a technical secretariat or intermediate bodies, and in such cases the managing authority undertakes an additional set of administrative checks, both on projects and on the subordinate bodies' systems. Moreover, the administrative checks and on-the-spot visits must be undertaken by a different member of staff than the person who administers the project application and approval process. A second set of checks on projects is undertaken by the programme certifying authority before it approves project payment claims and submits them to the European Commission (IBID, Article 61). The regional or national audit authority completes a third set of checks and audits, encompassing all the programme's management systems and procedures to ensure that they function effectively (IBID, Article 62). In addition, all these organisations, as well as individual projects, are subject to financial controls and audit visits by Commission DGs (including the Commission's Anti-Fraud Office, as well as DG Regional Policy and DG Employment) and the European Court of Auditors (IBID, Articles 72-73). Lastly, programmes and projects must comply with national and regional procedures for financial management, control and audit, which may differ from EU rules, for example in terms of approaches to administrative and on-the-spot checks, data requirements and payment procedures. The first measure of financial accountability is the de-commitment or 'n+2' rule which states that managing authorities must pay out annual tranches of Cohesion policy funding to projects within two years or lose the resources from the programme's budget (EUROPEAN COUNCIL, 2006, Articles 93-97). This also implies that all funds must be paid out within two years of the end of the programme period. The aim is to ensure that EU funds are spent in a timely way, as programmes were often slow to absorb funds in 1989-93 and 1994-99 and were not formally closed until several years after the end of programme periods. additional assistance to projects in difficulty [START_REF] Polverari | Programmes at the turning point[END_REF]VIRONEN, 2008).

[

INSERT TABLE 1 ABOUT HERE]

In addition, managing authorities have used the n+2 rule as a means of inducing changes in the behaviour of other actors, for example by requiring the more rapid submission of payment claims by projects, overcoming interruptions in domestic schemes linked to Structural Funds programmes, and releasing additional domestic co-financing (VIRONEN, 2008). However, some difficulties have proved harder to resolve, not least when unforeseen planning or construction challenges emerge in relation to large infrastructure projects; moreover, if such projects cannot be completed, it is often difficult to re-allocate the large volume of funds quickly enough (DAVIES and GROSS, 2007).

Although there is broad support among regional and national policy-makers for retaining the n+2 rule due to its impact on the timely absorption of EU funding, there are concerns that it leads to an over-emphasis on financial absorption rather than on project quality or strategic programme goals (DOWNES et al., 2003 , 2009). For example, pressure to absorb funds more rapidly has led some programmes to relax project selection criteria to include less strategic types of project.

Financial control and irregularities

While the introduction of the n+2 rule aimed to accelerate financial absorption, the second measure of financial accountability concerns efforts to reduce the level of irregularities. Audits by the European Court of Auditors and the Commission continue to find significant levels of error, although there is disagreement among EU authorities over the scale of irregularities and the broader implications of findings.

The European Court of Auditors publishes its audit results in its annual reports, and data for the last three years show that error rates remain relatively high (Table 2).

Unfortunately, the methods used by the Court of Auditors for presenting data have changed several times in recent years, so that it is not possible to use the data to assess whether error rates have fallen since the late 1990s. However, published data show that between 43 and 69 percent of the projects audited in 2006-08 showed some form of financial irregularity (Table 2). In addition, the Court of Auditors' reports state that 11-12 percent of resources reimbursed to the Member States in 2006-08 should not have been reimbursed (ECA, 2007(ECA, , 2008(ECA, , 2009)).

[INSERT TABLE 2 ABOUT HERE]

The Court of Auditors' findings are, however, disputed by the European Commission which, while recognising that the current level of financial irregularities is too high, questions the Court's methodology and findings (ECA, 2007(ECA, , 2008)) spending on ineligible projects), many are technical in character. They may include, for example, the declaration of costs not supported by an invoice (including where a project does not retain records for the required number of years); errors in calculating costs; or failures to meet EU rules on tendering, contracting or publicity.

The Commission also argues that the Court of Auditors' 'snapshot' methodology does not recognise that many of the errors would in any case have been detected by regional and national financial control and audit systems (ECA, 2007). However, the Commission's own audits also show significant levels of error (DG REGIONAL POLICY, 2007POLICY, , 2008a)). For example, DG Regional Policy's annual activity reports include an assessment of regional and national management and control systems, which show clear weaknesses (Table 3). In 2008, for example, around 60 percent of systems fell into the two 'best' categories and thus were seen to provide good assurance that effective financial management, control and audit procedures were followed -implying that such assurance was weak or non-existent in the remaining 40 percent of cases.

[INSERT efficiency (the cost of implementing programmes) and policy effectiveness (the outcomes of policy).

Administrative efficiency

Studies suggest that the cost of financial accountability mechanisms needs to be taken into account when designing systems because these costs can outweigh potential benefits in terms of reduced waste or corruption [START_REF] Mulgan R | Holding Power to Account: Accountability in Modern Democracies[END_REF]. Similar concerns have been voiced in debates over the control and audit of the EU budget, particularly in relation to the appropriate 'risk of error', as current EU rules state that errors must not account for more than two percent of resources, yet the costs of reducing the level of errors may be higher than savings from improved financial control (ECA, 2008).

In response to these concerns, the European Commission has funded research on the costs of administering Cohesion policy. One study of a sample of Member States found that the cost of financial controls alone was on average 3.5 percent of European Regional Development Fund payments, but that the cost in individual regions and Member States varied from less than 0.5 percent to over 12 percent (CEC, 2008b) However, significant uncertainties are associated with these estimates. For example, it is often difficult for policy-makers to separate out the Cohesion policy component of administrative costs, particularly as funds are often channelled into domestic instruments. In addition, the multiplicity of organisations involved in administering an individual programme makes it difficult to obtain a comprehensive overview, especially as information on administrative costs is sensitive because the two main variables are staff time and salary levels. Nevertheless, these studies suggest that administrative costs are significant and that an appropriate balance needs to be struck between efforts to ensure financial accountability on the one hand and administrative costs on the other.

Policy effectiveness

Two existing studies raise questions about possible tensions between EU rules on financial accountability and programme effectiveness [START_REF] Öir | Study on the efficiency of the implementation methods for Structural Funds[END_REF] In some countries, policy-makers argued that the greater rigour of financial control and audit seen in EU Cohesion policy in recent years has brought benefits. A minority of interviewees noted that EU rules on financial accountability had improved the quality of implementation. In particular, staff in Greece and Italy stated that experience of implementing Cohesion policy rules had raised awareness of the need to prevent irregularities and fraud, while interviewees in the Czech Republic, Greece and Poland argued that EU rules were shaping and raising the standards of domestic policy implementation.

However, the stricter rules on financial accountability in the 2000s were also seen to have also led to a significant increase in workload. The interviewees argued that these tasks have now become the primary focus of staff working in managing authorities and intermediate bodies, and many felt that only limited resources were available for other tasks, including strategic design, project generation and selection, output monitoring and impact evaluation. Cohesion policy implementation -are now reluctant to apply for funds. This reluctance is seen to be rooted in the administrative workload associated with Cohesion policy projects, as well as concerns that, if project-holders make administrative errors, they may have to return funds to the EU, even if errors are not detected for several years.

Nevertheless, many managing authorities acknowledged that the difficulties they faced were not simply due to the complexity of EU rules but also to tensions between EU and domestic approaches. Some authorities stated that Cohesion policy required more detailed approaches to certain aspects of financial management, control and audit than do domestic rules (e.g. in Belgium, the Czech Republic, Denmark, Finland, France, Greece, Slovenia and the UK). However, where some types of domestic rules were lighter, they were often balanced by other, more stringent rules; for example, if domestic requirements for on-the-spot project checks were more limited, procedures relating to administrative checks and financial audits would be stricter. The result for many managing authorities was seen to be duplications and tensions between domestic and EU-level rules (e.g. in the Czech Republic, Denmark, Germany and Italy).

Some managing authorities argued that the need to respect both EU and domestic rules raised questions over the allocation of tasks between the EU level and the regional or national level. A number of interviewees noted frustrations due to the fact that, on the one hand, they have had to take on additional tasks in relation to financial control and audit but, on the other hand, they feel that their work is duplicated by the Commission and the European Court of Auditors. Some argued that further implementation tasks should be decentralised to Member State or regional levels, or that domestic financial control and audit systems should be used instead of EU-level rules (e.g. in the Czech Republic, Germany, Italy, Sweden and the UK).

In addition, some interviewees felt that the administrative burden associated with financial accountability raised questions over the net impact of Cohesion policy. They argued that the contribution of programmes to regional economic development was reduced by the heavy cost of administrative procedures and the duplication of tasks at EU and domestic levels. This was seen to imply that, unless responsibility for these tasks was transferred to Member State and regional authorities, there would be a need to rethink the rationale for EU intervention in support of regional development.

This survey suggests that those involved in programme management perceive an increase in workload relating to financial accountability in recent years and that this is reshaping the types of project funded and the capacity of Cohesion policy to stimulate new approaches. It also indicates that some managing authorities feel that these changes, combined with the obligation to respect both EU and domestic rules, raises questions over the allocation of responsibility between different government levels, as well as over the net economic impact of Cohesion policy.

DISCUSSION AND CONCLUSIONS

Like other governmental authorities in Europe and elsewhere, the EU has developed a stronger focus on financial accountability in recent years. Key changes in financial accountability in Cohesion policy since the late 1990s have been examined in this paper, with a particularly focus on the approach employed in 2007-13.

One important aspect of accountability identified in the literature relates to chains of accountability or 'who is held responsible to whom' [START_REF] Bovens | Analysing and assessing accountability: a conceptual framework[END_REF][START_REF] Oliver | Government in the United Kingdom: The Search for Accountability, Effectiveness and Citizenship[END_REF][START_REF] Romzek | Cross pressures of accountability: initiative, command, and failure in the Ron Brown plane crash[END_REF]. A further important dimension concerns the instruments used to implement financial accountability (DEMKE et al., 2007;[START_REF] Mulgan R | Holding Power to Account: Accountability in Modern Democracies[END_REF]. The paper has examined two EU mechanisms that are used to monitor financial flows and check on the misuse of funds. The data available from EU sources show that tighter procedures ensured the more timely absorption of EU funds in 2000-06 but that auditors continue to find significant levels of financial irregularities. EU authorities' interpretations of audit findings vary but there is agreement that one reason for high error levels is the complexity of Cohesion policy rules (DG REGIONAL POLICY, 2008a). Options under discussion include raising the acceptable error rate (CEC, 2008c;ECA, 2008), and reducing the complexity of rules (WOSTNER, 2008).

This paper has also examined potential tensions between financial accountability and other goals such as efficiency and effectiveness (cf. GREGORY, 2007;[START_REF] Mulgan R | Holding Power to Account: Accountability in Modern Democracies[END_REF]. On the one hand, initial estimates suggest that the costs of administering [START_REF] Barca | An agenda for a reformed Cohesion policy: a place-based approach to meeting European Union challenges and expectations[END_REF][START_REF] Bachtler | Challenges, Consultations and Concepts: Preparing for the Cohesion Policy Debate[END_REF].

Nevertheless, further studies are needed on a number of the issues addressed in this paper. In particular, research should be undertaken to provide stronger evidence on the costs of administering Cohesion policy, not only within regional and national authorities, but also in final beneficiaries and EU authorities. More research is also needed on the effects of financial control and audit on the misuse of funds and on error rates. In addition, better understanding is needed of how financial accountability mechanisms interact with other dimensions of accountability (e.g. performance and political accountability [Brinkerhoff, 2004]) and other values such as efficiency and effectiveness. One means of investigating these issues would be to undertake further interviews with staff in managing, certifying and audit authorities at regional and national levels, and also with EU authorities (not only the European Commission, but also the Council, the Court of Auditors and the Parliament) and, particularly, with the final beneficiaries of EU funding.

These issues are particularly interesting because EU bodies are not simply under the same pressures as other governmental authorities to enhance financial accountability, but are also involved in more complex sets of relationships and interactions, due to the multiple layers of agents and the networked forms of governance involved in EU policy-making. Thus the chains of responsibility, the instruments used to ensure accountability and the potential tensions with other policy goals are often more intricate than those seen in national or regional policy-making. 3. In the case of the interviews with the national and regional authorities, the interviewers used a checklist of 55 questions which focused on the work of the managing authority (e.g. description of the management and control system, use of electronic data systems, and administrative and on-the-spot checks on projects), the certifying authority (e.g. checks undertaken to certify expenditure statements, the outsourcing of work, changes in procedures in 2007-13) and the audit authority (e.g. compliance assessment, audit strategy, and annual control report and opinion) and which also sought the interviewees' views of the specific regulatory changes introduced in 2007-13 and the effects of the Structural Funds' approach to financial control and audit. In the case of the interviews with European Commission staff, a checklist of 20 questions was used, which concentrated on the approach taken to financial control and audit (e.g. the Commission's tasks in 2007-13; the evolution of the Cohesion policy approach since the 1990s; steps taken to build audit capacity at EU level and in the Member States; and coordination between EU authorities), as well as on their views of the effects of the current system, and possible ways of improving financial control and audit in Cohesion policy. Source: DG REGIONAL POLICY (2007, 2008a).

F

  policy-making There has been a clear focus on strengthening financial accountability in EU policymaking in recent years, particularly in the context of the EU response to financial irregularities in European Commission activities in 1998, as well as shifts in the character of the EU due to recent enlargements. The refusal of the European Parliament to discharge (or sign off on) the Community budget in 1998 led to the resignation of the Santer Commission in March 1999 (BAUER, 2008; KASSIM, 2008) and to a reform package which included the creation of new Commission offices to investigate fraud and undertake internal audits, notably the European Anti-Fraud Office and the Commission's Internal Audit Service, as well as stronger financial control and audit functions in Commission Directorates General (DGs) responsible for the EU budget. Pressure for enhanced financial accountability has also been stimulated by changes in the European Council's composition and focus in the context of recent enlargements, which have led to a greater diversity of national interests, an even stronger awareness of the redistributive dimension of the EU budget, and an increased emphasis on how Member States use EU resources

the

  Cohesion policy approach to financial accountability. Core formal responsibilities are set out in the EU Treaty (EUROPEANUNION, 2008), and are further elaborated in the Financial Regulation and Cohesion policy regulations(EUROPEAN COUNCIL, 2002, 2006; CEC, 2006a). Since the late 1990s, significant efforts have been made to codify more clearly the obligations of different actors in relation to financial accountability, and this has generated detailed legal and procedural frameworks.Following changes introduced by the Lisbon Treaty, the consolidated Treaty now states that 'The Commission shall implement the budget in cooperation with the Member States in the implementation of the budget and the resulting responsibilities' (EUROPEANUNION, 2008, Article 317, authors' emphasis). Thus in principle, ultimate responsibility is now shared by the Member States and the Commission, rather than held solely by the Commission, as was previously the case (EUROPEAN UNION, 2006, Article 274), while the management of programmes and projects is in practice undertaken by large numbers of governmental, non-governmental and business organisations at local, regional and national levels.This emphasis on shared responsibility between the Commission and MemberStates was also built into the revision of the EU Financial Regulation in 2002 which, among other things, aimed to bridge the divide between the Commission's formal responsibility for the budget and the multiplicity of decentralised implementing organisations. The Financial Regulation describes three paths for managing different components of the EU budget, namely 'on a centralised basis; by shared or decentralised management; [or] by joint management with international organisations' (EUROPEAN COUNCIL, 2002, Article 53). Cohesion policy is implemented via 'shared management', where the Commission retains 'final responsibility for the implementation of the budget' (IBID, Article 53b), but the Member States are responsible for 'all the legislative, regulatory and administrative or other measures necessary for protecting the Communities' financial interests' (IBID, Article 53b).Member States are required to operate a system which ensures that interventions are genuinely carried out, that errors and fraud are prevented, that any funds wrongly used recovered, and that effective reporting mechanisms are in place (IBID, Article 28a, Article 53b).Nevertheless, this does not imply that Member States and regional authorities have increased scope to determine how they should manage their share of the Cohesion policy budget. Indeed, the revisions to the Cohesion policy regulations for the 2000-06 and 2007-13 periods include more prescriptive and stringent rules on financial management, control and audit than in previous periods, partly because the general regulation on the Structural Funds(EUROPEAN COUNCIL, 2006) is now reinforced by implementing regulations(CEC, 2006a). Moreover, the 2007-13 regulations give the Commission a degree of authority over the Member States and regions, particularly at the beginning of the period, when each managing authority must provide the Commission with a detailed description of the financial management and control system for each programme, and the regional or national audit authority must assess the system's compliance with EU rules(EUROPEAN COUNCIL, 2006, Articles 70-72; CEC, 2006a, Articles 21-25). European Commission staff then check both the managing authority's system description and the audit authority's assessment, and can require additional information or checks from domestic authorities. Until Commission staff explicitly approve both sets of documents, only limited funding is released (five percent of EU funds in the EU15 and seven percent in the EU12). This represents a significant shift from 2000-06, when the Commission could not insist on changes in programme implementation systems, nor impose financial penalties.The Cohesion policy regulations in 2007-13 not only define the obligations of the Member States in procedural terms but also require them to set up a number of

  Treaty and Financial Regulation now allocate greater responsibility to the Member States for financial accountability, the Cohesion policy regulations in 2007-13 are highly prescriptive and allow Member State and regional authorities less scope than in past periods to decide how to ensure accountability in relation to the use of EU funds. The regulations not only define the responsibilities of the Member States more clearly but also require multiple organisations to be set up for each programme, and oblige these bodies to take responsibility for different categories of accountability checks and to operate in accordance with EU rules.

  percent of EU receipts in the UK (HOUSE OF LORDS, 2008) to 4.8 percent in Sweden (STATSKONTORET, 2000), 5.5 percent in Malta (PWC, 2006a), 7.0 percent in Poland (DORADCA, 2007) and 9.0 percent of total funding in Estonia (PWC, 2006b).

  A distinguishing feature of Cohesion and other EU policies is the multiplicity of actors involved and thus the complexity of accountability relationships. The paper has explored recent shifts in the formal allocation of responsibility, with the Treaty and Financial Regulation no longer awarding sole responsibility to the Commission for EU budget implementation but stipulating that responsibility is shared with the Member States. However, the increased level of prescription in Cohesion policy regulations in 2000-06 and 2007-13 means that Member State and regional authorities must implement financial accountability in accordance with detailed EU rules and that the associated workload has risen significantly. At the same time, the frequency and intensity of checks by the Commission and Court of Auditors has also increased.

  ) Towards a common understanding of the concept of tolerable risk of error, Brussels. CEC (2007) Eighteenth annual report on implementation of the Structural Funds in 2006, Brussels. CEC (2006a) Regulation 1828/2006 of 8 December 2006 setting out rules for the implementation of Council Regulation 1083/2006 and of Regulation 1080/2006, Official Journal L371. CEC (2006b) Seventeenth annual report on implementation of the Structural Funds in 2005, Brussels. CEC, (2005) Sixteenth annual report on implementation of the Structural Funds in 2004, Brussels. CEC, (2004) Fifteenth annual report on implementation of the Structural Funds in 2003, Brussels. CEC (2003) Fourteenth annual report on implementation of the Structural Funds in 2002, Brussels. CEC (2002) Thirteenth annual report on implementation of the Structural Funds in 2001, Brussels. CEC (2001) Twelfth annual report on implementation of the Structural Funds in 2000, Brussels. COMMITTEE OF THE REGIONS (2010) Prospektivstellungnahme zur Zukunft der Kohäsionspolitik, Brussels. DG REGIONAL POLICY (2008a) Annual activity report 2007, Brussels.

  (2008b) Growing Regions, growing Europe: Contributions to the public consultation on the future of EU Cohesion policy, Brussels. DG REGIONAL POLICY (2007) Annual activity report 2006, Brussels. DAVIES S. and GROSS T, (2007) The end of the formal programming period for 2000-2006, IQ-Net Paper 19(1), EPRC, Glasgow. DEMKE C, HAMMSCHMID G and MEYER R (2007) Decentralisation and accountability as a focus of public administration modernisation, Austrian Federal Chancellery, Vienna. DENZIN N. and LINCOLN Y. (eds) (2005). The Sage Handbook of Qualitative Research, Sage, Thousand Oaks. DORADCA (2007) Ocena poziomu kosztów administracyjnych zarządzania i wdraŜania funduszy strukturalnych i Funduszu Spójności w Polsce Raport Końcowy. DOWNES R., DAVIES S., BACHTLER J. and MICHIE R. (2003) Review of Structural Fund programming, IQ-Net Paper 13(1), EPRC, Glasgow. EUROPEAN COUNCIL (2006) Regulation 1083/2006 of 11 July 2006 laying down general provisions on the European Regional Development Fund, the European Social Fund and the Cohesion Fund, Official Journal L210. EUROPEAN COUNCIL (2002) Regulation 1605 of 25.06.02 on the Financial Regulation applicable to the general budget of the European Communities'COURT OF AUDITORS) (2009) Annual report on the implementation of the budget concerning the financial year 2008, Official Journal C304. ECA (2008) Annual report on the implementation of the budget concerning the financial year 2007, Official Journal C286. ECA (2007) Annual report on the implementation of the budget concerning the financial year 2006, Official Journal C273. EUROPEAN PARLIAMENT (2009) Report on the discharge for implementation of the EU general budget for the financial year 2007, Brussels. EUROPEAN UNION (2008) Consolidated version of the Treaty on the functioning of the European Union, Official Journal C115. EUROPEAN UNION (2006) Consolidated versions of the Treaty on European Union and the Treaty establishing the European Community, Official Journal C321. FERLIE E., Lynn L. and POLLITT C. (2007) The Oxford Handbook of Public Management, Oxford University Press, Oxford. FERRY M. and MCMASTER I. (2009) Literature review for study 'Regional governance in the context of globalisation', Report to CEC, Brussels. GREGORY R. (2007) Accountability in modern government, in G. Peters and J. Pierre (eds) The Handbook of Public Administration, Sage, London, pp.339-350. HOOD C. (1991) A public management for all seasons? Public Administration 69, 3-19.

  Governance in the Context of Globalisation, Report to the European Commission, Brussels. VIRONEN H. (2008) Getting under way: the first phase of implementing the 2007-2013 programmes, IQ-Net Paper 22(1), EPRC, Glasgow. WOSTNER P. (2008) The micro-efficiency of EU Cohesion policy, Research Paper 64, EPRC, Glasgow.

  assessment of the impact of the n+2 rule in 2000-06 can be undertaken now that the period has formally closed. Data on financial absorption suggest that the n+2 rule has changed behaviour, leading to a steadier absorption of funds throughout 2000-06.

	Table 1 shows that almost one third of funds were paid out by 2003 and over 90
	percent by the end of the period. Measures taken by managing authorities to meet n+2
	targets include improvements in planning, risk analysis and monitoring; streamlined
	F administrative procedures; more support for project generation; increased staff o r resources; better communication with projects about payment deadlines; and
	P
	e
	e r
	R
	e
	v i e
	w
	O n l
	The n+2 rule was introduced y
	in 2000 and remains in place in 2007-13, although it has been changed to an n+3 rule
	for poorer Member States, which receive more EU funding and thus face greater
	financial management challenges.

14

A full

TABLE 3

 3

	ABOUT HERE]
	Although there is significant disagreement between EU authorities on the scale of
	problems relating to EU budget implementation (ECA, 2008; EUROPEAN
	PARLIAMENT, 2009), all agree that efforts are still needed to improve the quality of
	financial management, control and audit systems in Cohesion policy.

  This section provides more detailed evidence on policy-makers' perceptions of how changes in EU rules on financial control and audit are affecting Cohesion policy are presented in this section. It draws on a survey of the views of national and regional

	2008). authorities, undertaken in 2008 via 60 structured interviews with senior staff in the
	managing, certifying and audit authorities of Structural Funds programmes in 15
	Member States.
	F o r
	P
	e
	e r
	R
	e
	v i e
	w
	O n l
	y
	; WOSTNER,
	19

  Greece, Poland, Portugal, Slovenia, Sweden and the UK) argued that the cost of implementing smaller programmes and projects raises issues of financial viability.Stricter rules are also seen to have led to changes in the behaviour of both administrators and project applicants. A number of authorities stated that they are now cautious in allocating resources to project applicants who do not have a track record of implementing Cohesion policy projects effectively, or to types of project which have not previously been funded by Cohesion policy (e.g. in Austria, Poland, Slovenia and the UK). This contrasts with the past use of Structural Funds programmes to stimulate new approaches to regional development, for example via support for

	F o r
	P
	e
	e r
	R
	e
	v i e
	w
	O n l
	y
	The workload was viewed as particularly heavy in the case of smaller interventions
	because the same EU rules apply, regardless of programme or project size, although
	20

very large projects (over €50 million) are subject to additional procedures. Thus managing authorities (e.g. in Austria, Belgium, the Czech Republic, Finland, France, innovative or community-based projects. Moreover, managing authorities in a number of regions (e.g. in Belgium, Finland, France, Slovenia and the UK) noted that some potential applicants -including relatively large organisations with experience of

Table 1 :

 1 Financial absorption of Structural Funds resources in 2000-06

		EU funds
	Total EU funding	committed as a	EU funds paid out as
	allocated to Objectives	percentage of total	a percentage of total
	1, 2 and 3 in 2000-06,	allocations	allocations
	in billion Euro

Table 2 :

 2 Financial irregularities found by the European Court of Auditors in Cohesion The date refers to the financial year examined by the Court of Auditors' reports.2) Figures may not sum to 100 percent due to rounding.Source: Authors' calculations based onECA (2007ECA ( , 2008ECA ( , 2009)).

	policy in 2006-08
		2006	2007	2008
	Percentage of projects with	31	46	57
	no errors
	Types of error found:
	Ineligible spending	16	17	22
	Spending not incurred or not	7	4	0
	documented
	Inaccurate calculations	6	7	7
	Multiple errors	14	11	n/a
	Non-compliance with EU	25	15	29
	rules
	Total percentage of projects	100	100	100
	Total number of projects	167	180	170
	audited
	Notes: 1)

Table 3 :

 3 DG Regional Policy's assessment of Member State management and control systems for the ERDF in 2000-06, as a percentage of annual payments

	2007	2008

http://mc.manuscriptcentral.com/cres Email: regional.studies@fm.ru.nlRegional Studies

ACKNOWLEDGEMENTS

We acknowledge research funding received from the IQ-Net policy network which is run by the European Policies Research Centre at the University of Strathclyde. We also thank the policy-makers who were interviewed, as well as the following researchers for providing country-specific material: Martin Ferry, Frederike Gross, Henrik Halkier, Lucie Jungwiertová, Stefan Kah, Christina Kanata, Damjan Kavaš, Carlos Mendez, Rona Michie and Heidi Vironen. Last, we are grateful to John Bachtler, Frederike Gross, Martin Ferry, Irene McMaster and Katja Mirwaldt, as well as three anonymous referees, for comments and discussions on earlier drafts of this paper.

< R -Urban, Rural, and Regional Economics , Financial control, Cohesion policy,


Jérôme Franc

Shaonan Wang

Walter Bronzi

Radu State

Thomas Engel

BotCloud: Detecting Botnets Using MapReduce

Botnets are a major threat of the current Internet. Understanding the novel generation of botnets relying on peerto-peer networks is crucial for mitigating this threat. Nowadays, botnet traffic is mixed with a huge volume of benign traffic due to almost ubiquitous high speed networks. Such networks can be monitored using IP flow records but their forensic analysis form the major computational bottleneck. We propose in this paper a distributed computing framework that leverages a host dependency model and an adapted PageRank [1] algorithm. We report experimental results from an open-source based Hadoop cluster [2] and highlight the performance benefits when using real network traces from an Internet operator.

I. INTRODUCTION

The attacks in Internet and their variety have greatly increased leading to the emergence of defense techniques including firewalls, IDS (Intrusion Detection System), antivirus software... However, recent studies have shown that new attacks are hard to detect [START_REF] Wang | A graph based approach toward network forensics analysis[END_REF], [START_REF] Liao | Network forensics based on fuzzy logic and expert system[END_REF]. Thus, forensics is required for understanding these attacks and measuring their impacts. This is helpful to recover the system back to a safe state and counter them in the future. From a network point of view, attacks are more distributed. Botnets are one of the most major threat [START_REF] Networks | Worldwide infrastructure security report (2009 report)[END_REF] and have evolved from a centralized model towards a decentralized, highly scalable architecture [START_REF] Masters | Mariposa Botnet Mastermind Nabbed[END_REF] based on peerto-peer (P2P) networks [START_REF] Porras | A Multi-perspective Analysis of the Storm (Peacomm) Worm[END_REF].

Thus, detection and forensics analysis have to be shifted from edges to the core of the network, i.e., the operators (Internet Service Providers -ISP). However, the ISPs have to deal with a huge volume of traffic although fast and efficient analysis is required. Many forensic tools still rely on manual analysis [START_REF]Safeback[END_REF]. Hence, new assisted approaches have appeared relying on host dependencies [START_REF] Wang | A graph based approach toward network forensics analysis[END_REF], profiling host behaviors [START_REF] Mchugh | Passive network forensics: behavioural classification of network hosts based on connection patterns[END_REF] or using deep packet inspection [START_REF] Corey | Network forensics analysis[END_REF]. Due to scalability issues in high speed networks, common solutions exclude that and focus exclusively on Netflow [START_REF] Claise | Cisco Systems NetFlow Services Export Version 9[END_REF] data. This is an aggregated view of the network traffic excluding content and, thus, avoid many privacy issues which have to be considered in forensic analysis [START_REF] Mchugh | Passive network forensics: behavioural classification of network hosts based on connection patterns[END_REF].

Therefore, we propose to detect new generation of botnets from large dataset of Netflow data, such as those gathered by each individual operator. Our previous approach [START_REF] Franc ¸ois | Bottrack: Tracking botnets using netflow and pagerank[END_REF] is extended by leveraging cloud computing paradigms especially MapReduce [START_REF] Dean | MapReduce: simplified data processing on large clusters[END_REF] for detecting densely interconnected hosts which are potential botnet members.

A botnet description is given in section II. Our approach is described in III. Section IV explains the host dependency model and the algorithms. Section V is the experimental evaluation. Section VI summarizes related work. Conclusion and future work are included in section VII.

II. BOTNETS

A botnet is a network of compromised hosts (bots) which are controlled by an attacker also called the botmaster. The botmaster sends commands via a C&C (Command and Control) channel. Although first botnets relied on a central architecture with a core network of few interconnected IRC [START_REF] Oikarinen | rfc 1459: Internet relay chat protocol[END_REF] (Internet Relay Chat) servers, current botnets are based on P2P technologies [START_REF] Arce | An analysis of the slapper worm[END_REF], [START_REF] Porras | A Multi-perspective Analysis of the Storm (Peacomm) Worm[END_REF]. In a P2P architecture, each bot acts as a client and a server. Hence, for sending a command to certain bots, other bots are involved. Therefore, P2P bots are well interconnected and that is why we argue in this paper that analyzing interactions between hosts is valuable for detecting botnets.

III. SYSTEM OVERVIEW

A. Cloud computing

Today, storing large volumes of data is possible but analyzing them is still a problem. In our case, 720 millions netflow records (77GB) covering only 23 hours were collected from a major Internet operator in Luxembourg. Hence, distributed computing might be the only viable solution. The main idea of cloud computing is to provide a simple interface to clients who do not want to manage hardware related details such as the resource allocations. The cloud computing service aims to be very scalable and on demand without long delays: computing power should be available instantaneously. In brief, it can be seen as an abstraction layer taking benefit of recent virtualization outcomes in order to provide a simple way for final users to run tasks requiring intensive computing and storage.

The popularity of such services is highlighted for instance by Amazon EC2 [START_REF] Inc | Amazon Elastic Compute Cloud (Amazon EC2)[END_REF] which also introduces a new economic model where a cluster of machines can be easily rented. In this way, individuals or companies can take advantage of distributed computing without a huge financial investment.

B. MapReduce

MapReduce [START_REF] Dean | MapReduce: simplified data processing on large clusters[END_REF] is a high-level abstraction of parallel computing introduced by Google. Although traditional approaches need to define exactly the way to carry out the data to process, MapReduce programming model focuses on the processing code. The key idea of the method is to shift the network transfer from the data to the code. In brief, the data is distributed a priori using a distributed file system. For Fig. 1: BotCloud framework achieving a task, the code is then distributed where the needed data is. Therefore, the cloud computing paradigm is well suited for problem dealing with huge volumes of data.

MapReduce comes from functional programming concepts with functions (map and reduce) that take other functions as inputs. The map aims to divide input data into multiple inputs for applying a function on each of them (mapper). The reduce function applied by reducers aggregates the individual results from the mappers. These tasks are attributed by a master machine to slave ones. The master is also responsible to detect node or network failures by a ping mechanism in order to reassign tasks to others nodes.

From a theoretical point of view, the input data is composed of a set of key-value pairs such as (k i , v i ) and the map function is applied to each of them to produce a list of intermediate key-value pairs:

map : (k i , v i ) → list(k ′ j , v ′ j )
There is no relationship between the number of initial and intermediary keys. This intermediate list of key-value pairs represents the intermediary outputs produced by mappers which have to be merged by the reducers:

: (k2, list(v 2 )) → list(k 3 , v 3 )
The input of the reduce function is an intermediate key with a list of all intermediate values generated for this key by all mappers. Therefore, the reducer can generate the aggregated result for each key passed as argument of the reduce function. More details about MapReduce are given in [START_REF] Lin | Data-Intensive Text Processing with MapReduce[END_REF].

C. Hadoop

Our botnet detection method is based on Hadoop [START_REF] White | Hadoop: The Definitive Guide[END_REF], an open source implementation of MapReduce. A common deployment of an Hadoop cluster is represented in the lower part of figure 1 with a master and slave nodes. The first key component is the Hadoop Distributed File System (HDFS) for storing data. The namenode daemon maintains the file namespace (directory structure, the location of file blocks). However, the blocks are directly stored on the slaves (datanodes) and guarantee a redundancy. Although the master node is the entry point to locate data, the scalability is enforced thanks to direct data transfer between entities (slave machines, user) without being forwarded by the master.

Considering the application side, the jobtracker takes as input a MapReduce job and is responsible to coordinate (task assignment) and monitor the map and reduce tasks. For improving the robustness, the jobtracker and namenode daemons may be executed on different master machines. Unlike the number of reduce tasks, the number of map tasks is automatically determined (the user can only give a hint) regarding the data distribution on HDFS. This is the application of the main MapReduce paradigm which aims to upload the code where the data is. When a node is overloaded, it will transfer data blocks to another which will then run the code. Obviously, the user has not to deal with these aspects which is a strength of the Hadoop.

D. Detection

Figure 1 shows the main steps of our approach using Hadoop. The first step is to gather Netflow records (1) via exports from routers to a collector. Then, the interactions between hosts are analyzed in order to produce a dependency graph (2). This graph is the input to PageRank [START_REF] Page | The pagerank citation ranking: Bringing order to the web[END_REF] to figure out hosts which are well interconnected themselves such as within a P2P network. Our first experiments showed that the bottleneck of our approach is the PageRank algorithm which has to iterate many times before exhibiting stable results. Therefore PageRank is executed on Hadoop by distributing the adjacency matrix of the dependency graph among all datanodes (3) before executing map and reduce tasks (4).

The reducers write the scores of the different nodes of the dependency graph into the datanodes and that is why the detection module has to access to them for retrieving all the scores. Based on them, hosts are ranked and bots should be highly ranked. However, normal P2P nodes can also have high rankings and, to distinguish them from bots, we consider that some of them are prior known using a honeypot [START_REF] Spitzner | Honeypots: Tracking Hackers[END_REF]. In this case, the PageRank algorithm can be tuned (node weight in section IV-B) to increase the ranking of well interconnected hosts (graph partition) containing such hosts. Thus, legitimate P2P traffic can be discarded.

IV. ALGORITHMS

A. Dependency Graph

Netflow [START_REF] Claise | Cisco Systems NetFlow Services Export Version 9[END_REF] is a standard tool for today's large-scale network monitoring. A record represents a series of IP packets sharing the same source, destination address, associated ports, and protocols. A flow collecting architecture consists of probes and collectors. Probes or sensors are devices deployed in different network locations, and are responsible for capturing flow data and forwarding it to the collector. Almost all modern commercial-grade routers support Netflow or an equivalent format export.

Because of its wide availability and intrinsic host communication information, we utilize flow data and link analysis to detect structured botnets. The rationale behind our approach is that P2P structured botnets exhibit a distinguishable communication pattern among bots. Each node in a dependency graph represents a host, an edge pointing from node A to node B indicates that there exists at least one flow which originates from host A and destinates to host B. Hence, bots belong to the same P2P network are linked with either directly or via other bots.

Regarding privacy issues, Netflow records do not include content and our method relies only on host IP addresses which have been rendered anonymous using a reversible one-to-one function only known by the data owner. Thus, an ISP may use an outsourced Hadoop cluster without a high financial investment.

B. PageRank algorithm

The PageRank algorithm [START_REF] Page | The pagerank citation ranking: Bringing order to the web[END_REF] is a link analysis algorithm used by the Google web search engine to weight the relative importance of web pages on the Internet. It ranks each web page according to the hyperlink structure among web pages. The importance of a web page is determined by two factors:

1) how many pages contain a hyperlink pointing to it 2) the importance of the pointing pages Intuitively, pages receiving many links are important, and also pages receiving links from important pages are important.

Considering a dependency graph, an arbitrary initial score is attributed to each node which only impacts the convergence time. At each iteration, the current score of each node is distributed through its outgoing links, and the new ranking score for each node is the sum of distributed ranking scores that all the incoming links bring. The iterations continue until the score changes are sufficiently small. In case of nodes without outgoing links (dangling nodes) we assume the scores are distributed evenly to all nodes. To ensure convergence at primary eigenvalue, extra links are added between each pair of nodes. A certain portion of ranking scores is distributed through original links, and the rest is distributed through the added links. The portion of scores, distributed through the original links, is call damping factor d, and is fixed at 0.5 as an indication of how link structure influence the final rankings. We let the 1 -d node scores distributed to all the graph nodes according to our subjective preference of each node (a higher node weight is assigned to nodes representing infected honeypots). Assuming n nodes/hosts, P t and W are n-dimensional vectors representing the ranking scores and weights of the nodes, each sums to one, and let A be the adjacency matrix modified to link dangling pages to all the graph nodes, then the PageRank computation can be formalized as:

P t = (1 -d)W + dA T P t-1 (1)
The direction of edges indicates where the ranking scores are distributed. For flow monitoring, when edges point from the source to the destination host, the ranking scores are distributed towards the final destination of traffic, and is named hub rank (hr) in this paper; on the other hand, when pointing from the destination to the source host, the ranking scores are distributed towards the origins and it is named authority rank (ar). Equations ( 2) and (3) formulate this idea. Note that the adjacency matrix for hub rank and for authority rank are the transpose of each other.

hr t = dAhr (t-1) + (1 -d)W
(2)

ar t = dA T ar (t-1) + (1 -d)W (3)
Regarding our context, both scores are relevant because P2P bots act as client and server meanwhile.

C. MapReduce Implementation

PageRank is well fitted for MapReduce and this section reviews the basics of executing PageRank in the MapReduce context without taking into account the dangling nodes or the damping factor for clarity sake (details can be found in [START_REF] Lin | Data-Intensive Text Processing with MapReduce[END_REF]). As highlighted in section III-B, the first step is to divide data into multiple key-value pairs. Like other graph algorithms, a key is a node ID and the corresponding value is the list of adjacent nodes derived from the adjacency matrix A. In our case, each key (node ID) is also associated to the current PageRank score which is initialized at 1 for the toy example in figure 2(a). For each iteration of PageRank, a mapper distributes the current score of a node to its adjacent ones. A reducer is dedicated to sum all scores which were computed for a specific node ID.

This process is illustrated in figure 2(b) for the first iteration. For instance, the first mapper distributes the score of node 1 to nodes 2, 3 and 4. Hence, they get 1 3 each. Before the

V. EVALUATION

A. Datasets and methodology

Because no public dataset with labeled botnet traffic at an equivalent level than an ISP is available, our evaluation is based on NetFlow data provided by a major Luxembourg Internet Operator considered as free of botnet as it was checked by a traffic screening solution dedicated to ISP [START_REF]Peakflow SP: Traffic anomaly detection[END_REF].

This dataset involves around 16 million hosts within 720 million of netflow records. The corresponding dependency graph contains 57 millions links. Then, synthetic additional records reflecting the topology of three P2P protocols are added in a similar manner than in [START_REF] Franc ¸ois | Bottrack: Tracking botnets using netflow and pagerank[END_REF]: chord [START_REF] Stoica | Chord: A scalable Peer-To-Peer lookup service for internet applications[END_REF], kademlia [START_REF] Maymounkov | Kademlia: A peer-to-peer information system based on the xor metric[END_REF] and koorde [START_REF] Kaashoek | Koorde: A simple degree-optimal distributed hash table[END_REF]. A P2P network maps each peer to an ID defined in a huge ID space, as for example with a maximal node ID equal 2 160 . This paper focuses on structured P2P protocols since they guarantee high performances. Hence, Chord is a pioneering work where the routing has a complexity equals to log(N). Koorde is an extension of Chord with a lower complexity: O(log(N)/log(log(N)). Finally, Kademlia was chosen because it is well used in real world for file sharing but also for botnet communications [START_REF] Porras | A Multi-perspective Analysis of the Storm (Peacomm) Worm[END_REF].

Although the efficiency evaluation was done using the entire dataset (section V-C), generating synthetic botnet traces needs a lot of computation. Hence, the first experiment (section V-B) about the detection accuracy is based on a subpart of the dataset: 2,133k records and 323k hosts. To strengthen the evaluation, only 1% of IP addresses are used to generate bot traces (stealthy botnet).

Our Hadoop configuration is composed of 11 slave nodes: 5 Intel Core 2 Duo 2.13Gz with 4 GB of memory and 6 Intel Pentium 4 3GHz with 2GB of memory. This small cluster is ideal for testing Hadoop capabilities to cleverly assign the tasks even if the machines are heterogeneous.

B. Botnet detection

Figure 3 shows the ROC (Receiver Operating Characteristic) curves without strengthening initial weight of a prior known bot nodes for computing PageRank. Therefore, all hosts presenting a hub or authority value higher than a threshold are considered as bots. In this figure, this threshold varies for calculating the TPR (True Positive Rate) which is the proportion of bots correctly detected and the FPR (False Positive Rate) which is the proportion of benign hosts detected as bots. Both of these metrics are calculated in terms of number of counted IP addresses. As highlighted, the hub values are better to figure out bots. It means that the client role of P2P bot is more discriminative than the server role. There are also differences between topologies. More precisely, Kademlia botnet detection is very effective because this protocol is fault tolerant by guaranteeing multiple paths for a single destination which is similar to increase the linkage level of nodes measured by PageRank. Chord topology is more compact (without redundant paths) and that is why the detection accuracy is a bit lower. Bots based on these topologies are well detected (close to 100%) with few false positives (3%). Finally, a Koorde-based botnet is the worst to detect since the linkage level of node is very low due to its underlying topology (each node has few connections and shares them with its direct neighbors). However, botnets usually relies on robust overlay like Kademlia since Koorde can be easily disrupted by disconnecting few nodes. Knowing initially few bots using honeypot (around 20), the accuracy is improved (TPR = 99% with FPR < 0.1% knowing initially). However, this paper is not dedicated to accuracy results which are fully covered in [START_REF] Franc ¸ois | Bottrack: Tracking botnets using netflow and pagerank[END_REF].

C. Efficiency

We generated different datasets from the original one by extracting a subpart or by adding links in order to test configurations having between 100k and 300 millions of links. Preliminary experiments have shown that the number of nodes has no impact on the execution time. Because scores are propagated through them, the number of intermediate MapReduce key-value pairs is dependent on the number of links. Furthermore, the execution time of a single iteration is approximatively the same for a given configuration because the algorithm do exactly the same process at each iteration.

In figure 4, the configuration of the cluster varies with different numbers of slave nodes. As previously argued, the number of links highly impacts on the execution time. Because the x-axis has a logarithmic scale, the curves seem exponential but they are almost linear with different slopes (except for configurations having few links). For example, the execution time is multiplied by about 6 when the number of links is multiplied by 10 with 8 slaves. Obviously, when more machines are involved for running tasks, the execution time decreases. With few links, the differences are small as highlighted in figure 4(b). In fact, distributing the work using MapReduce entails a lot of additional tasks (data splitting, reduce phase) and also more delays due to network communications. Therefore, for problems with few links and so few computations, MapReduce is useless. Our experiments show that using Hadoop (#slaves > 1) is useful with at least 1 million links (figure 4(b)) and having more than 4 slave machines is efficient with at least 10 millions links which is the case with the original dataset (57 millions). Finally, using all our machines reduces the execution time by 7 comparing to a single machine with a huge dataset since this ratio seems stable for 100 millions links or more.

VI. RELATED WORK

Using NetFlow records were also employed in the past from detecting various attacks including botnets [START_REF] Sperotto | An overview of IP flow-based intrusion detection[END_REF]. As well as the Since tools and/or datasets of other approaches are not publicly available, only qualitative aspects are considered. By tracking hosts looking for specific DNS names, infected hosts might be detected [START_REF] Abu Rajab | A multifaceted approach to understanding the botnet phenomenon[END_REF]. For P2P botnets, a honeypot must be active to retrieve infected hosts by crawling the P2P network [START_REF] Holz | Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm[END_REF]. Another way to detect bots is to look for malicious activities such as spamming or scanning [START_REF] Karasaridis | Wide-scale botnet detection and characterization[END_REF]. Correlating such activities with potential C&C communication patterns may be helpful [START_REF] Franc | Cleaning your house first: Shifting the paradigm on how to secure networks[END_REF], [START_REF] Gu | Botminer: clustering analysis of network traffic for protocol-and structure-independent botnet detection[END_REF].

Considering our approach, there are also other works considering graphs especially host interactions [START_REF] Collins | Hit-list worm detection and bot identification in large networks using protocol graphs[END_REF] and complex analytic methods may be employed to detect P2P networks [START_REF] Iliofotou | Exploiting dynamicity in graph-based traffic analysis: techniques and applications[END_REF], [START_REF] Kim | Internet traffic classification demystified: myths, caveats, and the best practices[END_REF]. Such traffic classification is also performed by BLINC [START_REF] Karagiannis | Blinc: multilevel traffic classification in the dark[END_REF]. Discovering service or host dependencies may be helpful for network management tasks [START_REF] Kandula | What's going on?: learning communication rules in edge networks[END_REF]. BotGrep [START_REF] Nagaraja | Botgrep: Finding p2p bots with structured graph analysis[END_REF] uses on a random walk technique to discover botnet cluster within an interaction graph. Link analysis is leveraged in our previous work based on flow dependency graphs [START_REF] Wang | Mining netflow records for critical network activities[END_REF] and host dependency graphs [START_REF]Riskrank: Security risk ranking for ip flow records[END_REF] for finding the root cause of attack traffic. This technique is refined in this paper to detect botnets. Although in [START_REF] Franc ¸ois | Bottrack: Tracking botnets using netflow and pagerank[END_REF] we focused our evaluation regarding detection performance in different scenarios, this paper is dedicated to show the viability of the approach in a cloud-computing environment by highlighting computational performance benefits and specific use cases where it is more relevant (depending on the underlying data to deal with). Other works, like [START_REF] Li | Towards scalable and robust distributed intrusion alert fusion with good load balancing[END_REF], aim at dividing the traffic to analyze among different intrusion detection systems before correlating the generated alerts. Finally, [START_REF] Zhao | Botgraph: large scale spamming botnet detection[END_REF] is the closest relative work since they propose also a cloud-computing based botnet detection. The main difference with our approach is that it is focused on detecting malicious activities, especially spam, to create a correlation graph. Our model is dedicated to botnet C&C channel always used even no malicious activity is observable.

VII. CONCLUSION

This paper describes a scalable method for detecting P2P botnets regarding the relationships between hosts. Our evalu-ation shows a good detection accuracy and a good efficiency based on a Hadoop cluster. Our approach is easily usable, at low costs, thanks to existing cloud computing services such that Amazon EC2 [START_REF] Inc | Amazon Elastic Compute Cloud (Amazon EC2)[END_REF]. We plan to increase our cluster capacity and to execute all steps including the dependency graph generation on Hadoop. In the future, cooperation between ISP will be also studied and involves many issues, in particular related to exchange anonymous information.

Fig. 2 :

 2 Fig. 2: PageRank toy example

Fig. 3 :

 3 Fig. 3: Botnet detection

Fig. 4 :

 4 Fig. 4: Average execution for a single PageRank iteration

ACKNOWLEDGMENT

This work is partly funded by OUTSMART, a European FP7 project under the Future Internet PPP programme, and by MOVE, a CORE project funded by FNR in Luxembourg.

Note: figures include wikimedia contents (visit http://commons.wikimedia.org for license information).