Joachim Kock
email: kock@math.unice.fr

Bertrand To Ën

SIMPLICIAL LOCALIZATION OF MONOIDAL STRUCTURES, AND A NON-LINEAR VERSION OF DELIGNE'S CONJECTURE

We show that if (M, ⊗, I) is a monoidal model category then REnd M (I) is a (weak) 2-monoid in sSet. This applies in particular when M is the category of A-bimodules over a simplicial monoid A: the derived endomorphisms of A then form its Hochschild cohomology, which therefore becomes a simplicial 2-monoid.

Introduction

Deligne's conjecture. Deligne's conjecture (stated informally in a letter in 1993) states that the Hochschild cohomology HH(A) of an associative algebra A is a 2algebra -this means that up to homotopy it has two compatible multiplication laws.

Various versions of this conjecture have been proved, cf. e.g. [START_REF] Getzler | Operads, homotopy algebra and iterated integrals for double loop spaces[END_REF], [START_REF] Gerstenhaber | Homotopy G-algebras and moduli space operad[END_REF], [START_REF] Dmitry | Another proof of M. Kontsevich formality theorem for R n[END_REF], [START_REF] Kontsevich | Operads and motives in deformation quantization[END_REF], [START_REF] Voronov | Homotopy Gerstenhaber algebras[END_REF], [START_REF] Mcclure | A solution of Deligne's Hochschild cohomology conjecture[END_REF], [START_REF] Kontsevich | Deformations of algebras over operads and the Deligne conjecture[END_REF], [START_REF] Hu | On Kontsevich's Hochschild cohomology conjecture[END_REF], [START_REF] Berger | Combinatorial operad actions on cochains[END_REF]. All these proofs are technical, and a more conceptual proof would certainly be desirable (we refer for example to [START_REF] Batanin | The Eckmann-Hilton argument, higher operads and En-spaces[END_REF] for a conceptual point of view on Deligne's conjecture based on higher category theory). In the present work we state a non-linear version of this conjecture, and provide an elementary proof of it based on model category theory and simplicial localization techniques à la Dwyer-Kan.

The main result of this work is the following. It can reasonably be considered as a model category version of the well known fact that the endomorphisms of the unit of a monoidal category form a commutative monoid.

Theorem. Let (M, ⊗, I) be a monoidal model category. The simplicial set of derived endomorphisms of the unit, REnd M (I), is a simplicial 2-monoid (cf. 1.2).

The theorem applies in particular when M is the category of A-bimodules over a simplicial monoid A. Then the Hochschild cohomology HH(A) is naturally identified with REnd Bimod A (A), and hence becomes a 2-monoid in sSet. This is what we refer to as the non-linear analogue of Deligne's conjecture.

The proof of our theorem relies heavily on ideas of Segal [START_REF] Segal | Categories and cohomology theories[END_REF] and Dwyer-Kan [START_REF] Dwyer | Function complexes in homotopical algebra[END_REF]. Once the statements have been formulated in terms of Segal categories, the theorem follows from two easy observations and an application of a theorem of Dwyer and Kan.

First it is observed that if a monoidal structure on a category is strictly compatible with a notion of equivalence, the Dwyer-Kan localization is a monoid 1 in the category 1 We warn the reader that the word monoid is used in this work in a much weaker sense than usual, and always refers to an underlying notion of equimorphisms. See 1.2 for details.

1 of simplicial categories (see 1.2), and by taking the endomorphism space of the unit object we get instead a monoid in the category of simplicial monoids, i.e., what we call a simplicial 2-monoid.

Second, in the case of a monoidal model category (in the sense of Hovey [START_REF] Hovey | Model categories[END_REF]), the monoidal operation does not preserve equivalences, but we observe that Hovey's 'unit axiom' expresses exactly that a suitable equivalent full subcategory has the strict compatibility and hence we have reduced to the first case.

The theorem of Dwyer-Kan [START_REF] Dwyer | Function complexes in homotopical algebra[END_REF] describes the derived homomorphisms of a model category (the simplicial function complexes) in terms of its simplicial localization.

It is fair to point out that our viewpoint and proof do not seem to work for the original Deligne conjecture, since currently the theory of Segal categories does not work well in linear contexts (like chain complexes), but only in cartesian monoidal contexts. Also, we did not investigate the relations between 2-monoids and simplicial sets with an action of the little 2-cube operad, and therefore our version of Deligne's conjecture might be considered as a bit far from the original one. However, our original motivation was not to give an additional proof of Deligne's conjecture, but rather to try to understand it from a more conceptual point of view. The new insight provided by our approach may also shed light on related subjects. We also think it is an interesting application of simplicial localization techniques.

Localization of monoidal coloured categories

1.1. Coloured categories and simplicial localization. By a coloured category we mean a pair (C, W ) where C is a category and W is a subclass of arrows, called equimorphisms (or coloured arrows), closed under composition, and comprising all isomorphisms. Key examples are Top, sSet, and Cat with the usual notions of (weak) equivalences as equimorphisms. For the present purposes, an equally important example is sCat, the category of simplicial categories (cf. [START_REF] Dwyer | Simplicial localizations of categories[END_REF]): a simplicial functor F : A → B is coloured if π 0 F : π 0 A → π 0 B is an equivalence of categories and for each pair of objects x, y ∈ A, the map A(x, y) → B(F x, F y) is a weak equivalence of simplicial sets.

The importance of coloured categories is that they can be localised and thus serve as context for expressing weak structures. Let CCat denote the category whose objects are coloured categories and whose arrows are functors that preserve equimorphisms. The classical notion of localization [START_REF] Gabriel | Calculus of fractions and homotopy theory[END_REF] is the functor Ho : CCat → Cat defined by formally inverting all equimorphisms. A much more sophisticated construction is the simplicial localization introduced by Dwyer-Kan [START_REF] Dwyer | Simplicial localizations of categories[END_REF], which can be seen as a derived version of Ho. It is a functor L : CCat → sCat. It reflects much more homotopy theoretic information than the classical localization, and in many respects it seems to be the 'correct' localization, of which the classical localization is just a truncation. (Indeed, the category of connected components of LC is equivalent to Ho(C).)

There are several possible ways of turning CCat into a coloured category itselfthe crucial desired property is that L should be colour-preserving. For simplicity we take this as the definition: a (colour-preserving) functor F : (C, W ) → (C ′ , W ′ ) between coloured categories is called an equifunctor if LF is an equivalence of simplicial categories.

1.2. Monoids and 2-monoids. Let (S, W ) be any of the coloured categories mentioned above -in particular S is monoidal with cartesian product as multiplication and the singleton object * as unit. A monoid in (S, W ) is a functor

X : ∆ op → S satisfying [S0] X 0 = * [S1] The natural maps X k → X 1 × • • • × X 1 are equimorphisms (k ≥ 1).
This last axiom is the Segal condition. It played a crucial rôle in Segal's work [START_REF] Segal | Categories and cohomology theories[END_REF] and was subsequently named after him by Tamsamani [START_REF] Tamsamani | Sur des notions de n-catégorie et n-groupoïde non strictes via des ensembles multi-simpliciaux[END_REF]. A monoid homomorphism is a natural transformation of such functors. The category Mon(S) of monoids and monoid homomorphisms is coloured via the forgetful functor to S. A 2-monoid in (S, W ) is by definition a monoid in Mon(S).

In the case S = sSet, a monoid is just a Segal category with a single object, and a 2-monoid is a Segal category with a single 0-cell and a single 1-cell. For the basic theory of Segal categories see [START_REF] Hirschowitz | Descente pour les n-champs[END_REF] or [START_REF] Toën | Segal topoi and stacks over Segal categories[END_REF]. Note that this notion of monoid makes sense only in cartesian monoidal categories (in the ususal sense), since it depends on the universal property of the product.

Monoidal categories as weak monoids.

A monoidal category can be described as a sort of weak monoid object in Cat. The weakness is usually described in terms of 2-cells subject to coherence constraints (e.g., as a bicategory with a single object). Here, we will adopt instead the simplicial viewpoint, and define a monoidal category as a monoid in Cat, in the sense of 1.2, conveniently hiding all questions of coherence from the user interface. This notion is not the same as the usual one defined in terms of coherence, but since monoidal categories in either sense are equivalent to strict monoidal categories, the two notions lead to the same homotopy theory. It is not trivial to make specific translation between the two languages (cf. Leinster [START_REF] Leinster | Homotopy algebras for operads[END_REF]; see also Segal [21]).

Monoidal coloured categories.

A monoidal coloured category is a monoidal structure on a coloured category (C, W ) whose structure functors are colour preserving. Precisely, we define a monoidal coloured category to be a functor ∆ op → CCat satisfying [S0] and [S1].

1.5. Localization of monoidal coloured categories. The way we have set things up it is immediate that the localization of a monoidal coloured category is a monoidal simplicial category. Indeed, it is just the composite

∆ op → CCat L -→ sCat.
Since L preserves the terminal object, preserves products up to equivalence (see [START_REF] Toën | Segal topoi and stacks over Segal categories[END_REF]Cor. 4.1.2]), and preserves equivalences, this composite will again satisfy [S0] and [S1]. (Similar remarks hold of course for the classical localization.) 1.6. Endomorphisms of the unit. In fact the simplicial categories appearing in the image are all pointed -the base point is simply the image of [0]. Thus we can in a canonical way compose with the endomorphism functor sCat * → Mon(sSet), associating to each pointed simplicial category the endomorphism monoid of the base point. This is a strict simplicial monoid, and this functor preserves products, terminal object, and equimorphisms. The whole composite is therefore a monoid object in Mon(sSet), i.e., a simplicial 2-monoid. Hence: Theorem 1. Let ((C, W ), ⊗, I) be a monoidal coloured category. Then LC(I, I) is a simplicial 2-monoid.

Localization of monoidal model categories

Model categories are prominent examples of coloured categories, and their richer structure allows for important variations on the localization theme.

2.1. The pushout product axiom. Localization of monoidal structure in a model category M was considered from the very beginning of model category theory: Quillen [START_REF] Quillen | Homotopical algebra[END_REF] observed that in order to induce a monoidal structure on Ho(M ), it is not necessary for a monoidal structure on M to preserve equivalences on the nose, as in the general coloured case 1.4. It is enough that the unit is cofibrant and that ⊗ satisfies the pushout product axiom: given cofibrations A 1 → A 2 and B 1 → B 2 then the induced map

(A 1 ⊗ B 2 ) A 1 ⊗B 1 (A 2 ⊗ B 1 ) -→ A 2 ⊗ B 2
is again a cofibration, and if furthermore one of the two original maps is a trivial cofibration then the induced map is too. Indeed, in this case it follows easily from Ken Brown's Lemma that the full subcategory of cofibrant objects M c is a monoidal coloured category, and in any case M c and M have the same homotopy type, so one can induce a monoidal structure on Ho(M ) by taking it from Ho(M c ).

2.2. The unit axiom. Later, Hovey [START_REF] Hovey | Model categories[END_REF] remarked that the requirement that the unit be cofibrant can be relaxed: assuming the pushout product axiom holds, it is enough that M satisfies the unit axiom: for a given cofibrant replacement functor Q : M → M c , and for every cofibrant X, the composite QI ⊗ X → I ⊗ X → X is an equivalence (and similarly from the right). In this situation, even though the multiplication law on M c is not unital, the induced multiplication on Ho(M ) ≃ Ho(M c ) does in fact acquire a unit. This justifies the terminology of Hovey [START_REF] Hovey | Model categories[END_REF] which has become standard:

Definition. A monoidal model category is a model category with a monoidal structure satisfying the pushout product axiom and the unit axiom.

The following simple observation seems not to have been made before. Assume the pushout property axiom holds in (M, ⊗, I), and let M denote the full subcategory of all cofibrant objects together with the unit. 2.3. Lemma. The unit axiom holds in (M, ⊗, I) if and only if (M , ⊗, I) is a monoidal coloured category (i.e., the monoidal operation preserves equivalences).

Proof. Simply note that the unit axiom holds for QI ∼ → I if and only if for any cofibrant Z with an equivalence Z ∼ → I the conclusion of the unit axiom holds: for cofibrant X, the map Z ⊗ X → I ⊗ X → X is an equivalence. Now an equivalence in M is either one between cofibrant objects (which case is covered by the pushout product axiom), or of the type Z ∼ → I (the situation just analysed), or I ∼ → Z. But this last type of equivalences is preserved under ⊗, provided the unit axioms holds, as it readily follows by taking a cofibrant replacement of the map and invoking the 2-out-of-3 axiom for a model category.

It is easy to see that the monoidal structure induced on Ho(M ) by Hovey's arguments (resp. on LM ) is merely the one coming from Ho(M ) (resp. from LM ) via the direct construction of 1.5. One observation is due for this to make sense: 2.4. Lemma. The full embedding F : M ֒→ M induces an equivalence LM ∼ → LM of simplicial categories.

Proof. In fact this is true for any full subcategory sandwiched between M c and M . A cofibrant replacement functor

Q : M → M c ֒→ M comes with natural transfor- mations Q • F ⇒ id M and F • Q ⇒ id M ,
whose components are equivalences. By standard arguments (see [START_REF] Hirschowitz | Descente pour les n-champs[END_REF]Lemma 8.1] for all details), this induces an equivalence after simplicial localization.

2.5. Derived endomorphisms. The derived hom set (simplicial function complex) of a pair of objects in a model category is usually defined in terms of fibrant-cofibrant resolutions functors (see e.g. [START_REF] Dwyer | Function complexes in homotopical algebra[END_REF]). We will denote them by RHom M (-, -). For two objects A and B in M , RHom M (A, B) is an object in sSet defined up to equivalence. Of course, RHom M (A, A) is denoted by REnd M (A).

A deep result of Dwyer-Kan [START_REF] Dwyer | Function complexes in homotopical algebra[END_REF] states that this simplicial set is equivalent to the simplicial hom sets of the simplicial localization: Of course, the expression is in the above theorem really means is equivalent to the underlying simplicial set of a 2-monoid in sSet.

RHom M (A, B) ≃ LM (A, B) ≃ LM (A, B).
2.6. Remark. In some cases the trick of just adding the non-cofibrant unit by hand is not appropriate: for example in K-theory one studies Waldhausen categories which are subcategories of the category of cofibrant objects, and one cannot just add the unit. In a similar vein, Spitzweck [START_REF] Spitzweck | Operads, algebras and modules in model categories and motives[END_REF] works with a notion of monoidal model category with pseudo-unit: this pseudo-unit does not act as a unit, but its cofibrant replacements do, up to homotopy. In these cases the important structure is not the 'unit' itself but rather the space of cofibrant replacements. These cases are accounted for by the theory of monoidal categories with weak units, and more generally higher categories with weak identity arrows, where instead of strict identities each object has a contractible space of up-to-homotopy identity arrows. The basics of this theory is worked out elsewhere; see [START_REF] Kock | A notion of weak identity arrows in higher categories[END_REF] for an introduction. In fact our original approach to the theorem was with weak units, but for the present purpose the M trick seems simpler.

3.

A simplicial version of Deligne's conjecture 3.1. Bimodules. Let A be a simplicial monoid (in the strict sense, i.e. a simplicial object in the category of monoids), then A × A op is again a simplicial monoid, and we can consider the category of (A × A op )-modules (i.e., simplicial sets with a (A × A op )-action). (A × A op )-modules will be called A-bimodules, and the category of A-bimodules is denoted by Bimod A . This category carries a natural model structure whose fibrations and equivalences are induced via the forgetful functor Bimod A → sSet (this is standard, see e.g. Schwede-Shipley [START_REF] Schwede | Algebras and modules in monoidal model categories[END_REF]). There is a tensor product defined on Bimod A as the coequalizer

M × A × N ⇉ M × N → M ⊗ A N .
The bimodule A itself is the unit for ⊗ A . A ,⊗ A ,A) is a monoidal model category.

Lemma. (Bimod

Proof. The proof of the lemma relies on a small object argument, using the standard generating sets of cofibrations and trivial cofibrations (described in [START_REF] Schwede | Algebras and modules in monoidal model categories[END_REF]), as explained in [11, 4.3].

Let us recall that the forgetful functor Bimod A → sSet possesses a left adjoint F : sSet → Bimod A , sending a simplicial set X to the free A-bimodule F (X) = A× X ×A. If I 0 (resp. J 0 ) is a set of generating cofibrations (resp. trivial cofibrations) in sSet then I = F (I 0 ) (resp. J = F (J 0 )) is a set of generating cofibrations (resp. trivial cofibrations) in Bimod A .

To prove the pushout product axiom in Bimod A it is enough by [11, 4.3] to notice that for two simplicial sets X and Y one has a natural isomorphism of Abimodule

F (X) ⊗ A F (Y ) ≃ F (X × A × Y ).
The pushout product axiom in Bimod A is then a direct consequence of the wellknown facts that the functor F is left Quillen and that the pushout product axiom holds in sSet.

It remains to prove the unit axiom in Bimod A . For this we use the standard free resolution associated to the forgetful functor Bimod A → sSet (see e.g. Illusie [START_REF] Illusie | Complexe cotangent et déformations[END_REF]). Let us recall that for any A-bimodule M , one constructs a simplicial object P * (M ) in Bimod A , together with an augmentation P 0 (M ) → M such that the natural morphism hocolim n∈∆ op P n (M ) -→ M is an equivalence in Bimod A . Furthermore, each A-bimodule P n (M ) is free and given by P n (M ) : = F (P n-1 (M )), and the various face and degeneracy morphisms are given by using the adjunction between the forgetful functor and F . Since each P n (M ) is a cofibrant object in Bimod A (as it is free), we can use Hirschhorn [START_REF] Hirschhorn | Model categories and their localizations[END_REF]Thm. 19.4.2] to see that hocolim n P n (M ) is a cofibrant model for M . To check the unit axiom it is therefore enough by [11, 4.3] to prove that for any simplicial set X the natural morphism

(hocolim n P n (A)) ⊗ A F (X) -→ A ⊗ A F (X) ≃ F (X) is an equivalence. Clearly this morphism is isomorphic to hocolim n (P n (A) ⊗ A F (X)) -→ A ⊗ A F (X) ≃ F (X).
But, P n (A)⊗ A F (X) ≃ P n (A)× X × A, at least in sSet, and therefore the morphism is in fact isomorphic, as a morphism in sSet, to

hocolim n (P n (A) × X × A) -→ A × X × A = F (X).
The fact that this last morphism is an equivalence follows simply from the fact that P * (A) is a simplicial resolution of A and that homotopy colimits commute, up to equivalences, with products.

Note that the unit object A of the model category Bimod A is not cofibrant. Indeed, cofibrant means roughly 'free', i.e., direct sum of copies of A × A op , but A is rather a quotient.

3.3.

The Hochschild cohomology. The Hochschild cohomology of a simplicial monoid A can naturally be defined as

HH(A) : = REnd Bimod A (A).
The Hochschild cohomology of a simplicial monoid is clearly a homotopy version of its centre. Indeed, if M is a monoid (in the category of sets), the endomorphisms of M as a M -bimodule is naturally isomorphic to the centre of M .

There exist also more explicit descriptions of the Hochschild cohomology of a simplicial monoid A, more in the style of the Hochschild complex of an associative algebra. They can be obtained by taking explicit cofibrant replacement of A as an A-bimodule.

Finally, Theorem 2 applies, yielding the following corollary, which we call a theorem for emphasis: Theorem 3. Let A be a simplicial monoid. Then the Hochschild cohomology HH(A) is a simplicial 2-monoid.

Higher dimensional generalization

Theorem 3 can be generalized in the following way in terms of Segal categories (starting from the observation that a simplicial monoid is a Segal 1-monoid). First of all, the definition of monoids in a coloured category as described in 1.2 can be iterated. Starting by letting 0-SeMon be the coloured category of simplicial sets and equivalences, one defines (for d ≥ 1) the coloured category d-SeMon of Segal d-monoids as d-SeMon : = Mon (d-1)-SeMon , in the sense of 1.2.

Any Segal d-monoid M has an underlying Segal 1-monoid, which up to equivalence can be chosen to be a simplicial monoid in the usual sense (i.e. a simplicial object in the category of monoids), cf. e.g. [START_REF] Hirschowitz | Descente pour les n-champs[END_REF][START_REF] Getzler | Operads, homotopy algebra and iterated integrals for double loop spaces[END_REF]. We define the Hochschild cohomology of a Segal d-monoid to be the Hochschild cohomology of its underlying simplicial monoid, as defined in 3.3. Theorem 3 now has the following generalization. We will not include the proof of this theorem as it uses the theory of Segal categories and the so-called strictification theorem stated in [START_REF] Toën | Segal topoi and stacks over Segal categories[END_REF]. It would be interesting however to have a model category proof of Theorem 4. A possible approach would be through a suitable notion of iterated model category, which roughly would be an iterated monoidal category in the sense of [START_REF] Bȃlteanu | Iterated monoidal categories[END_REF], together with a compatible model category structure. Our Theorem 2 should then generalize as follows: if M is a d-times iterated monoidal model category then REnd M (I) is a (d + 1)-monoid.

(

  This was actually the original motivation for introducing simplicial localization.) In particular, by lemma 2.4 we have REnd M (I) ≃ LM (I, I), and in combination with Theorem 1 we get Theorem 2. Let (M, ⊗, I) be a monoidal model category. Then REnd M (I) is a simplicial 2-monoid.

Theorem 4 .

 4 Let A be a Segal d-monoid. Then the Hochschild cohomology HH(A) is a Segal (d + 1)-monoid.

Acknowledgements. We are thankful to André Hirschowitz and Clemens Berger for fruitful discussions, and to V. Hinich and A. Voronov for pointing out some references on Deligne's conjecture. The first named author wishes to thank the University of Nice for support.


Ph Stee

A Meilland

Ph Bendjoya

F Millour

M Smith

A Spang

G Duvert

K.-H Hofmann

F Massi

Evidence of an asymmetrical Keplerian disk in the Brγ and He I emission lines around the Be star HD 110432 ⋆

Keywords: high angular resolution -Techniques: interferometric -Stars: emission-line, Be -Stars: winds, outflows -Stars: individual (γ Cas) -Stars: circumstellar matter

 suggest that it might be a Be star harboring an accreting white dwarf or that the X-rays may come from an interaction between the surface of the star and its disk. Aims. To investigate the disk around this Be star we used the VLTI/AMBER instrument, which combines high spectral (R=12000) and high spatial (θ min =4 mas) resolutions. Methods. We constrain the geometry and kinematics of its circumstellar disk from the highest spatial resolution ever achieved on this star.

 that the inclination should be more than the γ Cas value. In the near-IR continuum, the disk of HD 110432 is 3 times larger than γ Cas's disk. We have no direct evidence of a companion around HD 110432, but it seems that we have a clear signature for disk inhomogeneities as detected for ζ Tau. This asymmetrical disk detection may be interpreted within the one-armed oscillation viscous disk framework. Another finding is that the disk size in the near-IR is similar to other Be stars with different spectral types and thus may be independent of the stellar parameters, as found for classical Be stars.

Introduction

HD 110432 (BZ Cru = HR 4830, B0.5-1 III-IVe; Dachs et al. (1986); Smith & Balona (2006)) is an interesting object since it exhibits variable hard-thermal X-rays, which is very different from other "classical" massive stars that are emitting soft X-rays or from non-thermal emission of all known Be/X ray binaries. The other well known Be star sharing these properties is γ Cas. Smith & Balona (2006) propose that HD 110432 should be the first new member of a select new class of "γ Cas X-ray analogs." These analogs exhibit the same peculiar X-ray and optical characteristics, i.e. Balmer and Fe II double-peaked emission lines with a strong IR excess due to free-free and free-bound emission (Stellebak 1982;Meyer & Savage 1981), as γ Cas itself. HD110432 is not yet known to be in a binary system. However, it may be a member of the cluster NGC 4609 (Feinstein & Marraco 1979). In this case its age would be 60 Myr, and it is a candidate Send offprint requests to: Philippe.Stee@oca.eu ⋆ Based on observations made with VLTI ESO telescopes at La Silla Paranal Observatory under GTO programme IDs 0.84.C-0062(A), 0.84.C-0062(B), 0.84.C-0062(C), 0.84.C-0062 (D) for a blue straggler. In addition, the star is situated near and beyond the Southern Coalsack dark nebula. However, only the UV reddening and extinction are appreciably affected by the presence of this nebula in the foreground.

The X-ray properties of HD 110432 have been described well by a series of papers by Lopes de Oliveira et al. (2007), Torrejón et al. (2012), and [START_REF] Smith | Interplay ofPeriodic, Cyclic, & Stochastic Variability in Selected Areas of the H-R Diagram[END_REF]. Although the Xray flaring properties are very comparable, the last two papers demonstrate that the dominant hot thermal plasma component associated with HD 110432 emission is even hotter than the analogous component of γ Cas.

The origin of this X-Ray emission of these γ Cas variables is still a subject of debate. Currently there are two competing scenarios. The first one is based on single Be stars with unusual strong magnetic activity and rapid X-ray correlations with optical and UV activity (see [START_REF] Smith | Interplay ofPeriodic, Cyclic, & Stochastic Variability in Selected Areas of the H-R Diagram[END_REF], Henry & Smith (2012), [START_REF] Smith | Interplay ofPeriodic, Cyclic, & Stochastic Variability in Selected Areas of the H-R Diagram[END_REF]). The second scenario proposes a binary system with a Be star and an accreting degenerate companion, such as a white dwarf in accordance with the evolutionary models of massive binary systems. Ph. Stee et al.: HD 110432 circumstellar disk studies with the VLTI/AMBER instrument To better constrain the physics and the mechanism responsible for this X-ray emission, as well as the link to its circumstellar environment, we observed this Be star with the Very Large Telescope Interferometer (VLTI) combining 1.8m telescopes on baselines up to 128m, with the AMBER focal instrument that combines high spectral (R=12000) and high spatial (θ min =4 mas) resolutions (Petrov et al. 2007;Robbe-Dubois et al. 2007) mainly focused on the Brγ and He I 2.05 µm emission lines.

In this paper, we would like to address the following points.

• If there is a strong coupling between a putative magnetic field and the circumstellar disk that may lead to part of the observed X-ray emission, is the disk forced to rotate as a solid body by the magnetic field? What is the kinematics within HD110432's circumstellar environment? (2012) for eight other Be stars? • Since the binarity of HD 110432 may figure in the production of the hard-thermal X-ray emission, either as a source of X-ray emission or previous transfer of angular momentum to the Be star, do we have any evidence of a companion in our interferometric data?

The paper is organized as follows. In Section 2 we summarize the stellar parameters of HD 110432. In Section 3 we present the VLTI/AMBER observations and the data reduction process. A first analysis using an axi-symmetrical geometrical models is presented in Sects. 4 and 5, and a more advanced modeling of the differential data using a kinematic model is discussed in Section 6. Finally, we summarize our results in Section 7.

The stellar parameters and distance

To constrain the stellar contribution to the total flux we need to know the effective temperature T eff , the radius R ⋆ , and the gravity log g eff of the central star. However, these stellar parameters for rapidly rotating Be stars are quite uncertain. Taking gravitational darkening effects into account, Frémat et al. (2005) showed that the apparent T eff is typically thought to be ∼ 5 % to 15% colder than the values of the non rotating counterparts.

In the case of HD 110432, they found an apparent T eff of 20324±344K and T eff of 24070±603 for its parent non rotating counterpart (pnrc). Using the same method, Zorec et al. (2005) derived an average T eff on the stellar surface of 22510 K. Knowing these uncertainties on the definition of the effective temperature, we adopted T eff =22000±2000K in this paper.

On the other hand, Frémat et al. find an apparent g eff of 3.638±0.042 and 3.950±0.074 for the pnrc. As this parameter does not strongly affect the overall SED and the determination of the stellar fluxes in the infrared, we simply assume g eff =3.9±0.1.

The stellar radius is also strongly affected by the stellar rotation. Zorec et al. (2005) 7.7R ⊙ . We note that the mean apparent radius will depend on the object inclination angle. However, here we decide to adopt a value of R ⋆ =6.5±1.2R ⊙ . Using the distance derived from van Leeuven (2007) Hipparcos parallaxes, i.e. d=373±pc, we infer a photosphere angular size of 0.16 mas. The parameters are summarized in Table 1.

Using this set of stellar parameters and photometric measurements from the SIMBAD1 database, we tried to determine the relative flux of the circumstellar environment within the VLTI/AMBER spectral domain, i.e. the H and K bands. To determine the stellar flux in these bands we used Kurucz models reddened using the law of extinction from [START_REF] Ph | HD 110432 circumstellar disk studies with the VLTI/AMBER instrument[END_REF]. However, we found that the influence of the reddening in the near-infrared fluxes is negligible compared to the uncertainties on the stellar parameters and distance.

Finally we found that the emission in the H and K bands are both dominated by the circumstellar environment with a relative circumstellar flux (F disk ) of 71±7% and 79±5%, respectively.

Observations and data reduction process

HD 110432, was observed in January, February and March 2010 with the A0-K0-G1 and D0-H0-G1 VLTI/AMBER triplets of the 1.8m Auxiliary Telescopes array, ranging from 51 to 124m baselines (See Fig. 1). We used both low resolution (LR=30) and high resolution (HR=12000) measurements in the H (1.54-1.87µm) and K (1.94-2.37µm) bands with the help of the FINITO fringe tracker. With an apparent diameter of 0.83 ± 0.01 mas in the CHARM2 catalog from Richichi et al. (2005), HD 113752 was used to calibrate the visibility measurements (see Table 2). More details about the AMBER instrument can be found in Petrov et al. (2007).

Data were reduced using the VLTI/AMBER data reduction software, i.e., amdlib v3.0.3b1 (see Tatulli et al. 2007 andChelli et al. 2009 for detailed information on the AMBER data reduction). We selected individual exposures with the standard selection criteria (Millour et al. 2007). We rejected the 80% of frames with the lowest S/N. For observations in LR mode we also rejected the frames with a piston larger than 10µm, as well as frames with a flux ratio between the beams higher than three.

The interferometric observables (visibility, differential phase, and closure phase) were then averaged and calibrated. For this last step we used scripts described in Millour et al. (2007) that are now part of the standard amdlib package. The calibration process includes an estimation of the calibrators' size and their uncertainties from various catalogs, a determination of the transfer functions and their evolution during the whole night, and a computation of the calibrated visibilities and phases. The final errors on the measurements include uncertainties on the calibrators' diameter, the atmosphere transfer function fluctuations, and intrinsic errors on the measurements (Fig. 2). It uses data error estimates based on the OI FITS format, which does not include error correlation estimates. Therefore, in some cases, LITpro can provide underestimated errors on the parameters.

Modeling the H and K band continuum

2 LITpro software available at http://www.jmmc.fr/litpro

Extension of HD110432 in the continuum

Even if the spatial resolution of the VLTI/AMBER instrument is about 4 mas, it is not necessary to fully resolve the target, i.e. to reach the first zero of the visibility function to estimate its size.

It is always possible to use a partial resolution of the interferometer to estimate the size of the target with a model that fits the data and thus determines the angular size of targets smaller than 4 mas. See for instance the review of the interferometric observations of rapidly rotating stars by van Belle (2012). Thus, to estimate the disk extension in the near infrared, we model the central star as a uniform disk + an extended elliptical Gaussian distribution. This model then has four free parameters: the FWHM of the major axis of the Gaussian distribution (θ disk ), the relative environment continuum flux (F disk ), the flattening ratio of the major to the minor Gaussian distribution axis (f), and the position angle of the major axis of the disk measured eastward from the north (P.A).

Since we have VLTI/AMBER data in two different spectral domains, namely the H band between 1.54-1.87 µm and the K band within 1.94-2.37 µm, we tried to constrain both data sets separately. HD 110432 is a variable Be star, and the data used to estimate the circumstellar contribution to the total near-IR continuum flux is not contemporaneous to our interferometric measurements. Nevertheless, using the values of F disk obtained in section 2, i.e. 71±7% and 79±5% in the H and K bands respectively, we can infer the disk dimension in the continuum.

The best LITpro models and the corresponding extensions are given in Table 3. We obtain a major Gaussian distribution axis of 0.92 mas, a flattening ratio of 1.56 in the H band that, assuming a flat disk, corresponds to 50 ± 5 • with a reduced χ 2 r of 4.4 and a P.A. of 22± 5 • . In the K band the disk appears to have similar properties: an angular size of 0.95 mas, a flattening of 1.62 corresponding to an inclination inclination angle of 52 ± 5 • and a compatible P.A of 17 ± 5 • . These extensions are similar to the disk size in the near-IR continuum, i.e. 0.82±0.08 mas, obtained for γ Cas by Stee et al. (2012). Nevertheless, for γ Cas it corresponds to 1.9 D ⋆ and thus HD 110432 exhibits a disk size three times larger in the near-IR continuum than γ Cas. An intensity map in the K band is plotted in Fig. 3. The P.A. of ∼ 20 • is neither perpendicular nor parallel to the polarization measurement of 81 • by Yudin (2001). The error bars on these disk measurements are mainly dominated by the uncertainties on the disk flux contribution in the H and K bands.

Modeling the disk in Brγ and HeI emission lines

The kinematic model

To quantitatively constrain the velocity fields in the circumstellar environment of HD110432, we developed a simple twodimensional kinematic model of a rotating and/or expanding equatorial disk. This model has already been used to successfully model classical Be stars (see Delaa et al. 2011;Meilland et al. 2011;Meilland et al. 2012) and is described in detail in Delaa et al. (2011). The model geometry is completely ad-hoc: the star is modeled as a uniform disk and the envelope emission in the emission line as an elliptical Gaussian distribution with a given FWHM and a flattening due to a projection effect of the geometrically thin equatorial disk, i.e., f = 1/cos(i), where i is the star-disk system's inclination angle.

The emission maps are then combined with a twodimensional projected velocity map of a geometrically thin expanding and/or rotating equatorial disk. For each spectral channel in the line, an iso-velocity map projected along the line of sight is then calculated and multiplied by the whole emission map in the line.

The model parameters can be classified into three categories:

Inclination (i) 50 • 52 • F disk (%) 71 ±7 79 ±5 χ 2 r 4.4 3.4
Notes. θ disk is the FWHM of the major axis of the Gaussian distribution, F disk the relative environment continuum flux, f the flattening ratio of the major to the minor Gaussian distribution axis, and P.A. the position angle of the major axis of the disk measured eastward from the north. The estimated inclination angle (i) is given assuming a very thin disk.

The star distance is taken from van Leeuwen (2007), and R ⋆ is derived from the fit of the SED. The nine other parameters are free.

If the disk is directly connected to the stellar surface, the rotational velocity (V rot ) should be equal to the stellar rotational velocity. However, in some cases, V rot may exceed the stellar velocity if the star is not critically rotating and some additional momentum is transferred to the circumstellar matter. Finally, we considered in our modeling that V rot is a free parameter with a higher maximum value equal to the critical velocity (V c ).

Model fitting and results

We have computed several hundred models to constrain the parameters, determined the uncertainties, and tried to detect any degeneracy or linked parameters. Owing to the large number of free-parameters, an automatic model-fitting method would have resulted in computing millions of models. Moreover, we clearly know each parameter's effect on the visibility and phase variations (see Meilland et al. 2012). Consequently, we decided to perform the fit manually. We could exclude models with significant expansion velocity of more than a few km s -1 . Consequently, we decided to set the expansion velocities to zero. We then tried to constrain the seven remaining parameters (i, PA, V rot , β, a c , a l , and EW). To reduce the number of computed models, we started with a qualitative estimation of the parameters from our interferometric data (especially for PA, i, a c , a l , and EW l ) and explored the parameter space with decreasing steps to converge to a χ 2 minimum. To check for other minima, we also explored the full range of possible parameters space but with larger steps.

The parameter values for the best-fit model are presented in Table 4. The corresponding differential visibilities and phases are overplotted in Figs. 4 and5. For this model, we obtained a reduced χ 2 of 2.0. The overall morphology and amplitude of the lines' profile and differential visibilities and phases are roughly fitted. Nevertheless, such a simple axisymmetric model cannot reproduce the asymmetries of the spectro-interferometric data, and this issue will be discussed in more detail in Section 6.3.

Discussion

The central star

We obtain the same inclination angle i.e. i=55 ± 5 • , similar to the one determined from the continuum fit in the previous section and a P.A. of 45 ± 10 • , larger than the P.A obtained in the H and K bands (∼ 20± 5 • ). This is more than the value found for γ Cas (about 42 Yudin (2001). We obtain a rotational velocity of 450 ± 50 km s -1 . Assuming that V rot , the velocity at the base of the disk is the stellar rotational velocity, we obtain a V sin i of 368±43 km.s -1 . This is higher than the value determined by Slettebak (1982), i.e. Vsin i ≃ 300 km s -1 , and Ballereau et al. (1995), i.e. Vsin i ≃ 318km s -1 , but compatible with Vsin i = 400 ± 30 km s -1 determined by Chauville et al. (2001) from model fitting of the HeI 4471 and MgII 4481 lines, duly corrected for the veiling effect and considering wavelengthdependent limb darkening inside the spectral lines.

As already noted in Sect. 2, Zorec et al. (2005) estimate that the stellar mass is M/M ⊙ = 9.6. Consequently, this gives a critical velocity for the star of V c = 487 ± 32 km s -1 . With this value, an inclination angle of 55±5 o , and Chauville et al.(2005) V sin i of 400±30km s -1 , we obtain V rot /V c =1.00±0.2. Consequently we can conclude that HD 110432 is rotating very close to its breakup velocity, like almost all interferometrically observed Be stars.

The disk kinematics and extension

The disk is rotating following a Keplerian rotation, as is now clearly established for Be stars (Meilland et al. 2007;Meilland et al. 2012). Since this is the first interferometric observation of HD 110432, it is difficult to compare the geometry obtained. However, we can compare disk radii in the Brγ with the measurements obtained in a survey of eight Be stars by Meilland et al. (2012). Using the same equipment and reduction algorithms we found that in Brγ flux at least the disk size of HD 110432 is larger to those of α Col (5.5 ± 0.3 R ⋆ ) and α Ara (5.8 ± 0.5 R ⋆ ). Following Meilland et al. (2012), we note that α Col is a B7IV star with a T e f f of 12963 ± 203 K and α Ara a B3IV star with a T e f f of 18044 ± 312 K. Since both are considerably cooler than HD 110432, conditions other than only the stellar effective temperature do influence the disk size.

We recall that the total emitted flux in the Brγ line has two components. One of them is due to the photospheric absorption of the star that underlies the circumstellar disk or envelope. The other component corresponds to the emission produced in the circumstellar environment.

For this simple model, we can write the expression of the modulus of the visibility in the Brγ line as

V Brγ = V ⋆Brγ F ⋆Brγ + V envBrγ F envBrγ F tot , (1)
where V ⋆Brγ and F ⋆Brγ represent the visibility and the flux of the photospheric Brγ absorption respectively, while V envBrγ and F envBrγ are the visibility and the flux emitted by the envelope in the Brγ line. The F tot flux is simply

F tot = F ⋆Brγ + F envBrγ . (2)
The quantity of interest in our analysis of the emitting region (V envBrγ ) can then be written by using Eq.1 and Eq.2:

V envBrγ = V Brγ -V ⋆Brγ F ⋆Brγ F tot 1 - F ⋆Brγ F tot . (3)
Thus, changing the effective temperature will change the ratio

F ⋆Brγ
F tot in a nontrivial way since it may increase F ⋆Brγ but also change the value of F envBrγ . This is because modifying T e f f will also change the source function of the disk emitting region. The same argument applies to the formation of He I line and nearby continuum emission.

From this paper and the cited work, the disk size does not seem to be correlated with the stellar spectral type. We also measured the disk size within the He I emission line at 2.05 µm, which seems to be smaller compared to the Brγ line, i.e. 7.8 vs 10.2 D ⋆ . To our knowledge, the only other Be star with a disk measurement in the He I 2.05 µm emission line was the binary Be star δ Sco with a disk extension of 4.5 ± 0.5 D ⋆ (Meilland et al. 2011), thus smaller than our measurement by a factor 1.7. In the Brγ, Meilland et al. (2011) find a FWHM of 5.5 ± 1D ⋆ , again 1.8 times smaller than the one we measured for HD 110432. The difference may originate from the youth of δ Scorpii disk, which started to form in 2000 and which was still growing in 2010 according to the same authors. Note that Meilland et al. (2011) were able to measure the disk of δ Sco in the Brγ line out to the inferred disk truncation radius, i.e. ∼ 2.24 mas or 4.2 R ⋆ at periastron. But this truncation radius is impossible to determine for HD 110432 since the mass and the separation of the system components (assuming the star is a binary) are unknown. In a recent paper, Touhami et al. ( 2011) have estimated the nearinfrared continuum emission from the circumstellar gas disk of Be stars using a radiative transfer code for a parametrized version of the viscous decretion disk model. They were able to predict the half-maximum emission radius along the major axis of the projected disk in the H and K bands. For HD 110432 they obtain a color excess E ⋆ (V ⋆ -18µm) of 2.5 which corresponds to a disk density of ∼ 3.1 10 -11 g cm -3 from their Fig. 1. Using their Fig. 2 and Table 1, it translates into a disk HWHM radius of ∼1.41-1.58 R ⋆ so smaller than our ∼ 5.8 R ⋆ . To obtain a similar disk size, it seems from their Table, that the disk density is certainly higher, i.e. ∼ 1.0 10 -11 g cm -3 . On the other hand, many effects may explain this discrepancy:

• A larger disk inclination and a density of ∼ 8.1 10 -11 g cm -3 . The estimated radius by Touhami et al. ( 2011) becomes 3.13 R ⋆ . • The contamination of the interferometric visibilities from the incoherent light of a possible companion close enough to influence our signal at the time of the VLTI observations. In that case, a correction of the visibilities from this contamination is necessary before solving for the angular diameter of the disk. That would considerably lower the fitting value of angular size. Although Mason et al. (1997) did not detect a companion through speckle, neither do we, and the system is suspected to be a high mass X-ray binary. • Variability: our interferometric measurements were taken at the beginning of 2010, whereas the AKARI IR excesses originated before 2010. • The value for the density exponent adopted in the model (n=3) by Touhami et al. (2011) . This assumption could be argued to justify the higher disk size. In fact, the IR excess and the disk size are highly sensitive to this parameter. • The HWHM used in their model is the image disk radius, which could be slightly different from the disk radius obtained from a Gaussian elliptical disk. • A higher density than what the model predicts, which may be a clue to a new outburst episode. This could be verified by looking for variabilities in Hα EW, but unfortunately we were not able to find any Hα spectra before 2010.

Disk inhomogeneities

We see from Fig 4 and Fig 5 that the differential phases for these two lines are, first, represented well by our very simple kinematical model, and second that they exhibit the typical "S" shape of a rotating disk. The amplitude of this "S" shape is ∼ 10 -15 • , which is very similar to the differential phases obtained by Carciofi et al. (2009) for the Be star ζ Tau, and for δ Sco by Meilland et al. (2011). Our differential phases exhibit a very asymmetrical "S" shape with a smaller amplitude in the blue part of the "S" curve with respect to the central line wavelength. This was also the case for ζ Tau. This was clear evidence for a one-armed spiral structure in the ζ Tau disk, which may also be the case for HD 110432. Moreover, our visibilities across the Brγ line are asymmetrical, with a red wing of the visibility systematically smaller than the blue wing. The line profiles are also clearly asymmetrical, with Brγ and He I line profiles showing a V/R < 1 even if the S/N and spectral resolution for He I are not high enough to clearly believe this line asymmetry (See Fig. 6). Our simple symmetrical "toy" model is not able to reproduce the V/R of the observed profiles as seen from Fig. 6.

Thus, HD 110432 circumstellar disk is globally rotating, with a larger volume and brighter region responsible for the red part of the line, i.e. flowing away from us, and a smaller (more compact), fainter, or more absorbed region in the blue part of the line, i.e. rotating in our direction. These emitting regions are also responsible for the Brγ line profiles with V/R < 1. Moreover, since the differential phase is asymmetrical, it means that the photocenter of the emitting regions is asymmetric with respect to the central star (or the rotational axis).

To account for these asymmetries, we tested two different types of asymmetric models. In the first one the line emission is modeled by an asymmetric gaussian disk :

I l (r, θ) = e -r 2 2σ 2 (θ) with σ(θ) = σ 0 (1 + A cos(θ -θ 0 )) (4)
In this model the Gaussian width, given by σ, depends on the azimuth θ. The reference for the azimuth (θ=0 o ) is the projected polar axis of the star. The parameters A and θ 0 set the amplitude and orientation of the asymmetry, respectively.

In the second type of asymmetric model, we try to roughly reproduce the one-arm oscillation model presented in Okazaki (1997). Thus, we consider an antisymmetric spiral-like intensity distribution given by

I l (r, θ) = e (-r 2 2σ 2 ) (1 + A cos(θ -θ 0 -πr/T )) (5)
where A is the amplitude of the spiral perturbation of the Gaussian distribution, and T the spiral period.

Examples of both intensity distributions are shown in Figure 7.

As for the axi-symmetric model, the intensity distribution is then rotated on the skyplane and flattened, taking the inclination angle of the object into account. The use of these models significantly improve the fit of the data. The χ 2 r obtained for the best-fit asymmetric Gaussian disk and the antisymmetric spiral are 1.4 and 1.6, respectively, compared to 2 for the symmetrical model (see section 5). For both types of models, the best-fit model was obtained without modifying the stellar and kinematic parameters from Table 4 and with only minor changes in terms of the FWHM of the intensity distribution and/or equivalent width of the emission line. The corresponding parameters values for these models, namely A, θ 0 , and T , are presented in Table 5.

The two additional parameters for the asymmetric Gaussian disk, i.e. A and θ 0 are well constrained. The asymmetry is quite large, i.e. the largest disk extension is about 1.7 times the smallest one and the over intensity is orientated close to the projected minor axis, and mainly to the south-east. In the case of the antisymmetric spiral model, we could not obtain asymmetric visibility variations for a period of the spiral arms of less than T=20 R ⋆ . Actually, for shorter periods, the asymmetries introduced in the model by the spiral averaged themselves out, considering that the disk FWHM in the emission lines are on the order of 4-5R ⋆ . Nevertheless, for longer periods, we were still able to constrain the two other parameters for this model. As for the asymmetric Gaussian disk model, we obtain an asymmetry that is roughly oriented in the south-east. Finally, the better agreement of the asymmetric Gaussian disk with the interferometric data is mostly because this model is able to produce stronger asymmetries in the visibility with almost symmetric S-shaped phases. Moreover, this model also reproduces the visibility and phases observed along the polar orientation better. Nevertheless, the quantity and quality of our data are not sufficient to fully constrain the intensity distribution in the emission lines. Regarding the possibility of a companion, we have no evidence of binarity from our interferometric measurements, neither from a modulation of the visibility modulus as a function of time or spatial frequency, nor from a phase modulation of the fringes. The question of an unseen companion orbiting HD 110432 becomes an issue when studying the origin of its hard X-ray flux, if indeed the X-rays are formed somehow from infall in the form of gas stream or blobs originating in the Be star.

Conclusion

Using standard long baseline optical interferometric techniques, we have reported on the size and orientation of the disk of the first "γ Cas X-ray analog" system other than the prototype γ Cas itself. We obtained a disk FWHM of 10.1 D ⋆ in the Brγ and 7.7 D ⋆ in the He I lines.

We have clearly detected an asymmetry in the disk in both the Brγ and He I lines which is to our knowledge the first time that an asymmetry is detected on such a small spatial scale within the He I emission line. As a whole, the viscous disk model seems to be a possible scheme to match the inhomogeneities detected in HD 110432 disk since it produces non symmetrical, spectrally resolved visibilities and phases, as measured by Carciofi et al. (2009). Nevertheless, the pursuit of possible disk inhomogeneities requires a more dedicated set of observations, as done by Carciofi et al. (2009) for ζ Tau.

The disk is in Keplerian rotation and is in contact with the central star, as for γ Cas. If HD 110432 has a magnetosphere, it must be very small, i.e. smaller than the size of classical T-Tauri magne-Table 5. Parameters values for the best-fit asymmetric kinematic model. tospheres that lie between 3 R ⋆ and 7 R ⋆ (Getman et al. 2008) and probably smaller than 1 R ⋆ , in order to have undetectable effects on our interferometric measurements. The disk's major-axis position angle (PA) of HD 110432 is 45 • from the kinematics fit or 20 • from the continuum disk emission fit, but in both cases is neither aligned nor perpendicular to the polarization measurements. Finally the disk size seems to be independent of the stellar parameters, as already found for classical Be stars by Meilland et al. (2012).

We concluded that HD 110432 is a near critical rotator characterized by V rot /V c =1.00±0.2.

Fig. 1 .

 1 Fig. 1. (u,v) plane coverage for our VLTI/AMBER observations of HD 110432. LR observations are plotted as red squares, HR data as blue circles for Brγ, and green ones for the 2.06 µm He I line.

4. 1 .

 1 The LITpro software To model the continuum visibility modulus and closure phases obtained from our VLTI/AMBER observations we used the LITpro 2 model-fitting software for optical/infrared interferometric data developed by the Jean-Marie Mariotti Center (JMMC) to analyze our data(Tallon et al. 2008). It is based on the Levenberg-Marquardt algorithm, which allows a fit to converge to the closest χ 2 local minimum from a set of initial values of the model parameters. It also includes tools for facilitating the search for the global minimum. LITpro calculates an error on the fitted parameters based on the χ 2 value at the minimum.

Fig. 2 .

 2 Fig.2. Left. H band data from the VLTI/AMBER instrument for different baselines (blue, red and green lines) with a LITpro model over-ploted along the minor (dotted line) and major (plain line) disk axis. Right. Same kind of data but for the K band.

Fig. 4 .

 4 Fig. 4. HD 110432 differential visibility and phase within the Brγ line from our four VLTI/AMBER HR measurements (red line). Each row corresponds to one VLTI/AMBER measurement (3 different baselines). The visibility and phase of the best-fit kinematics model is overplotted in green.

Fig. 5 .

 5 Fig. 5. HD 110432 differential visibility and phase within the He I line from our four VLTI/AMBER HR measurements (red line). The differential visibility is first plotted with the corresponding phase for 3 different baselines with B=73.20m, PA=-143.06 • ; B=88.32m, PA=-62.36 • ; and B=123.48m, PA=-98.16 • . The visibility and phase of the best-fit kinematics model is overplotted in green.

Fig. 3 .

 3 Fig. 3. LITpro model of HD 110432 Cas disk in the K band assuming a uniform central star with a surrounding Gaussian disk

Fig. 6 .

 6 Fig. 6. Brγ (Right) and He I lines from our VLTI/AMBER observations (red line) with our symmetrical line profile fit (blue line) and our asymmetrical model (green line).

Fig. 7 .

 7 Fig. 7. Examples of pole-on (Upper figures) and projected onto the sky (Lower figures) intensity distributions for the two asymmetric classes of models tested in this paper. The central white circle represents the position of the central star.

•

  What is the disk extension in the Brγ and He I 2.05 µm emission lines? Is the circumstellar disk dense and/or large as suggested from the strong and quasi-symmetrical profile of the Hα line (EW ∼ 60 Å) and the detection of several metallic lines in emission by Lopes de Oliveira et al. (2007) and Torrejón et al. (2012)? • What is the central Be star's rotational velocity? Is the stellar rotation close to critical as already found by Meilland et al.

Table 1 .

 1 ⋆ =5.3R ⊙ , which leads to the critical radius at the equator of Stellar parameters and distance of HD 110432 adopted in this paper.

	Parameter (unit)	T eff (K)	log g eff -	R ⋆ (R ⊙ ) (pc) d
	Value Uncertainty ±2000 22000	3.9 ±0.1	6.5 ±1.2 ±41 373

then estimate the stellar mass as M/M ⊙ = 9.6 and the stellar age t/t MS = 0.61 (t MS is the time the rotating star spend in the main sequence), which mean that the corresponding 'spherical' radius of the parent non rotating object is R

Table 2 .

 2 Ph.Stee et al.: HD 110432 circumstellar disk studies with the VLTI/AMBER instrument Observations log of HD 110432

		Observation		Projected baseline	Mode	DIT Seeing Calibrators
	Date	Time	Triplet	L(m)	P.A. ( o )		(s)	(")	(HD)
	24/01/2010 07:32 A0-K0-G1 78.7/81.1/127.9 -163.2/-89.5/-125.7 HR-K-F-2.17 26/01/2010 07:33 A0-K0-G1 78.5/81.8/127.8 -161.7/-87.4/-123.7 HR-K-F-2.17 10/02/2010 07:33 A0-K0-G1 76.1/86.0/126.2 -151.5/-73.6/-109.7 HR-K-F-2.17 10/02/2010 08:29 A0-K0-G1 73.2/88.3/123.5 -143.1/-62.4/-98.2 HR-K-F-2.06 17/03/2010 07:30 D0-H0-G1 68.2/58.5/53.5 -31.8/98.9/24.1 LR-HK-F 17/03/2010 07:41 D0-H0-G1 68.4/58.0/53.1 -29.8/101.5/25.5 LR-HK-F 17/03/2010 08:15 D0-H0-G1 69.0/56.1/51.5 -23.1/109.6/30.0 LR-HK-F 19/03/2010 05:23 A0-K0-G1 75.6/86.5/125.8 -149.8/-71.4/-107.4 LR-HK-F 19/03/2010 06:00 A0-K0-G1 73.6/88.1/123.9 -144.0/-63.7/-99.5 LR-HK-F 19/03/2010 06:34 A0-K0-G1 71.3/89.2/121.5 -138.7/-56.4/-92.0 LR-HK-F 19/03/2010 07:08 A0-K0-G1 68.6/89.9/118.5 -133.4/-49.2/-84.4 LR-HK-F	12 12 12 12 0.05 0.05 0.05 0.05 0.05 0.05 0.05	0.69 0.60 0.66 0.84 0.36 0.50 0.57 0.41 0.37 1.30 0.90	113752 113752 113752 113752 113752 113752 113752 113752 113752 113752 113752

Table 3 .

 3 Parameters obtained with LITpro for HD 110432 assuming a 0.31 mas central star (see section 2).

	Parameters	H band 1.54-1.87µm 1.94-2.37µm K band
	θ disk (mas) θ disk (D ⋆ ) f P.A.	0.92 ±0.05 5.7 1.56 ±0.05 22 ±5 •	0.95 ±0.07 5.9 1.62 ±0.03 17 ±5 •

Table 4 .

 4 Parameters values for the best-fit axisymetric-kinematic model. Cas value. It is also consistent with the value of 68 o ± 5 o obtained from the evolutionary tracks by Ekström et al. (2012). The disk P.A. is neither perpendicular nor parallel to the polarization measurement of 81 • by

	Param.	Value	Remarks
	R ⋆ d i PA	Global geometric parameters 6.5 R ⊙ 373 pc From von Leeuween (2007) 55 ± 5 • 45 ± 10 • Inconsistent with Polar.
		Global kinematic parameters
	V rot β	450 ±50 km s -1 0.5 ±0.05	See discussion Keplerian rotation
	a Brγ	Brγ disk geometry 10.2±0.5 D ⋆ = 1.64 ± 0.08mas
	EW Brγ	10±0.5 Å
	a HeI	He i disk geometry 7.8±1.0 D ⋆ = 1.25 ± 0.16 mas
	EW HeI	8.±1.0 Å
	inference from optical Fe II emission profiles by Smith & Balona (2006) that the inclination should be greater than the γ

• , Stee et al. 2012), and is consistent with the

available at http://simbad.u-strasbg.fr/simbad/

Ph.Stee et al.: HD 110432 circumstellar disk studies with the VLTI/AMBER instrument

Acknowledgements. This work has benefited from funding from the French Centre National de la Recherche Scientifique (CNRS) through the Institut National des Sciences de l'Univers (INSU) and its Programmes Nationaux (ASHRA, PNPS).This research made use of SIMBAD and VIZIER databases, operated at the CDS, Strasbourg, France. We thank Yamina Touhami for an interesting discussion about the continuum disk size and the referee for his extensive and extremely helpful criticisms of the original manuscript.


Yousra Chabchoub
email: yousra.chabchoub@isep.fr

Christine Fricker
email: christine.fricker@inria.fr

Philippe Robert
email: philippe.robert@inria.fr

Improving the detection …1 Improving the detection of On-line Vertical Port Scan Improving the detection of On-line Vertical Port Scan in IP Traffic

Keywords: Bloom filter, Internet measurements, On-line algorithms, Attack detection

We propose in this paper an on-line algorithm based on Bloom filters to detect port scan attacks in IP traffic. Only relevant information about destination IP addresses and destination ports are stored in two steps in a two-dimensional Bloom filter. This algorithm can be indefinitely performed on a real traffic stream thanks to a new adaptive refreshing scheme that closely follows traffic variations. It is a scalable algorithm able to deal with IP traffic at a very high bit rate thanks to the use of hashing functions over a sliding window. Moreover it does not need any a priori knowledge about traffic characteristics. When tested against real IP traffic, the proposed on-line algorithm performs well in the sense that it detects all the port scan attacks within a very short response time of only 10 seconds without any false positive.

Improving the detection of On-line Vertical Port Scan in IP Traffic

INTRODUCTION

Problem statement

We address in this paper the problem of designing an on-line algorithm for identifying port scan attacks in IP traffic. A port scan is a method of determining whether particular services are available on a host or a network by observing responses to connection attempts [START_REF] Devivo | A review of port scanning techniques[END_REF]. The received information are exploited to identify weaknesses and vulnerabilities of the host and to launch therefore more serious attacks. Several attack tools are now available and can easily be used (see (Nmap), (Foundstone) and (Nessus)) Port scan can be launched from one or several sources. In this latter case, we are dealing with distributed attacks, which are more difficult to detect as the contribution of each source can be considered as legitimate traffic. According to [START_REF] Staniford | Practical automated detection of stealthy portscans[END_REF] port scan attacks can be classified into two categories:

1. Vertical scan consisting of scanning to big number of destination ports for a single destination address. 2. Horizontal scan when many IP addresses are scanned (generally within the same subnet), on one or several ports.

Related works

Many port scan detecting methods had been developed in the literature. In [START_REF] Monowar | Surveying port scans and their detection methodologies[END_REF] Monowar et al. provide a survey on a large number of detection approaches. They classified them into many types (algorithmic, threshold-based, soft computing, rule-based, and visual approaches). They also established a comparison based on type, mode of detection and accuracy of the algorithms. Their main conclusion is that methods combining data mining and threshold-based analysis are the most efficient in terms of false positive rates, scalability and robustness. Most of detection approaches are single source and can not detect distributed attacks (e.g. [START_REF] Robertson | Surveillance detection in high bandwidth environments[END_REF] , [START_REF] Roesch | Snort-lightweight intrusion detection for networks[END_REF]). Very few methods can be applied on-line and give real time response. Moreover a common weakness of port scan detecting methods, particularly the threshold-based methods, is that their accuracy is closely dependent on traffic characteristics. Quite often, algorithms depend on constants directly related to the traffic intensity. For a limited set of traces, they can be tuned by hand to get reasonable performances. This procedure is, however, not acceptable in the context of an operational network. As a general requirement, it is highly desirable that the constants used by algorithms automatically adapt, as simply as possible, to varying traffic conditions. As an example, in (Heberlein, 1990) Heberlein et al. propose an IDS (Intrusion Detection System) where a source is considered as malicious if it contacts more than 15 other IP addresses in a given time window.

In this paper we focus on vertical port scan where many ports are scanned for a given destination address. Our objective is to design an adaptive algorithm that detects on-line this kind of attacks. The algorithm will be deployed on operators IP backbone network carrying traffic at a very high bit rate. At this level one can have an aggregated view of the global traffic (generated by many hosts) which is very useful to detect attacks. Moreover at this level, network operator can stop the attack to avoid its propagation until the destination and therefore save network resources. An on-line analysis of IP traffic in the core network is a challenging issue. The algorithm has to perform a very quick data processing and to store only relevant information. Data analysis should be faster than the arrival rate of data stream of a real-time execution. So the processing time of a packet has to be lower than the inter-arrival packets time which is of the order of few nanoseconds. This is typically a context of data mining.

A natural solution to cope with the huge amount of data in IP traffic is to use hash tables. A data structure using hash tables, a Bloom filter, proposed by B. Bloom [START_REF] Bloom | Space/time trade-offs in hash coding with allowable errors[END_REF] in 1970, has been used to test whether an element is a member of a given set. Bloom filters have been used in various domains : In [START_REF] Mcilroy | Development of a spelling list[END_REF] and [START_REF] Mullin | A tale of three spelling checkers[END_REF] they are used to represent words of a dictionary with a small memory. They make the search in the dictionary much faster. Bloom filters are also very useful for some distributed database applications. With a simple representation of a table content in a Bloom filter, we can speed up significantly semi-join operations and reduce the overhead communication between machines as they only exchange Bloom filters (see [START_REF] Bratbergsengen | Hashing methods and relational algebra operations[END_REF] and [START_REF] Mullin | Optimal semijoins for distributed database systems[END_REF]). Many distributed network applications rely on Bloom filters to improve their performance. We can for example mention the distributed web cache sharing proposed by [START_REF] Fan | Summary cache: A scalable wide-area web cache sharing protocol[END_REF] or the detecting loops algorithm introduced by Whitaker and Wetherall [START_REF] Whitaker | Forwarding without loops in Icarus[END_REF], in the context of packet switching. Bloom filters are well adapted to many other applications such as multicast [START_REF] Gronvall | Scalable multicast forwarding[END_REF] resource routing in peer-to-peer networks [START_REF] Druschel | Storage management and caching in past, a large-scale, persistent peer-to-peer storage utility[END_REF], [START_REF] Stoica | Chord: A scalable peer-to-peer lookup service for internet applications[END_REF] and queue management [START_REF] Dilip | Stochastic fair blue: A queue management algorithm for enforcing fairness[END_REF]. Bloom filters have been used by [START_REF] Estan | New directions in traffic measurement and accounting[END_REF] to detect large flows. A Bloom filter consists of k tables of counters indexed by k hash functions. The general principle is the following : for each table, the flow ID of a given packet (that is the addresses and port numbers of the source and the destination) is hashed onto some entry and the corresponding counter is incremented by 1. Ideally, as soon as a counter exceeds the value C, it should be concluded that the corresponding flow has more than C packets. Unfortunately, since there is a huge number of small flows, it is very likely for instance that a significant fraction (i.e. more than C for example) of them will have the same entry, incrementing the same counter, thereby creating a false large flow. To avoid this problem, [START_REF] Estan | New directions in traffic measurement and accounting[END_REF] propose to periodically erase all counters. Without any a priori knowledge on traffic (intensity, flow arriving rate, etc.), which is usually the case in practical situations, the erasure frequency can be either 1. too low, and, in this case, the filters can be saturated : Because of the large number of small flows, many of them may be hashed on the same entry of the hash table and, therefore, the corresponding counter is increased accordingly, and consequently creating a false large flow.

2. too high and a significant fraction of large flows can be missed in this case : Indeed, the value of the counter of a given entry corresponding to a large flow with a low throughput may not reach the value C if the value of this entry is set to 0 too often.

The efficiency of the algorithm is therefore highly dependent on the period ! of the erasure mechanism of the filters. This quantity is clearly related to the traffic intensity.

Organization of the paper

Starting from Estan and Varghese's algorithm, we propose an adaptation to the context of port scan attacks. An algorithm based on Bloom filter with a new adaptive refreshment scheme is proposed. The organization of this paper is as follows: A detailed description of the algorithm detecting port scan is given in the next section. The algorithm proposed is tested against experimental data collected from IP backbone network in the third Section. Concluding remarks are presented in the last section.

ALGORITHMS WITH BLOOM FILTER

In this section, we describe our new algorithm designed to identify on-line port scan attacks in the Internet IP traffic. According to the port scan definition given above, the number of different destination ports per destination address is an excellent observable to control in order to detect this kind of attacks. That is why the proposed algorithm is based on an on-line counting of the number of distinct destination ports used for each destination address.

Let us first define the flow as the set of the those packets with the same destination address. The flow size is then naturally defined as the number of different destination ports used during a given time window ! . Hence the objective of the algorithm is to identify flows which get "much" larger than the others.

The algorithm is divided into two parts:

1. The counting mechanism: In this part IP traffic is filtered and only significant observables for port scan detection are stored. 2. The decisional module: The objective of this part is to detect automatically suspicious behavior in the filtered data derived from the counting mechanism.

The problem of on-line counting the number of distinct elements (cardinality) in a given set has been already addressed in the literature. One can mention the Probabilistic counting and the Hyperloglog algorithms proposed by Flajolet et al. [START_REF] Flajolet | Hyperloglog: the analysis of a nearoptimal cardinality estimation algorithm[END_REF], [START_REF] Flajolet | Probabilistic counting algorithms for data base applications[END_REF] or the minCount algorithm of Giroire and Fusy [START_REF] Giroire | Estimating the number of active flows in a data stream over a sliding window[END_REF]. These are very efficient algorithms in term of memory usage and speed. Unfortunately, they are not adapted to our context as one has to run them for each destination address, which is unrealistic given the potential number of destination addresses, especially with the transition to IPv6.

The specificity of the port scan detection problem is that the counting mechanism has to be performed for each destination address. This brings an additional difficulty compared to the classical counting problems. The proposed solution is based on an improvement of Bloom filter that takes into account this new challenge.

Counting with Bloom filter

The starting point is the algorithm based on Bloom filters designed by [START_REF] Estan | New directions in traffic measurement and accounting[END_REF]. The objective of this algorithm is to identify flows with more than C packets, called large flows. Notice that flows size is in this context simply defined as its total packets number. The filter, see Figure 1, consists of k stages. Each stage i contains m counters taking values from 0 to C. It is assumed that k independent hash functions h 1 , h 2 . . . , h k are available. The total size of the memory used for the filter is denoted by M, recall that M should be of the order of several Mega-Bytes. An additional auxiliary memory is used to store the identifiers of detected large flows. The flow is detected as a large flow.

The algorithm as such is of course not complete since small flows can be mapped repeatedly to the same entries and create false large flows. This is the classical problem of collisions in the context of Bloom filters. One has therefore to clear the filters from the influence of these undesirable flows. Estan and Varghese [START_REF] Estan | New directions in traffic measurement and accounting[END_REF] proposed to erase all counters of the filters on a periodic basis (5 seconds in their paper):

Estan and Varghese's refreshing mechanism:

• Every ! time units all counters are re-initialized to 0.

Ideally, the constant ! should be directly related to the traffic intensity. On the one hand, if the refreshment mechanism occurs frequently, the counters corresponding to real large flows are decreased too often and a significant fraction of them may not reach the value C and therefore many large flows will be missed. On the other hand, if ! is too large then, because of their huge number, small flows may be mapped onto the same entry and would increase the corresponding counter to the value C, creating a false large flow. This periodic refreshing mechanism could perfectly work if there would be a way to change the value of ! according to the order of magnitude of the number of small flows. Such a scheme is however not easy to implement in practice.

In [START_REF] Chabchoub | Analysis of a Bloom Filter algorithm via the supermarket model[END_REF], a Bloom filter associated to k hash functions is used to identify large flows, in a different way: For each received packet, only one counter, chosen at random among the smallest counters, is incremented by 1. A new refreshing mechanism is also introduced. It consists of decrementing periodically all positive counters by one. The objective is to eliminate progressively small flows without damaging large ones. In fact the bound between small and large flows is very thin: more or less than C packets. In the context of attacks detection, we aim intuitively to erase all flows related to standard traffic in order to keep only very large flows that are very likely to correspond to some attacks. As there is a significant difference between these two kinds of flows, we can apply a more aggressive refreshing mechanism on the filter.

We propose in the next subsection a new adaptive refreshing mechanism that needs no a priori knowledge about traffic characteristics and that automatically varies according to traffic intensity.

Estan and Varghese's algorithm cannot be directly applied to the port scan detection problem. In fact, for a given flow, only packets having a new destination port number should be counted (cf flow size definition given before). This means that, for each flow one has to store already used destination port numbers. The counting mechanism is performed as follows: All counters are initially equal to 0. If a packet belonging to a flow A , with a destination port P is received then () ij F and T are adapted in the following way:

• The cell ij F , where

() ih A = and jP = , is considered. If ( 0) ij F = then o 1 ij F = o 1 ii TT =+
Notice that Estan and Varghese [START_REF] Estan | New directions in traffic measurement and accounting[END_REF] algorithm uses k hashing functions in order to reduce the impact of collisions consisting of mapping several flows to the same counter via a given hashing function. Consequently this counter over estimates flows size. In the context of the port scan detection algorithm, the size of a flow A can be over estimated if and only if these two conditions are satisfied:

A collides with an other flow B; (h(A) = h(B)) 2. A and B have different destination ports

In practice this is an unusual situation as the commonly used destination ports are not very numerous, even if the number of different ports can theoretically reach 65,536 as a port number is encoded on two bytes. Moreover, for the port scan detection problem one does not focus on an exact estimation of flows sizes but only on identifying very large flows. So unlike for Estan and Varghese, this new context is much less sensitive to the problem of collisions. That is why we prefer saving memory by using only one hash function in our algorithm.

Adaptive Refreshing Mechanism

The presented algorithm cannot run indefinitely. In fact flows have a limited lifetime and ideally old flows have to be erased from the filter to keep an efficient counting mechanism. So the filter needs to be sometimes refreshed. The general principle is the following: If the state of filter is declared as overloaded then all the cells in the filter () ij F and in the summation table T are reinitialized to 0.

The following "RATIO" criterion is proposed to declare the state of the filter as overloaded: Let us define r as the proportion of non-null counters in the summation table T; the filter is overloaded when r is above some threshold R. This refreshing mechanism is clearly adaptive as its frequency only depends on traffic variations: As long as the state of the filter is not overloaded, nothing occurs and if there is a peak of activity, the filter gets quite quickly filled and the refreshment mechanism is automatically executed. More precisely, as R is computed on the table T and not globally for the filter, the peak of activity consists of a big number of destination addresses received in a short time window. Notice that the occurrence of a vertical port scan (where only one destination address is involved) has no impact on the refreshing frequency. This is very important to could detect the attack.

The key parameter of this refreshing mechanism is the filling up threshold R. It is a very sensitive parameter for the algorithm. For a fixed m (size of the summation table T), there is clearly a trade-off in the choice of the value of R: On the one hand, with a small R, collisions will be minimized so the counting mechanism will be more accurate. But on the hand, if we refresh the filter too frequently (lets say every second), the impact of a port scan attack on the traffic characteristics can not be seen as the attack will be fractionated over many sliding windows. An intermediate solution is to fix R in an initialization step of the algorithm as follows: R is the filling up rate reached after a given duration !. It is a variable threshold depending on the traffic type considered. In practice ! is set to one minute, which is a reasonable duration given that a port scan attack lasts several minutes.

The attacks detection mechanism

As explained above, the adaptive refreshing mechanism proposed gives an estimation of the number of different destination ports for each destination address over a sliding window of one minute. Recall that this observable is defined in the second section as flows size. The objective of the attacks detection mechanism is to identify "large" flows. The term "large" has to be properly defined. Roughly speaking, this means that such a flow is much larger than the other "normal" flows. Again, because of the variation of traffic, an adaptive scheme has to be devised to properly define these concepts.

The main idea of the algorithm is to evaluate a varying average m n of the largest flow in several sliding time windows of length !. The quantity m n describes "normal flows"; it is periodically updated in order to adapt to varying traffic conditions. It is a weighted average that takes into account all its past values to follow carefully traffic variations but not too closely. If a flow in the n th time window is much larger than m n!1 , it is considered as an attack, and the moving average is not updated for this time window.

The following variables are used: • As before, r is the proportion of non-zero counters in the summation table T.

• S is a multiplicative detection threshold. Roughly speaking, an attack is declared when an observation is S times greater than the "normal" behaviour. The value of S is fixed by the administrator. • R s and R are thresholds for the variable r. The constant R s is independent of traffic and taken once and for all equal to 90% and R is a variable threshold depending on the traffic type considered. • " is the updating coefficient for averages; " = 0.85 in our experiments.

• ! is the duration of the initialization phase (1 minute in the paper). It is in fact a bound for the time before which an attack should be detected. • m n is the weighted moving average for the n th time window.

Initialization phase:

• All counters in the filter matrix () ij F and the summation table T are set to 0 . • () ij F and T are progressively updated when packets are received After a duration ! , evaluate the variable r o If s rR ! then : Rr = else : s RR = . o Find the highest counter in T : 1 :[ ] i mm a x T i = .

Detection phase: the th n time window • At the beginning () ij F and T are initialized to 0 .

• The Bloom filter is progressively updated with packets arrivals by using their destination address and destination port.

If a counter exceeds

1 n Sm ! , an attack is declared. If rR ! o Find the highest counter in T : max n . o If 1 max nn Sm ! < 1 (1 ) max nn n mm !! " =+ " o Start the (1 )
n + th time window.

Table 1. Algorithm for port scan detection

The algorithm starts with an initialization phase of length ! in order to evaluate the threshold R. At the end of this phase, R will be definitively fixed for the rest of the experiment. In addition, as this phase corresponds to the first time window, the moving average m 1 will be initialized as the biggest counter obtained. We implicitly assume that there is no attack during the initialization phase. See Table 1 for the description of the algorithm.

Note that an alarm is declared during the n th time window as soon as the value of a counter becomes greater than Sm n . In this case the moving weighted average m n is not updated, it keeps its old value, computed in the previous time windows. Both attacker and victim can be identified as the attack is always raised by the last performed packet and we can simply store and update the IP header of the last received packet.

At the beginning, the first time window is fixed (its duration is !) but, since the evolution depends on the occupation rate of the summation table T, the duration of the other time windows is variable. If traffic characteristics are not much varying, time windows duration remain around one minute. In this case, an attack is detected at the latest after one minute so that the network administrator can react quickly.

EXPERIMENTAL RESULTS

Dataset

To evaluate and validate the attack detection algorithm described in the previous section, we run experiments on a traffic trace captured in the IP backbone network of Orange Labs in December 2007 in the context of the ANR-RNRT OSCAR project. This traffic trace contains some port scan attacks. Its global characteristics are given in Table 2 A simple analysis of the trace shows that the global characteristics of the traffic (rate, number of flows per minute) do not vary too much (see Figure 3 and4). Thus Port scan attacks have no impact on the global traffic parameters. More specific experiments at flow level are performed in Figure 5 to identify port scan attacks. Recall that a flow is defined as a set of packets with the same destination address. Figure 5 shows the real size of the largest flow (i.e. the number of its different destination ports) in a sliding window of one minute. Notice that these experiments are done off-line. They are based on an exhaustive exact counting, which is unrealistic in an on-line context. According to this figure, the largest flow has about 150 different destination ports. This size has also a small variance. But one can clearly detect two peaks, which correspond to two port scan attacks. They occur at the 27 th and 58 th minute. The attacked address is 10.0.0.3 in the two cases. This address has up to 6000 different destination ports per minute. The used destination ports are mainly composed of the so-called in [START_REF] Devivo | A review of port scanning techniques[END_REF] Well Known Ports (0-1023) and some Registered Ports (1024-49151). Figure 6 shows the results of the proposed algorithm on the traffic trace. The size m of the summation table T is taken equal to 1024. So the total size of the Bloom filter matrix is equal to 67 MB. After the initialization phase of one minute, the filling up reached 47%, and the parameter R is fixed to this value. The multiplicative detection threshold S is set to 2. The choice of this value is mainly based on the small variance of the largest flow size showed before. One can see in Figure 6 that the moving weighted average m n is always close to the real size of the largest flow except in case of attacks. In fact when attacks occur, m n is not updated for the current time window and all packets addressed to the attacked destination are no more inserted into the Bloom filter until the end of the attack. This avoids overloading the filter with useless information. The moving average m n is therefore updated in the following window. Thus the attack has no impact on m n and the algorithm is able to deal with several simultaneous attacks.

Flow experiments and performance analysis

Moreover our algorithm is very reactive and has a very short response time as it detects the attacks in the first 10 seconds. Let us recall that the algorithm raises an alarm as soon as a counter in T becomes too high compared to m n . It means that is does not wait the end of the time window to declare the attack.

Notice finally that this algorithm can be easily implemented on a core router as its total required memory is less than 100MB and it is well adapted to an on-line analysis. The counting mechanism used in the proposed algorithm gives an estimation of the size of the largest flow. More precisely, it can over estimate the real size because of collisions in the bloom filter. As the objective is the identification of very large flows, the counting mechanism has not to be "too" accurate. But the overestimation can also lead to some false positives (false raised alarms) beyond a given limit. The efficiency of the counting mechanism depends closely on the filling up threshold R. (256, 1024 and 4096). The algorithm gives no false positives in the three cases. It is clear that the estimation is more accurate for small values of R. But, a static highest filling up threshold R s must be defined to limit the impact of the over estimation. R s is taken to 90%.

Figure 1 .

 1 Figure 1. A Bloom filter

Figure 2 .

 2 Figure 2. Counting flows sizes with a Bloom filter matrix

Figure 3 .

 3 Figure 3. Total packets number per minute Figure 4. Total flows number per minute

Figure 5 .

 5 Figure 5. Size of the largest flow per minute (2 port scan attacks against 10.0.0.3)

Figure 6 .

 6 Figure 6. Detected attacks with m =1024, S =2

Figure 7 .

 7 Figure 7. Impact of m on the counting mechanism accuracy

Table 2 .

 2 . Characteristics of the traffic used for attack detection

	Nb. IP packets	Duration	Nb. Flows
	32.10	6	67 minutes	250.10	3

The proposed algorithm can also deal with slow port scan attacks. In this case the attack is performed progressively by adding a small number of destination ports each time (see [START_REF] Dabbagh | Slow port scanning detection[END_REF] for more details). The weakness of the threshold-based algorithms is that they can miss the attack if the attacker is just below the threshold. To detect slow port scan attacks, one has to consider a larger time scale and a more aggregated traffic. More precisely, two Bloom filters will be used and two time windows will be considered: ! 1 = 1 minute and ! 2 = 5 minutes. The algorithm will be performed separately for these two Bloom filters which are totally independent. Each packet will be registered twice in the two filters, and slow attacks will be only identified using ! 2 . The required resources (memory and processing capacity) are obviously doubled but the algorithm can still be implemented on a standard router for an online analysis.

Remark on threshold

The algorithm uses the variable S, called the multiplicative detection threshold. It is related to the network administrator's decision about the precise definition of an anomalous behaviour. In the experiments, there is a set of events which will be qualified as "attacks" for a smaller values of S. Note however that, for some large but "milder" variations, the qualification as attack will depend on the particular value of this parameter. There is no way to avoid this situation in our view. This is the role of the administrator to define the level of abnormality in traffic.

CONCLUDING REMARKS

We have presented in this paper a novel adaptive algorithm for identifying vertical port scan attacks in Internet traffic. A new approach using a two-dimensional Bloom filter is developed. Unlike Estan and Varghese approach where the filter is periodically erased, we propose a new original "RATIO" criteria to refresh the filter according to traffic intensity. The proposed algorithm has been successfully tested against a real traffic trace (captured in the IP backbone network of orange Labs) containing some port scan attacks.