Francois Fouquet

Olivier Barais

Noel Plouzeau

Jean-Marc Jezequel

Brice Morin

Franck Fleurey

A Dynamic Component Model for Cyber Physical Systems

Keywords: D.2 [Software Engineering], D.2.8 [Software Engineering]: Software Architectures-Domain-specific architectures, Languages Component-based software engineering, Autonomic computing, Embedded software, Software architecture

Cyber Physical Systems (CPS) offer new ways for people to interact with computing systems: every thing now integrates computing power that can be leveraged to provide safety, assistance, guidance or simply comfort to users. CPS are long living and pervasive systems that intensively rely on microcontrollers and low power CPUs, integrated into buildings (e.g. automation to improve comfort and energy optimization) or cars (e.g. advanced safety features involving car-to-car communication to avoid collisions). CPS operate in volatile environments where nodes should cooperate in opportunistic ways and dynamically adapt to their context. This paper presents µ-Kevoree, the projection of Kevoree (a component model based on models@runtime) to microcontrollers. µ-Kevoree pushes dynamicity and elasticity concerns directly into resource-constrained devices. Its evaluation regarding key criteria in the embedded domain (memory usage, reliability and performance) shows that, despite a contained overhead, µ-Kevoree provides the advantages of a dynamically reconfigurable component-based model (safe, fine-grained, and efficient reconfiguration) compared to traditional techniques for dynamic firmware upgrades.

INTRODUCTION

Over the last decades, the Internet has undergone dramatic changes, moving from a rather static Internet of Content, to an always more complex, dynamic and ubiquitous mix of Internet of People, Services (IoS), and Things (IoT) [START_REF]The Internet of Things Meets The Internet of People[END_REF]. Based on this infrastructure, which ranges from large datacenters and cloud servers to an heterogeneous and ever growing set of things (smartphones, sensors, etc) operated by resource-constrained CPUs and microcontrollers, Cyber Physical Systems (CPS) have emerged. CPS are long living and pervasive systems that rely intensively on microcontrollers and low power CPUs, integrated into buildings and cities (automation to improve comfort, safety and energy optimization), cars (advanced safety features involving car-tocar communication to avoid collisions), and so on.

CPS operate in volatile environments where nodes should cooperate in opportunistic ways and dynamically adapt to their context. In a car-2-car scenario, 2 cars (or more) approaching the same intersection should be able to synchronize in a reasonably short delay to share information about their own context and configuration, then take distributed decisions e.g. on the precedence order to cross the intersection. In a building automation scenario, users working or living in the building should be able to customize their working or living environment according to their desires and needs, e.g. using their smartphones or tablets to adjust the intensity of the lights according to the ambient light, etc. In a factory chain scenario, robots operating on the chain should be able to adapt and cope with failures, instead of shutting down all the chain when a failure is detected. Depending on the context, it is necessary to dynamically adapt both the software and the way the CPS are configured, as things are containers that can host services.

Dynamic adaptation, pursuing IBM's vision of autonomic computing, is a very active area since the late 1990's -early 2000's [START_REF] Kephart | The Vision of Autonomic Computing[END_REF]. However, many existing techniques concentrate on the adaptation of rather powerful nodes, which are typically able to run a Java Virtual Machine. Adaptation of resource-constrained devices such as microcontrollers has received less attention. These resource constraints prevent the use of standard operating systems, middlewares and frameworks, making the design of adaptive software for microcontroller a challenging task. In practice, microcontroller code is most of the time developed by using low-level programming languages and by following ad-hoc manual trial and error processes; these processes includes extensive testing of the resulting software in its target environment. While this might be acceptable to build static, dedicated applications, this is not a practical solution for CPS, because CPS operate in an open and dynamic environment, where the target environment cannot be foreseen at design-time.

Kevoree leverages and extends state-of-the-art approaches to scale CBSE principles horizontally (distribution between a large set of nodes) and vertically (from cloud-based nodes to microcontrollers). This paper focuses on µ-Kevoree, a mapping of Kevoree concepts for microcontrollers. µ-Kevoree pushes dynamicity and elasticity concerns directly into resource-constrained devices. In particular, this paper details the challenges of mapping such a large component model onto microcontroller-based architectures. We explain the tradeoffs that were used to obtain a useful solution coping with stringent resource constraints. This dynamic component model for resource-constrained systems has been thoroughly benchmarked against key criteria that are specific to the embedded software domain (memory usage, reliability and performance). Our model has also been applied to a real-life case study. The evaluation of µ-Kevoree for these key criteria show that, despite a contained overhead, µ-Kevoree provides a dynamically reconfigurable component-based model (safe, fine-grained, and efficient reconfiguration) with a limited overhead with respect to static approaches.

This paper is organized as follows. Section 2 presents the Kevoree component model and Section 3 details the challenges of mapping dynamic component model concepts to resource-constrained microcontrollers. Section 4 then explains how we ported Kevoree to these challenging platforms, and details the necessary tradeoffs. This new version o fK e v o r e ei sv a l i d a t e di nS e c t i o n5t h r o u g has e to fa t o m i c benchmarks. Section 6 discusses the result and presents related work and Section 7 concludes and draw some perspectives to be addressed in future work.

BACKGROUND

Kevoree at a glance

Kevoree 1 is an open-source dynamic component model, which relies on models at runtime [START_REF] Blair | Models@run.time[END_REF] to properly support the dynamic adaptation of distributed systems. Models@runtime basically pushes the idea of reflection [START_REF] Morin | Taming Dynamically Adaptive Systems with Models and Aspects[END_REF] one step further by considering the reflection layer as a real model that can be uncoupled from the running architecture (e.g. for reasoning, validation, and simulation purposes) and later automatically resynchronized with its running instance.

Kevoree has been influenced by previous work that we carried out in the DiVA project [START_REF] Morin | Taming Dynamically Adaptive Systems with Models and Aspects[END_REF]. With Kevoree we push our vision of models@runtime [START_REF] Morin | Models@ Run.time to Support Dynamic Adaptation[END_REF] farther. In particular, Kevoree provides a proper support for distributed models@runtime. To this aim we introduce the Node concept to model the infrastructure topology and the Group concept to model semantics of inter node communication during synchronization of the reflection model among nodes. Kevoree includes a Channel concept to allow for multiple communication semantics between remoteComponents deployed on heterogeneous nodes. All Kevoree concepts (Component, Channel, Node, Group) obey the object type design pattern [START_REF] Johnson | The Type Object Pattern[END_REF] to separate deployment artifacts from running artifacts. Kevoree supports multiple kinds of execution node technology (e.g. Java, Android, MiniCloud, FreeBSD, Arduino, . . . 1 ).

Dynamic Adaptation with Kevoree

Kevoree aims at providing advanced adaptation capabilities to different types of nodes: The adaptation engine relies on a model comparison between two Kevoree models to compute a script for a safe system reconfiguration; execution of this script brings the system from its current configuration to the new selected configuration [START_REF] Morin | Taming Dynamically Adaptive Systems with Models and Aspects[END_REF]. Model comparison yields a delta-model defining changes (using CRUD operations) that should be applied on the source model to obtain the target model. Planification algorithms [START_REF] André | F4plan: An approach to build efficient adaptation plans[END_REF] use this delta-model as input in order to defined an efficient schedule of the adaptation steps. The delta-model is finally compiled into a Kevoree script. The Kevoree Script language (KevScript for short) is a core language for describing reconfiguration. KevScript is comparable to FScript for Fractal Component Model [START_REF] L E D O U X | FPath and FScript: Language support for navigation and reliable reconfiguration of Fractal architectures[END_REF]. Execution of a KevScript directly adapts a Kevoree system, without the need for a full Kevoree model definition. Such adaptation scripts are written by designers, or they can be generated by automated processes (e.g. within a control loop managing the Kevoree system).

MAPPING KEVOREE ADAPTATION CONCEPTS ON MICROCONTROLLERS

Challenges

Dynamic adaptation is a key concept to build advanced CPS able to adapt to their context and to user needs. Models at runtime is an efficient approach to manage the complexity of dynamic adaptation [START_REF] Morin | Taming Dynamically Adaptive Systems with Models and Aspects[END_REF] by providing control and abstraction over reflection mechanisms. Applying reflection techniques is rather straightforward on fully grown component or service models such as OSGi, or directly on top of modern object-oriented languages such as Java, as long as the execution hardware is powerful enough to run a virtual machine. The embedded software sensing and acting on the physical world (via hardware components) should be able to adapt to the needs of different (and potentially concurrent) services running on powerful nodes (in the cloud, on tablets, etc). Some services will for example subscribe to temperature alerts (the sensors being responsible to notify the service when a threshold has been reached), and then reconfigure the sensors to send almost continuous data, so that the service can precisely monitor the evolution of the temperature.

Applying models at runtime (or any dynamic adaptation technique) on execution nodes with scarce resources (e.g. microcontroller-based computation nodes) is much more difficult, for the following reasons: CPS relying on a large set of autonomous sensors have cost and energy constraints that calls for cheap and powerefficient platforms able to run for long period of times with minimum on-site maintenance (e.g., battery replacement). This is particularly true in the environmental monitoring domain: off-shore oil spills monitoring, flood prediction [START_REF] Morin | Models@ Run.time to Support Dynamic Adaptation[END_REF], air quality monitoring or radiation monitoring, for the following reasons2 :

1. Their simplified architecture is robust and predictable: microcontrollers can operate by a wide range of temperature (typically -40 to 85 degrees Celcius), humidity, power supply, and have fixed number of cycles to execute a given operation. 2. Their energy needs (and generated heat) are very low: An 8-bit microcontroller running at 32kHz typically consumes less than 0,05W (less than 0,5W at 1MHz) excluding the need for any radiator. They can thus run for very long time on battery. 3. Their simplified architecture allows for mass production, making microcontrollers very cheap to deploy even in large numbers.

Compared to full-fledged computation nodes, cheap microcontrollers suffer from an adaptation overhead that stems from their hardware technology in terms of adaptation time or memory wear: dynamic provisioning of component types requires writing a program in flash memory. Therefore, implementing Kevoree concepts for microcontrollers nodes relies on a precise trade-off between flexibility and typical exploitation costs. Finding a lightweight solution for each of reconfiguration level described above is one of the main challenges of µ-kevoree.

Case study

We will use a smart building case study to validate Kevoree on a set of heterogeneous nodes, including of course some microcontrollers. Different systems (relying on proprietary devices and protocols) are usually deployed in buildings to manage different aspects of the building automation, in particular comfort (lighting, air conditioning, etc), safety and security (smoke and fire detection, sprinklers, etc). The degree of flexibility offered by a building automation system is often very poor.

• These systems rely on fixed topology of communication channels. Sensors and actuators often need to be physically coupled, hindering any future reconfiguration or evolution of the system. For example, a motion sensor will trigger all the lights of the corridor.

• The architecture is organized around a central server.

When the devices are not physically coupled, they usually communicate through a central server, to execute the event-driven rules that orchestrate the system. Even though updating these rules is possible, to adapt the behavior of the system, this requires access to the central server.

The goal of Kevoree is to seamlessly distribute both the business logic and the dynamic adaptation capabilities on heterogeneous nodes ranging from powerful servers, to tablets, and to simple devices operated by microcontrollers. On a day-to-day basis, this would allow users to configure and reconfigure their offices on-the-fly from a smartphone, (e.g. to define a lighting environment according to the ambient luminosity, temperature, etc), while some other concerns would be managed by a central server (e.g. to turn the cameras on at night). In a crisis situation, this kind of seamless distribution would allow emergency services to cope with the failure of some nodes. Firemen could still access the data provided by low-level sensors, and compute meaningful context information on a tactical decision system despite the loss of a nodes.

DYNAMIC ADAPTATION FOR MICROCONTROLLERS

This section describes how Kevoree concepts are mapped to Arduino nodes. Arduino 3 is an open-source hardware and software electronics prototyping platform based on an 8-bits AVR microcontroller. Arduino boards can be connected to a set of sensors and actuators and programmed in languages from the C/C++ family. While we have chosen Arduino to implement our µ-Kevoree approach, it can be applied easily to other microcontroller families (PIC, ARM, etc).

Firmware implementations are often coded manually in C using a trial and error process, with an intensive manual and automated test-based validation. More advanced techniques (such as the MDE techniques proposed by ThingML4 [START_REF] Fleurey | A Model-Driven Approach to Develop Adaptive Firmwares[END_REF]) aim at generating static source code for microcontrollers. Such techniques can easily be leveraged to generate the internal code of component, which is not the scope of Kevoree. Microcontroller firmware puts a strong emphasis on resource usage (such as memory, CPU and energy needs) and reliability: microcontrollers can run for long periods of time and recover in case of power or connectivity loss. We acknowledge that these properties are critical, and the benefits provided by dynamic adaptation capabilities should not jeopardize them. Our work aims at breaking the static nature of code generation while preserving all benefits of low level code design.

To this aim our approach clearly separates structure and behavior: component type behaviors are currently implemented manually in C or in the Wiring language, using state of the art practice. One core contribution of our approach is the definition of a proper abstraction system to automate management of the adaptation logic of microcontrollers, by making their business logic a separate concept. Moreover, having a clear component structure with well defined inputs and outputs also eases testing at a more abstract level.

µ-Kevoree

This sub-section describes how the main concepts of Kevoree have been ported onto microcontrollers. µ-Kevoree is totally aligned and compatible with the exiting Java and Android versions.

Types. In Kevoree component types and channel types encapsulate business logic; they are generated as C structures. Provided ports of component types are mapped to methods, so that client components (which require ports of t h es a m et y p e )c a ni n v o k et h e s em e t h o d sa n de v e n t u a l l y push data. Kevoree properties that can be dynamically updated are simply mapped onto local variables contained by this structure. A local scheduler prevents concurrent calls on these variables. Required ports are generated as local structures, which can optionally refer to a bound channel instance. Similarly, channel types are generated as plain C structure. Outgoing channel bindings are generated as an internal array structure, enabling dynamic allocation and storage of external provided ports references.

Asynchronous message passing. As in Kevoree's implementations for Java and Android nodes, µ-Kevoree maps each port and channel onto an actor. More precisely, a FIFO queue is generated in front of each protected method. A dispatcher (local to each component) is then in charge of dispatching messages pushed on these queues to the correct method. This local scheduler is driven by a global scheduler described below.

Instance scheduler On each node a global instance scheduler is responsible for keeping its node in a consistent state by applying the following balance strategy:

• Periodic execution: the global scheduler periodically invokes the local scheduler of each component instance that has declared a periodic execution; • Triggered execution: the global scheduler invokes the local scheduler of each component that has a non empty message queue.

The global scheduler also periodically checks for external messages related to dynamic adaptation, as described in the next two sub-sections.

Firmware flash to handle major evolutions

Flashing a microcontroller's firmware and then rebooting the device is an easy way to implement adaptation of a microcontroller node, by replacing the implementation entirely. This adaptation technique is acceptable in some specific and controlled contexts (initial production, on-site maintenance, etc), since the device is physically connected to a more powerful node using a communication link with broad bandwidth (e.g. wired link). In this case, flashing a controller's memory is rather safe (provided that the code of the firmware is safe) and also reasonably fast: flashing the entire memory by uploading the new firmware and then rebooting the device takes a few seconds only. However, this technique is problematic when the devices are deployed remotely. Flashing the firmware over-the-air is a hazardous manipulation: firmwares are typically bulk data (compared to other data usually transmitted on wireless links) and communication errors are more likely to occur; this requires advanced protocols to cope with error handling. In practice, this approach impacts significantly the time needed to install a new firmware.

Our approach limits flashing the full firmware to cases where new component types need to be deployed. In this regard C-based microcontrollers do not provide the same flexibility than Java/OSGi nodes with respect to dynamic provisioning and class loading. This is typically required for the initial deployment of the system where all the planned component types are provisioned, or for major evolutions of the system (e.g. to handle a new type of device not foreseen before the initial deployment). In all other cases such as reconfigurations of component instances for instance, our approach performs a partial flash memory update.

Seamless dynamic adaptation of microcontrollers

Following the principles of model@runtime, our dynamic adaptation process is fully automated, saving designers from writing low-level adaptation scripts or from entangling adaptation logic with business logic. Prior to any adaptation, all necessary checks on the new configuration are performed on the target model. Since microcontroller nodes have limited computational power, configuration checks are performed on more powerful, Java or Android based nodes. These checks aim at detecting a mismatch between the planned configuration and the physical hardware possibilities. After this validation step, the configuration is used as input for a generator algorithm, which computes a reconfiguration script. This script is then transmitted in a compact form to dependent microcontrollers. As communication errors are frequent in wireless sensors networks, we avoid problematic microcontroller states inconsistencies by implementing a roll-back based recovery mechanism. applications execution time. Volatile memory usage (RAM): amount of RAM memory dedicated to dynamic allocation of component instances, channels, and bindings. This metrics thus influences the maximum number of component instances, channels and bindings that a microcontroller can manage. Persistent memory usage: amount of persistent memory used to store reconfiguration scripts and impact of storage strategy on memory life time. Persistent memory types such as the EEPROM embedded in the 8 bits AVR have a limited number of write cycles certified for each byte, thereby limiting the amount of storable data. Recovery reboot delay: time needed by the microcontroller to reboot and restore its last configuration, after a c r a s ho ral o s so fp o w e r .

We have used realistic configurations to assess our approach and evaluate the overhead induced by our dynamic component-based platform for microcontrollers, compared with static configurations that are updated by flashing the whole memory. All experiments were done using the Kevoree Arduino node implementation 6 running on an Arduino board with an ATMEL AVR 328P microcontroller. This processor embeds 32 KB of flash memory for storing programs, 2 KB of RAM memory and 1 KB of EEPROM. A flash-type memory (microSD) connected via an SPI bus was also used as persistent memory to assess the impact of memory type on results.

The following subsections show our specific experimental protocol and results, while the last subsection will present an industrial use case to validate the seamless integration of µKevoree devices in an existing dynamic architecture.

Downtime: How long does an adaptation freeze business logic?

Experimental setup. In this experiment we setup five different configurations, similar to the ones presented in the case study (building automation). The corresponding Kevoree models used different numbers of instances to simulate changes between the configuration used at night and a personalized configuration used during the day. More details on these models are available here 6 . In a nutshell, these models were configured with 4 nodes, hosting 0 to 10 instances each. Instances are implemented in C, with 30 lines of code each on average.

In a first step we generated the firmware of our test microcontroller, with code containing all type definitions used in this experiment. This step therefore includes code generation, compilation and writing into flash memory. Moreover, the generated code is automatically instrumented with probes to measure downtime and memory use (EEPROM and SDRAM). This step was repeated delayed of 100 ms with a new configuration that is chosen randomly; each new configuration was dynamically installed to replace the current running configuration. This random reconfiguration step was repeated 500 times. Figure 2 plots the raw data collected in this experiment. The plot on top shows that the RAM usage is constant. The second plot shows the downtime per reconfiguration, and third and bottom plots show downtime and script size respectively. Experimental results and analysis. Deploying a configuration by flashing the whole firmware is very costly: the downtime to deploy the initial configuration is 12.208 seconds. This high value comes mainly from the long transfer time of a full firmware but also from the time taken by the default boot loader to perform a full restart of the microcontroller. This value varies in a range of +/-2 seconds.

Results of this first experiment highlight that the size of the reconfiguration script is highly correlated with the downtime time: the Spearman correlation coefficient observed between script size and downtime is higher than 0.9. In addition, the compression algorithm used to decrease the script size in EEPROM has also an impact on downtime. We observed that the execution of this task is directly correlated with higher values of downtimes. This is discussed in the next subsection.

After 500 cycles of reconfiguration we measured the following extrema and mean values: The graph in Figure 3 clearly shows that the downtime values are clustered around 220 ms. 95% of the values are below 400 ms and 75% are below 250 ms. Then, only 5% of the values are above the 400 ms, which is explained by the EEP-ROM compression step. The lazy compression strategy allows us to limit the number of peaks and keep the maximum value around 200 ms. The highest values for the downtime are systematically linked to a reduction of the EEPROM size (caused by the compression routine). We observed 32 compressions of the EEPROM during the 500 reconfigurations i.e., 6.4% of the reconfigurations trigger a compression so that they can be completely stored into the EEPROM. The maximum value of these 32 downtime peaks is 916 ms, the minimum is 218 ms and the mean value is 580.815 ms. This mean value is significantly higher than the mean value of the whole set of 500 reconfigurations (234.682 ms).

•
Probes also monitored SDRAM during this experiment. Neither memory leaks nor memory fragmentation occurred. Although the SDRAM is stable, it is necessary to check that the overhead induced by the framework actually allows for the dynamic creation of a realistically high number of instances, to match concrete use case needs. Our next experiment aimed at evaluating the capacity (in terms of dynamic instances) of our test microcontroller.

Experimental results and analysis with a different setup. We used the same protocol of 500 iterations, but we replaced the EEPROM with a 2 GB external flash memory (SD card), connected on an SPI bus. This experience is repeated twice: with only 1kb (same size as EEPROM), and with 16kb; results are shown in the following table. Flash memory has a longer initialization time, which explains that the lowest values for the flash experiment are higher than the lowest value in the EEPROM experiment. However, writing speed of flash memory is high, resulting in a homogenization of downtime, which is under 200 ms most of the time. One can notice that the large increase of persistent memory (16 kb) clips the downtime peaks and therefore improves average downtime value. However this does not change the distribution of main values significantly.

Volatile memory usage: how many instances?

Experimental setup. The purpose of this experiment was to precisely determine the maximum number of instances that can fit into the SDRAM. An initial configuration was created with three instances: a timer, a switch and a default channel. Every 100 ms, the configuration was expanded by adding a new switch instance. Probes were injected to monitor the SDRAM.

Experimental results and analysis. Figure 4 shows that SDRAM memory is full after 22 cycles, i.e. our test microcontroller can manage 25 instances (the 3 initial ones plus 22 additional instances). In practice, the count of devices controlled by one single microcontroller is approximately equal to the number of pins they have. In addition, microcontrollers should be able to run some code to orchestrate these devices and perform some computation. Kevoree is able to manage 25 instances (both for wrapping physical devices and for defining some orchestration) on our test microcontroller (22 pins). Despite a memory overhead, our approach is compatible with current practices.

Experiments results and analysis with a different setup. I nt h i ss e t u pw eu s e da nA T M E L2 5 6 0( 4K Bo f SDRAM) as our test microcontroller. The AVR 2560 accepts a load of 100 instances i.e. an improvement of+300% instances with +300% SDRAM. Again, the number of instances is larger than the number of pins (80) of the AVR 2560.

Persistent memory usage:

How many certified reconfigurations?

Experimental setup. We used the setup of Section 5.1.

Experimental result and analysis. We observed that 500/32 = 15.625 reconfigurations can happen before the EEPROM (1 KB) is full, requiring a compaction using a new initial state. As for Solid State Disk [START_REF] Fleurey | Design tradeoffs for SSD performance[END_REF], write operations to EEPROM should to be distributed throughout the memory in order to distribute wear. Our algorithm writes every byte before computing a new initial state. Each byte of this memory is certified for 100,000 writes 7 . Therefore if we assume 100 reconfigurations every day (which is much more than what is needed in most case studies), each byte of the EEPROM will be written 6.4 times a day on average, ensuring 15,625 days (i.e. about 43 years) of certified lifetime for the EEPROM.

Experiments results and analysis with a different setup.

In average, we can serialize the reconfiguration scripts of our experiment using 16 bytes. Since our algorithm ensures that every byte is written before the memory needs to be compressed, we can use the reasoning of the previous paragraph to compute the lifetime with a larger memory. Experimental setup. This experiment used the configuration set described in Section 5.1, with only 50 cycles of reconfiguration performed every 2 seconds. The microcontroller was physically rebooted between each reconfiguration, and a new probe was inserted to measure the configuration restore time the after booting.

Experimental results and analysis. Figure 5 displays the results of this second experiment. It appears that in the worst case with this AVR product (when the 1 KB EEPROM memory is almost full) the boot time is approximately 15 ms. In the best case (EEPROM almost empty) the boot time is approximately 3 to 4 ms. This value is mainly due to the slow read speed of the EEP-ROM embedded in the AVR. However, the time to restore a configuration is reasonable for most use cases, even in the worst case. We can therefore infer that the script size in EEPROM has a small impact on boot time with respect to save time. Therefore the best strategy is to use all available memory.

Experimental results and analysis with a different setup.

We used the same setup, but we replaced the EEPROM with a flash memory (1 KB and 16 KB). Using SD memory instead of EEPROM implies a longer boot time. We noticed a coefficient value of 0.012 for the EEPROM, and of 0.023 for the SD. This comes from the extra computation needed to read and write SD card. Unlike the EEPROM, the communication bus to access the SD flash is external to the microcontroller. The initialization time taken by flash memory configuration is linearly distributed to the limit of 16 KB. Above this size, the initialization time becomes greater than 360 ms. This is significantly higher than the reconfiguration time.

Discussion

The choice of persistent memory type and size depends on the use case needs. In some cases, there is a real need for traceability, and the history of the system should be kept e.g.,f o rpost mortem analysis in case of failure. In other cases, performance of adaptation and boot time after a fail-ure is more important. The benchmark developed in this approach can be useful to determine empirically which memory setup to use.

However, using an external memory significantly increases the price of such a platform. In addition, ensuring atomicity of reconfigurations is more difficult because of the asynchrony of transfer protocols. Existing protocols for interaction with SD cards (like MMC) are not suitable for storing reconfiguration scripts. More precisely, these scripts are much shorter (around 25 bytes in our experiments) than the minimum frame size (512 bytes) required by these protocols, and this leads to a significant overhead. In practice, most embedded devices combine EEPROM and flash memories. Kevoree allows designers to combine different memory types for different purposes.

µ-Kevoree overhead. Our framework adds several overhead sources, especially for the management of dynamic instance creation of components and channels. In order to quantify overhead, we measured volatile and program memory sizes on an HelloWorld program, using plain C and a Kevoree firmware setup on a 328P AVR microcontroller. The plain C version left 1842 free bytes after boot sequence, while the Kevoree version left 1604 bytes free. This represents an overhead about 11% of the total available RAM (242 bytes out of 2048). The plain C version used 2.3 KB of firmware memory, while the Kevoree use was 7.3 KB, giving an overhead of about 15% of the total 32kb available. The impact of Kevoree scheduler on processing cycles is highly program dependent, and we are currently experimenting further to compute this overhead.

Our synchronization and communication layer introduced an overhead under 15% on both memories, which is an acceptable value in the case of our IoT application. However, thisimpactshouldbeev aluatedinmoredepthforhardrealtime applications, with a special attention to components needs in terms of processing cycles.

RELATED WORK

Software architecture aims at reducing complexity through abstraction and separation of concerns by providing a common understanding of component, connector and configuration [START_REF] Dashofy | An infrastructure for the rapid development of XML-based architecture description languages[END_REF][START_REF] Medvidovic | A Classification and Comparison Framework for Software Architecture Description Languages[END_REF][START_REF] Van Ommering | The Koala Component Model for Consumer Electronics Software[END_REF]. One of the remaining challenges, strengthened by the Future Internet and CPS [START_REF] Nitto | A journey to highly dynamic, self-adaptive service-based applications[END_REF], is to properly manage dynamic architectures. SCA8 is a standard that highlights modular software architecture concepts. It provides a model for composing applications that follow Service-Oriented Architecture principles. Frascati [START_REF] S E I N T U R I E R | A Component-Based Middleware Platform for Reconfigurable Service-Oriented Architectures[END_REF] is a SCA runtime that allows developing highly configurable applications. However, SCA focuses on rather heavy nodes typically able to run a JVM whereas µ-Kevoree also manages the dynamic adaptation of microcontroller-based systems, in addition to Java nodes, with a contained overhead.

Many approaches have highlighted the need for dynamic architectures to implement pervasive computing. A common approach consists in building a middleware to hide the heterogeneity of networks, hardware, operating systems, and programming languages.Rellermeyer et al. [START_REF] Rellermeyer | AlfredO: an architecture for flexible interaction with electronic devices[END_REF] for example provides an architecture for flexible interaction with electronic devices. Based on OSGi to implement a dynamic module system, their approach provides an abstraction layer for device independence. Their architecture has the following non-functional benefits: scalability and ease of administration, flexibility, security, and efficiency. In a similar vein Escoffier et al. proposed iPOJO [START_REF] Escoffier | iPOJO: an Extensible Service-Oriented Component Framework[END_REF], a service component runtime that simplifies the development of OSGi applications. iPOJO has mainly been used in home-automation to implement service-oriented pervasive applications [START_REF] Bourcier | AutoHome: An Autonomic Management Framework for Pervasive Home Applications[END_REF]. Au-toHome is a middleware that extends the iPOJO component model, to create a framework to host autonomic home applications. Gaïa [START_REF] Román | A Middleware Infrastructure for Active Spaces[END_REF] is a CORBA-based meta-operating system for ubiquitous computing, built on top of a classical operating system aimint at abstracting the heterogeneity and complexity associated with ubiquitous environments. Olympus [START_REF] Ranganathan | Olympus: A High-Level Programming Model for Pervasive Computing Environments[END_REF] proposes a high-level DSL to ease the development of Gaïa applications. Cassou et al. [START_REF] Cassou | Leveraging Software Architectures to Guide and Verify the Development of Sense/Compute/Control Applications[END_REF] proposes a generative programming approach to provide programming, execution and simulation support dedicated to the pervasive computing domain. They also demonstrate how abstraction can help to guide and verify the development of pervasive applications. Again, all these approaches rely on a reconfigurable middleware (often OSGi-based), and this restricts their deployment to powerful nodes, e.g. powerful enough to run a Java virtual machine. Our goal is to provide the same level of abstraction to develop pervasive and adaptive applications for powerful nodes and also for resource-constrained devices.

Several approaches have shown the benefits of using Model Driven Engineering (MDE) to design and reconfigure pervasive applications. Model-based approaches such as Matlab9 , Charon [START_REF] Alur | Modular specification of hybrid systems in charon[END_REF], UMLh [START_REF] Burmester | Hybrid uml components for the design of complex self-optimizing mechatronic systems[END_REF], HyRoom [START_REF] Stauner | Approaching a discrete-continuous uml: Tool support and formalization[END_REF], Masachio [START_REF] Henzinger | Masaccio: A formal model for embedded components[END_REF], Mechatronic UML [START_REF] Schäfer | Graph transformations and model-driven engineering[END_REF], HyVisual [START_REF] Eker | Taming heterogeneity -the ptolemy approach[END_REF], or SysML10 propose a model to code development process with verification techniques to design modular embedded systems. However, none of these approaches support dynamic adaptation of a running system without first designing the adaptation at a business level. This, in practice, significantly reduces the number of configurations these approaches can manage. Indeed, these approaches provide no means to manage the combinatorial explosion of the number of configurations typically encountered in CPS: all configurations need to be explicitly designed.

Several approaches have shown the need of dynamic reconfiguration capabilities for embedded systems. Reconfigurable intelligent sensors are now able to confront major challenges in the design of cost-effective, energy-efficient, customizable systems, for example in the domain of health monitoring systems adaptable to individual users [START_REF] Jovanov | Reconfigurable Intelligent Sensors for Health Monitoring: A Case Study of Oximeter sensor[END_REF], or in the domain of operating system kernels [START_REF] Bagchi | Nano-kernel: a dynamically reconfigurable kernel f o rW S N .I n1st international conference on MOBILe Wireless MiddleWARE[END_REF]. Run-time reconfiguration can be achieved through programmable logic reconfiguration and/or software adaptation. In the first case, reconfigurable System on Chips [START_REF] Singh | Morphosys: An integrated reconfigurable system for data-parallel and computation-intensive applications[END_REF] are a promising solution. To support software adaptation of embedded software, other works reuse a software architecture-based approach to the construction of embedded systems. For example, The Koala model [START_REF] Van Ommering | The Koala Component Model for Consumer Electronics Software[END_REF], used for embedded software, allows late binding of reusable components with no additional overhead. Think [START_REF] Fassino | Think: A Software Framework for Component-based Operating System Kernels[END_REF] defines a component-based framework to support different mechanisms for dynamic reconfiguration and to select between them at build time, with no changes in operating system and application components. Different from these approaches, Fleurey et al. [START_REF] Fleurey | A Model-Driven Approach to Develop Adaptive Firmwares[END_REF] present an approach b a s e do ns t a t em a c h i n e sa n da na d a p t a t i o nm od e lt od e r i v e adaptive firmwares for microcontrollers. The approach relies on automatically enumerating configurations by exploring a set of adaptation rules defined at design time and compiling the resulting state-machine (which merges the business logic and the adaptation logic) into an optimized, yet static, firmware. In [START_REF] Höfig | On the performance of UML state machine interpretation at runtime[END_REF], Hofig et al. highlight the use of models@runtime for resource-constrained devices. They provide a UML state machine interpreter for AVR microcontrollers and compare the performance overhead with static code generation: model@runtime interpretation is adequate for the majority of situations, except when dealing with highthroughput or delay-sensitive data. Influenced by these approaches, Kevoree leverages models@runtime for microcontrollers and proposes new mechanisms to support dynamic reconfigurations and to select between them at runtime.

CONCLUSION AND PERSPECTIVES

This paper presented µ-Kevoree, which pushes dynamicity and elasticity concerns directly into resource-constrained devices, based on the notion of models@runtime. This modeling layer that micro-controllers expose at runtime, enables the efficient and safe reasoning (by other Kevoree nodes: Java or Android) to adapt microcontroller-based nodes. In particular, this paper focused on the challenges met when mapping Kevoree and models@runtime features to low power microcontrollers, and on the required tradeoffs because of the stringent resource constraints.

This new version of Kevoree has been thoroughly evaluated with benchmarks in order to assess its usability in realistic setups. Despite an overhead with respect to static (non adaptive) code, these benchmarks have shown that 75% of the transactional reconfigurations can be performed in less than 250 ms, which is an acceptable value in many case studies. This is definitely faster (by a factor of almost 50) than a full memory rewrite of the firmware. Also, these benchmarks have shown that the time needed to reboot a microcontroller and restore its previous configuration is a linear function of the script size. For example, booting using a 1 kB EEPROM memory takes between 3 to 15 ms, while this memory size is large enough to store the script of 15 successive reconfigurations before needing compaction. Finally, the benchmarks have shown that Kevoree enables the deployment of software component instances in a number greater than the available pin count on the microcontroller. It is therefore possible to bind a software component to each physical device controlled by the microcontroller, and to deploy an extra component to coordinate these components.

In the future, we will improve the reliability of reconfigurations by making the computation of the initial state step transactional (compression of the persistent memory) e.g., and by exploiting a circular rolling buffer on the persistent memory. Our scheduling algorithm is another area for improvement. Based on existing opportunistic garbage collectors (e.g. Java) we will leverage the computational cycles not used by hosted components to trigger the compression of the persistent memory in a lazy way, rather than waiting for a "memory full" event. We will also investigate further optimizations to reduce the memory consumption and the energy consumption. Finally we are planning to integrate simple reasoners in microcontrollers driven by µ-Kevoree so that they can operate in a fully autonomous mode, with no need to delegate the reasoning to a larger node.

6

  http://goo.gl/Xl2z9

Figure 2 :

 2 Figure 2: Experiment raw results 7

Figure 3 :

 3 Figure 3: Flash RAM percentile downtime distribution (in ms)

Figure 4 :

 4 Figure 4: SDRAM capacity experiment

Figure 5 :

 5 Figure 5: Persistent memory size boot time influence5.4 Recovery reboot delay:How long to recover?

•

  Level 1: Parametric adaptation. Dynamic update of parameter values, e.g. change of sampling rate in a component that wraps a physical sensor (adaptation of instance properties).

	• Level 2: Architectural adaptation. Dynamic ad-
	dition or removal of bindings or components, e.g. repli-
	cation of software components and channels on differ-
	ent nodes to perform load balancing (adaptation of
	instances graph).
	• Level 3: Dynamic provisioning of types. Hot de-
	ployment of component types that were not foreseen
	before the initial deployment of the system. This al-
	lows for system evolution by enabling parametric and
	architectural reconfigurations, including management
	of instances for types that are added and managed dy-
	namically (adaptation of types).
	• Level 4: Adaptation for remote management.
	Nodes supporting level 4 adaptation participate in a
	remote management layer, which supervises less pow-
	erful nodes. This layer monitors remote nodes by re-
	questing their current Kevoree model; the layer trig-
	gers dynamic adaptation of nodes by sending precom-
	puted reconfiguration scripts to them. This remote
	adaptation process supports seamless management of
	less powerful nodes by a more powerful one, which has
	enough resources to build and evaluate new and ap-
	propriate configurations.

http://www.kevoree.org

See for example http://www.atmel.com/Images/doc2545.pdf for detailed facts about microcontrollers

http://www.arduino.cc

www.ThingML.net

http://arduino.cc/en/Reference/EEPROMWrite

http://osoa.org/

www.mathworks.com/products/matlab/

http://www.sysml.org/

Acknowledgment

This work has been funded by the EU FP7 projects: FI-PPP ENVIROFI, S-Cube NoE and MODERATES.


Romain Giot
email: romain.giot@ensicaen.fr

Christophe Charrier
email: christophe.charrier@unicaen.fr

Maxime Descoteaux
email: m.descoteaux@usherbrooke.ca

Local Water Diffusion Phenomenon Clustering From High Angular Resolution Diffusion Imaging (HARDI) *

The understanding of neurodegenerative diseases undoubtedly passes through the study of human brain white matter fiber tracts. To date, diffusion magnetic resonance imaging (dMRI) is the unique technique to obtain information about the neural architecture of the human brain, thus permitting the study of white matter connections and their integrity. However, a remaining challenge of the dMRI community is to better characterize complex fiber crossing configurations, where diffusion tensor imaging (DTI) is limited but high angular resolution diffusion imaging (HARDI) now brings solutions. This paper investigates the development of both identification and classification process of the local water diffusion phenomenon based on HARDI data to automatically detect imaging voxels where there are single and crossing fiber bundle populations. The technique is based on knowledge extraction processes and is validated on a dMRI phantom dataset with ground truth.

Introduction

Diffusion Weighted magnetic resonance imaging (DW-MRI) is able to quantify the anisotropic diffusion of water molecules in biological tissues such as the human brain white matter. The great success of DW-MRI comes from its capability to accurately describe the geometry of the underlying microstructure. DW-MRI captures the average diffusion of water molecules, which probes the structure of the biological tissue at scales much smaller than the imaging resolution [START_REF] Descoteaux | Diffusion-Weighted MRI[END_REF]. New dMRI techniques for high angular resolution diffusion imaging (HARDI) are now able to recover one or more directions of fiber populations at each imaging voxel and thus, overcome some of the limitations of diffusion tensor imaging (DTI) * This work is supported by Samuel de Champlain 63.102 funds Most current classification techniques are based on DTI measures of Westin et al [START_REF] Westin | Processing and visualization for diffusion tensor MRI[END_REF]. For example, a recent paper from [START_REF] Vos | The influence of complex white matter architecture on the mean diffusivity in diffusion tensor MRI of the human brain[END_REF] classifies the white matter voxels into single and crossing fibers simply by hard thresholding the linear, planar and spherical measures computed from the eigen-values of the diffusion tensor. Other techniques have been developed to better handle fiber crossings using apparent diffusion coefficient [START_REF] Descoteaux | Apparent Diffusion Coefficients from High Angular Resolution Diffusion Imaging: Estimation and Applications[END_REF] modeling from HARDI and other HARDI models representations based on spherical harmonics (SH) decomposition [START_REF] Prčkovska | Fast classification scheme for hardi data simplification[END_REF]. It was previously suggested using automatic Bayesian relevance determination [START_REF] Behrens | Probabilistic diffusion tractography with multiple fibre orientations. what can we gain?[END_REF] that between 1/3 and 2/3 of WM voxels contained crossings. Jeurissen et al [START_REF] Jeurissen | Investigating the prevalence of complex fiber configurations in white matter tissue with diffusion magnetic resonance imaging[END_REF] have just showed that this number is an underestimation and that WM crossings can take up to 90% of WM voxels using maxima extracted from a robust SH-based fiber orientation distribution estimation using constrained spherical deconvolution. Otherwise, the first attempts to classify HARDI voxels using machine learning techniques was done in [START_REF] Wassermann | Diffusion Maps Clustering for Magnetic Resonance Q-Ball Imaging Segmentation[END_REF] using the space of SH coefficients from q-ball imaging. These techniques are based on diffusion maps and spectral clustering but were never applied to neurodegenerative datasets. More recently, Schnell et al. [START_REF] Schnell | Fully automated classification of HARDI in vivo data using a support vector machine[END_REF] have designed a classification process based on support vector machines, also based on the SH representation of the dMRI signal and have compared their results with the classical classification of Westin's measures, as done in [START_REF] Vos | The influence of complex white matter architecture on the mean diffusivity in diffusion tensor MRI of the human brain[END_REF].

The main contribution of this paper is the creation of a system allowing to automatically classify voxels of HARDI data in order to segment the white matter among different classes. The proposed method goes deeper than the approach presented in [START_REF] Schnell | Fully automated classification of HARDI in vivo data using a support vector machine[END_REF] because it takes into account the neighbourhood of the voxels by using convolved data.

Classifier Creation and Evaluation

Proposed Approach

Using the Spherical Harmonic (SH) representation of each voxel [START_REF] Descoteaux | Apparent Diffusion Coefficients from High Angular Resolution Diffusion Imaging: Estimation and Applications[END_REF], we want to be able to classify it as: (a) white matter with a single fiber bundle (WMSF), (b) white matter with crossing fiber bundles (WMCF), (c) non-white matter (N-WM) of type gray matter (GM) or cerebrospinal fluid (CSF). Section 3.1 presents the dataset. We use a Support Vector Machine (SVM) [START_REF] Vapnik | Theory of support vector machines[END_REF] classifier to obtain the label of a voxel. The SVM tries to find the best separating hyperplane between two classes. As we work with several classes, a one-against-one approach is used (we train n class * (n class -1)/2 classifiers).

We easily see that using only the SH information may be not enough accurate, as there is no knowledge of the neighborhood while classifying the voxel. To address this problem, we operate a 2D convolution of each slice of the brain against a kernel. This allows to work with a voxel representation resulting of a weighted sum of the neighboring voxels. The convolution kernels are chosen in order to obtain the best accuracy (see Section 2.4).

Classification of Voxel Using a Particular

Feature Space and its Kernels Say we have F the selected feature space of cardinality n (i.e., each voxel is represented by a vector of size n ; n depends on the SH order) and K = {k 1 , • • • , k n }, the convolution kernels with one convolution kernel per dimension of the features space. We apply the convolution kernel k i on each feature i of each voxel of each slice j:

vc j i = v j i ⊗ k i , ∀i ∈ [1, n], ∀j ∈ [1, N ] (1)
with v j i [x, y] the feature i of the voxel located at position (x, y) of the slice j, vc j the slice j after convolution of all voxels and features and N the number of slices. Now, we consider all the voxels as being in a whole set Ω of couples {x, l} (x is the feature vector and l its label) whatever their slice and localisation in the slice:

Ω = j,x,y {vc j [x, y], label j [x, y]} (2)
with label j [x, y] the label of the voxel at (x, y) in slice j).

We apply a 6 fold stratified cross validation (we obtain 6 subsets, where each label is represented at the same ratio in each subset: there is the same recognition difficulty in each subset). Each subset serves as a testing set, while the other subsets serve as training set (the following procedure is then applied 6 times). The mean (µ) and the standard deviation (σ) of the feature vectors of the training set is computed in order to apply a zscore normalisation of the training and testing sets (normalised sample = (sample -µ)/σ). The normalised training samples serve to train a SVM with a gaussian kernel. To quickly evaluate the couple (K, F) we do not try to search the best SVM parameters. So γ and C are at the default value of libsvm (C = 1, γ = 1/n). The learned SVM is used to predict the label of the testing samples.

Evaluation of a Set Kernels for a Feature Space

There is a large disparity in the number of individuals of each class. So, we do not want to simply compute an averaged classification error rate. Instead we compute the following errors: (i) Missed WM Ratio (MWMR): ratio of WMSF and WMCF voxels recognized as being N-WM (CSF or GM) voxels; (ii) Exchanged WM Ratio (EWMR): ratio of WMSF voxels recognized as being WMCF voxels and WMCF voxels recognized as WMSF voxels; (iii) Imagined WM ratio (IWMR): ratio of N-WM (CSF and GM) voxels recognised as being WMSF or WMCF voxels. Then the final error score is computed as following:

rate = α * M W M R+β * EW M R+γ * IW M R (3)
with α = 1.5, β = 1 and γ = 2 in this experiment. This way, we give a low weight on the EWMR and bigger weights on IWMR and MWMR. Although we try to differenciate them, we do not care of exchanging CSF and GM.

Selection of the Best Kernels

As, for each feature set, the search space is very huge, we use a genetic algorithm in order to search the best convolution kernels. Each kernel is an array of size w * w, with w the width of the kernel. The genome consists of the n kernels stored in a 1D array using values in the interval [-2; 2] (it means that values inside the kernel will be in this interval), so it has a size of w * w * n. We do not pay attention to have a kernel summing to 1 as we do not care if the data obtained after convolution is not in the same metric as the original data (we do not manipulate or visualize the convolved data, it only serves for classification). Population contains 500 individuals. The initial population contains:

• one individual build with gaussian kernels which are supposed to be good by doing a weighted average based on the distance around the voxel of interested The procedure stops after 100 generations or 3 days of computing. The cross-over rate is set at 0.9 and use 2 points. The mutation rate is set at 0.1 (a higher mutation did not implyied a faster convergence nor better results) and apply gaussian mutations. The number of elites is set at 20. The fitness value of a chromosome is the rate explained in (3) and the genetic algorithm wants to reduce this rate.

3 Measure of Performance

Apparatus

Ground truth datasets and validation is one of the biggest challenge of the dMRI community. Hence, there is an important effort to build ex-vivo phantoms that produce realistic datasets, more realistic than simulated synthetic data. This is the case of the FiberCup data, mimicking a coronal slice of the brain. It is a simple 3D dMRI dataset, but is quite unique because it reproduces complex fiber crossing configurations, similar to configurations in the cemtrum semioval and 'U' fibers of the brain. The underlying ground truth is known and thus will serve as our learning/testing dataset. For this paper, we have focused on the 3 mm isotropic, 64 directions, b = 1500 s/mm 2 dataset [START_REF] Fillard | Quantitative evaluation of 10 tractography algorithms on a realistic diffusion mr phantom[END_REF]. The phantom and ground truth fibers are illustrated in Fig. 2. Thus, we use a good compromise between synthetic data as in [START_REF] Schnell | Fully automated classification of HARDI in vivo data using a support vector machine[END_REF] and in vivo data for which it almost impossible to have ground truth. Phantom border represents GM, fibers in one direction (resp. several directions) is WMSF (resp. WMCF), the rest is CSF.

From this HARDI dataset, we provide one input among the following choices to the SVM: i)-ii) a SH order 4 and 8 representation of raw signal (SH4, SH8 respectively) [START_REF] Descoteaux | Apparent Diffusion Coefficients from High Angular Resolution Diffusion Imaging: Estimation and Applications[END_REF], or iii) the eigenvalues of the diffusion tensor [START_REF] Westin | Processing and visualization for diffusion tensor MRI[END_REF] (EIG).

Results of the proposed method are compared to a baseline classifier. This classifier does not use convolution operations, but it works with far more information. Each voxel is classified by several SVM classifier using a different feature space (SH4, SH4 rotation insensitive [START_REF] Schnell | Fully automated classification of HARDI in vivo data using a support vector machine[END_REF], SH8, SH8 rotation insensitive, eigenvalues SH4 after deconvolution, ODF4, ODF8). Each classifier is trained using the best parameters (C,γ) by getting them

Results

Using a computer having 4Gb of RAM and a processor of 4 cores, scripts written in python and consuming tasks compiled using Cython, it takes around 24 hours to run the evolution procedure for most couples of feature/kernel width (we need to evaluate 50000 = 500 * 100 classification tasks on a high quantity of voxels for each couple of selected feature and kernel width). As the feature space is smaller, results or obtained quickly for SH4 data than for SH8. The evolution procedure was not able to find a better individual than the standard kernel matrices for some configurations. This can be because of the size of the search space which is too big in comparison to the size of the quantity of individuals involved in the procedure.

Tab. 1 presents the performances obtained using the best filter sets for each couple of features (SH4, SH8) and convolution kernel's width [START_REF] Flamary | Large margin filtering[END_REF][START_REF] Prčkovska | Fast classification scheme for hardi data simplification[END_REF][START_REF] Vapnik | Theory of support vector machines[END_REF] as well as the performances of the baseline classifiers. Fig. 3 visually presents the recognition performance using our method (SH8, kernel width of 5) against the best baseline classifier.

Baseline classifiers mainly do mistakes by detecting crossing fibers as single fibers. If we use the global classification error rates, they seem to perform well, however if we use the fitness value or look at Fig. 3a, we understand they perform badly. This may be explained because it is trained in order to reduce the global error rate whatever is the location of the errors. The proposed convolution based classifier performs better. Most error are miss recognition of the border of the phantom. This can be explained by the fact that the fitness function does not try to minimize this error. Most of the other errors are located at the frontier between two different classes. If we ignore the recognition error between CSF and GM (because there may not be important in our context), the error rate drops from 14.65% to 6.61% (SH8/window of size 5).

The huge amount of time involved in the experiment is not representative of a real use of the system as a lot of classifiers are learned and tried during the optimisation procedure. To give a more accurate representation of the duration of the computation, we have computed the mean time taken to learn the classifier and the mean time taken to classify the voxels by using the best kernels for each configuration of features and kernel width. It takes in average less than 11s to learn the classifier and a bit more than 1.50s to classify each voxel. In a real life application, only the classification process is used ; so we think it is fast enough to be used in a real world application even if processing time would be slightly larger with more voxels. We can approximate an overestimate of the classification duration of a whole brain by:

timing(V ) = 1.5 * V 3 * 64 2 (4)
with V the number of voxels to classify. It is an overestimate as it does not take into account a potential reduction of the number of voxels to classify after having applyied a manual or automatic localisation of the brain. Thus with a matrix of 256 * 256 * 80, the classification duration would be approximatly timing(5242880) = 640.0s.

Ten minutes seems to be a correct amount of time.

Conclusion

We have proposed a new SVM classifier taking into account a local spatial neighbourhood to classify each voxel of HARDI data according to its water diffusion phenomenon. We can successfully classify voxels containing single fiber bundles, voxels with several directions of diffusion reflecting crossing fiber populations and random isotropic voxels without fiber bundles.

We believe that this opens many possible perspectives in quantitative white matter analysis in healthy and patients with neurodegenerative diseases. Future experiment could use large margin filtering [START_REF] Flamary | Large margin filtering[END_REF] in order to optimize the SVM parameters while optimizing the convolution matrices. It is also important to apply the results on real brain datasets manually labelled by neurologists or neurosurgeons. Morphological operators could also decrease the recognition error rate.

Figure 1 :

 1 Figure 1: Proposal

•

  250 individuals created with modification of the first individual (mean of the gaussian kernels based individual and a random one • 249 individuals generated totally randomly.

Figure 2 :

 2 Figure 2: Phantom dataset with ground truth fibers.

Figure 4 :

 4 Figure 4: Confusion matrix by (merging CSF and GM labels)

Figure 3 :

 3 Figure 3: Visual analysis of the performances of classification. For (a) and (b): left column is the obtained labels; center column is the ground truth; right column shows the errors; each line is a different slice of the phantom.

Table 1 :

 1 Recognition performance (fitness value/global classification error rate), using the best convolution kernels, and for the baseline classifiers

		Kernel width
	Features 5	7	9
	SH4	(0.28/0.19)	(0.29/0.16) (0.26/0.15)
	SH8	(0.21/0.14)	(0.27/0.17) (0.23/0.12)
	EIG	(0.42/0.25)	(0.44/0.8)	(0.40/0.22)
	Baseline majority vote	Baseline SVM
		(0.42/0.18)	(0.36/0.16)
	through a grid search and 10 fold cross validation. A
	final SVM classifier operates a fusion (in order to obtain
	better results than a single SVM) of the results of the
	previous classifier in order to give the label of the voxel.
	Note that this SVM fusion gives better results than a
	majority vote and that each individual classifier.


Romain Giot
email: romain.giot@ensicaen.fr

Mohamad El-Abed
email: mohamad.elabed@ensicaen.fr

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

Web-Based Benchmark for Keystroke Dynamics Biometric Systems: A Statistical Analysis

Most keystroke dynamics studies have been evaluated using a specific kind of dataset in which users type an imposed login and password. Moreover, these studies are optimistics since most of them use different acquisition protocols, private datasets, controlled environment, etc. In order to enhance the accuracy of keystroke dynamics' performance, the main contribution of this paper is twofold. First, we provide a new kind of dataset in which users have typed both an imposed and a chosen pairs of logins and passwords. In addition, the keystroke dynamics samples are collected in a web-based uncontrolled environment (OS, keyboards, browser, etc.). Such kind of dataset is important since it provides us more realistic results of keystroke dynamics' performance in comparison to the literature (controlled environment, etc.). Second, we present a statistical analysis of well known assertions such as the relationship between performance and password size, impact of fusion schemes on system overall performance, and others such as the relationship between performance and entropy. We put into obviousness in this paper some new results on keystroke dynamics in realistic conditions.

I. INTRODUCTION

Keystroke dynamics allows users to be recognized based on their way of typing on a keyboard. This is a behavioral modality which has been first experimented in the eighties [START_REF] Gaines | Authentication by keystroke timing: some preliminary results[END_REF]. It is always an interesting subject of research, as it is a low cost two factors authentication approach. Most consequent keystroke dynamics studies have been evaluated on datasets where users typed the same fixed string [START_REF] Killourhy | Comparing anomaly-detection algorithms for keystroke dynamics[END_REF], [START_REF] Giot | Greyc keystroke: a benchmark for keystroke dynamics biometric systems[END_REF], [START_REF] Balagani | On the discriminability of keystroke feature vectors used in fixed text keystroke authentication[END_REF], while very few of them used different strings for each users [START_REF] Cho | Web-based keystroke dynamics identity verification using neural network[END_REF], [START_REF] Hosseinzadeh | Gaussian mixture modeling of keystroke patterns for biometric applications[END_REF].

For this study, we want to be placed in the following context. We want to use a web-based application with an authentication system based on static keystroke dynamics. Some studies have already been done on web-based keystroke dynamics [START_REF] Revett | Developing a keystroke dynamics based agent using rough sets[END_REF], [START_REF] Cho | Web-based keystroke dynamics identity verification using neural network[END_REF], [START_REF] Gagbla | Applying keystroke dynamics for personal authentication[END_REF], [START_REF] Jiang | Keystroke statistical learning model for web authentication[END_REF], but none of them provided the used dataset and their experimental protocols were really differents. Some worked with individual passwords [START_REF] Jiang | Keystroke statistical learning model for web authentication[END_REF], while other used the same strings for each user [START_REF] Revett | Developing a keystroke dynamics based agent using rough sets[END_REF]. In our work, we statistically analyze the behavior of these two approaches.

There is a strong need of a large dataset. We provide a new dataset where users typed both an imposed pair of login and password, a chosen login (their usual one) and password (one chosen by themselves for the experiment). The aim of the dataset is to show the viability of using personal identifiers (i.e., chosen login and password) in native web browser (i.e., using no plug-in or extension of the web browser), because the most recent applications are web-based ones, and systems usually use different logins and passwords for each user. The contribution of this paper is to present this new dataset that is publicly available 1 for testing algorithms in an operational context and experiment keystroke dynamics on this dataset. It is the sole public dataset which satisfy these properties. Additionally, we analyze information provided in this dataset to answer operational questions such as those presented in section III, part B. The paper is organized as follows. Section II presents existing public datasets and the dataset built for the experiment. Section III presents the various experiments. Section IV presents their results. Section V concludes this paper and gives some perspectives.

II. PUBLIC KEYSTROKE DYNAMICS DATASETS

In most studies, researchers use their own dataset which, most of the time, suffers of lack of number of users and sessions. Some keystroke dynamics databases are publicly available in the literature, but none of them provides different login and password for each user. In [START_REF] Giot | Greyc keystroke: a benchmark for keystroke dynamics biometric systems[END_REF], several users have typed the passphrase "greyc laboratory" on two different keyboards on the same computer during several sessions. 100 users have provided at least 60 samples each on 5 different sessions spaced of one week (most of the time). This database contains the most number of users, but, the number of samples and sessions may be too small to track variability through time. In [START_REF] Killourhy | Comparing anomaly-detection algorithms for keystroke dynamics[END_REF], several users have typed the password ".tie5Roanl" on a single computer during several sessions. 51 users have provided 400 samples each on 8 different sessions spaced of, at least, one day. This database contains a huge number of samples, but the time interval may be too small to track variability on a long period. These two databases are the only ones containing enough samples and users to give statistically significant results. Sadly, they mainly have been used by their own creators, and not by the community. Table I summarizes this information. Even if these two databases are interesting, they do not really fit requirements for realistic studies: 1) We want different logins and passwords per user. This is the most realistic scenario for keystroke dynamics. Real users use different logins and passwords.

2) It is interesting to have different computers and keyboards to grow the variability of the samples (due to shape of keyboard, responsiveness of the computer, precision of the timer, . . . ).

3) The captures must have been done in a web browser (because nowadays, most of modern applications are available as web-based applications, and not desktop applications. Collecting samples from different browsers allows to track more variability due the browser itself (several browsers exist on all the operating systems).

We have created a web-based application which allows us to capture keystroke dynamics during several sessions. We think that with this dataset, researchers will have an interesting dataset providing a lot of variabilities due to the different factors presented before. The results would not be over optimistic as it may be the case with actual ones. The next section presents the experiment.

III. EXPERIMENT

A. Proposed Dataset 1) Acquisition Protocol: Each week, we have sent an email to the students of our school of engineering and some colleagues of our lab. It asks them to realize the session capture of the week. The first one explains the aim of their participation. During the first session, each user has to choose its own login (we asked them to use the login of their school account, but they have not all respected that), and password. We expect them to type their login as they are used to. So, each user chooses when he/she wants to do the session without any obligation or pressure. Participants have not been rewarded. A session is composed of three different steps. Each step consists in typing several times a pair of login and password. The user interface presents two input fields: one for the login, and one for the password. No typing correction is allowed: if a user presses backspace, the input field is cleared, and the user must type its text from scratch. The password and login the user have to type are displayed near the form and are displayed in a pop-up box at the start of each step 2 .

A progression bar is shown at the bottom of the screen. It indicates how many inputs are yet needed to complete the session. As the interface is displayed in a web browser, it is written with Javascript, html and css. Most studies of keystroke dynamics which work on a web browser are written in Java [START_REF] Revett | Developing a keystroke dynamics based agent using rough sets[END_REF], [START_REF] Cho | Web-based keystroke dynamics identity verification using neural network[END_REF], [START_REF] Gagbla | Applying keystroke dynamics for personal authentication[END_REF]. We have not chosen this language because it imposes the user to install a Java plugin for its browser. For each key event (key press and key release), the timing information is captured through the timeStamp value of the event 3 . We do not track timing information of the key having a code inferior to 48 (except tab, shift, space, ctrl, altgr, and keycode 0 which seems to be present for some punctuated keys) as all as right and left Windows key and keys from F1 to F12. The three acquisition steps are the following ones: 2 No screenshots for lack of space 3 https://developer.mozilla.org/En/DOM/Event.timeStamp password. This allows us to capture exactly the same thing for all the users as in [START_REF] Giot | Greyc keystroke: a benchmark for keystroke dynamics biometric systems[END_REF], [START_REF] Killourhy | Comparing anomaly-detection algorithms for keystroke dynamics[END_REF].

• Step 2.
Ten inputs of the chosen pair of login and password of the user. This simulates the authentication of the user on a system as in [START_REF] Hosseinzadeh | Gaussian mixture modeling of keystroke patterns for biometric applications[END_REF], [START_REF] Revett | A machine learning approach to keystroke dynamics based user authentication[END_REF]. • Step 3. For two other users, five inputs of the selected pair of login and password. This allows us to capture ten impostor samples belonging to two other users. 2) Presentation of the Obtained Dataset: As the participation was only based on the goodwill of the users, very few of them participated to the study or to each session. That is why only 83 users have participated to the study, whereas the emails were sent to more than 300 students. Sessions were not always done completely. Users have provided a total of 5185 genuine samples (pair of login, password typed by its owner), 5754 impostor samples (pair of login, password typed by a user different of its owner), and 5439 imposed samples (pair of imposed login and password). Most participants are between 20 and 24 years old (mainly students in computer science, chemistry and electronics). Most users are males, which can be problematic to generalize results if males and females have different typing behaviors [START_REF] Giot | A new soft biometric approach for keystroke dynamics based on gender recognition[END_REF]. Most users have more than 20 impostor samples which allows to obtain good information on False Match Rate. The number of genuine and imposed samples per user is not equally set, there are several users who have provided less than 40 genuine samples. It is difficult to obtain a large keystroke dynamics database with enough quantity of samples per user (which may explain why there are so few publicly available keystroke dynamics databases, and why, most of the time the number of users is relatively small).

Although the obtained dataset is not the largest in terms of number of users involved, it is the only public keystroke dynamics providing different logins and passwords per users. Thus, it is the more realistic one.

B. Experimental Protocol

We want to answer to the following questions: 1) Does keystroke dynamics' performance behaves similarly on a dataset built with imposed strings, against a dataset built with strings chosen by users themselves? This question is interesting because all public datasets do use imposed strings.

2) Which approach (individual or global threshold) gives better results in terms of performance? This question is interesting, because both approaches are used in the literature and avoid an easy performance comparison. 3) Which features must be used in a score fusion system, in order to improve results? 4) Are password length, entropy and complexity correlated with the recognition performance? This question is interesting, because it has not been studied in the literature (probably because all the passwords are identical). It can give information of how the password must or must not be chosen by the user, in order to strengthen the system. We have run several experiments using the different subsets (chosen/imposed) to analyze the performance of keystroke dynamics authentication methods. The Equal Error Rate (EER) is individually computed for each user (i.e., EER is computed with the comparison scores of its test samples against its model and real impostors' test samples against its model), and, its averaged value (among all users) is presented under EER i . EER g presents the EER with the same threshold for all the users (EER is computed with a global intra-scores and inter-scores set). These are two common ways of presenting keystroke dynamics results, but no study analyzed the performance difference between the two approaches. Authentication test is done with only one capture, we do not give another chance if it fails (several tries is a another common way of presenting results [START_REF] Hosseinzadeh | Gaussian mixture modeling of keystroke patterns for biometric applications[END_REF], [START_REF] Killourhy | Keystroke biometrics with number-pad input[END_REF]). Training is done with 20 samples (two sessions), and testing is done with the remaining samples. We only keep users having at least 20 testing samples (at least two sessions per user). So, we work with users having used the system during at least 4 sessions. As users may use different keys for typing their login or password, the number of pressed characters may be different.

1) Distance Computation: In this paper, we have tested only one score computing method. It is based on a Gaussian distribution assumption of the features [START_REF] Hocquet | Estimation of user specific parameters in one-class problems[END_REF]. Each user provides N samples to build its template. A sample x is a n-dimension vector. The template θ = (µ, σ) is composed of the mean vector µ and the standard deviation vector σ among these features. The distance between sample x and template θ is computed using the following formulation:

d(x, θ) = 1 - 1 n n i exp - |x i -µ i | σ i (1)
If a query is not of the same size (different combinations of keys, or use of the mouse to select and erase text, can be the reason of this difference) of the template, we return a distance of 1 (the worst score, 0 being the best).

2) Statistical Validation: In order to verify the various answers, we use the Kruskal-Wallis (KW) test [START_REF] Higgins | An introduction to modern nonparametric statistics[END_REF]. It is a non-parametric (distribution free) test, which is used to decide whether K independent samples are from the same population. More generally speaking, it is used to test two hypothesis: the null hypothesis (H 0 : µ 1 = µ 2 = ... = µ k ) assumes that samples have been generated from the same population (i.e., equal population means) against the alternative hypothesis (H 1 : µ i = µ j ) which assumes that there is a statistically significant difference between at least two of the subgroups. The decision criterion is then derived from the estimated p -value as depicted in equation 2.

p -value ≥ 0.05 accept H 0 otherwise reject H 0 (2)
3) Simple Feature Authentication: We test several features: "rp" (latency between the release of a key, and the pressure of next one), "rr" (latency between the release of two successive keys), "pp" (latency between the pressure of two successive keys) and "pr" (duration of pressure of one key) for both login and password individually, and for each kind of datasets (imposed login/password and chosen login/password). This gives us 4 * 2 * 2 = 16 4 different experiments.

4) Score Fusion: Although feature fusion is often used in keystroke dynamics [START_REF] Giot | Keystroke dynamics with low constraints svm based passphrase enrollment[END_REF], [START_REF] Balagani | On the discriminability of keystroke feature vectors used in fixed text keystroke authentication[END_REF], [START_REF] Killourhy | Comparing anomaly-detection algorithms for keystroke dynamics[END_REF], we have chosen to use a score fusion system [START_REF] Teh | Statistical fusion approach on keystroke dynamics. Signal-Image Technologies and Internet-Based System[END_REF], [START_REF] Hocquet | Estimation of user specific parameters in one-class problems[END_REF]. A user sample is composed of several sub-samples (one per kind of extracted features): x = (x l rr , x l rp , x l pr , x l pp , x p rr , x p rp , x p pr , x p pp ) (superscript l and p respectively represent login and password). A template is built for each kind of sample extracted features: θ = (θ l rr , θ l rp , θ l pr , θ l pp , θ p rr , θ p rp , θ p pr , θ p pp ). In this case, the same keystroke dynamics method is used for each extracted features. The final score is the mean (without score normalization) of each of these scores (one for each selected feature), so the fusion rule is: s f = 1 m m i s i with s f the new fused score, and s i the comparison score of system i (using features of type i), when using m different systems. As an illustration, figure 1 presents the score fusion architecture when pp and rp times from login and password are used.

5) Study of the performance depending on password size and complexity: For this experiment, we use the score fusion of all the features of the password. We would like to verify if keystroke dynamics' performance depends on the complexity, the size, or the entropy of the password. Towards this goal, we use again the KW test. For the complexity computation, we have used an existing algorithm which is often used in web applications as depicted in figure 2. The entropy quantifies the expected value of the information contained in the password p. The password contains P unique characters {c 1 , • • • , c P }. p(c i ) is the probability of appearance of the character c i in the password P. Entropy is computed as following:

H(P) = - P i=1 p(c i ) log 2 (c i ) (3)
IV. RESULTS

In this section, we present the results of the experiments previously presented. Even if the number of users in the dataset is quite important, only 48 of them provided enough samples to be used in the experiments (note that most of keystroke dynamics studies even use fewer individuals). Require: P ASSW ORD SIZE ← number of char of P ASSW ORD LOW , U P P , N U M , OT H ← (0, 0, 0, 0)

for i = 1 to SIZE do CHAR ← P ASSW ORD[i] if CHAR ≥ 'a' and CHAR ≤ 'z' then SCORE ← SCORE + 1 LOW ← 1 else if CHAR ≥ 'A' and CHAR ≤ 'Z' then SCORE ← SCORE + 2 U P P ← 2 else if CHAR ≥ '0' and CHAR ≤ '9' then SCORE ← SCORE + 3 N U M ← 3 else SCORE ← SCORE + 5 OT H ← 5 end if end for COEF F ← SCORE/SIZE DIV ERSIT Y ← LOW + U P P + N U M + OT H return COEF F * DIV ERSIT Y * SIZE Fig. 2.
Compute the complexity of a password (in terme of password security and not typing difficulty).

A. Simple Feature Authentication

Table II presents the results of the simple feature authentication experiments. Using the KW test, we find that there is no significant difference (p -value = 0.68) of performance between the chosen and the imposed datasets. This was a surprising result since users are more likely to type their own login and password than an imposed ones. We may obtain these results because, even if users have chosen their password, it is not their real password they type several times per day. Using the chosen and imposed datasets, we found that the performance of individual approach outperformed (p -value << 0.05) the global approach.

Using both datasets, we found that the login outperformed (p -values are below to 0.05, respectively) the password information. This result was also attended since the used logins are much more easier than passwords (hence, users' way of typing the imposed logins would be much more stable than typing the imposed passwords).

A study of the fusion of both information is given in the next section.

B. Score Fusion

Table III presents the performance of the score fusion when using different features on the chosen dataset. We can see that we can improve the performance by fusing the comparison scores of the right extracted features.

In order to see which feature (or combination of features) gives the best performance result, we use the KW test over the seven sets which combine login with password: the EER values related to the use of "pr", "rr", "pp", "pr" & "rr", "pr" & "pp", "rr" & "pp", and "pr" & "rr" & "pp" informations, respectively. We found that the worst result (with p -value below to 0.05) is obtained by using the "pr" information (the duration of the press of a key which is the most often used feature). We have not selected "rp" which is the worst feature in Table II. The use of all the features ("pr" & "rr" & "pp") outperformed (p -values below to 0.05) the use of "pr" and "pp" informations, while there were no significant performance difference between all the features and "rr", "pr" & "rr", "pr" & "pp", "rr" & "pp" informations. We conclude, that the use of all the features (even if they are redundant) may improve the performance. This generalizes results obtained on a single fixed text [START_REF] Balagani | On the discriminability of keystroke feature vectors used in fixed text keystroke authentication[END_REF].

C. Study of the performance depending on password size, entropy and complexity

Using the KW test, we find that the size (p-value = 0.019) and the entropy (p -value = 0.0062) of the used passwords have a significant impact on system performance, while there was no impact (p-value = 0.12) according to the complexity algorithm. More generally speaking, the average EER value is increased from 10.03% (for users having more than 8 characters) to 15.85% (for the others). Using the entropy information, the average EER value is increased from 10.01% (for those whom the entropy of their passwords is more than 2.7) to 16.09% (for the others). The average method is used to fix both thresholds (8 and 2.7). It would be important in the future then to investigate more the way of choosing passwords, which may be considered as a quality measure in keystroke dynamics research field. Such quality information would be useful during the enrollment process in order to enhance the system overall performance.

V. CONCLUSION

We have presented a new publicly available dataset for keystroke dynamics. This dataset is composed of several users who have a different login and password. We think it is the most realistic keystroke dynamics dataset which is publicly available. We have statistically verified that: (a) presenting EER computed with an individual threshold, gives better result than computing the EER with a global threshold (which explains why a lot of keystroke dynamics studies use this method), (b) using logins gives better performance than using passwords, (c) using all features during the fusion improves the performance, (d) the size and the entropy of the password have an impact on the performance.

Keystroke dynamics is an interesting modality, but, it requires strict conditions during acquisition to avoid capture of noisy samples. This may imply an eduction of the user. As its performance decreases a lot with time, it is necessary to track the time variability into account which will be the next work on this dataset.

Fig. 1 .

 1 Fig. 1. Score fusion scheme using only RR and RP features.

TABLE I SUMMARY

 I OF THE KEYSTROKE DYNAMICS DATABASES. PROP. REFERS TO THE PROPOSED DATASET. SAME MEANS EACH USER TYPES THE SAME PASSWORD (SO IMPOSTOR ARE USED TO TYPE THE SAME PASSWORD THAN THE USER), WHILE DIFFERENT MEANS EACH USER TYPES A DIFFERENT PASSWORD (AND IMPOSTORS ARE NOT USED TO TYPE IT). Ten inputs of a pair of imposed login and

			Size	Login/password
	Study # users	# samples	same different
	[4]	100	60000
	[11]	51	20400
	Prop.	83	5185	+
			5754/5439

• Step 1.

TABLE II AUTHENTICATION

 II RESULTS, FOR DIFFERENT EXTRACTED FEATURES FOR EACH KIND OF TEXT. THE BEST RESULT OF EACH LINE IS IN BOLD. THE BEST RESULT OF EACH COLUMN IS UNDERLINED.

			Chosen dataset	Imposed dataset
	Type Field	EERi	EERg	EERi	EERg
	pr	login	26.50%	28.81%	19.79%	21.90%
	rp	login	21.25%	25.91%	14.84%	20.91%
	rr	login	18.00%	24.01%	10.00%	15.21%
	pp	login	19.27%	24.48%	11.86%	18.63%
	pr	pwd	22.21%	25.30%	23.21%	27.08%
	rp	pwd	18.51%	21.56%	26.63%	30.54%
	rr	pwd	16.95%	19.90%	22.17%	27.00%
	pp	pwd	16.45%	20.64%	24.02%	29.00%
		Mean	19.89%	22.57%	19.65%	23.78%

TABLE III AUTHENTICATION

 III RESULTS, WHEN USING VARIOUS FEATURE FUSION. THE BEST RESULT OF EACH LINE IS IN BOLD. THE BEST OVERALL RESULT IS UNDERLINED.

	Login pr rr	Password pp pr rr pp	EER i	EERg
		Login only
			15.99%	22.42%
			14.36%	20.72%
			16.57%	23.07%
		Password only
			14.24%	17.75%
			12.52%	16.74%
			15.36%	19.04%
		Login and password
			18.92%	23.51%
			12.37%	15.63%
			11.45%	16.15%
			10.25%	15.85%
			9.4%	19.96%
			10.71%	14.95%
			08.87%	14.08%
		Mean	13.15%	18.45%

http://www.epaymentbiometrics.ensicaen.fr/

number of features * login or password * imposed or chosen