Segen Tewelde

Stefan Gruner

Martin Olivier

NOTIONS OF HYPOTHESIS IN DIGITAL FORENSICS

Keywords: Digital forensics, philosophy of science, scientific hypotheses

With the growing scientification of the discipline of digital forensics, the notion of "scientific hypothesis" is becoming increasingly important, because all empirical science is hypothetical, not apodictic. Although the word "hypothesis" is used widely in the digital forensics literature, its usage is not sufficiently reflected from a philosophy of science point of view. This chapter discusses this problem with particular reference to Carrier's methodological work in which the notion of hypothesis plays a prominent role.

Motivation

This chapter is based on the little-disputed premise that the young discipline of digital forensics is still -to use a phrase by Thomas Kuhn [START_REF] Olivier | On the scientific maturity of digital forensics research[END_REF] -in a "proto-scientific" stage, although its scientification is on the way [START_REF] Garbolino | The scientification of forensic practice, in New Challenges to Philosophy of Science, The Philosophy of Science in a European Perspective[END_REF]. When a discipline grows from a proto-scientific stage to a "paradigmatic" stage [START_REF] Kuhn | The Structure of Scientific Revolutions[END_REF], two phenomena can be typically observed: (i) a growing formalization (or mathematization) in the expression of the theories in the discipline; and (ii) a growing methodological awareness of what is required or forbidden or allowed for the methods in the discipline in order to qualify as "scientific." These phenomena manifest themselves according to Bunge's differentiation between the substantive and operative parts [START_REF] Bunge | Philosophy of Science: From Explanation to Justification, Volume Two[END_REF] of the entire body of knowledge of a discipline.

As far as the first (substantive) point is concerned, the mathematical formalization of the theoretical language in digital forensics has already shown some progress (see, e.g., [START_REF] Bosman | Log file analysis with context-free grammars[END_REF][START_REF] Chabot | A complete formalized knowledge representation model for advanced digital forensics timeline analysis[END_REF][START_REF] Wang | An OCL-based formal method for cloud forensics[END_REF]). On the one hand, this is because scholars from the traditional theoretical computer science and formal methods communities are successfully penetrating the interdisci-plinary barriers and are beginning to gain visibility in the field of digital forensics. On the other hand, the need for formalization has also been recognized by a number of scholars in the digital forensics community. One example is the formal description of aspects of digital forensics by Cohen [START_REF] Cohen | Digital Forensic Evidence Examination[END_REF], including critiques of earlier projects.

The second (operative) point is more problematic in the development of digital forensics. Not only is there little methodological awareness, but the growing methodological disputes in the discipline are often taking place outside the realm of science. For example, according to Cohen [START_REF] Cohen | Digital Forensic Evidence Examination[END_REF], many of the details of currently-used procedures and tools are neither published nor thoroughly tested. Where tool testing is discussed, the coverage is often reminiscent of testing in an engineering sense (e.g., a tool performs some task correctly) as opposed to an assessment in a methodological sense (i.e., the task performed ought to be at the methodological core of the discipline).

Carrier [START_REF] Carrier | A Hypothesis-Based Approach to Digital Forensic Investigations[END_REF] has contributed to this discourse by formulating a hypotheses-oriented approach for all digital forensic investigations to meet the classical science-philosophical criteria of scientificness. (Note that the term "science-philosophical" is used throughout this chapter as the adjective form of the philosophy of science.) Alas, not every hypothesis is per se scientific. Consequently, the scientificness of an empirical discipline such as digital forensics is not automatically guaranteed by a demonstration that it follows (or is able to follow) a hypothesis-based approach. Additional scientificness criteria, such as those identified by Bunge [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF], must be stipulated for hypotheses before they can be used as indicators of the degree of scientificness of the discipline in which the hypotheses are formulated.

At this point, one of the methodological weaknesses in the current meta-theory of digital forensics has been reached. Whereas the word "hypothesis" is already in wide use (see, e.g., [START_REF] Beyers | Database application schema forensics[END_REF]), it is mainly used in an undifferentiated and science-philosophically unreflected manner. This suggests that users of the concept are largely unaware of the many different classes of empirical hypotheses. A potentially harmful illusion of scientificness could arise as a consequence of this ignorance.

The foregoing considerations motivate this meta-analysis of Carrier's methodological framework [START_REF] Carrier | A Hypothesis-Based Approach to Digital Forensic Investigations[END_REF] with regard to Bunge's well-established classification scheme for scientific hypotheses [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF]. This is, indeed, the principal contribution of this chapter. Note that this chapter is not concerned with the often-mentioned extrinsic pragmatic value of the scientificness of digital forensics (i.e., acceptability in courts of law). Instead, this chapter focuses on the intrinsic philosophical value of scientificness for its own sake, whereby the notion of scientificness must never be conflated with truth.

Related Work

The use of Bayesian decision networks for evaluating and interpreting scientific findings in forensic science is discussed in [START_REF] Garbolino | Evaluation of scientific evidence using Bayesian networks[END_REF][START_REF] Taroni | Bayesian Networks for Probabilistic Inference and Decision Analysis in Forensic Science[END_REF]. The philosophical problems underling the narrative construction of explanations by means of hypothetical linkages between individual events are detailed in [START_REF] Garbolino | Historical narratives, evidence and explanations, in Explanation, Prediction and Confirmation, The Philosophy of Science in a European Perspective[END_REF]. Note that the work of Carrier [START_REF] Carrier | A Hypothesis-Based Approach to Digital Forensic Investigations[END_REF] also has a strong focus on the explanatory construction of such kinds of histories [START_REF] Pollitt | History, historiography and the hermeneutics of the hard drive[END_REF] of (digital) events.

An appropriate meaning of the term "hypothesis" is crucial for all these considerations because genuine science must be an explanatory undertaking [START_REF] Windelband | History and natural science[END_REF], which goes well beyond the mere gathering and description of data and facts (as the descriptivists would have it). Thereby, all empirical/scientific explanations are ultimately hypothetical [START_REF] Bunge | Philosophy of Science: From Explanation to Justification, Volume Two[END_REF].

The formulation of hypotheses for explanatory purposes is also discussed in the related field of forensic engineering [START_REF] Wiechel | Application of the scientific method to the analyses in forensic science with case example[END_REF]. Thereby, the types of hypotheses formulated in digital forensics are similar to those formulated in software testing because both digital forensics and software testing are idiographically oriented towards what is unique (not towards what is universally general). For this reason, the meta-scientific methodological considerations about the problem of justification of empirical hypotheses in software testing [START_REF] Angius | The problem of justification of empirical hypotheses in software testing[END_REF] should also be studied carefully by digital forensic theoreticians.

Carrier's Work

Carrier [START_REF] Carrier | A Hypothesis-Based Approach to Digital Forensic Investigations[END_REF] has proposed a methodological framework for hypothetical digital forensic event reconstruction with high scientific plausibility. The framework incorporates seven categories and more than thirty classes of analysis techniques for formulating or testing digital forensic hypotheses. Before going into the details of Carrier's categories, it is instructive to use an example [START_REF] Carrier | A Hypothesis-Based Approach to Digital Forensic Investigations[END_REF] to understand the conceptual relationships between the categories and the purposes for which the hypotheses in the categories are formulated.

Example: A computer is suspected of having been used to download contraband pictures from the Internet. Lower-level hypotheses are formulated about the time that the system was operational and the technical (operational) capabilities of the system. The hypotheses are used as presuppositions for formulating succeeding hypotheses of higher complexity. At this point, the lower-level presuppositions are tacitly considered to be true.

Next, a higher-level hypothesis is formulated that asserts disjunctively that either program A or program B was used to download the pictures from the Internet. This hypothesis is formulated on the basis of the assumption that programs A and B are capable of downloading the pictures. In order to determine which of the two programs was actually applied, a particular log file ℓ is inspected to see which program was operational during the suspected time of the incident. From a logical point of view, the existence of the log file ℓ justifies the deduction:

(A ∨ B), ¬B A
under the condition ℓ =⇒ ¬B. This investigative step, however, hypothetically assumes the trustworthiness (integrity) of the log file itself because otherwise the required implication ℓ =⇒ ¬B would no longer be compelling.

Last, but not least, it must be taken into account that the computer could have been compromised by an intruder who stored the pictures on the computer without the computer owner's knowledge.

Given the need to create different types of hypotheses with various degrees of plausibility, Carrier [START_REF] Pollitt | History, historiography and the hermeneutics of the hard drive[END_REF] has proposed a schema for formulating hypotheses about (possible) sequences of past events in the lifetime of digital evidence. The remainder of this section examines the schema in detail.

History Duration

According to Carrier, hypotheses in this category are formulated about the time span T during which the system under analysis was operational. To formulate testable hypotheses in the History Duration category, lower-level hypotheses about time instants t ∈ T must be formulated.

With regard to Bunge's classification scheme [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF], the hypotheses are typically singular and specifiable because they can be obtained by substituting variables for constants to account for single facts. They are also testable with regard to the existence of log files or other temporal traces. As far as Bunge's precision attribute is concerned, hypotheses in the History Duration category are refined as they are both predicateprecise and range-precise. However, they are typically isolated and not systemic as they define unique events in a manner that Windelband [START_REF] Windelband | History and natural science[END_REF] called idiographic as opposed to nomothetic. Hypotheses of this kind are typically, in Bunge's terms, both confirmable as well as refutable in principle. Note, however, that confirmability and refutability in principle cannot guarantee de facto confirmation or refutation in every individual case.

Carrier notes that hypotheses about an entire duration T are not without exceptions. For example, all the information on a storage device can be overwritten and, thus, traces of previous events can be erased [START_REF] Carrier | A Hypothesis-Based Approach to Digital Forensic Investigations[END_REF]. From a science-philosophical point of view, this corresponds to the situation of historians and archaeologists such that the science-philosophical methodologies of the two classical disciplines can become relevant (and important) to digital forensics [START_REF] Pollitt | History, historiography and the hermeneutics of the hard drive[END_REF]. Hypothetical claims about the previous existence of information that no longer exists are typically unspecifiable (in Bunge's terms), but they can motivate deeper research in their role as programmatic hypotheses.

Primitive Storage System Configuration

According to Carrier, the first type of hypotheses in this class have the form: device d has a storage capacity c, which is empirically unknown before a measurement is taken. A hypothesis of this type is, again, singular and specifiable in Bunge's terminology. The hypothesis is also phenomenological because it merely describes the surface of a phenomenon, not the details of its inner mechanisms. The hypothesis is both confirmable and refutable by means of a suitable experimental apparatus. Interested readers are referred to [START_REF] Bunge | Philosophy of Science: From Explanation to Justification, Volume Two[END_REF] for a deep science-philosophical discussion of observations, measurements and experiments.

The second type of hypotheses in the Primitive Storage System Configuration category have the form: device d was connected during the time T of an incident. In Bunge's terms, this is again a singular hypothesis of localizing existential character. Because it refers to the past, the previously-mentioned historical/methodological issues [START_REF] Pollitt | History, historiography and the hermeneutics of the hard drive[END_REF] are also relevant to this class, especially where the possibility of deleted information or information that no longer exists are concerned.

Primitive Event System Configuration

Carrier's third category covers hypotheses that make assertions about the capabilities of devices involved in events of interest. In Bunge's classification scheme, these correspond to the same types of hypotheses discussed above.

Primitive State and Event Definition

In this category, Carrier normatively states that five classes of techniques shall be used to formulate and test hypotheses: (i) primitive state observation class; (ii) state and event capability class; (iii) state and event sample data class; (iv) state and event reconstruction class; and (v) state and event construction class.

Activities in the primitive state observation class are meant to collect data by observing an output device like a computer monitor. The observed state is defined in the inferred history for the times that the observation was made. The corresponding hypothesis deals with a single state that existed at a specific time. In Bunge's terms, this is a singular, specifiable, testable, refined and grounded hypothesis that is experiencereferent and phenomenological. Carrier states that the data should be considered as facts if they do not conflict with the observations made by another investigator. Thus, Bunge's considerations about observations, facts and phenomena in the intersection of the knowing subjects and the physical objects [START_REF] Bunge | Philosophy of Science: From Explanation to Justification, Volume Two[END_REF] are especially relevant.

In Carrier's state and event capability class, hypotheses about primitive system capabilities correspond to presuppositions. They must be tested and accepted before they can be used to formulate hypotheses about possible system states and events. This composition of higherlevel and lower-level hypotheses is, in Bunge's terms, mechanismic because of the references to the inner workings of the machinery under test. Once again, the hypotheses are singular, specifiable, refined and grounded.

Hypotheses formulated with techniques in the state and event sample data class are probability hypotheses that cannot be decisively confirmed or refuted by finite amounts of data. Similar types of hypotheses occur (to use one of Bunge's examples) in the field of clinical medicine where tobacco smoking and lung cancer are typically correlated with each other. Carrier has clarified that the research techniques choose events and states that occur with a probability above some threshold value. Some level of subjectivity must be admitted because neither the threshold value nor the notion of probability are clearly specified. What may appear as highly probable to one investigator may be improbable to another investigator.

Carrier's requirements for the state and event reconstruction class are that an investigator must understand the logic associated with the event capabilities of a system and that it would be prudent to identify the unique signatures of events (this provides background information for formulating a hypothesis). A hypothesis formulated by this technique has the form: event e causes state s. In Bunge's classification scheme, this is the strongest type of hypothesis because it must be defined functionally in terms of one free stimulus variable and its dependent effect variable, and it must be thoroughly experimented with in order to distinguish genuine causality from mere coincidence. At this point, Carrier may well consider the possibility of generating general nomothetic hypotheses of the form: every event of type e will always cause a state of type s. This may be incorporated in a case-independent general theory of digital forensics.

For the final technique, the hypotheses formulated in the state and event construction class are probability hypotheses too, with their notorious difficulties as far as confirmability and refutability are concerned. The truth value of such a hypothesis can only be assessed based on the end state of a trace. However, quasi-general hypotheses [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF] can be formulated in cases where a system prevents, by its own construction, certain events from occurring when the system is in a particular state.

Complex Storage System Configuration

Two types of hypotheses are formulated in this category, which defines entities such as the names of complex storage types that existed during a time interval T , the transformation functions for each of the complex storage types, the attribute names for each of the complex storage types, etc. The hypotheses in this category are more complicated than hypotheses in the simpler History Duration category. Here, the techniques defined for the hypotheses do not test them decisively because probability hypotheses are at best confirmable, not refutable. The hypotheses typically state that a particular device d existed during a time interval T . Since the complex storage was created by a program, a forensic investigator needs to identify the corresponding program. For this purpose, Carrier specified a program identification technique that searches for reconstructed program states. The previously-mentioned science-philosophical problems of historiography, especially with regard to securely deleted information, are also relevant [START_REF] Pollitt | History, historiography and the hermeneutics of the hard drive[END_REF].

The second type of hypotheses in this category, the complex storage capability hypotheses, are singular hypotheses about the capabilities of devices. Carrier proposed three techniques to formulate and test these hypotheses. Since all three techniques are related to testing software, it important to consider the science-philosophical issues pertaining to the justification of empirical hypotheses in software testing discussed by Angius [START_REF] Angius | The problem of justification of empirical hypotheses in software testing[END_REF].

Complex Event System Configuration

The first of the three types of hypotheses formulated in this sixth category is basically the same as in the Complex Storage System Configuration category described above; its associated techniques have also been analyzed above. Using the data type reconstruction class of techniques in this category, the digital forensic investigator formulates hypotheses that are difficult to test. Once again, these hypotheses are similar to those formulated in scientific software testing [START_REF] Angius | The problem of justification of empirical hypotheses in software testing[END_REF]; the objects of the hypotheses are algorithms and data structures. Because algorithms and data structures have many-to-many relations with each other -one algorithm can manipulate many data structures and one data structure can be manipulated by many algorithms -the notorious Duhem-Quine dilemma [START_REF] Vuillemin | On Duhem's and Quine's theses[END_REF] looms for the hypotheses. From the perspective of Bunge's classification scheme, these are hypotheses of relatedness. A technique in the first class, based on the complex system capabilities, is used by an investigator to determine a possible state or event from the list of possible states and events associated with the system of interest; this bears much similarity with the primitive state and event system capability class. Here, the investigator formulates the same type of hypotheses, with the only difference that, for these hypotheses, information about system capabilities is presupposed from prior work in the previous categories.

Complex State and Event Definition

In the state and event sample data class, a standardized sample is required for all investigations if an objective hypothesis is to be formulated. Again, this does not differ very much from the primitive state and event sample data class discussed above. In Bunge's classification scheme, this corresponds (once again) to a singular, specifiable, testable, refined and grounded hypothesis.

Techniques in the state and event reconstruction class refer to the occurrence times of events in multitasking distributed systems. Empirical hypotheses in such contexts often have a statistical character because of the notorious non-deterministic behavior of distributed systems in which certain input/output observations are often not experimentally reproducible.

Techniques in the state and event construction class can be used to postulate events that may have occurred, albeit with a rather low level of confidence on the part of the investigator. Bunge has categorized such vague hypotheses in his pragmatic functions category [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF].

Techniques in the data abstraction class generate hypotheses by checking the data in the inferred history to determine the complex storage location types that could be relevant. These are singular and testable hypotheses that can be refuted by comparing the range of each attribute to the attribute value defined by the previous complex state event system capability technique. The Duhem-Quine dilemma again looms when the data in the inferred history can support multiple complex storage types.

Hypotheses produced using the data materialization class are similar to those discussed above.

Unlike the scenarios involving complex storage locations, lower-level events can only be part of one complex event for a specific inferred history. Grounded and testable hypotheses can be formulated in such scenarios unless there are multiple lower-level events, in which case, a new inferred history is created. Thus, an inferred history represents an investigator's assumptions about the events in an incident. If inconsistencies arise, an alternative inferred history must be identified. For the given inferred history, however, singular, specifiable and grounded hypotheses are formulated using the descriptions of lower-level events. A technique in the event abstraction class is used to refute a hypothesis about the complex events when lower-level events for the same time are defined in the inferred history, but are not caused by the event that is the focus of the hypothesis.

The techniques belonging to the final event materialization class are not used to formulate hypotheses. Instead, they are used to refute primitive or complex event hypotheses in cases where a higher-level event existed at the same time T , but was not causally related to the lowerlevel event stated in the (refuted) hypothesis.

Bunge's Classification

Bunge's classification scheme for scientific hypotheses [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF], which has been used in the previous section as the science-philosophical basis of the present analysis of Carrier's work, is extremely thorough, fine-grained and subtle. Many of Bunge's categories are especially relevant to thein Windelband's terms -nomothetic [START_REF] Windelband | History and natural science[END_REF] sciences, in which hypotheses serve the highest purpose in formulating general scientific laws (e.g., Einstein's E = mc 2 in theoretical physics) or quasi-general statistical laws or hypotheses (e.g., smoking causes cancer in the domain of medical science).

In digital forensics, the situations in which hypotheses are formulated are usually fundamentally different in that the general epistemic interest of digital forensics is typically not nomothetic. Digital forensic profes-sionals are not interested in proposing general law-like hypotheses such as E = mc 2 . Instead, they are primarily interested in finding out what has happened and when and why in historically unique and hardly generalizable situations. In Windelband's terms [START_REF] Windelband | History and natural science[END_REF], digital forensics is thus idiographic rather than nomothetic.

As far as Bunge's classification scheme is concerned, it is not surprising that the specific and individual fact-referent classes of hypotheses occur most frequently in Carrier's framework. Digital forensics shares these idiographic characteristics with the science of software testing, in which (too) only specific hypotheses about a given system under test are formulated [START_REF] Angius | The problem of justification of empirical hypotheses in software testing[END_REF]. Most relevant to digital forensics is Bunge's classification of hypotheses with regard to their testability. These include [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF]:

Empirically untestable hypotheses

Purely confirmable hypotheses

Purely refutable hypotheses

Both confirmable and refutable hypotheses Also relevant is Bunge's classification of hypotheses with respect to their pragmatic functions [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF]:

Generalizers of past experiences

Case-specific inference starters

Programmatic research guides

Explanatory hypotheses

Ad hoc protectors of other hypotheses

From this point of view, the degree of scientificness of every discipline increases with its amount of confirmable and refutable explanatory hypotheses.

In this context, however, it must be noted that Bunge emphasized that truth and scientificness are not synonyms: let H = H s H n be a disjoint union of scientific and non-scientific hypotheses, and let I : H → IB be a Boolean interpretation of the hypotheses. Then, it is possible for two hypotheses that I(h) = t and I(h ′ ) = f with h ∈ H n and h ′ ∈ H s . The pragmatic implications to digital forensics are obvious. Indeed, this is a very important, but often forgotten, issue.

Similarly, the manner by which a hypothesis comes into existence is not relevant to the scientificness of the hypothesis. Accordingly, Bunge's scientificness criteria for hypotheses [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF] are not genealogical criteria. In other words, even the most sophisticated scholarly method could generate non-scientific hypotheses and even the proverbial "random monkey" could generate a hypothesis that formally satisfies all the criteria of scientificness.

Limitations of the Study

Carrier's methodological framework is normative rather than descriptive. Carrier provides guidelines to digital forensic practitioners about the types of hypotheses that ought to be formulated, as well as about the types of objects about which the hypotheses ought to be formulated during the course of forensic investigations. Of course, what is actually done "in the field" by digital forensic practitioners is quite a different question, one which this study has not addressed. Because Carrier's normative methodological work resides in an intermediate layer between the science-philosophical analysis discussed here and digital forensic practice, it is not possible to judge the actual degree of scientificness of the digital forensics discipline by assessing Carrier's meta-work about the discipline from the elevated meta-meta-level as engaged in this study. By analogy, it is also not possible to make a judgment about the discipline of physics -in the way it is carried out by physicists in their laboratories -by critiquing Karl Popper's or Hans Reichenbach's philosophies of physics as "scapegoats." This is because Popper and Reichenbach might have been mistaken in their own interpretations of the discipline of physics in such as way that any anti-Popper or anti-Reichenbach critique no longer strikes the actual physicists working in their laboratories.

This distance from the actual usage of hypotheses in the daily practice of digital forensics is clearly a clear shortcoming of the present study. As mentioned below, the present study could have been strengthened by an analysis of how hypotheses are actually formulated and used by practitioners in the field. This would have provided deeper insights into the actual state of scientificness of the digital forensics discipline. Alas, such a field study would have been too difficult to conduct with the available resources. Therefore, Carrier's work was chosen as a pars pro toto substitute.

Thus, only if (or so far as) the field behaves according to Carrier's normative prescriptions is the preceding analysis of Carrier's work by implication also an analysis of the field. If, however, Carrier's notions and the practice of the field are disjoint, then the above meta-metastudy about a meta-study can only be -in Bunge's terms -of program-matic character to motivate further meta-scientific and methodological research.

Conclusions

Hypotheses that have been tested and strongly corroborated over time eventually develop into scientific theories, which are (semantically) tightly connected networks of hypotheses [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF]. The development of a scientific theory, however, is not the goal of digital forensic practitioners who formulate hypotheses specifically about the cases they investigate. Nevertheless, case-specific hypotheses must also, according to Bunge [START_REF] Bunge | Philosophy of Science: From Problem to Theory[END_REF], be theoretically embedded (grounded), for example in theories of computer science or computer engineering [START_REF] Gladyshev | Formalizing Event Reconstruction in Digital Investigations[END_REF].

As far as the scientificness of the notion of hypothesis is concerned -which is not to be confused with the truth of an individual hypothesis -Carrier's work does not strongly contrast with Bunge's scientificness criteria for formulating hypotheses. By and large -although not philosophically-systematically -Carrier's guidelines have indeed taken into account established criteria such as well-definedness and testability.

At this point, it is important to distinguish -again -between science and practice. To count as scientific, a hypothesis must be, in principle, testable (regardless of whether or not it has actually been tested). For practical use, such as in digital forensics, a hypothesis should actually be tested too (which implies its testability). Thus, when Carrier recommends that digital forensic practitioners should sometimes assume some hypotheses to be true in order to get on with their investigations, he does not leave the territory of scientificness as long as the preliminary assumptions are testable in principle. Whether they are actually true or not is not a matter of their scientificness.

A few minor issues can be found in Carrier's framework because it was developed for practical and not philosophical purposes. An example is the somewhat vague conceptual separation between the notions of data, fact and hypothesis in his primitive storage system configuration category.

Due to Carrier's focus on the discipline of digital forensics, the types of hypotheses mentioned in his guidelines are typically singular (casespecific) and often probabilistic (in Bunge's terms), which clearly indicates the idiographic character (in Windelband's terms) of the discipline. While singular hypotheses are often in danger of being too isolated (or ad hoc) with regard to embedding theories (and are, thus, deficient in their explanatory power), probabilistic hypotheses do not only have their notorious testability issues with regard to corroboration or refutation by single instances of observation, but also depend on an often unclarified (i.e., intuitive) notion of probability. Nomothetic hypotheses of high generality and deep (law-like) explanatory power are not prominent in Carrier's work: this is a feature of the digital forensics discipline and is thus certainly not Carrier's fault.

What Carrier has conducted, in contrast with Bunge, is not a classification of the types of hypotheses that may be formulated during digital forensic investigations. Rather, Carrier has systematically partitioned the domain of digital forensic investigations into sub-domains and describes rather informally the material subjects about which hypotheses have to be formulated within the boundaries of the sub-domains. From a methodological point of view, Carrier's work thus provides the digital forensics community with a domain theory -the importance of which must not be underestimated [START_REF] Bjorner | Domain theory: Practice and theories, discussion of possible research topics[END_REF] -instead of a type theory of hypotheses. Thereby, from a type-theoretic point of view, the types of hypotheses in Carrier's domains and sub-domains are more or less the same. Furthermore, whereas the methods that Carrier recommends for generating hypotheses are interesting in practice, they are not relevant to the scientificness of the generated hypotheses because scientificness is not a matter of genealogy.

As far as future work is concerned, additional empirical and theoretical research on the concept of hypothesis in digital forensics needs to be conducted. The empirical research should focus on how hypotheses are actually formulated and applied by practitioners in their field work regardless of Carrier's normative stipulations at his methodological metalevel. The theoretical research should attempt to clarify formally how hypotheses can be chained to construct logically-consistent discursive arguments used in forensic reasoning. Both these research efforts might benefit from the improvement and refinement of the domain-theoretic work [START_REF] Bjorner | Domain theory: Practice and theories, discussion of possible research topics[END_REF] initiated by Carrier in [START_REF] Carrier | A Hypothesis-Based Approach to Digital Forensic Investigations[END_REF], including the formal mereological [START_REF] Luschei | The Logical Systems of Lesniewski[END_REF] considerations at the basis of domain theory.

Acknowledgement

The authors wish to thank the anonymous reviewers and the conference participants for their critical remarks that have helped improve this chapter.


Oluwasayo Oyelami

Martin Olivier

USING YIN'S APPROACH TO CASE STUDIES AS A PARADIGM FOR CONDUCTING EXAMINATIONS

Keywords: Digital forensic science, digital evidence, examination, case study

d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Forensic science is an intriguing discipline. It epitomizes the relationship between science and law and the complexities of these two fields working together towards the same goal. The goal is to ensure that the innocent remains free and that the guilty is convicted [11,12].

In an adversarial system, each party must state its case by presenting evidence or expert testimony that supports its assertions and may also refute the opposing party's assertions [11]. To succeed in a legal dispute, the goal of each disputing party is to convince the court to make a


Dae Glendowne

Cody Miller

Wesley Mcgrew

David Dampier

CHARACTERISTICS OF MALICIOUS DLLS IN WINDOWS MEMORY

Keywords: Malware, DLL injection, memory analysis

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Malware manifests itself in a variety of forms in Windows systems depending on the malware authors' needs and capabilities. For example, malware may run as its own process, as code injected into another process, as a service or as a driver. New techniques for executing malicious software in Windows systems arise occasionally, designed by malware authors in order to subvert detection and analysis. Each form of mal-ware has its own characteristics that distinguish it from others and each generates a different set of artifacts that may be used for detection.

Code injection describes any situation where malicious software might copy code to the memory space of an existing legitimate process, with the goal of executing the code either immediately or as part of a "hook" placed in the target process. Dynamic link library (DLL) injection is a form of code injection that inserts a malicious DLL into a separate legitimate process [START_REF] Hale Ligh | The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux and Mac Memory[END_REF]. The DLL may be loaded directly at runtime or it could be loaded automatically the next time a process executes. This chapter focuses on malware that performs DLL injection to accomplish its goals.

Malware authors implement DLL injection for two primary reasons. First, injection provides a level of stealth to malware code as it executes; any actions taken by the DLL appear to originate from the process. Second, it grants malware the execution context of the "container" process. This allows malware to utilize system resources with the privileges of the host process such as the filesystem, registry and network access. If a botnet client needs to contact its command and control server, it may inject a DLL into a web browser to bypass host-level, process-specific firewalls that might otherwise block access.

This chapter explores the characteristics of malicious DLLs in Windows 7 x86 memory images. This is accomplished by executing malware samples in a sandboxed environment and acquiring memory. Volatility is used to extract features associated with a DLL sample, such as the host process, load path, base address and load count [START_REF]Volatility[END_REF]. These features are analyzed to identify behavioral patterns in injected DLLs. Identifying these patterns serves two purposes. First, the patterns contribute to the general knowledge of malicious behavior in memory and can be used by forensic examiners as heuristics to aid in identifying malicious injected DLLs in Windows 7 memory images. Second, the patterns define characteristics of malicious injected DLLs that can help distinguish between malicious and legitimate DLLs. Distinctive behavioral patterns are necessary for machine learning to produce a robust model for reliably classifying new data. Machine learning has previously been used to classify malicious PE (portable executable) files using static and dynamic features [START_REF] Shabtai | Detection of malicious code by applying machine learning classifiers on static features: A state-of-the-art survey[END_REF]. Preliminary analysis reveals that it is also viable for classifying malware in Windows memory images.

This research makes two principal contributions. The first is a procedure for generating and processing large quantities of infected memory images to identify injected DLLs. The second contribution is the extraction of behavioral information drawn from the data as it relates to malicious and legitimate DLLs in a system.

Motivation

Several challenges are associated with identifying the use of malicious DLLs by a process. The use of legitimate DLLs by a process may make it more difficult to identify malicious DLL use. The variety of techniques used to inject malicious code, including DLLs, further increases the difficulty. This research address the complex and dynamic nature of DLL usage to identify DLLs in memory images that are considered to be malicious.

Runtime dynamic linking occurs when a DLL is loaded at runtime by a process or another DLL. A DLL loaded in this manner provides some required functionality and may be unloaded shortly after the requirement is met or it may persist within the process. Legitimate software that provides plug-in or add-on interfaces frequently uses this capability [START_REF] Shewmaker | Analyzing DLL injection[END_REF]. This leads to discrepancies in the DLLs loaded by a process based on the point in time at which its DLL list is examined.

Malware may be injected as a DLL into a running process by utilizing the same system code that is used to load legitimate runtime DLLs. The use of an identical loading mechanism enables malicious DLLs to better blend in with their legitimate counterparts. Many of the artifacts generated by this loading process are the same as, or at least not significantly different from, other legitimate DLL loading artifacts.

Related Work

While this work focuses on the effective identification of DLL injection events during dynamic analysis, a body of research covers the more general problem of detecting malware in memory. The Blacksheep rootkit detector [START_REF] Bianchi | Blacksheep: Detecting compromised hosts in homogeneous crowds[END_REF], for example, compares memory images from multiple systems to perform a variety of analyses. Blacksheep compares the loaded kernel modules between memory images as well as the code in the kernel space itself. Kernel data structures and entry points to kernel code are also checked for differences. After the comparison procedure, memory images are clustered based on their combined distances from each other based on the comparison features.

Mandiant's Memoryze [START_REF] Mandiant | Find evil in live memory, Alexandria, Virginia[END_REF], when incorporated as a part of the Redline investigation tool, can be used to scan memory images and apply heuristics to assign scores to objects in memory that could be malicious. Other commercial products, such as Malwarebytes [START_REF] Arntz | Memory scan, Malwarebytes Unpacked, Official Security Blog, Malwarebytes[END_REF], scan memory in search of malicious software. However, the mechanisms and criteria used by these products are not always transparent and little information is published on the techniques that determine the features used to cluster and identify malicious code.

Gionta et al. [START_REF] Gionta | SEER: Practical memory virus scanning as a service[END_REF] have designed an architecture for memory virus scanning as a service. The architecture allows for the efficient acquisition and scanning of memory in massive virtual environments. In this way, in-depth memory analysis techniques, such as those described in this chapter, can be efficiently used with minimal impact on virtual machine operations.

In the general case, determining if a piece of software would exhibit malicious behavior is undecidable [START_REF] Christodorescu | Semantics-aware malware detection[END_REF]; extensive reverse engineering is typically required to understand the functionality of the underlying code and craft detection signatures. Signature-based scanners are grossly inadequate for detecting sophisticated modern malware [START_REF] Goodin | Antivirus pioneer Symantec declares AV "dead" and "doomed to failure[END_REF]. This has led to the use of machine learning for classifying software as benign or malicious [START_REF] Shabtai | Detection of malicious code by applying machine learning classifiers on static features: A state-of-the-art survey[END_REF]. The research in this area is extensive, but the focus is normally on identifying features in a Windows PE file such as byte n-grams, API calls and opcodes, and using the features to train a classifier. The features listed in this work are based on in-memory structures and the way that observed malware uses the structures. However, there is some overlap with existing research because features are extracted from PE headers in memory.

Test Data Generation

The test data was generated from a set of 33,160 malware samples obtained in 2012 from VirusShare [START_REF] Virusshare | com -Because sharing is caring[END_REF]. The malware samples were subsequently processed by VirusTotal [15]: 97.29% of the samples were labeled as malicious by ten or more scanners. Additional verification was done using Metascan [START_REF]Metascan Online[END_REF], which labeled 97.16% of the samples as malicious with a minimum detection rate of ten scanners.

The malware samples were then processed using the Cuckoo Sandbox [START_REF] Foundation | Cuckoo Sandbox 1.2[END_REF]. The samples were submitted to a SQLite database where they were queued until they were processed. The Cuckoo host sent each queued sample to a Cuckoo analysis virtual machine running Windows 7 x86 with 512 MB of allocated memory. Since the sandbox does not provide external access to the Internet, INetSim was used to simulate various services; this caused some malware to exhibit additional functionality. The malware was executed in the Cuckoo analysis virtual machine for four minutes while being monitored by the Cuckoo agent, which runs as a Python script in the Cuckoo analysis virtual machine. The data collected about the malware included Windows API calls; network, registry and file interactions; and a memory capture of the system after malware execution. After this data was collected and compressed on disk, the Cuckoo analysis virtual machine was restored to the baseline snapshot and the next piece of malware from the queue was passed to the virtual machine. Figure 1 illustrates the process. Note that the data collected from Cuckoo by processing a piece of malware is referred to as a "cuckoo sample." A total of 33,160 cuckoo samples were generated. While each cuckoo sample contains several types of information related to the execution of a piece of malware, this work focuses on data obtained solely from infected memory images. Volatility [START_REF]Volatility[END_REF] was used to extract DLL artifacts from each memory image. The virtual address descriptor tree was traversed for each process to find nodes containing the mapped files. Artifacts were extracted from data structures associated with each node, including LDR DATA TABLE ENTRY, MM-VAD and EPROCESS. The artifacts were combined to create a data point describing a given DLL.

Data Classification

Each memory image in the dataset had between 615 and 1,645 loaded DLLs. Each of these DLL data points had to be classified before analysis could be performed. A DLL and its host process were classified into one of four categories: Legitimate processes containing legitimate DLLs.

Legitimate processes containing malicious DLLs.

Malicious processes containing legitimate DLLs.

Malicious processes containing malicious DLLs.

A whitelist of all the files was created from the baseline snapshot of the analysis virtual machine. For a given data point, the process and Each memory image contained the same legitimate processes. The processes tended to load the same DLLs across memory images, so using the set of "Legitimate processes containing legitimate DLLs" yielded large sets of repeated DLLs. When a malicious process is executed, it typically loads several system DLLs it requires for execution. These DLLs may not have been loaded by any of the other legitimate processes. Because the focus is on the DLLs and their behavior and appearance in memory, as long as they are legitimate, the nature of the loading process (whether malicious or legitimate) does not affect the analysis.

Injected DLL Characteristics

This section discusses the various characteristics identified in the injected DLLs. The characteristics drawn from the set of injected DLLs were contrasted with those of legitimate DLLs where appropriate. As mentioned above, 33,160 cuckoo samples were generated for the study; 955 of the samples exhibited DLL injection behavior. It is plausible that more samples than the 955 identified performed DLL injection, but they did not in this instance due to the lack of a required resource (e.g., configuration file, Internet connection or installed software).

The analyzed data was split into two subsets. The first subset contained all the injected DLLs and all the legitimate DLLs, 2,385 and 162,567 DLLs, respectively. The second subset contained the unique injected and legitimate DLLs for a given memory image, 1,168 and 152,883 DLLs, respectively. Table 1 shows the dataset distribution.

Target Processes. Malware that injects DLLs must specify a target process to host the malicious code. Figure 2 shows the target processes. In the dataset used in the study, some processes are more common than others. The most common processes targeted for injection were explorer.exe, svchost.exe and taskhost.exe, accounting for more than 52% of injections. Each of these processes always runs on a Windows system and presents a large and/or varied set of DLLs at runtime. For example, explorer.exe had an average of 210 legitimate DLLs loaded at one time, and several instances of svchost.exe and taskhost.exe were typically in execution.

Number of Injections.

A malware sample can choose to inject a DLL into any running process. Injecting DLLs into multiple processes can provide malware with greater survivability and versatility, but it also increases the chances of detection. In the dataset, 955 malware samples injected a DLL into a process. Figure 3 shows the number of injections per malware sample. Sixty percent (573) of the 955 samples targeted a single process while the remaining 40% (382) targeted two or more processes.

Simultaneous Loads. When malware injects a DLL into several processes, it often iterates through the active processes and injects the DLL as it finds its target(s). For malware that loaded into multiple processes, the load time extracted from LDR DATA TABLE ENTRY was examined to see how many DLLs had approximately the same load time. For a given DLL within a memory image, the DLL load time was compared against its load time in all the other processes containing the DLL. For every load time within one second, the simultaneous load value of the DLL was incremented by one [START_REF] Arntz | Memory scan, Malwarebytes Unpacked, Official Security Blog, Malwarebytes[END_REF]. If the DLL appeared in multiple processes, but did not share a load time, then a value of zero (0) was assigned. If a DLL existed only once within an entire memory image, a value of minus one (-1) was assigned. Of the DLLs that existed in more than one process (those with a value of zero (0) or greater), the number of DLLs detected with at least one simultaneous load for injected DLLs was 73.3%. For legitimate DLLs, the corresponding percentage was 45.4%. This shows that malicious DLLs tend to have approximately the same load times whereas the load times of legitimate DLLs are more varied.

Load Position. The InLoadOrderModuleList is a doubly linked list of LDR DATA TABLE ENTRY structures. The list is ordered based on when a DLL was loaded into a process, with the executable occupying the first position. The beginning entries are occupied by dynamically linked DLLs named in the import address table. DLLs loaded at runtime naturally appear at the end of the list. Some loaded DLLs are volatile in that they are loaded and unloaded repeatedly during the lifetime of a process while others are more stable, remaining loaded for longer periods of time.

The load position was calculated for each DLL that existed in the InLoadOrderModuleList. The average load position was calculated for injected and legitimate DLLs. The average load position for all the injected DLLs was 83.7. The average load position for legitimate DLLs was 52.6. Note that the system ran for a short period of time, which may have affected the reliability of the results. Depending on the number of DLLs unloaded by a process, an injected DLL may appear closer to the beginning of the list.

Init Position. Similar to the InLoadOrderModuleList, the InInitial-izationOrderModuleList represents the order in which the DLLMain function of a DLL was executed. The average init position for all the injected DLLs was 87.4. The average init position for legitimate DLLs was 51.3. This result may also be affected by the short execution time of the analysis system.

Base Address. The base address is the virtual address in a process where a DLL is loaded. The default base address for DLLs is 0x10000000. Since a process normally contains multiple DLLs and only one DLL can occupy a given virtual address within a process, many DLLs contain a .reloc section in the PE header that specifies how to translate its offsets. In all, 48% of the unique injected DLLs were loaded at the virtual address 0x10000000; this is in sharp contrast to legitimate system DLLs, for which 99.99% of the DLLs were loaded at an address other than 0x10000000.

Exported Function Count. The number of functions exported by each DLL were extracted and used to calculate the means and modes for the injected and legitimate DLLs. The injected DLLs exported considerably fewer functions on the average, with a mode of 2 and a mean of 13. Legitimate DLLs had a mode of 11 and a mean of 368.

Imported Function Count. The number of functions imported by each DLL were extracted and used to calculate the means and modes for the injected and legitimate DLLs. The mode of each type of DLL was similar with injected DLLs and legitimate DLLs having modes of 213 and 198, respectively. The means for injected DLLs and legitimate DLLs were 115 and 257, respectively.

Loaded from Temp.

A common heuristic when looking for malware is searching binaries loaded from a temporary directory such as %TEMP% (C:\Users\UserName\AppData\Local\Temp). In all, 20% of the unique injected DLLs were loaded from a directory with temp in the path. Nearly all of these were from %TEMP%, but a small number were from the directories C:\temp or C:\Windows\temp. Load Paths. Figure 4 shows the most common load paths for injected legitimate DLLs. In the case of legitimate DLLs, 97% were loaded from C:\Windows\System32 or C:\Windows\System32\en-us. COM Server. The Component Object Model (COM) is an interface standard used in the Windows operating system. It enables software to call code hosted by other software components without in-depth knowledge of its implementation. The calling component is the client and the hosting component is the server. Malware writers sometimes leverage the COM infrastructure to implement malicious code [START_REF] Sikorski | Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software[END_REF]. A COM server is required to export at least two Windows API functions: DllGetClassObject [START_REF]Microsoft, Windows API and Reference Catalog[END_REF] and DllCanUnloadNow [START_REF]Microsoft, Windows API and Reference Catalog[END_REF]. If these two API calls are seen in the exports of a DLL, then it is considered to be a COM server. Only 5.2% of the unique injected DLLs were implemented as COM servers.

COM Client. Windows binaries can call COM objects as clients. In order to use COM objects, the binary must call the OleInitialize [START_REF]Microsoft, Windows API and Reference Catalog[END_REF] or CoInitializeEx [START_REF]Microsoft, Windows API and Reference Catalog[END_REF] functions. DLLs importing either of these functions were considered to be COM clients. Only 2.1% of the unique injected DLLs in the dataset were capable of calling COM objects.

Threats to Validity

Certain issues have to be accounted for in the generation process. The analysis described above was restricted to a specific Windows operating system version on a single architecture. While all versions of Windows share the same general linking and loading procedures, the details of the mechanism can change over time and across architectures. In the case of "user-land" malware, the details of the mechanism may not impact the results for newer versions of the operating system, but the behavior of malware that operates with elevated privileges may vary. This may be countered in future work by performing the data gathering and processing on multiple virtual machines with different operating system versions. The manner in which the resulting data is stored may have to be restructured to account for multiple DLL datasets for the different circumstances under which malware was executed.

Another issue is that the behavior of malicious software (and nonmalicious software in the sandbox virtual machine) may vary based on the availability and status of the environmental resources and settings. Malware may choose not to act unless it determines that it can establish a "real" connection to a command and control server across the public Internet. It may choose not to inject DLLs into other processes unless it can detect the presence of email servers, active directory services or network shares. This would impact the ability to gather adequate DLL data, although it could be resolved by improving the fidelity and capability of virtual sandbox environments.

No additional software was installed on the system beyond the base installation. The legitimate DLLs referenced in this work are all Windows system DLLs. The behavior of third-party application DLLs may differ from that of the Windows system DLLs.

Conclusions

The research described in this chapter generated Windows 7 x86 memory images for 33,160 malware samples obtained from VirusShare. The malware samples were executed in Cuckoo Sandbox, a sandboxed dynamic analysis environment. The memory images were processed using Volatility to extract several artifacts associated with DLLs. DLLs that had been injected into legitimate processes were identified. From among the 33,160 cuckoo samples that were generated, 955 samples injected a total of 2,385 (1,168 unique) DLLs into legitimate processes. There were also 162,567 (152,883 unique) legitimate DLLs in the dataset. Analysis of this data revealed several characteristics of malicious injected DLLs and legitimate Windows DLLs. The characteristics contribute to the understanding of malicious DLLs and can be applied as heuristics to assist in identifying malware in Windows memory images. Additionally, they demonstrate the applicability of machine learning to the identification of malicious DLLs in Windows memory images. Future research will examine other forms of in-memory malware such as processes and drivers. The research will employ a similar methodology to identify characteristics that can assist in distinguishing malicious processes and drivers from their benign counterparts. The characteristics presented in this work will be used to build a feature set for training a machine learning classifier to identify malicious DLLs in memory. Feature selection algorithms will be applied to determine the most useful features and the resulting feature set will be evaluated using a variety of algorithms.

Figure 3 .

 3 Figure 3. Number of injections per malware sample.

Figure 4 .

 4 Figure 4. Malicious load paths.

Table 1 .

 1 Dataset distribution.DLL were compared against the whitelist to determine the classification. Injected DLLs refers to DLLs categorized as "Legitimate processes containing malicious DLLs." Legitimate DLLs refers to either "Legitimate processes containing legitimate DLLs" or "Malicious processes containing legitimate DLLs." This work has opted to use the latter category because it provides a greater variety of legitimate DLLs than the former.

		All	Unique
	Injected DLLs	2,385	1,168
	Legitimate DLLs 162,567	152,883

Acknowledgement

The authors wish to thank Puntitra Sawadpong for her assistance in formatting and proofreading this chapter.


Laurent Reynaud
email: laurent.reynaud@orange.com

Isabelle Guérin-Lassous
email: isabelle.guerin-lassous@ens-lyon.fr

Improving the performance of challenged networks with controlled mobility

Keywords: Controlled mobility, virtual forces, MANET, challenged networks, DTN, unmanned aerial vehicles, disaster communications

In this work, we investigate the application of an adapted controlled mobility strategy on self-propelling nodes, which could efficiently provide network resource to users scattered on a designated area. We design a virtual force-based controlled mobility scheme, named VFPc, and evaluate its ability to be jointly used with a dual packetforwarding and epidemic routing protocol. In particular, we study the possibility for end-users to achieve synchronous communications at given times of the considered scenarios. On this basis, we study the delay distribution for such user traffic and show the advantages of VFPc compared to other packet-forwarding and packet-replication schemes, and highlight that VFPc-enabled applications could take benefit of both schemes to yield a better user experience, despite challenging network conditions.

Introduction

Over the last 15 years, the notion of ubiquitous network access got closer to reality. As an illustration, by that time, the worldwide Internet penetration rate has grown 7 times, reaching 43% in 2015 [START_REF] Sanou | ICT Facts and Figures 2015[END_REF]. Yet, this encouraging key performance indicator should not conceal the acute challenges still posed by the current need to greatly improve access to network infrastructure in many unconnected or ill-connected territories. Although the reasons for this imperfect network coverage may differ, with various issues and constraints met in either rural areas, remote zones or emerging countries, alternate communication resources need to be deployed on site to grant network access. A similar problem arises in the case of disasters which may leave the existing networks impaired at a time when communications are greatly needed by the rescue, response and restoration teams. To this end, various rapid deployment communication systems were proposed, often relying on different types of terrestrial, aerial and satellite network segments [START_REF] Nelson | The Evolution of Hastily Formed Networks for Disaster Response: Technologies, Case Studies, and Future Trends[END_REF]. Moreover, the principles of Mobile Ad Hoc Networks (MANETs) [START_REF] Corson | Mobile Ad hoc Networking (MANET): Routing Protocol Performance Issues and Evaluation Considerations[END_REF] have often been adopted in these contexts [START_REF] Reina | A Survey on Multihop Ad Hoc Networks for Disaster Response Scenarios[END_REF], since they can forgo the time-consuming, staff-demanding and potentially costly roll-out of a surrogate cellular network infrastructure. Further, MANETs allow devices to form temporary and self-organized networks in dynamic topologies, where multi-hop communications are used to extend the inherently limited range of wireless transmissions. Yet, in the context of challenged networks [START_REF] Fall | A Delay-Tolerant Network Architecture for Challenged Internets[END_REF] with high node mobility, low node density and other detrimental issues, the performance of MANETs can be severely hindered by the scarcity of network connectivity and subsequent link disruptions, which in turn increase packet losses [START_REF] Sassatelli | Reliable Transport in Delay-Tolerant Networks With Opportunistic Routing[END_REF]. In contrast, Delay/Disruption Tolerant Network (DTN) techniques were designed to handle packet delivery in case of intermittent connectivity found in challenged networks. Moreover, while MANETs use synchronous routing schemes based on the determination of an end-to-end path, DTN schemes on the other hand rely on the asynchronous store-carry-and-forward principles [START_REF] Li | Delay-Tolerant Network Protocol Testing and Evaluation[END_REF] wherein a network node buffers and carries incoming packets as it moves. Further, among the proposed DTN routing strategies, two specific directions were abundantly explored:

-Packet-forwarding, which, often combined with modified synchronous protocols to support longer delays (e.g. Deep-Space Transport Protocol (DS-TP) or TP-Planet [START_REF] Sassatelli | Reliable Transport in Delay-Tolerant Networks With Opportunistic Routing[END_REF]), allows better packet delivery with respect to MANET performance.

-Epidemic approaches enable a node to transmit copies of incoming packets to nodes it gets in contact with. As a result, multiple replications of a specific packet may exist in the network at the same time, increasing the chances for this packet to reach its destination. Yet, a systematic packet replication at each contact opportunity incurs a significant resource consumption. As a result, several solutions (e.g. MaxProp [START_REF] Burgess | MaxProp: Routing for vehiclebased disruption-tolerant networks[END_REF], RAPID [START_REF] Balasubramanian | DTN Routing as a Resource Allocation Problem[END_REF] and Spray and Wait [START_REF] Spyropoulos | Spray and Wait: An Efficient Routing Scheme for Intermittently Connected Mobile Networks[END_REF]) were proposed to keep packet replication as low as possible.

In this regard, due to the unpredictable nature of most intermittently connected networks, traditional DTN schemes fail to fully ensure consistent network performance gains with respect to multiple key routing metrics such as packet delivery, delay, overhead and resource consumption. This observation has been referred to as the incidental effect [START_REF] Balasubramanian | DTN Routing as a Resource Allocation Problem[END_REF] of existing DTN schemes. To overcome this limitation, the concept of controlled mobility [START_REF] Zhao | Controlling the mobility of multiple data transport ferries in a delay-tolerant network[END_REF] has recently been explored, bringing a new perspective on network node mobility, which was until then mainly considered as an unavoidable nuisance requiring mitigation. In contrast, controlled mobility enforces deployed network protocols with the ability to put nodes in motion and direct them where they can help increase the overall network performance. Some forms of controlled mobility mechanisms have been notably studied in the context of DTNs, where specific nodes may be used as message ferries to enhance connectivity in networks with sparsely deployed nodes [START_REF] Zhao | Controlling the mobility of multiple data transport ferries in a delay-tolerant network[END_REF]. Likewise, wireless sensor networks may benefit from data sinks with controlled mobility for various performance aspects, such as network lifetime increase [START_REF] Basagni | Controlled sink mobility for prolonging wireless sensor networks lifetime[END_REF]. In this work, we particularly focus on swarming principles, a distributed form of controlled mobility for which local node interaction can engender desirable emergent behaviors [START_REF] Brambilla | Swarm robotics: a review from the swarm engineering perspective[END_REF]. In effect, swarming mechanisms give network nodes the ability to cooperatively readjust their movements thanks to the exchange of local information and to collectively achieve a given spatial organization. In this regard, although swarming mechanisms generally require a large number of mo-bile nodes to complete pattern formations such as grids and lattices [START_REF] Spears | Distributed, Physics-Based Control of Swarms of Vehicles[END_REF], specific strategies can achieve chain formations with a limited number of nodes, which is a useful property in network deployments, where the number of nodes is often constrained. Thus, several works studied chain formations with probabilistic finite state machine [START_REF] Nouyan | Path formation in a robot swarm: selforganized strategies to find your way home[END_REF] and evolutionary robotics techniques [START_REF] Sperati | Self-organised path formation in a swarm of robots[END_REF].

In our previous studies, we investigated a third approach, for which local information exchange is based on virtual force principles [START_REF] Reynaud | Design of a force-based controlled mobility on aerial vehicles for pest management[END_REF], [START_REF] Reynaud | Physics-Based Swarm Intelligence for Disaster Relief Communications[END_REF]. We notably presented in [START_REF] Reynaud | Physics-Based Swarm Intelligence for Disaster Relief Communications[END_REF] the Virtual Force Protocol (VFP), allowing mobile nodes, and in particular unmanned aerial vehicles (UAVs), to form communication chains and provide network connectivity in the context of disaster relief operations. We assessed VFP performance and notably showed that a peak efficiency was obtained with a limited set of nodes, which confirmed its interest in network deployments where the number of nodes is constrained. Yet, the performance gain from the use of a simple MANET protocol to a joint use of MANET and VFP, however significant, could not exceed a relatively low threshold of about 40%, in terms of Packet Delivery Ratio (PDR).

In this work, we seek to overcome this PDR limitation while keeping endto-end delays as low as possible. To this end, our main contribution can be summarized as follows: we give our VFP-based strategy, which we here name VFPc, the ability to work jointly with a DTN epidemic scheme, with the objective to thoroughly improve packet delivery. We also design a cross-layer framework that allows switching from packet-replication to packet forwarding (and reciprocally), based on the context given by VFPc to the upper layer routing components, in terms of whether a VFP communication chain is established or not. That way, end-users can benefit from synchronous communications when a VFP chain connects the traffic endpoints. Otherwise, the network autonomously falls back to asynchronous communications. The rest of this paper is organized as follows: Section 2 presents the disaster relief scenario which gives the context of this study. Section 3 details the design choices made for our VFPc strategy and other schemes used as comparison references. The performance of VFPc is then evaluated along with the other schemes, in terms of PDR and end-to-end delay, in Section 4, and we finally conclude in Section 5.

Scenario

In the context of this study, we envision a scenario where a rapid deployment communication system is required to provide network coverage on a zone Z e where network access is non-existent or temporarily impaired. To this end, our system encompasses the following nodes, as illustrated by Fig. 1: -Traffic nodes are regular end-user devices which, like the other nodes, support the VFPc scheme in order to cooperate with the rest of the network. Two such nodes are assumed to move randomly within Z e , respectively acting as source and destination of all user traffic during the considered case flow.

-Survey nodes explore Z e , exchange information with other nodes in radio range and store their location for future use and dissemination in the network.

Survey nodes

Traffic node

Relay nodes Fig. 1. A representative network deployment in the considered scenario.

-Relay nodes are initially survey nodes which change their function at given times to become part the set of intermediate nodes in the multihop communication chain between the traffic nodes. When not needed anymore in the chain, relay nodes revert to their former survey type.

VFP Protocol design

A force-based system

Our VFPc scheme implements a virtual force-based distributed system, VFP [START_REF] Reynaud | Design of a force-based controlled mobility on aerial vehicles for pest management[END_REF], [START_REF] Reynaud | Physics-Based Swarm Intelligence for Disaster Relief Communications[END_REF], which is used to control node mobility so as to create and maintain a wireless multi-hop communication chain between any traffic (source, destination) pair. Further, VFP defines a beacon message which is regularly broadcast 1-hop away by each node in the network. VFP beacons contain various information such as the emitting node coordinates and velocity vector, whether it belongs to a communication chain and in that case which intermediate nodes are preceding and following in the chain. It additionally encompasses a list of nodes previously discovered, also with relevant information. This local distribution of information is a pivotal mechanism for network nodes to quantify the forces exerted by neighboring nodes, reassess their own subsequent acceleration and velocity vectors, move accordingly, and take part to the relay node election process [START_REF] Reynaud | Physics-Based Swarm Intelligence for Disaster Relief Communications[END_REF]. As illustrated by Fig. 2 (left), relay nodes in a communication chain (nodes P and N in the given example) are subjected to interaction and alignment forces. To calculate both forces, nodes use received VFP beacon information differently:

-Interaction forces [START_REF] Reynaud | Design of a force-based controlled mobility on aerial vehicles for pest management[END_REF], which encompass three repulsive, friction and attractive components, are exerted by the node's predecessor in the chain (i.e. N and P are subjected to interaction forces from respectively P and S in the given example). Depending on the distance with its predecessor, a node can be located in a virtual repulsion, friction or attraction zone, delineated by the red, grey and green areas in Fig. 2 (right). In this study, we select a repulsion-attraction intensity profile such that f ra = I in the repulsion zone, f ra = -I in the attraction zone and f ra = 0 elsewhere. Further, the repulsion-attraction force is used to move the node within a given relative distance from its predecessor, while the friction force f fr enables smooth decelerations and allows avoiding undesirable oscillating movement effects [START_REF] Reynaud | Design of a force-based controlled mobility on aerial vehicles for pest management[END_REF]. These forces are calculated on the basis of 1-hop information received from the predecessor's beacons.

-In contrast, alignment forces [START_REF] Reynaud | Physics-Based Swarm Intelligence for Disaster Relief Communications[END_REF] can be calculated by a relay node as soon as it learns the position of the traffic source and destination nodes (S and D in the example of Fig. 2). This force steers relay nodes towards line (SD), and ultimately tends to generate a straight line topology for the communication chain. In the example of Fig. 2 (right), the alignment force f a tends to steer N towards its projection N p on line (SD). If N p was closer from P p to S, f a would be directed towards the symmetric point of N p about P p on (SD). That way, the alignment force also helps reordering chains if a relay node is not correctly located with respect to its predecessor and successor in the chain.

A cross-layer framework

Figure 3 gives an architectural representation of the dual routing stack made of a packet-forwarding scheme (the synchronous stack) and a packet-replication scheme (the asynchronous stack) hosted on each node. It also outlines how three VFP entities interact with the other main components involved both in network traffic transmission as well as in node mobility control:

-The mobility controller retrieves information such as coordinates and velocity vectors from the node Inertial Measurement Unit (IMU) and various sensors via the Autopilot application. This entity also performs the calculation of the force system exerted on the node based on available local information and sends the Autopilot the updated measures (e.g. under the form of a velocity vector or a waypoint).

-The link manager is in charge to periodically build and emit VFP beacons as well as receive and store beacons from neighboring nodes. As shown by the blue arrows, VFP beacons only rely on 1-hop broadcasts provided by the synchronous scheme and don't require any DTN persistence.

-The chain manager works together with a selection mechanism (illustrated by the red arrows in Fig. 3) which allows triggering the relevant routing stack depending on the VFP status of the node: if this later does not belong to an established VFP chain whose destination matches the considered user traffic destination, then the corresponding packets are handled by the DTN-based asynchronous stack. Otherwise, it is known the node has an available multi-hop route via its successor in the chain to the destination and the selection mechanism lets the synchronous stack handle packet forwarding on a hop-by-hop basis.

Implementation aspects

Although the outlined framework may allow the use of multiple routing schemes, specific deployment choices were required to allow a rigorous performance evaluation of VFPc. Because of its well-documented properties, the epidemic protocol [START_REF] Alenazi | Epidemic routing protocol implementation in ns-3[END_REF] was therefore selected for deployment as packet-replication scheme within the cross-layer framework. This DTN protocol exhibits a simple opportunistic flooding-based design, with the use of a dedicated beacon to inform nodes of contact opportunities with neighboring nodes, as well as of another specific mechanism, the summary vector exchange, which allows two nodes to exchange their disjoint packets during contacts. Moreover, we implemented the Routing Stack Selector (RSS) shown by Fig. 3 as well as a simple forwarding scheme in the same component. Basically, when an incoming packet needs processing, the component requests the VFP status of the node, and if applicable, the identifier of its successor in the chain. If applicable, the packet is immediately forwarded to the successor. Otherwise, the packet is passed to the epidemic protocol and will be kept into persistent storage for further transmission, when a contact opportunity with a neighboring node arises.

On this basis, we designed seven routing strategies, as Fig. 4 shows. The first six schemes only partially use our framework components. The RWP1 scheme exclusively relies on Random Waypoint Mobility (RWP) and not on virtual forcebased controlled mobility. Besides, it only supports a MANET forwarding-based routing. We also study two other RWP-based schemes which on the opposite only support the epidemic protocol: while RWP2 uses a regular epidemic stack with default values, RWP2-op lowers the period of packet list exchange between two neighboring nodes by setting HostRecentP eriod = 1 s (instead of 10 s by default) [START_REF] Alenazi | Epidemic routing protocol implementation in ns-3[END_REF]. Hence, the use of this later scheme should incur a faster transmission of epidemic packets during contacts (i.e. when nodes are in direct radio range and able to exchange their list of stored epidemic packets to determine which packets should be transmitted). We also consider the VFP1 scheme, which supports VFP controlled mobility and which relies on a MANET forwarding-based routing, but never on the epidemic routing. As a result, the user traffic in only transmitted when valid end-to-end routes are established and is dropped otherwise. We then implemented two VFP-based schemes which only rely on the epidemic stack: whereas VFP2 uses the epidemic routing with default values, VFP2-op employs optimized values, with the aforementioned expected benefits. The last strategy, VFPc, supports all the features offered by our framework: the VFP component controls node mobility when applicable, and the user traffic is contextually passed to the epidemic or the forwarding scheme, depending on whether the considered node belongs to an established communication chain. It is worth noting that VFPc uses the default epidemic parameter valuation.

4 Performance evaluation

Simulation parameters

The simulation parameters were chosen as closely as possible as those described in our previous work [START_REF] Reynaud | Physics-Based Swarm Intelligence for Disaster Relief Communications[END_REF]. Table I summarizes the values of the key parameters of our simulation setup, which uses the network simulator ns-3.23. The node number, initial positions and mobility patterns are given in Table I. All nodes use IEEE 802.11b/g communication links with High-Rate Direct Sequence Spread Spectrum (HR-DSSS) at 11 Mb/s, whose communication range is set to 100 m and radio propagation is assumed lossless. Moreover, the MANET routing is supported by the Optimized Link State Routing protocol (OLSR) [START_REF] Clausen | RFC3626, Optimized Link State Routing Protocol (OLSR)[END_REF] for the non-crosslayer schemes that use the packet-forwarding stack (i.e. the RWP1 and VFP1 strategies). In contrast and as previously mentioned in Section 3.3, the packet-forwarding component of VFPc relies on a VFP-based simplified hop-by-hop routing. With respect to the force-based controlled mobility, Table I refers to our previous works [START_REF] Reynaud | Design of a force-based controlled mobility on aerial vehicles for pest management[END_REF] and [START_REF] Reynaud | Physics-Based Swarm Intelligence for Disaster Relief Communications[END_REF] which provide a detailed justification of the chosen values for respectively the interaction forces f i and the aligment forces f a . Moreover, the user traffic is modelled with a Constant Bitrate (CBR) flow at 10 Kb/s, which is assumed sufficient in the context of the considered scenario to convey important and potentially delay-tolerant traffic, such as UAV telemetry or payload sensor data. Note that the case of larger bitrates was studied in [START_REF] Reynaud | Design of a force-based controlled mobility on aerial vehicles for pest management[END_REF]. Further, each point of Fig. 5 and Fig. 6-7 is respectively averaged over 2000 and 10000 independent simulations of 900 s each. On that note, errors bars are shown in all figures and are based on a confidence level of 95%.

Results are analyzed in the rest of this section, and are based on two performance metrics: the Packet Delivery Ratio (PDR) relates to the user traffic between both traffic nodes. Then, the end-to-end delay is defined here from source to destination traffic node, for the same user traffic. We additionally examine the Cumulative Distribution Function (CDF) of this delay.

Simulation results

We first took interest in how the considered schemes behave with an increasing number of nodes. We followed a similar approach as taken in our previous study [START_REF] Reynaud | Physics-Based Swarm Intelligence for Disaster Relief Communications[END_REF] regarding the performance of VFP1 and RWP1 with respect to PDR and end-to-end delay, this time using those results as a comparison basis to evaluate the other schemes. Fig. 5 shows the PDR and end-to-end delay of the CBR transmissions between both traffic nodes for all considered schemes, with a varying initial number N of survey nodes in the network, such that 1 ≤ N ≤ 30.

General performance outcomes It can first be observed that both RWP1 and VFP1 exhibit low end-to-end delays (below 15 ms for all values of N ) compared to the other schemes. However, VFP1, with a PDR reaching a maximum of around 35% for 16 ≤ N ≤ 18 , represents a significant improvement over RWP1 and its lower PDR, consistently below 5%. As we detailled in [START_REF] Reynaud | Physics-Based Swarm Intelligence for Disaster Relief Communications[END_REF], the low performance of RWP1 can easily be explained by the low node density and the relatively high velocity of the survey nodes, in the range of [START_REF] Sassatelli | Reliable Transport in Delay-Tolerant Networks With Opportunistic Routing[END_REF][START_REF] Balasubramanian | DTN Routing as a Resource Allocation Problem[END_REF] m/s, which goes beyond the regular pedestrian-type speeds found in most MANET deployment scenarios. Likewise, the PDR results of VFP1 are understandably constrained by the unavoidable time needed for the mobile nodes to physically move and the traffic endpoints. We however verified in [START_REF] Reynaud | Physics-Based Swarm Intelligence for Disaster Relief Communications[END_REF] that the performance of VFP1 is close to that of an ideal-theoretic mobility control scheme where node positions would always be known. Consequently, further design improvements of VFP1 based solely on packet-forwarding routing would offer limited perspectives, especially regarding PDR. In contrast with RWP1 and VFP1, the five epidemic-enabled strategies share a sharp improvement in terms of PDR, at the expense of significantly lengthened delays, as Fig. 5 illustrates. In any case, these schemes have an increasing PDR with N and, in this regard, will systematically outperform RWP1 and VFP1 for N > 3.

At this stage, a sharp distinction can also be made between the five epidemicenabled schemes, on both the criteria of PDR and end-to-end delay:

-VFPc, VFP2 and VFP2-op systematically yield better PDR results than RWP2 and RWP2-op for N ≥ 9: for instance, when N = 15, the former set outperforms the latter, in terms of PDR, by 7% to 15%. Figure 6 (left), which shows how PDR evolves with time for N = 15, confirms that the VFP-and-epidemic-based schemes consistently outmatch the RWP-and-epidemic-based strategies at all times. Further, while for N = 30, all PDRs are contained between 96% and 99.5%, VFPc, VFP2 and VFP2-op obviously converge faster and are already above 96% for N ≥ 15. However, for N ≤ 7, RWP2 and RWP2-op always outperform VFPc, VFP2 and VFP2-op regarding PDR. This is easily explained by the fact that low values for N do not allow the VFP-based controlled mobility protocol to successfully establish communication chains. Instead, the VFP-enabled strategies here forms incomplete chains which are not sufficiently long to create an end-to-end path between both user traffic endpoints, and which waste intermediate nodes which could otherwise explore the overall area and opportunistically transmit packets, hereby increasing PDR. Yet, for N > 7, using a VFP controlled mobility protocol starts making more sense than applying a simple RWP mobility scheme to the network nodes.

-With respect to delay, Fig. 5 (right) shows two general trends: first, VFPc, VFP2 and VFP2-op yield lower end-to-end delays for any value of N . In addition, as already observed for PDR, the optimized schemes (i.e. VFP2-op and RWP2op) behave better than their counterpart with default values, which was expected by construction. Moreover, Fig. 6 (right) illustrates how the average end-to-end delays from CBR packets received since the start of the simulation evolves with time, for N = 15. VFPc, VFP2 and VFP2-op clearly exhibit a maximum at simulation time t ≈ 400 s, which corresponds, for the considered scenario, to the statistical time at which the VFP-based communication chain is established, and packets can be transmitted along the multi-hop path formed by the relay nodes. Subsequent CBR packets are then likely to reach their destination endpoint with significantly lower delays, decreasing the average end-to-end delay accordingly. Instead, the average end-to-end delays of RWP2 and RWP2-op never decrease with time. At the end of the total simulation time, this delay reaches a steady point with RWP2-op while it still increases with RWP2.

Performance of VFPc

The specific case of the full-featured, dual routing stack, VFPc, is now singled out and analyzed. Although VFPc uses the epidemic stack with default parameter values, its PDR results are however almost identical to that of the optimized VFP2-op, as Fig. 5 (left) and Fig. 6 (left) illustrate. The same can be said in terms of mean delays, as shown by Fig. 5 (right). Fig. 6 (right) shows that VFP2-op slightly outperforms VFPc during a part of the simulation, although the average delays of both schemes eventually match. As a result, both schemes exhibit a comparable performance in terms of PDR and mean delay, although VFPc has a more frugal behavior regarding overhead, thanks to the use of default epidemic parameter values which generates less control messages.

Furthermore, an in-depth study of the delay distributions reveals a solid argument, besides epidemic control message overhead mitigation, to consider the use of VFPc. Figure 7 displays the CDF of the end-to-end delays related to the CBR traffic for all epidemic schemes. The RWP-based schemes yield the longer delays: only 1% and 6% of the CBR packets are respectively received within 1 s when using the RWP2 and RWP2-op schemes. For the VFP-enabled schemes, the distributions significantly vary: while about 56% of CBR packets are received within 7 s when using VFPc or VFP2-op, only 8% of CBR packets are received in that time windows with VFP2. However, almost no packet is received within 100 ms for VFP2-op, versus more than 54% with VFPc. Even more significantly, a dual pattern can be observed from the CDF curve of VFPc: 52% of the user traffic is received synchronously, within 10 ms, through the VFPenabled communication chains, while the rest is received asynchronously, with delays exceeding 1 s, via DTN-based opportunistic exchanges. This confirms the interest of enforcing controlled mobility principles: with VFPc, as much user traffic as possible is received with low delays when the VFP-based topology is fully formed, while the rest is conveyed via packet replication, with longer delays.

Conclusion

In this work, we presented VFPc, a distributed controlled mobility strategy relying on virtual forces, which enables a flock of network nodes to move cooperatively and form multi-hop communication links where needed. The use of VFPc is particularly justified in the context of disaster-relief communications and more generally, rapidly formed networks, which need to provide an efficient network coverage with a reduced set of network equipment. In that regard, we presented the architectural principles of VFPc and a dual routing framework that allows switching from packet-replication to packet forwarding (and reciprocally), based on whether a VFP communication chain is established or not. We then evaluated this strategy via a set of simulations which confirmed that the joint use of the VFP controlled mobility and a dual packet forwarding-replication routing stack yields the best performance in terms of packet delivery and delays, compared to other MANET-or DTN-based schemes. In addition, delay CDF results show that VFPc incurs two distinct communications phases during which the user traffic may be transmitted with very low delays, when VFPc communication chains are established, or with more elastic delays otherwise. An application aware of the times at which it enters synchronous or asynchronous modes may offer new perspectives in terms of user experience despite challenging network conditions. In the future, we plan to implement VFPc and its routing framework on a swarm of UAVs and further assess VFPc performance via experimentation.

Fig. 2 .

 2 Fig.2. Principles of virtual forces applied on nodes P and N in a communication chain, (right) detailed forces on N (note that friction ffr is non-existent in this case).

Fig. 3 .

 3 Fig. 3. Representation of the cross-layer framework.

ForwardingFig. 4 .

 4 Fig. 4. Overview of the implemented schemes, ordered by function support.

Fig. 5 .Fig. 6 .

 56 Fig. 5. PDR (left) and end-to-end delay (right) of the CBR packets received by destination node D, versus the number N of initial survey nodes.

Fig. 7 .

 7 Fig. 7. Cumulative Distribution Function of the end-to-end delays.

Table 1 .

 1 Main simulation parameters Nodes Exploration zone Ze = 1000 m × 1000 m, 2 traffic nodes, N (survey + relay) nodes, N = 15 or 1 ≤ N ≤ 30 Mobility patterns Traffic nodes Position initially uniformly distributed on Ze,

			RWP, velocity ∈ [0.25, 1] m/s
		Survey nodes Position initially at center of Ze,
			RWP, velocity ∈ [5, 10] m/s
		Relay nodes VFP-based mobility, velocity ∈ [0, 10] m/s
	Network	802.11b/g, HR-DSSS at 11 Mb/s, radio range = 100 m
		constant speed propagation delay model
	VFPc protocol	Beacon emission interval = 1 s, interaction forces fra and ffr
		configured as in [14], Alignment force fa valued as in [15].
	Routing	MANET	OLSR with default values [11]
		DTN	Epidemic protocol [12]
	User traffic	CBR bitrate = 10 Kb/s, CBR packet size = 512 B