François-Xavier Aguessy
email: francois-xavier.aguessy@thalesgroup.com

Lucie Gaspard

Olivier Bettan

Vania Conan

Remediating Logical Attack Paths Using Information System Simulated Topologies Category: Specialized

Keywords: logical attack paths, remediation candidates, MulVAL attack graph, simulated topology, remediation costs, remediation database

With the increase of attacks and Information Systems getting ever more complex, security operators need tools to help them protecting critical assets. An attack graph is a model to assess the level of security of an Information System, but it can be used to compute actions that mitigate the modeled threats. In this paper we present a method to remediate the most relevant attack paths extracted from a logical attack graph. In order to help an operator to choose between several remediation candidates, we rank them according to a cost of remediation combining operational and impact costs. We implement this method using MulVAL attack graphs and several publicly available sets of data.

Introduction

Due to the increase in the number and complexity of attacks, any Information System (IS) is vulnerable. Accurately assessing the risk is necessary but can be difficult. An attack graph is a risk analysis model regrouping all the paths an attacker may follow. It is composed of nodes, representing the actions possible for an attacker. Nodes are linked together with edges, representing dependencies between these actions. The main attack paths can be extracted from this graph in accordance to the IS priorities. In this paper we do not take into account the probability of occurrence of the attack path nor the damages it can do on the IS, but rather focus on the computation of remediations to an attack path.

A remediation aims at protecting the IS against an attack path by preventing its fulfillment. The nodes of an attack path not having any incoming edge are the starting points of attacks and are called preconditions. It is possible to offer remediation actions to apply on preconditions to mitigate the vulnerabilities and secure the targeted assets. In this paper, the definition of remediation encompass a patch, a firewall rule or an Intrusion Prevention System rule. Other more complex remediations such as access control or security policy management will not be investigated here. The computation of filtering remediations has required the use of an accurate simulation of the IS network topology. To be usable in an operational environment, remediation candidates have to be ranked according to their operational and impact costs depending on the monitored IS. The assessment of the impact cost requires both the simulation of network flows and a functional model describing the normal behavior of the IS, in order to determine which nominal services may be disturbed by the deployment of a remediation.

The main contributions of this paper are (1) the design of a remediation process correcting the relevant attack paths rather than the whole attack graph generally too complex, (2) the method to remediate these paths based on the correction of attack preconditions, ranking remediation candidates according to a cost function considering both operational and impact costs, (3) the build of a generic remediation database assigning vulnerabilities with their remediations.

This paper is organized as follows: in Section 2, we briefly describe the state of the art. Section 3 formally defines the attack path and its main components. Section 4 explains how to compute remediations for an attack path. Section 5 describes the ranking of remediation candidates according to their cost. Section 6 details an implementation of this method with the MulVAL attack graph engine we use for the experiments of Section 7. Finally, in Section 8 we compare our model with the related work, before concluding on our work.

State of the art

Topological and functional models of the Information System

An efficient security analysis needs an accurate topological model of the system studied. Recent developments have shown that models of an IS can be created automatically from network scans [START_REF] Lagadec | Visualisation et analyse de risque dynamique pour la cyber-défense[END_REF] [START_REF] Jajodia | Advanced cyber attack modeling analysis and visualization[END_REF]. It can also be created by importing the configuration of network devices as it is done in some commercial solutions [28]. The model should be as accurate as possible to be exploitable. Nevertheless, its completeness is not guaranteed by the available technology.

The functional model of an IS is complementary to the topological one. It contains the dependencies between components of the IS and can be used to improve the automation of the deployment of remediations. In [START_REF] Toth | Evaluating the impact of automated intrusion response mechanisms[END_REF], Toth and Kruegel present a dependency model that allow to determine the impact of remediations on the whole system. In [START_REF] Kheir | Cost evaluation for intrusion response using dependency graphs[END_REF], Kheir et al. propose a framework modeling dependencies which handles both confidentiality, integrity and availability.

Attack graphs and attack paths

Attack graphs are a model regrouping all the steps an attacker may follow in an IS during an attack. It has been first introduced by Phillips and Swiler in [START_REF] Phillips | A graph-based system for network-vulnerability analysis[END_REF]. It has been widely used ever since, thus many heterogeneous models are now behind the name attack graph. Generally, vertices (also called nodes in the literature) represent opportunities in an IS or actions that can be done by an attacker, and edges (also called arcs in the literature) represent the dependency relations between the opportunities and/or actions. An attack graph can be built using information about the potential exploits that can be carried out on a network and using existing vulnerabilities databases [START_REF]NIST: Capec, common attack pattern enumeration and classification[END_REF] [START_REF]NIST: Cve, common vulnerabilities and exposures[END_REF]. A summary of the state of the art on the early papers about attack graphs (from 2002 to 2005) has been done by Lippmann and Ingols in [START_REF] Lippmann | An annotated review of past papers on attack graphs[END_REF]; a more recent by Kordy et al. in [START_REF] Kordy | Dag-based attack and defense modeling: Don't miss the forest for the attack trees[END_REF].

MulVAL, The Multi-host, Multi-stage Vulnerability Analysis Language tool is an open-source attack graph engine created by Ou et al. [START_REF] Ou | Mulval: A logic-based network security analyzer[END_REF]. It uses Datalog, a logic programming language, in order to generate an attack graph in which nodes are related to each other with logical relations (OR or AND). The other two main attack graph engines are commercial products: Cauldron [START_REF] Jajodia | Cauldron missioncentric cyber situational awareness with defense in depth[END_REF] (originally presented by Jajodia et al. in [START_REF] Jajodia | Topological analysis of network attack vulnerability[END_REF]) and Artz's NetSPA [START_REF] Artz | NetSPA: A Network Security Planning Architecture[END_REF].

An attack graph contains targets and multiple paths to reach them. Such attack paths can be extracted from the graph using different algorithms, according to the needs. Swiler et al. describe in [START_REF] Swiler | Computer-attack graph generation tool[END_REF] shortest paths algorithms used to find the most likely or lowest cost attack paths. In [START_REF] Sawilla | Identifying critical attack assets in dependency attack graphs[END_REF], Sawilla and Ou present a generalization of Google's Page-Rank algorithm to identify the most critical attack nodes. An attack path extraction and scoring function has also been presented by Bettan et al. in PoSecCo, a FP7 European Research project [START_REF] Bettan | D4.8 -prototype: Standardized audit interface[END_REF].

Selecting remediations

Remediations to an attack can be regrouped in three types: corrective, active and passive. The first one is the correction of the exploitable vulnerability. This is generally implemented by patch management software. The technology is quite mature (several tools exist, vendors regularly propose patches for their software) but it suffers from limitations detailed by Cavusoglu et al. in [START_REF] Cavusoglu | Security patch management: Share the burden or share the damage?[END_REF]. The most important is that patch deployment still requires human intervention: each patch must be tested on all platforms to prevent conflicts or regressions before being applied. The active remediations regroup those that prevent the exploitation of a vulnerability that still exists after the deployment. This is for example the case of simple filtering by a firewall or an Intrusion Prevention System (IPS). An IPS blocks flows that has been flagged as abnormal thanks to a signature or due to its statistical behavior [START_REF] Stakhanova | A taxonomy of intrusion response systems[END_REF]. More generally, an Intrusion Response System (IRS) is a system that provides other types of responses to a detection. This is a currently active research topic and many papers treat this subject, as summarized by Shameli-Sendi et al. in [START_REF] Shameli-Sendi | Intrusion response systems: survey and taxonomy[END_REF]. Finally, the passive remediations regroup the detection of the exploitation of a vulnerability and its report. This is a last resort but is widely used, as it can help security operators to know what happened in their IS. A system that only provides passive responses (alerts, reports, logs...) is generally called Intrusion Detection System (IDS) [START_REF] Tucker | A new taxonomy for comparing intrusion detection systems[END_REF].

Some papers propose techniques to compute or select remediations using attack graphs. In [START_REF] Cuppens | Anticorrelation as a criterion to select appropriate counter-measures in an intrusion detection framework[END_REF], Cuppens et al. describe how the LAMBDA language, that has been used to model attacks, can also be used to model counter-measures and using the concept of anti-correlation allow to compute the appropriate countermeasures for an attack. In [START_REF] Wang | Minimum-cost network hardening using attack graphs[END_REF], Wang et al. base their analysis on the initial conditions of an attack graph to compute all hardening options for a network. This approach has been improved by Albanese et al. in [START_REF] Albanese | Time-efficient and cost-effective network hardening using attack graphs[END_REF] with a near-optimal algorithm more efficient and cost-sensitive. In [START_REF] Noel | Proactive intrusion prevention and response via attack graphs[END_REF], Noel and Jajodia describe several methods to prioritize the deployment of patches depending on an attack graph. In [START_REF] Ingols | Modeling modern network attacks and countermeasures using attack graphs[END_REF], Ingols et al. explain how they represent three types of countermeasures (Firewall rules, IPSs and proxy firewall) in the NetSPA attack graph. Attack graphs are also used by Noel and Jajodia [START_REF] Noel | Optimal ids sensor placement and alert prioritization using attack graphs -springer[END_REF] to compute the optimal locations to deploy IDSs in an IS: they allow to minimize the cost of sensors while keeping a complete coverage of potential attack paths.

Ranking remediations

There are sometimes several remediations that could be deployed for a detection. Thus, they should be ranked to select the most appropriate one. Generally, this evaluation contains an estimation of the impact of a remediation and thus rely on a functional model as presented above. The ranking method presented by Toth and Kruegel in [START_REF] Toth | Evaluating the impact of automated intrusion response mechanisms[END_REF] first uses an algorithm that evaluates the impact of the remediations. Then, it advises to select the remediation with minimal negative effect on legitimate users. In [START_REF] Kheir | Cost evaluation for intrusion response using dependency graphs[END_REF], Kheir et al. present how to compute an index called RORI which represents a return on investment of a remediation. It is based on a dependency graph where are propagated the levels of Confidentiality, Integrity and Availability of assets. This index can then be used to rank remediations. An other parameter that can be taken into account when selecting a remediation is the impact of such counter-measure against the success likelihood of the attack. This kind of approach has been presented by Kanoun et al. in [START_REF] Kanoun | Towards dynamic risk management: Success likelihood of ongoing attacks[END_REF], where they implement a model based on dynamic Markov Models to assess the success likelihood of attacks. This model allow to select the most appropriate counter-measures to prevent an attacker from reaching its objectives.

Selecting a remediation among many brings challenges to overcome because it needs the knowledge of many parameters (costs parameters, functional and topological models) and how to combine them. It also requires assumptions regarding the coverage of the remediations on the attack.

3 Attack paths and preconditions -V is a set of vertices that describe logical facts. Each vertex could be an AND (respectively an OR) vertex, meaning that this vertex needs the conjunction (resp. the disjunction) of its incoming arcs to be true. -A is a set of directed arcs that represent a logical dependency from the child vertex to the parent one.

In an attack graph as defined above, it is possible to choose attack targets. These are the vertices describing important final steps for an attacker. Based on these targets can be built attack paths using a bottom-up approach from the target to the upper preconditions of the attack graph. They can be ranked according to their impact and probability of occurrence, but this is a full-fledged subject that has been, for example, described in [START_REF] Bettan | D4.8 -prototype: Standardized audit interface[END_REF] or [START_REF] Sawilla | Identifying critical attack assets in dependency attack graphs[END_REF]. Definition 2. An attack path is an acyclic and logically valid subgraph of an attack graph with one target and several preconditions. Definition 3. The target of an attack path is the vertex whose outdegree is 0, deg + (v) = 0 (no outgoing arcs). Definition 4. A precondition in an attack path is a vertex whose indegree is 0, deg -(v) = 0 (no incoming arcs). Definition 5. A subgraph S of an attack graph G is logically valid if S contains at least one vertex and for each vertex v ∈ S, v ∈ G and if deg - G (v) > 0 (more than one incoming arc in G): if v is an AND, all the parents and incoming arcs of v in G are in S, if v is an OR, at least one parent of v and its incoming arc in G is in S.

An attack path may have several intermediate goals but has only one main goal: the target of the attack path. It contains one, several or all the possible paths in the attack graph allowing to compromise this target.

Remediations can be applied only on preconditions

Proposing remediations to an attack path is searching the means to prevent the attacks and protect its target. An attack path is a logical graph: a fact is true if and only if the conjunction or disjunction of its parents is also true. As a precondition does not have any parent, it is not deducted from any other vertex. So, they are the first conditions from which all other vertices are deducted and thus the only vertices where can be applied remediations. This is the basic assumption on which we will build our remediation method.

Sufficient preconditions

The attack path contains one target that should be protected by the remediations. As the attack path is an AND-OR graph, it is possible to compute all conjunctions of to-be-remediated preconditions, sufficient to protect the target. This logical expression SP can be represented with a set of disjunctions containing conjunctions as following:

SP = i SP i = i j SP i,j (1)
where is logical OR, is logical AND, SP i is a conjunction of preconditions sufficient to protect the target (i indexing the conjunction of preconditions) and SP i,j is a precondition to remediate (j indexing the preconditions). Returns the list SP to delete the vertex v 2:

if v is a precondition then v has no parent 3:

return return result

[[v]] it
( i Ai) ∧ ( j Bj) = i,j
(Ai ∧ Bj)

28: end function

In fact, computing SP is identical to find all the conjunctions of preconditions sufficient to delete the target vertex according to the AND/OR formalism. Definition 6. A conjunction of precondition SP i is sufficient to delete the target t of an attack path AP if the deletion of each precondition SP i,j ∈ SP i and its propagation in AP implies that henceforth t / ∈ AP .

The recursive algorithm that computes SP can be found in Figure 1. It should be called on the target of the attack path and will go up recursively along the arcs. All conjunctions of preconditions computed with this algorithm allow to prevent the access to the target, if remediated. Of course all preconditions can not be remediated. If this is the case in a conjunction, the entire set of preconditions will not be usable to successfully protect the target of the attack path.

Remediation of an attack path

A diagram summarizing the remediation process can be found in Figure 2.

Remediate a precondition

A precondition contains a logical fact describing what can be used by an attacker. We detail real preconditions and their remediations in Subsection 6.3, but will first describe two general methodologies that can be applied to preconditions.

Simple remediations to preconditions

The first case appearing when remediating a precondition is a simple remediation that can be applied to negate this precondition. This usually corresponds to the first type of remediation presented in the state of the art. You need a database that makes the link between the precondition (eg: the vulnerability) and how you can remediate it (eg: a patch).

Remediations using the network topology Some remediations require more advanced techniques. This is the case of those which try to prevent the exploitation of a vulnerability. It corresponds to the second type of remediation of the state of the art. Computing such remediations requires an accurate knowledge of the flows exchanged on the network and thus need to simulate the network topology.

Remediation candidates for an attack path

Each remediation potentially contains several elementary actions. More formally, for each attack path, we have succeeded to compute:

-A disjunction of conjunctions of sufficient preconditions to remediate, in order to protect the target of the attack path: SP -A disjunction of conjunctions of remediation actions sufficient to prevent a precondition p:

RA(p) = i RA i (p) = i j RA i,j (p) (2)
where RA i (p) is a conjunction of remediation actions allowing to prevent the precondition p (i indexing each conjunction) and RA i,j (p) is a remediation action (j indexing each action of the conjunction) each remediation action RA i,j is constituted of the tuple (action to apply, machine to deploy it). Returns all remediation candidates protecting an attack path.

2:

res We need to combine SP and RA to compute a disjunction of remediation candidates containing the actions that allow to protect the target:

RC = i RC i = i j RC i,j (3)
where RC i is a remediation candidate (i indexing the number of candidates) and RC i,j is a remediation action (j indexing the number of actions in the candidate).

An algorithm computing such remediation candidates is shown in Figure 3.

Costs of remediations

The last essential point for our remediation method is to estimate the cost of a candidate. This will help an operator to choose between several candidates remediating the same attack path. We have identified two principal sources of cost that must be considered: the operational and the impact costs.

Operational cost

The first important cost for an operator deploying a remediation is the operational cost (OC). It represents the difficulty to implement the remediation on the assets and to maintain it. For each remediation action RC i,j that should be applied, we identified four categories in which this cost can be split.

1. Remediation cost (RC): This is the cost of the input necessary to apply the remediation, for example, the price of a patch or of a signature. 2. Deployment costs (DC): This is the cost representing the workload to apply the remediation on the concerned machine. 3. Test costs (T C): This is the cost to test that all important features of the Information System are still working as expected, after the deployment. 4. Maintenance costs (M C): This is the cost per year of the maintenance induced by the remediation. It reflects for example the increase of CPU, memory, storage and treatment of logs that will be induced.

These elements can be expressed in a monetary unit and we detail in Subsection 6.5 how to compute them. The operational cost of a remediation action is the sum of all these elements as shown in Equation 4.

OC(RC i,j ) = RC + DC + T C + M C (4)
To simplify the estimation of the operational costs of a candidate containing several remediation actions, we made the assumption that these actions are independent. This assumption has been introduced and justified by Gonzalez-Granadillo et al. in [START_REF] Granadillo | Combination approach to select optimal countermeasures based on the rori index[END_REF] as Axiom 1. This is moreover the most common case, as the remediation actions are usually deployed on different machines or are of different types. With this assumption, the operational cost of a candidate is the sum of the operational costs of its actions, as shown in Equation 5.

OC(RC

i ) = j OC(RC i,j ) (5)

Impact cost

We propose here a basic impact cost (IC) function that measures the loss due to the unavailability of services after the deployment of a remediation. This function uses a list of (1) dependencies of business applications toward services, (2) services toward network accesses and (3) interdependencies between services.

In addition to this are added cost values related to the temporary and permanent unavailability (U C) of business applications. Thanks to those parameters, we can compute the cost of unavailability of all business applications before (on the real system) and after (on a simulated system) deploying a candidate RC i , by checking recursively that the services dependencies are verified as shown in Equation 6.

IC(RC

i ) = ba∈businessApp isImpactedBy(RC i , ba) * U C(ba) (6)
The impact cost is certainly the most important part to take into account when deploying a remediation but it is perhaps also the most difficult to quantify, as it is hard to estimate the cost if a business application is unavailable and to know which applications will be disrupted by a remediation candidate. It is therefore very important to provide security operators with indications about such a cost, to help them choose at best the remediation to deploy.

Ranking remediation candidates

These costs allow us to attach a global cost C to a candidate as shown below:

C(RC i ) = OC(RC i ) + IC(RC i ) (7)
The candidate cost function can be considered as a ranking function taking as input an unsorted set of remediation candidates and that outputs a set of the same candidates sorted according to their cost. This allow a security operator to select one of the candidates that has the lowest cost.

As the remediation candidates cost function is only used to compare candidates with each other, even if the cost parameters are not assigned exactly, it does not change significantly the order between them. Thus, the details of the cost models parameters are not required, but only need to represent a tendency, in order to conserve the ranking between candidates. This assumption has also already been justified by Gonzalez-Granadillo et al. in [START_REF] Granadillo | Combination approach to select optimal countermeasures based on the rori index[END_REF].

Implementation

Simulation of the network topology

As we need a simulated network topology representing the target IS, we created a network simulator that accurately reproduces simple network behaviors of hosts: we are able to simulate exchanges between hosts, calculate routes, test if a packet can pass firewall rules, etc. We designed a pivot file in which we put the topological information needed by the simulator. We also created connectors to automatically build such a file. The first connector we built was a python server that gathered the topological information collected by agents deployed on Linux machines into the pivot format. The second connector was built for the European Research Project PoSecCo [1], where we had an ontology containing the network topology. We thus implemented a connector that was querying in the ontology for the information needed.

Generation of attack paths

We use the open source attack graph engine MulVAL [START_REF] Ou | Mulval: A logic-based network security analyzer[END_REF]. It requires three types of inputs: topological, filtering and vulnerabilities information. We combine our simulated topology with a vulnerability scan (of Nessus [START_REF] Tenable | Nessus[END_REF]) by merging the information about services and their vulnerabilities extracted from the scanner report into our topology. MulVAL inputs are stored in a file using the Datalog language. It outputs an XML file containing the logical attack graph computed thanks to its engine from which the attack paths are extracted.

Preconditions in MulVAL and their remediations

The main preconditions proposed by MulVAL to model attacks and their remediations can be seen in Table 1. We will focus here only on three relevant types of remediation for an enterprise: applying a patch, deploying a rule on an IPS (preventing vulExists()) and deploying a firewall rule (preventing hacl()).

Application of a patch

In order to propose the right patch to a vulnerability, we use the parameter in the fact of the precondition vulExists containing the identifier of a vulnerability, generally a CVE (Common Vulnerabilities and Exposures) [START_REF]NIST: Cve, common vulnerabilities and exposures[END_REF]. We use this identifier to look for known patches in the remediation database we describe in Subsection 6.4.

Deployment of a firewall rule

To compute the firewall rule that should be deployed, we use all the parameters of the fact hacl(src, dst, port, protocol). This precondition explains the network access the attacker needs for his attack. So, it should be negated by the rule to deploy, which should have the following form:

DROP FROM s r c TO d s t : p o r t USING p r o t o c o l

It can be generated according to the type of firewall aimed. For example, we propose an automatic generation of iptables [START_REF]Netfilter: iptables[END_REF] firewall rules.

The last problem we need to deal with for the firewall rules proposal is where it should be deployed. We use here the topology simulation presented in Section 4.1 to determine the route followed by packets between src and dest:port. We then deduce on which machine the firewall rule can be deployed.

Deployment of an IPS rule

The last type or remediation we will detail is the deployment of IPS rules for Snort [29] which prevent the exploitation of a vulnerability. For each vulExists related to an hacl, we can know (1) The Snort rules that may exist to prevent the exploitation of the vulnerability by searching its identifier in the remediation database presented in Subsection 6.4, and (2) the network routes that may be used by the attacker to exploit this vulnerability, by using the simulation of the network and a deduction process similar to the calculation of the firewall rules. On each route, we must have an IPS host where we can deploy the rule. Otherwise, the remediation is not possible. The rules we propose here must be used with Snort in inline mode and they begin with the drop keyword, meaning that we use it as an IPS.

Filling the remediation database

One challenge of the proposition of remediation is the ability to build automatically a remediation database. We will describe here how we overcome it.

Database model

We use a relational model stored in a SQLite file. We choose to use a model similar to the one used in the National Vulnerability Database [21] to represent vulnerabilities. Then, we added two tables corresponding to the types of remediations. In order to have a N-to-N association with the vulnerabilities, we also add a join table for each kind of remediation. Patches We used the NVD [21] to find the links toward patches that correct vulnerabilities. Among the attributes related to a CVE, a reference can point to a website describing how to patch the vulnerability. So, we parse the dumps of the NVD, extract the links toward patches and store it in the database. Around 20% of the CVE have a "PATCH" reference attached. Snort rules In the standard format of a Snort rule, there is an option "reference" which often contains a CVE. In the freely available database of rules provided by Sourcefire [29], nearly 50% of the rules are related to a CVE.

Providing the costs parameters

Operational cost Operational costs depends highly on the company and on the remediation. So, we choose in our prototype to assign parameters per types of remediation. Generally the difference of operational cost between remediations of the same type is low, but it may be also possible to add the cost parameters into the remediation database, in order to be able to attach to each remediation specific operational cost parameters. Impact cost The description of dependencies used for impact cost is also totally dependent on the IS and has to be provided by the security operator. To describe these dependencies, we use an XML file in which the dependencies relations are described according to a dependency graph.

Experiments and results

In order to validate the whole remediation method described in this paper, we applied it on several test topologies. We implemented it on the use-cases of the European Research Project PoSeCo [START_REF] Bettan | D4.8 -prototype: Standardized audit interface[END_REF]. But before detailing this test-bed and our experiments on it, we will present a simpler scenario implementing the main concepts. We will end with a discussion about the complexity of our approach.

Simple experiment scenario

Network topology and attack scenario The first scenario we implement rely on a topology that we deployed on virtual machines. It contains 5 Linuxbased hosts: a web server, a database server, an machine inside a LAN, a firewall that protects the LAN and the servers from the Internet, and the attacker's machine that is on the Internet. We configure the firewall in such a way that the web server is the only service that is accessible from the Internet and the LAN. The web server needs the database server to work properly and has a full access to it. The enterprise has two business applications using the IT: an Extranet which is rarely used and an Intranet which is used for all employees and is thus much more critical. The database server contains also some confidential information that the company wants to protect.

When the web server is exploited, the attacker can access the database server and with an other exploit can try to gain access to all the data it contains. This is the attack path that will be described in the rest of this scenario.

Generation of the attack path and proposition of remediations

To collect the topological information, we use the python agents described in Subsection 6.1. We generate MulVAL inputs and launch the attack graph engine, then extract the attack paths and select the one presented above. It chains the exploitation of two vulnerabilities: the first one CVE-2004-1315 is on the web server, the second one, CVE-2012-3951, is on the database server.

We use our prototype to visualize the attack path to correct and the remediation candidates. We present here the four most relevant candidates, ranked by cost. We also explain for each candidate why its cost is low, medium or high.

1. The first candidate is the deployment on the firewall of the Snort rule sid:12610 that allows to block the exploitation of the first vulnerability. This remediation has a lot of advantages, because it doesn't interrupt any genuine service, is not too much expensive (deployment can be nearly fully automated), and blocks successfully the attack. This candidate has no impact cost, a low operational cost and thus a very low global cost, that is why this is the first one to be proposed. 2. The second one is the proposal of a patch to the first vulnerability. As the first one, it doesn't have any impact on normal service, but has much more operational cost, because deploying a patch need human intervention. So, this candidate has a low global cost and thus is the second one to be proposed. 3. The third one is a firewall rule that blocks all the traffic from the Internet to the web server on http port. It has a low operational cost, because it can be automatized, but has a medium impact because it cuts the access from the Internet to the web server, even if it keeps all the accesses from the LAN. So this candidate has a medium global cost and thus is the third to be proposed. 4. The last one is a firewall rule that blocks all the traffic to the web server on http port. It has also a low operational cost, but has a huge impact because it cuts also all the accesses for the employees of the LAN to the web server. So this candidate has a high global cost and thus is the last one to be proposed.

Results on PoSecCo's testbed

We will now present the results of this method applied on the testbed of the FP7 European Research Project PoSecCo [1].

The main use case in which the PoSecCo prototypes have been tested has two main business services: a broadcaster Internet distribution and a corporate streaming service. These services have several security requirements and run on a testbed that has been deployed during the project, on which prototypes have been tested. It contains around twenty machines (some are representing server farms) and eight routers. All the topological information needed for our prototype are collected from an ontology and the attack paths extracted are ranked according to their impact on security requirements.

On the twenty machines and eight routers, there are more than a thousand vulnerabilities in total. It was chosen for this project that there will be one attack path per target, gathering the relevant ways to compromise it. Thus, after establishing a list of five hosts to protect in priority, the operator has five attack paths to assess and correct. These attack paths contain between thirty and hundreds of nodes, the possible remediations are computed in a few seconds. Due to project limitations, only two types of remediations are proposed: patches and firewall rules. For each attack path, many candidates are proposed (up to a hundred), and are ranked according to their operational and impact cost. The first candidates (lower cost) offer the best compromise between efficiency and cost and should be the best option for a security operator.

During the project, the prototype implementing this approach was presented to end-users that compared their risk analysis and its remediation, in anticipation of a change in the testbed topology, with and without the prototype. The end-users, independent of the project, concluded that the scenario using this methodology was much more efficient: it reduces the analysis from four hours to twenty two minutes and could reduce the number of people needed for this task from between three and six to only one. The result of this evaluation can be found in PoSecCo's Deliverable 1.7, in scenario SP06 [START_REF] Demetz | D1.7 -final project evaluation[END_REF].

Complexity

What must be well understood before talking about the complexity of our algorithms is that in this paper, we propose remediations to attack paths and not to a whole attack graph, we thus have smaller complexity issues. Indeed, an attack graph is usually a large graph whereas, an attack path is smaller, because it focuses only on the very impactive or the most likely ways to access a target.

The complexity of the algorithm computing the candidates is not very impactive, because 1) it is linear in the number of conjunctions of precondition and 2) the number of remediations for one precondition is generally low. The algorithm computing SP depends highly on the structure of the input attack path, especially on the number of parents of each vertex. In the best case (each vertex has only one parent) this algorithm is linear in the number of vertices. In the worst case (each vertex has several parents), the complexity is exponential in the number of parents of OR vertices. This is the factor that most influence the complexity. We made simulations on non-realistic graphs with different varying parameters (number of parents, OR nodes, AND nodes, preconditions...) to validate these results. Nevertheless, in practice on several real use cases, we found that the number of parents for OR vertices in attack paths is generally low: an average of 1.7 per OR vertex in attack paths produced by MulVAL. This can be simply explained knowing that, in an attack path, as explained above, we only have few different possibilities to compromise a target, alternatives creating disjunctions in the attack path. It implies that this methodology generally scales well, if the attack paths treated are properly generated.

Related Work

The papers which describe the closest approach to our work are [START_REF] Wang | Minimum-cost network hardening using attack graphs[END_REF] and [START_REF] Albanese | Time-efficient and cost-effective network hardening using attack graphs[END_REF]. In [START_REF] Wang | Minimum-cost network hardening using attack graphs[END_REF], Wang et al. base their analysis on the preconditions of an attack graph to compute ways to prevent attacks. But even when they evocate the cost to choose one remediation solution rather than another, they do not present a cost function to sort candidates as we did in this paper. In [START_REF] Albanese | Time-efficient and cost-effective network hardening using attack graphs[END_REF], Albanese et al. extend [START_REF] Wang | Minimum-cost network hardening using attack graphs[END_REF] mainly by adding a cost model, similar to the one we present here, and by improving the complexity of the algorithm to compute candidates. But what distinguish our approach from both these ones is that we do not compute remediations to an attack graph but to attack paths, meaning that our algorithms are working with smaller inputs. We are convinced that it is much more sound and efficient to correct only the paths that are significant rather than reasoning on the global attack graph. This was assessed on realistic use-cases.

What is also original in our approach is that our remediation computation is generic. In [START_REF] Noel | Proactive intrusion prevention and response via attack graphs[END_REF] and [START_REF] Noel | Optimal ids sensor placement and alert prioritization using attack graphs -springer[END_REF], Noel and Jajodia propose various types of remediations to predefined types of attacks modeled by attack graphs. The method we present here is more generic. Indeed, the expressiveness of logical attack graphs allows the modeling of every attack described with AND/OR conditions and our method applies to all of them, without the limitations identified in the related work. Dealing with new attacks only imply to define remediation for potential new kinds of preconditions. These remediations can be simple or may require network topology simulation, as the ones presented in this paper.

Furthermore, several databases that contain remediations exist. However, each database is dedicated to a type of remediation. For example, the NVD contains information about patches [21] and Snort databases contain only Snort rules [29]. In this paper, we design a remediation database and fill it using several online available sets of data. This database contains different kinds of remediations and can be extended to provide new types of remediations.

Conclusion

We present in this paper a method describing how to compute remediations for scored attack paths extracted from an attack graph. Attack graphs have been widely used for assessing the security level of an Information System, we chose instead to use them in order to propose solutions to enhance this security level, by computing remediations preventing attack paths in an Information System. Using scored attack paths extracted from an attack graph allows us to remediate only the very likely or impacting paths that lead to main assets which is much more efficient than remediating the global attack graph.

We have stated that the only vertices on which we compute remediations, within a logical attack path, are the preconditions. We have implemented algorithms to cluster these nodes into conjunctions of sufficient preconditions to be remediated, in order to protect the target of an attack path. Then, after explaining how to compute remediation actions to prevent a precondition, we detailed their combination with the sufficient conjunctions of preconditions to determine the candidates. As the operator has to choose one remediation among several candidates providing the same remediation objective, we assign to each remediation a global cost combining operational and impact costs. To calculate topological remediations to certain preconditions and to assess the effects of remediations on the system, we have designed a simulated network topology.

Limitations of the logical model used for modeling attack graphs were detailed during this study since this model is deterministic and not dynamic. Thus, it has to be extended into a quantitative model to represent dynamic attacks and to model them more accurately. However, this logical model has the advantage to be efficiently generated and processed and is well suited to model potential attacks. Future work will study the computation of more complex remediations with the development of a more accurate cost function. A prerequisite will be a better knowledge of the IS through new mining techniques.

3. 1

 1 Attack path representation Definition 1. A logical attack graph G is a directed AND-OR graph represented by G(V, A) where:

Fig. 1 .

 1 Fig. 1. Recursive algorithm computing the conjunctions of sufficient preconditions 1: function computeSP(Vertex v)Returns the list SP to delete the vertex v 2:if v is a precondition then v has no parent 3:return[[v]]it is the only precondition 4:else if v is an AND then 5:res←[[]] 6:for each parent p of v do 7:res ← res;computeSP(p) 8:end for 9:return res

Fig

  Fig. 2. Remediation process based on attack paths

Fig. 3 .

 3 Fig. 3. Algorithm computing the remediation candidates 1: function computeCandidates(SP , RA) Returns all remediation candidates protecting an attack path. 2: res ←[[]] 3: for SPi in SP do 4: res ← res ; computeRemedsToPreconds(SPi, 1, RA) 5: end for 6: return res 7: end function 8: function computeRemedsToPreconds(SPi, j, RA) Returns all conjunctions of actions allowing to remediate the preconditions of SPi starting from j. 9: SPi,j ← SPi[j] j th precondition to remediate 10: RAj ← RA[SPi,j] Remediations of j th precond 11: if empty(RAj) then j th precondition can not be remediated 12: return [[]] 13: else 14: if j=size(SPi) then Terminaison of recursion 15: return RAj 16: else 17: RAj+1..n ←computeRemedsToPreconds(SPi, j + 1, RA) 18: return conjunctionOfSets(RAj, RAj+1..n) 19: end if 20: end if 21: end function

  . 2. Remediation process based on attack paths

	Topological		Network					Functional model
	model		simulation
	Attack Graph Engine	Attack graph	Extraction of attack paths and scoring Remediation database paths Attack	Sufficient Remediation of preconditions	RA	candidates algorithm Remediation	RC	Operational Impact cost computation	candidates ranking Remediation	candidates remediation Ranked
				preconditions	SP			cost
				algorithm				computation

Table 1 .

 1 Main MulVAL preconditions and their remediations

	Preconditions	Description	Possible remediations
	hacl(src, dst, port, portocol)	The host src has access to dst on	Deploy a firewall rule
		port using protocol
	vulExists(host, vulID, program) program on host has a vulnera-	Apply a patch or deploy a Snort
		bility vulID	rule
	networkServiceInfo(host, pro-	program on host launched as	Stop this network service
	gram, protocol, port, user)	user open port using protocol
	hasAccount(user, host, account) user has account on host	Disable this account


Fabien Vialla

Ermin Malic

Benjamin Langlois

Yannick Chassagneux

Carole Diederichs

Emmanuelle Deleporte

Philippe Roussignol

Jean-Sébastien Lauret

Christophe Voisin

Universal non-resonant absorption in carbon nanotubes

Photoluminescence excitation measurements in semi-conducting carbon nanotubes show a systematic non-resonant contribution between the well known excitonic resonances. Using a global analysis method, we were able to delineate the contribution of each chiral species including its tiny non-resonant component. By comparison with the recently reported excitonic absorption crosssection on the S22 resonance, we found a universal non-resonant absorbance which turns out to be of the order of one half of that of an equivalent graphene sheet. This value as well as the absorption line-shape in the non-resonant window is in excellent agreement with microscopic calculations based on the density matrix formalism. This non-resonant absorption of semi-conducting nanotubes is essentially frequency independent over 0.5 eV wide windows and reaches approximately the same value betweeen the S11 and S22 resonances or between the S22 and S33 resonances. In addition, the non-resonant absorption cross-section turns out to be the same for all the chiral species we measured in this study. From a practical point of view, this study puts firm basis on the sample content analysis based on photoluminescence studies by targeting specific excitation wavelengths that lead to almost uniform excitation of all the chiral species of a sample within a given diameter range.

In contrast to graphene, single-wall carbon nanotubes (SWNTs) show marked resonances in their optical spectrum that primarily reflect the one-dimensional quantum confinement of carriers. These resonances that combine one-dimensional and excitonic characteristics have been extensively investigated and are widely used as finger prints of the (n, m) species [1]. However, spectroscopic studies reveal that the absorption of nanotubes does not vanish between resonances and consists of a wealth of tiny structures, such as phonon side-bands, crossed excitons (S ij ), or higher excitonic states [2][3][4][5]. In ensemble measurements, the non-resonant absorption is even more congested due to the contribution of residual catalyst or amorphous carbon and due to light scattering [6]. In total, a relatively smooth background showing an overall increase with photon energy is observed, from which it is challenging to extract any quantitative information.

In this study, we show that thorough photoluminescence excitation (PLE) measurements yield a much finer insight into the non-resonant absorption of carbon nanotubes, that reveals the universal features of light-matter interaction in carbon nano-structures [7]. In particular, we show that the non-resonant absorption of SWNTs per unit area well above the S 11 or S 22 resonances reaches an universal value of 0.013±0.003 in good agreement with the value α √ 3 (where α is the fine structure constant) predicted by a simple band-to-band theory.

Our study of non-resonant absorption is based on the global analysis of PLE maps of ensembles of carbon nanotubes that allows us to deconvolute the contribution of each (n, m) species while keeping a high signal to noise ratio. The sample consists of micelle suspensions (sodium cholate) of HiPCO and CoMoCat nanotubes in deutered water (D 2 O). All measurements are done at room temperature. The sample is excited by using a cw Xe lamp filtred by a monochromator that provides 5 nm-wide excitation steps throughout the near UV, visible and near IR regions. The luminescence of the suspension is collected in a 90 degree geometry and dispersed in a 30 cm spectrograph coupled to an InGaAs linear detector. The spectra are corrected from the grating and detector efficiencies and are normalized to the incoming photon flux. The PLE map of a HiPCo sample is displayed in Figure 1. It consists of bright spots that correspond to the resonant S 22 excitation of the S 11 luminescence of the semi-conducting species. The (n, m) species were identified according to the scheme developed by Bachilo et al. [1]. These spots are surrounded by a weak but non vanishing background showing up as vertical light-blue strips in the map. In contrast to absorption measurements, the presence of such a background in a luminescence measurement shows that there is an actual absorption by the very species that give rise to the IR luminescence, that is the semi-conducting nanotubes themselves. Due to the luminescence detection scheme, this background can be unambiguously distinguished from contributions such as elastic light scattering, absorption by metallic species, by catalyst or amorphous carbon particles, etc. that blur the non-resonant response of the sample in linear absorption measurements.

This point is illustrated in Figure 2 where the linear absorption spectrum of a chirality enriched (6,5) sam- ple (NanoIntegris) is compared to the PLE spectrum of the same sample. Both spectra are normalized to the maximum of the S 22 resonance in order to compare their background levels. The latter appears to be 2 to 3 times lower in the case of the PLE spectrum, showing that extrinsic contributions in the linear absorption spectrum are sizable even for sorted samples.

Importantly, PLE and absorption spectra can be directly compared if the relaxation from the upper lev- els down to the light-emitting level is much faster than the competing relaxation processes [START_REF] Bastard | Wave mechanics applied to semiconductor heterostructures[END_REF]. Several timeresolved studies have shown that non-resonant excitation of SWNTs leads to extremely fast (sub-ps) relaxation to the lower bright level [START_REF] Lauret | [END_REF][10][11]. We also checked with two-color pump-probe measurements that the population build-up time on the S 11 level does not depend on the pump wavelength (Appendix, Figure 7). To further make sure that this internal conversion is faster than the competing relaxation processes, we varied the latter by changing the temperature of the sample (from 10 to 300K) [12] and checked that the PLE spectrum remained unchanged (Appendix, Figure 8 ). In total, we can safely assume that non-resonant PLE measurements accurately reflect the absorption properties of SWNTs.

Due to the numerous chiral species present in the sample and due to the partial spectral overlap of their IR emission lines, a specific analysis method is required in order to quantitatively assess the non-resonant absorption of each species. To this end, we developed a global fitting procedure: When the luminescence is excited at the S 22 resonance of a given (n, m) species, the corresponding S 11 emission line becomes the dominant feature of the luminescence spectrum, thus making possible to determine accurately the emission energy and the width. We performed such preliminary fitting for each (n, m) species emission line. From this set of S 11 energies and widths, we constructed a model function made of the sum of Lorentzian profiles with free amplitudes and fixed energies and widths. Finally, the PL spectrum obtained for each excitation wavelength was fitted to the model function (Appendix, Figure 10). The resulting amplitude of each Lorentzian component defines the PLE amplitude of the corresponding (n, m) species at this excitation wavelength [13].

Such a deconvoluted PLE spectrum is displayed in Figure 3 for two exemplary species. The most prominent features are the S ii resonances (essentially the S 22 and S 33 ones) and the associated phonon side-bands [2,3]. An additional weaker resonance is observable roughly 0.5 eV above the S 22 resonance that might be attributed to the S 23 cross polarized transition [4]. In addition to these features, a background is obtained between the excitonic resonances in the PLE measurements. This background is readily observable as a plateau in the 0.5 eV wide energy window free of any resonant feature on the red side of each excitonic resonance. It represents roughly 15% of the S 22 absorption cross-section. Interestingly, we can compare the deconvoluted PLE spectrum of a given species (namely the (6,5) one) for two type of samples (black (for HiPCO) and red (for CoMoCat) lines in Figure 3 (a)). Although these samples differ in both the growth method and the post-growth processing, the PLE spectra are remarkably similar, confirming that the non-resonant signal has an intrinsic origin.

In order to be more quantitative, we make use of our recent measurement of the absolute value of the S 22 absorption cross-section of most of the chiral species present in this sample [14] to rescale the PLE axis into absorption cross-section. In order to take into account the total number of carbon atoms involved in the absorption for each species, we further calculate the (unitless) absorption cross-section per unit area by dividing the absorption cross-section by πd t where d t is the tube diameter. In addition, this approach provides a direct comparison with the case of graphene that shows a frequency independent absorption cross-section of πα = 0.023 in the visible and near IR region [7].

The non-resonant contribution of SWNTs is defined as the minimum of the absorption cross-section between two resonances, which practically corresponds to a 500 meV wide plateau on the red side of each S ii resonance. We note that depending on the chiral species, trigonal warping effects can spread the transition energies leading to wider observation windows for the non-resonant signal (between the S 22 and S 33 transitions for type II species for instance). Conversely, for large diameter nanotubes, the limited energy splitting between resonances (that may become comparable to their width) may compromize the observation of the plateau or warp its value.

The observation of this non-resonant background is consistent with former PLE measurements [5,15] and with recent absorption studies conducted for individual large diameter nanotubes between higher transitions [16,17] showing systematically a sizable background between higher transitions. These studies are in agreement with our observations both regarding the profile and the magnitude of the non-resonant signal.

We were able to quantitatively reproduce this nonresonant absorption spectrum within microscopic calculations based on the density matrix formalism combined with tight-binding wave functions [START_REF] Malic | Graphene and Carbon Nanotubes: Ultrafast Optics and Relaxation Dynamics[END_REF]. The calculation of the frequency-dependent absorption coefficient α(ω) requires the knowledge of the microscopic polarization p k (t) = a + vk a ck , which is a measure for the transition probability between the conduction and the valence band at the wave vector k [START_REF] Malic | Graphene and Carbon Nanotubes: Ultrafast Optics and Relaxation Dynamics[END_REF]. Applying the Heisenberg equation of motion and exploiting the fundamental commutator relations, we obtain the corresponding semiconductor Bloch equation for p k (t) within the limit of linear optics [START_REF] Malic | Graphene and Carbon Nanotubes: Ultrafast Optics and Relaxation Dynamics[END_REF] :

ṗk (t) = -i∆ω k p k (t) + i Ωk (t) -γp k (t). ( 1
)
The dephasing of the microscopic polarization is taken into account by the parameter γ, which determines the line width of optical transitions. The Coulomb interaction is considered within the screened Hartree-Fock level and leads to a renormalization of the transition energy ∆ε k = (ω c (k) -ω v (k)) due to the repulsive electron-

∆ω k = ∆ε k - k ′ W e-e (k, k ′ ) (2)
and to the renormalization of the Rabi frequency Ω k (t) =

i e0 m0 M cv z (k)A z (t) due to the attractive electron-hole in- teraction W e-h (k, k ′ ) Ωk (t) = Ω k (t) + 1 k ′ W e-h (k, k ′ )p k ′ (t) . (3)
Here, M cv z (k) is the optical matrix element describing the strength of the carrier-light coupling and A z (t) is the vector potential denoting the optical excitation of the system with light polarized along the nanotube axis (here, z-axis). We obtain an analytic expression for M cv z (k) within the nearest-neighbor tight-binding approximation [START_REF] Malic | [END_REF]. The screened Coulomb matrix elements W vk ′ ,vk vk,vk ′ determining W e-e (k, k ′ ) and W vk ′ ,vk vk,vk ′ in Eqs. ( 2), (3) [20] are obtained by explicitly calculating the appearing tight-binding coefficients and by applying the Ohno parametrization of the Coulomb potential, which is known to be a good approximation for CNTs [21].

By numerically evaluating the Bloch equation for the microscopic polarization p k (t), we have access to the absorption of carbon nanotubes with arbitrary chiral angle and with a wide range of diameters. Here, we calculated the absorption coefficient of the investigated (6,5) and (10,2) nanotubes representating near armchair and near zigzag species (Figure 3). The absolute value of the absorption was obtained by scaling the graphene absorption calculated in the same way to πα [7], [22]. We further checked that the calculated absorption of very large nanotubes tends to the graphene limit (Figure 4). In order to match the experimentally measured S 22 resonance, we applied a global energy shift to the theoretical spectra to account for the environment-induced screening of the Coulomb potential [23] and a broadening of ≃150 meV to account for the many-particle-induced broadening that has not been considered on the applied Hartree-Fock level. Note that the broadening does not alter the non-resonant absorption value since the variations of the latter are very small at this scale (see Inset of Fig. 3). The agreement between theory and experiment is remarkable regarding this non-resonant absorption in the sense that there are no free parameters in the theory. In particular, both the amplitude and the profile of the non-resonant spectrum are very well reproduced. In contrast, the excitonic resonances significantly differ, which can probably be traced back to the presence of phononinduced and other side-bands that have not been taken into account in the theory and that withdraw parts of the oscillator strength from the main excitonic transition.

The experimental non-resonant absorption contribution was extracted for 10 species (Figure 5). This absorption shows no clear dependence on the diameter of the species, with overall variations smaller than the mean error bar. We also examinated a possible dependence on the chiral angle but could not see any effect (Appendix, Figure 11). This is in strong contrast to the case of the ) FIG. 4. Calculated absorption of nanotubes for selected diameters. For larger diameters, it clearly appears that the absorption becomes diameter independent and reaches the one of graphene. The calculations are normalized so as to set the value of this plateau to πα.

resonant S 22 transition that shows a remarkable chiral angle dependence [14,24]. Notably, the non-resonant absorption cross-section is almost identical between the S 11 and S 22 resonances or between the S 22 and S 33 resonances and corresponds to approximately one half of the value for graphene. Interestingly, most of these observations -including the non-resonant absorption of approximately one half of that of graphene-can be qualitatively understood in the framework of a simple band-to-band absorption theory. Actually, the non-resonant contribution is observed for energies well above the excitonic resonance, where Coulomb correlation corrections are expected to be weak. In fact, this independent electron description allowed to compute quite accurately the graphene absorption in the NIR and visible range [7,25]. Let us first note that from a simple oscillator strength conservation argument, the background absorption of nanotubes is expected to be smaller than that of graphene because most of the oscillator strength is transferred into the resonances of the nanotubes. More quantitatively, the absorption probability is given by the Fermi golden rule and involves the dipolar matrix elements and the joint density of states (JDOS) between the valence and conduction sub-bands. In a first approximation, the latter can be obtained from a zonefolding approach using the conical approximation for the graphene band-structure in the vicinity of the K points. The JDOS of a nanotube is computed per graphene unit cell (or equivalently per two carbon atoms) [26]:

j N T (ω) = √ 3a 2 2π 2 v F d t i g( ω, S ii ) (4)
where

g( ω, E i ) = | ω|/ ( ω) 2 -E 2 i if | ω| > E i 0 if | ω| < E i
where a is the length of the graphene lattice base vector, v F = 10 6 m.s -1 is the graphene Fermi velocity and d t is the nanotube diameter. Using the same notations, the joint density of states per unit cell for graphene reads:

j G (ω) = √ 3a 2 8π( v F ) 2 ω (5)
The key point here is that j N T (ω) tends to a plateau when the photon energy is much larger than the excitonic energy and increases stepwise for each additional S ii transition. This is in contrast to the case of graphene where the joint density of states grows linearly with the photon energy, leading to the well known frequency independent absorption probability. The link between the 2D graphene case and its 1D CNT counterpart lies in the number of plateaus that fit within the ω energy window. Therefore, there is a profound relationship between the absorption probability of a nanotube away from the resonances and that of a graphene layer. In a first approximation, we neglected the possible variations of the matrix element with the direction of electron wave-vector. Due to the overall frequency dependence of the optical matrix element and of the prefactors [START_REF] Malic | [END_REF]27], the JDOS plateaus turn into slowly decreasing tails in the absorption spectrum in agreement with the experimental observations and the microscopic calculations (see Figure 3).

More quantitatively, this simple model allows us to compare the JDOS per carbon atom (and therefore the absorption) in the cases of graphene and of nanotubes at a photon energy at the foot of the S ii resonances of the nanotubes (where the non-resonant contribution is most readily observable (Figure 3)). One finds j N T /j G = √ 3/π ≃ 0.55 at the foot of the S 22 transition and j N T /j G = 3 4π ( 4

√ 15 + 2 √
3 ) ≃ 0.52 at the foot of the S 33 transition, leading to an absorption of ≃ 0.012 in the nanotube case, in good agreement with the mean experimental value 0.013 ± 0.003 (Figure 5).

Incidentally, this universal off-resonant absorption (that depends neither on the frequency, nor on the transition order, nor on the chiral species) explains why nonresonantly excited photo-luminescence spectra are empirically known to give a good image of the chiral species content of a sample. This effect simply results from the fact that such a non-resonant excitation provides a uniform excitation of the sample at a given wavelength regardless of the chiral species. This effect is depicted in Figure 6 where the linear absorption spectrum of a HiPCO sample is compared to its PL spectrum excited off-resonance (for a laser wavelength falling inbetween the S 22 and S 33 resonances of most chiral species). It 0.75 0.8 0.85 0.9 0.95 1 0 0.5

0.75 0.8 0.85 0.9 0.95 1 0 0.5 is clearly observable that the magnitude of the lines observed in the PL spectrum is in good agreement with that of the absorption spectrum.

In conclusion, we used PLE measurements with global fitting analysis to delineate the contribution of each (n, m) species to the non-resonant absorption background of a micelle suspension of SWNTs. We show that this non-resonant absorption reaches an universal value for all chiral species, equal to approximately one half of the value of the unrolled graphene sheet both between the S 11 and S 22 and between the S 22 and S 33 resonances. In addition, this non-resonant absorption hardly depends on the photon energy over 0.5 eV wide win- dows inbetween excitonic resonances. These properties of the non-resonant absorption of SWNT were quantitatively reproduced by microscopic calculations based on the density matrix formalism. This study has practical implications for non conventional excitation schemes of ensembles of SWNTs. Furthermore, it exemplifies the profound link between the photophysical properties of the differents nanocarbons.

APPENDIX Time-resolved measurements

Femtosecond pump-probe measurements were carried out to probe the population build-up dynamics of the S 11 level subsequent to either S 22 or non-resonant excitation (Figure 7). The strictly identical rise-times of the transients (within our 250 fs time-resolution) are consistent with ultrafast internal conversion, making possible a direct scaling of PLE spectra into absorption. (6,5) nanotubes in a micellar suspension subsequent to femto-second excitation at either their S22 transition (black line) or at several non-resonant energies as indicated in the figure. In all cases, the product of the pump power density with the absorbance was kept constant resulting in similar excitation densities. Inset : same data plotted on an extended time window.

Temperature dependence

We measured the PLE spectrum of an ensemble of nanotubes deposited on a quartz plate as a function of temperature. After normalization, the PLE profiles are identical showing that the internal relaxation towards the S 11 level is much faster than any other competing process. In fact, if this was not the case, the temperature-induced changes expected for these processes would warp the PLE profile. The amplitude is rescaled globally so that the value computed for a graphene layer matches the universal value of 0.023 (blue solid line). An effective broadening of 0.01 eV was used. 3ωd t /(4v F ), where v F ≃ 1 × 10 6 m.s -1 stands for the graphene Fermi velocity. The JDOS plateaus of the nanotube give rise to slowly decreasing absorption tails between the resonances, reaching approximately one half of the absorption of graphene at the foot of each resonance.

Band to band calculations

Global analysis method

The efficiency of the global analysis method is exemplified in Figure 10 with deconvoluted spectra (red line) from the global analysis method for selected chiral species with associated error bars.

Chiral angle dependence

The non-resonant absorption cross-section extracted for 10 chiral species can be plotted as a function of their chiral angle (Figure 11). Following previous studies [14], we rather plot them as a function of the trigonal parameter q cos 3θ (where q = n-m mod 3) which is more suited to describe chiral variations of the electronic properties in SWNTs. Within our error bars, we do not observe any systematic variation of the non-resonant absorption with the chiral angle. However, a nascent trend can be guessed that would correspond to a decrease of σ NR12 with increasing q cos 3θ and a symmetrical increase of σ NR23 . We believe that these are not intrinsic features but that this rather arises from the decrease with increas-ing q cos 3θ of the energy splitting between the S 22 and S 33 resonances as a consequence of the trigonal warping (and inversely for S 11 and S 22 ). Therefore, the background is slightly overestimated for σ NR23 due to overlapping with the tails of the resonances for positive q cos 3θ values (and inversely for σ NR12 ).

FIG. 1 .

 1 FIG. 1. Photoluminescence map of a micelle suspension of HiPCO nanotubes in D2O. The (n, m) indices are assigned to each PL resonance according to the scheme of Ref. 1. The spots at the bottom of the map correspond to the excitation on the S22 resonances of the nanotubes whereas the spots in the upper part of the map correspond to the excitation on the S33 levels.

FIG. 2 .

 2 FIG.2. Linear absorption spectrum (black) and PLE spectrum (red) of a (6,5) enriched suspension. Both spectra are normalized to the maximum of the S22 resonance to show their respective background contributions.

FIG. 3 .

 3 FIG.3. Deconvoluted PLE spectra for the (6,5) (a) and (10,2) (b) species (HiPCO (black) and CoMoCat (red)) extracted from the PL map of Figure1. The absolute value of σ is retrieved from the knowledge of the resonant S22 absorption cross-section[14] and assuming a flat internal conversion rate. The values are expressed per unit area allowing a direct comparison with the graphene case. The blue dashed line represents the equivalent absorption of a graphene layer. The black dashed lines show the non-resonant absorption plateaus that make up the input of Figure5. The solid blue line is the microscopic calculation of the absorption spectrum of the corresponding species after applying a global energy shift and a global convolution with a 150 meV (a) or 130 meV (b) broad Lorentzian. The inset in (a) shows the calculated spectra for a set of broadenings of 70, 100, 150 and 200 meV, showing that the magnitude and the shape of the non-resonant absorption is hardly altered..

FIG. 5 .

 5 FIG.5. Diameter dependence of the non-resonant absorption contribution extracted from deconvoluted PLE spectra for 10 species either between the S22 and S33 (σNR23) (a) or the S11 and S22 transitions (σNR12) (b). The black symbols stand for the HiPCO material and the red ones for the CoMoCat material. The blue dashed line represents the graphene absorption, while the magenta dashed line shows non-resonant absorption of nanotubes estimated within the zone-folding approximation.

FIG. 7 .

 7 FIG. 7. Transient bleaching of the S11 transition of (6,5) nanotubes in a micellar suspension subsequent to femto-second excitation at either their S22 transition (black line) or at several non-resonant energies as indicated in the figure. In all cases, the product of the pump power density with the absorbance was kept constant resulting in similar excitation densities. Inset : same data plotted on an extended time window.

Figure 9 FIG. 8 .FIG. 9 .

 989 Figure9shows the absorption spectrum calculated in the band-to-band approximation both for graphene and nanotubes as a function of reduced frequency ω ′ =

FIG. 10 .

 10 FIG.10. Comparison of regular PLE spectra (black solid line) with deconvoluted spectra (red line) from the global analysis method for selected chiral species with associated error bars.

FIG. 11 .

 11 FIG.11. Non-resonant absorption of several chiral species measured at the foot of their S33 (a) and S22 (b) transition as a function of the trigonal parameter q cos 3θ, where q = nm mod 3 .

Acknowledgement

This work was supported by the GDR-I GNT and the ANR grant "TRANCHANT". CV is a member of "Institut Universitaire de France". E.M. acknowledges financial support from the Einstein Foundation Berlin.