Tarek Moulahi
email: tarek.moulahi@lifc.univ-fcomte.fr

Hervé Guyennet
email: herve.guyennet@lifc.univ-fcomte.fr

Salem Nasri
email: salem.nasri@enim.rnu.tnhajlaoui.rjab@gmail.com

Rjab Hajlaoui

On the Construction of Load-Balanced (k,r-hop)-Connected Dominating Set for WSNs

Keywords: component; Load-balancing, (k, r-hop)-CDS, Virtual backbone, Fault tolerance, WSNs. I

Connected Dominating Sets (CDS) are selected to construct a virtual backbone in Wireless Sensor Networks (WSNs). Indeed, CDS are used for fault tolerant broadcasting, routing and even efficient gathering of data. On the other hand, r-hop connected k-dominating sets ((k,r-hop)-CDS) are introduced to reduce the size of CDS and the total amount of information to be transmitted. Unfortunately, no work considers the load-balance factor of (k,r-hop)-CDS. Recently, there is a proposition of constructing load-balanced CDS for WSNs. In this paper we re-use the same concept of selecting load-balanced CDS to construct a Load-Balanced (k,r-hop)-CDS (LB(k,r-hop)-CDS). Then, the allocation of dominatees to the appropriate dominators is done. Through simulations, the proposed method of constructing LB(k,r-hop)-CDS extends network lifetime by an important rate compared with the most recent (k,r-hop)-CDS construction method.

INTRODUCTION

WSNs are ad hoc networks composed of many sensor nodes supervised and controlled by a base station. Each sensor is a small device able to sense, to compute and to communicate via wireless channel. The low cost of these devices and the functionalities of collecting, computing and communicating data have attracted the attention of the community. Thus, WSNs are actually used in several domains such us military, health care, environment and others [START_REF] Yick | Wireless sensor network survey[END_REF][START_REF] Akyildiz | Wireless sensor networks: a survey[END_REF]. Nodes in WSNs are deployed without any predefined topologies. Consequently, this network is formed randomly using wireless radio channels. The most important disadvantage of WSNs is their limited energetic capacity, so that many methods, algorithms and protocols were introduced and developed taking in consideration this constraint.

Moreover, the main functionality of WSNs is to carry out a collaborative work in order to observe and supervise nature. That is why, the communication between nodes has a major importance. According to the energy constraint in sensors, many heuristics and strategies were proposed to minimize the broadcasting storm problem, the redundancy [START_REF] Moulahi | An Energy Aware MPR-based Broadcasting Algorithms for Wireless Sensor Networks[END_REF][START_REF] Moulahi | Amalioration of MPR by a Backbone-based Brodcasting Algorithm for WSNs[END_REF] and to realize a communication with a respectable level of fault tolerance. Selecting a CDS provide a virtual backbone used when broadcasting, routing or even for gathering data. A (k,r-hop)-CDS is introduced to reduce the size of CDS and the amount of information to be transmitted. In fact, a (k,r-hop)-CDS problem is to select a connected set D of the network respecting that every vertex u not in D is at a distance within rhop from at list k vertices in D. Recently, there is a proposition to find out a load-balanced CDS [START_REF] He | Load-Balanced CDS Construction in Wireless Sensor Networks Via Genetic Algorithm[END_REF][START_REF] He | Constructing a Load-Balanced Virtual Backbone in Wireless Sensor Networks[END_REF][START_REF] He | Genetic-Algorithm-Based Construction of Load-Balanced CDSs in Wireless Sensor Networks[END_REF] that helps to extend the network lifetime with a very high rate. According to the best of our knowledge there is no a proposition of LB(k,r-hop)-CDS. The goal behind our work is to provide a solution to resolve this problem. This paper is organized as follows. In the next section, we give some important definitions to clarify the vocabularies used in this work. In section III, there is a study of the related work. Section IV describes the problem definition. In section V, the main problem is treated. Section VI contains some measurement and experimental results to illustrate our improvement. Finally, section VII is a recapitulation of this work.

II. DEFINITIONS

In this section, we present some important definitions that will be used later.

A.

Network model In this paper we only consider unit disk graph, static WSNs and sensors with the same coverage area. WSNs can be considered as a graph G(V;E), where V is the set of vertex representing nodes and E is the set of edges between vertexes.

An edge exists between two nodes A and B in this graph only if

A is in the coverage area of B and B is in the coverage area of A.

B.

k-connected graph A graph G(V;E) is said k-connected graph if and only if it contains k independent paths between any two vertices.

C.

k-connected m-dominating sets A subset C of V is k-connected m-dominating set if every node in V \ C is dominated by at least m nodes in C and the sub graph induced by C is k-connected, The nodes in C are denoted as dominators, and nodes in V \ C are denoted as dominatees.

D. r-hop connection

Given two vertexes u and v of a graph G(V;E), u is r-hop connected by v if we can find a path in G from u to v within r hops i.e. this path has r-1 intermediates nodes.

E.

r-hop connected k-dominating sets A subset D of V is r-hop connected kdominating set if every node in V \ D is r-hop dominated by at least k nodes in D and the sub graph induced by D is connected, The nodes in D are denoted as dominators, and node in V \ D are denoted as dominatees.

III. RELATED WORK

To construct a CDS, lots of efforts have been made and many approaches were used either centralized or decentralized. In what follows, a description of the most important methods of CDS selection are given in addition a short study of the recent LBCDS problem is realized.

A.

CDS-based backbone Many heuristic were proposed to resolve the problem of CDS construction. In [START_REF] Sakai | Timer-Based CDS Construction in Wireless Ad Hoc Networks[END_REF], the authors provide a method of CDS selection based on timer that can be applied to Mobile Ad Hoc Networks (MANET). The construction of CDS can be either centralized or decentralized which mean either that one hope select the CDS or that the whole network participates to the CDS selection. In [START_REF] Schleich | Decentralized Fault-tolerant Connected Dominating Set Algorithm for Mobile Ad hoc Networks[END_REF] there is a proposition of a decentralized CDS construction method for MANET. In [START_REF] Shang | Algorithms for minimum m-connected k-tuple dominating set problem[END_REF] a method of searching minimum m-connected k-tuple CDS is given, this method helps to reduce the consumed energy in routing. The (k,m)CDS helps to realize the task of routing or broadcasting with high level of fault tolerance [START_REF] Yongzhao Bian | Construction of a fault tolerance connected dominating set in wireless sensor network[END_REF]. In fact, every node out of the CDS is dominated by m node in CDS and nodes in CDS are k-connected.

B.

(k,r-hop)-CDS-based backbone (k,r-hop)-CDS was proposed to minimize the information to be transmitted as well as the cost of communication. In [START_REF] Li | Two algorithms for minimum 2-connected r-hop dominating set[END_REF] there is a proposition of computing (2,r-hop)-CDS. The proposed method is applied to 2-connected graphs. The most recent heuristic of (k,r-hop)-CDS was proposed in [START_REF] Zheng | Constructing (k,r)-Connected Dominating Sets for Robust Backbone in Wireless Sensor Networks[END_REF]. Indeed, this heuristic is decentralized and helps to extract a virtual backbone in two steps: first the cluster construction is done by selecting (k,r-hop)DS from the graph. Next, (k,rhop)DS are linked to each other to form (k,r-hop)-CDS.

C.

Load-balanced CDS-based backbone Recently, Jing He et al. proposed some methods to construct a load-balanced CDS. In [START_REF] He | Load-Balanced CDS Construction in Wireless Sensor Networks Via Genetic Algorithm[END_REF], they make use of a genetic algorithm to select LBCDS. In [START_REF] He | Constructing a Load-Balanced Virtual Backbone in Wireless Sensor Networks[END_REF] they propose a LBCDS based on a heuristic which is done in two steps. First, the selection of dominators is done. Next, they define a loadbalanced method for allocation of the dominatees to the appropriate dominators. This operation allows the increasing of network lifetime. In [START_REF] He | Genetic-Algorithm-Based Construction of Load-Balanced CDSs in Wireless Sensor Networks[END_REF], they used an evolutionary algorithm to resolve the LBCDS problem.

D.

Synthesis To the best of our knowledge there is no works that consider the load-balanced factor when constructing (k,r-hop)-CDS. In this paper we try to re-use the concepts recently defined in [START_REF] He | Load-Balanced CDS Construction in Wireless Sensor Networks Via Genetic Algorithm[END_REF][START_REF] He | Constructing a Load-Balanced Virtual Backbone in Wireless Sensor Networks[END_REF][START_REF] He | Genetic-Algorithm-Based Construction of Load-Balanced CDSs in Wireless Sensor Networks[END_REF] to resolve the problem of LB(k,r-hop)-CDS.

IV. PROBLEM DEFINITION

In this section, we try to give the definition of our problem by studying a concrete example.

A.

Symbols and notations In table I, we introduce the symbols used in this paper and their definitions. The number of element in ND(x) p-norm Defined to compute the load-balanced factor of a subset in WSNs, proposed in [START_REF] Kalantri | A p-norm Flow Optimaziation Problem in Dense Wireless Sensor Network[END_REF], and used in [START_REF] He | Load-Balanced CDS Construction in Wireless Sensor Networks Via Genetic Algorithm[END_REF][START_REF] He | Constructing a Load-Balanced Virtual Backbone in Wireless Sensor Networks[END_REF] it is equal to:

p p n i i p x / 1 1 ) | | ( | | ∑ = = Χ d(x)
Refers to the degree of a node x in the graph d̅ Refers to the superior integer part of the average of degrees in a graph G. D

The set of dominators in a graph G B. Dominators selection In fig. 1, an example of WSNs is given. The (1,2-hop)-CDS from the given network is selected using the latest algorithm of (k,r-hop)-CDS construction proposed in [START_REF] Zheng | Constructing (k,r)-Connected Dominating Sets for Robust Backbone in Wireless Sensor Networks[END_REF]. The result of this selection is the set {c,f}. In order to measure the load-balancing of the selected set we compute its p-norm. According to [START_REF] Kalantri | A p-norm Flow Optimaziation Problem in Dense Wireless Sensor Network[END_REF], for p=2 the data flow shows an analogy to electrostatic filed. So, computing pnorm with p=2 helps to measure the load-balance among xi. Finally, if the p-norm of a set becomes small this set will be more load-balanced [START_REF] He | Load-Balanced CDS Construction in Wireless Sensor Networks Via Genetic Algorithm[END_REF]. According to [START_REF] He | Load-Balanced CDS Construction in Wireless Sensor Networks Via Genetic Algorithm[END_REF][START_REF] He | Constructing a Load-Balanced Virtual Backbone in Wireless Sensor Networks[END_REF] :

| | d d x i i - = Hence, 10 | 3 6 | | 3 4 | }) , ({ 2 2 = - + - = - f c norm p j l g a b c c e d f f h k i
In fig. 2, we try to select another (1,2-hop)-CDS which is {c,d,e}. For this set the p-norm will be:

3 | 3 4 | | 3 4 | | 3 4 | }) , , ({ 2 2 2 = - + - + - = - e d c norm p Figure 2. Example of a WSN: (1,2-hop)CDS is {c,d,e}
After a simple comparison of the two p-norms:

3 10 
To conclude, we can say that the second set is more loadbalanced. Consequently, constructing a LB(k,r-hop)-CDS should take into consideration the minimization of its p-norm value.

C. Dominatees association

In this subsection, we give two examples of dominatees' association to dominators. Next, we compare the two possibilities to see which of them is more load-balanced. In fig.

3, ND(c)={b,a}; ND(d)={h,g,j,f,k} and ND(e) ={i,l}.

Then, if we choose : In fig. 4, another association of dominatees to dominators is done: ND(c)={b,a}; ND(d)={h,g,j} and ND(e) ={i,l,f,k}. Then the p-norm will be:

| ) ( | ) ( || i ND i ND x i - = Hence, 6 | 3 2 | | 3 5 | | 3 2 | }) , , ({ 2 2 2 = - + - + - = - e d c norm p
2 | 3 4 | | 3 3 | | 3 2 | }) , , ({ 2 2 2 = - + - + - = - e d c norm p
Finally, we can deduce that the second association is more load-balanced. In this section, the main problem is formally treated. Two steps are done to resolve LB(k,r-hop)-CDS problem. First, the dominators are selected. Next, the association of dominatees to dominators is done. We treat only LB(1,r-hop)-CDS.

A.

CDS selection According to the example studied in the previous section the construction of CDS is to select a subset D of V (V is the set of vertices of the WSNs represented by the graph G(V,E) ). With D should has the next mentioned proprieties

• D is connected.

• For all node u of V\D, there is a node v in D, such that u is at a distance within r-hop from v.

• 2 / 1 2 | | 1 ) | ) ( | ( | | ∑ = - = D i i p d x d D Minimize
Thus, the selection of D should start by selecting node that minimizes |D|p and it ended when D is connected, and every node not in D is at a distance within r-hop from at least one node in D. Finally, we optimize D i.e. extracting node n from D, if D\{n} still respect the above proprieties. Below, the algorithm of D selection is given: If we apply algorithm1 to the network of fig. 1 in order to construct (1,2-hop)CDS, we have d=3 ̅ , there is no node having 3 neighbors. Then, for d=4, ̅ D={c} . For this set D there still exist uncovered nodes within 2-hops. Next, D={c,d}this set also does not cover all nodes within 2-hops. Finally, D={c,d,e}. This D is connected and all nodes in V\D are within 2-hops from at least one node in D. Consequently, the algorithm terminates. If i is chosen as an element of D, it will be extracted in the step of optimization before the end of the algorithm.

Algorithm1: Dominators selection Input: a connected graph G(V,E) Output: the set of dominators D 1: D Ø 2: compute d̅ in G 3: for all node n in G do 4: if d(n) = d̅ then D  D U {n} 5: if D is

B. Load-balanced allocation of dominatees to dominators

The problem of load-balanced allocation of dominatees to dominators can be defined as:

• Every dominatees is allocated to only one domiantors.

• The distance between a dominatee and his allocated dominator is within r hops.

• The allocation should minimize

2 / 1 2 | | 1 ) | ) ( | ) ( || ( | | ∑ = - = D i i i p x ND x ND D
The algorithm below is defined respecting the above mentioned properties. The algorithm is started by the allocation of the imposed dominatees i.e.:

• A node that can be allocated only to one dominator.

• Or it is a neighbor of only one dominator.

• Or it is a neighbor of only one allocated dominatee.

VI. PERFORMANCE AND EVALUTION

The test and the measurement of the performance are done using NS2 [START_REF]The Network Simulator -ns-2[END_REF]. Identical sensors with the same coverage area (50m) are used. The size of packet to be transmitted between nodes is 200b or 400b. We suppose in this test that the sink node is directly linked to one node of the (k,r-hop)-CDS. In every 10 seconds, the sink node broadcast a packet to all nodes in the network, and after 10 seconds it receives gathered data from all nodes. Finally, we extract periodically the energy of the most worker node in the (k,r-hop)-CDS selected by our load-balanced method. Then, we compare it to the energy of the most worker node in the (k,r-hop)-CDS which is selected using the method proposed in [START_REF] Zheng | Constructing (k,r)-Connected Dominating Sets for Robust Backbone in Wireless Sensor Networks[END_REF]. Initially, every node is alimented by two AA lithium batteries i.e. the initial energy in nodes it is nearly 30kJ. We treat only the consumed energy for communication and we neglect the consumed energy for sensing and internal processing. In fig. 5, we can observe that there is an important improvement of the lifetime of the most worker node in the (1,2-hop)CDS. The two curves are linear. Consequently, we can easily compute the time when nodes will be exhausted. Finally, we can conclude that LB(k,r-hop)-CDS make an extension of node lifetime with 68% if we compare it with the latest proposed (k,r-hop)-CDS construction method. This fact is confirmed in fig. 6 using a network with 200 nodes as density and 200b as size of transmitted packet and in the network of fig. 7, with 200 nodes as density and 400b as size of transmitted packet. The extension of the lifetime of the most worker node in the CDS has an important effect on extending the whole network lifetime. Indeed if a node in CDS will be quickly exhausted the CDS will be disconnected. Then a big set of sensors in the network will be unreachable.

VII. CONCLUSION

This work treats the problem of LB(k,r-hop)-CDS aiming to select a (k,r-hop)-CDS with taking into consideration the load-balance factor. The problem resolution is centralized, is based on the minimization of p-norm and done in two steps. First, the set of dominators is selected. Next, the allocation of dominatees to the appropriate dominators is completed in order to guarantee the load-balance propriety. According to the measurement of performance given, LB(k,r-hop)-CDS provides an important improvement in term of increasing the network lifetime compared to the latest proposed method of (k,r-hop)-CDS selection.

Figure 1 .

 1 Figure 1. Example of a WSN : (1,2-hop)CDS is {c,f}

Figure 3 .

 3 Figure 3. Example of a WSN: a non equilibrate association of dominatees to dominators

Figure 4 .

 4 Figure 4. Example of a WSN: an equilibrate association of dominatees to dominators

  For other nodes the association is done to the dominators having the minimum |ND(x)| Algorithm2: Dominatees allocation Input: a connected graph G(V,E) a set of dominators D of V. Output: all dominatees are allocated to dominators. 1: SV \ D 2: Temp  G(V,E) 3: Allocate all imposed domiantees to their appropriate dominators and withdraw them from S, start by 1-hop domiantees to r-hop domiantees 4: for all node n in S and x in D do 5: r 1 6: select the set x where we can allocate n within r-hop in Temp 7: choose x having the minimum |ND(x)| 8: ND(x) ND(x) U {n} 9: S S \ {n} 10: delete edges between other x and n from Temp 11: r  r+1 12: if S is empty break 13: end for allIf we apply algorithm2 to the network of fig.2in order to complete the allocation of dominatees to dominators. First, ND(c)={a,b} because a and b are imposed to c. Same for h and i which are imposed respectively to d and e. Then, l is imposed to e and g,j are imposed to d. Consequently, ND(d)={h,g,j} and ND(e)={i,l}. The node f will be linked to e because |ND(e)|<|ND(f)|. Finally, ND(e)={i,l,f,k} and, S will be empty therefore, the algorithm terminates.

Figure 5 .Figure 6 .Figure 7 .

 567 Figure 5. Evolution of energy in the most worker node in the (1,2-hop)CDS with a density of 12 nodes and using packet with 200b as size

TABLE I

 I

		. SYMBOLS AND NOTATIONS
	Symbol	Signification
	a,b,c…..	Refers to the sensors used in the network
	ND(x)	Refers to the set of dominatees of a dominator x
	| ND(x)|

  connected and all nodes in V\D are within rhop from at least one node in D then D\{n} is connected and all nodes in V\D\{n} are

	6:	break
	7: else d̅  d+1 ̅
	8: end if
	9: end for all
	10: for all node n in D do
	11: if

within r-hop from at least one node in D\{n} then 12: D  D \ {n} 13: end if 14: end for all


Syed Raheel
email: raheel.hasan@univ-fcomte.fr

Julien Bourgeois #
email: julien.bourgeois@femto-st.fr

Vaidy Sunderam

Li Xiong
email: lxiong@mathcs.emory.edu

Detection of Distributed Attacks in Hybrid & Public Cloud Networks

In this paper early detection of distributed attacks are discussed that are launched from multiple sites of the hybrid & public cloud networks. A prototype of Cloud Distributed Intrusion Detection System (CDIDS) is discussed with some basic experiments. The summation of security alerts has been applied which helps to detect distributed attacks while keeping the false positive at the minimum. Using the summation of security alerts mechanism the attacks that have slow iteration rate are detected at an early stage. The objective of our work is to propose a Security Management System (SMS) that can detect malicious activities as early as possible and camouflaging of attacks under the conditions when other security management systems become unstable due to intense events of attacks.

I. INTRODUCTION

Cloud computing provides Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). There exist multiple types of clouds such as community, private, public and hybrid clouds. Community clouds are formed by multiple organizations which are working for the same objective. Private cloud is owned by one administrative domain, this type of cloud network is used by organizations who wants to have full control of the cloud resources. Private cloud is not used by many users as the benefits are very limited. Public cloud are the most common and easily available place for user to use resources either free or pay as per usage. Hybrid clouds are the combination of community or public clouds. The member of these clouds can get benefits of both the cloud networks. It provides the users a large range of resources available to use. There exists many cloud service provider and they are growing as the technology is becoming mature. The most prominent are the Amazon Elastic Compute Cloud (Amazon EC2) [START_REF]Amazon elastic compute cloud (amazon ec2)[END_REF] or S3 [START_REF]Amazon simple storage service (amazon s3)[END_REF], Google cloud services [START_REF]Google?s cloud services[END_REF], Eucalyptus [START_REF]Eucalyptus is the world's most widely deployed cloud computing software platform for on-premise (private) infrastructure as a service clouds[END_REF], IBM smart cloud [START_REF]Smartcloud is the ibm vision for cloud computing[END_REF] and Opennebula [START_REF]Opennebula is an open-source project[END_REF].

One of the security concern in the cloud computing, is the handling of the data that is going to be placed at the service provider's network. The data placed on the cloud can be misused or compromised and the owner does not even know about the incident. A security management systems called Cloud Distributed Intrusion Detection (CDIDS) has been proposed in this paper. CDIDS's separate policies can be applied on the data in the form of security rules. The security rules generate alarms if the security policy is violated by the cloud service provider, by the owner itself or by any of its staff members. The proposed solution can also helps in resolving issues of privacy in the cloud infrastructure. In this paper more details of the security issues in cloud networks are discussed with their proposed solution.

The remaining part of the paper consists of VI sections. Section II is the related work, section III highlights the existing problems, section IV presents the proposed solution, section V consists of the experiments, and section VI concludes and outlines the future development.

II. RELATED WORK

The most recent issues are discussed by Balduzzi et al. [START_REF] Balduzzi | A security analysis of amazon's elastic compute cloud service[END_REF] where they highlighted the security issues present in the public virtual images. They performed vulnerability tests on 5000 virtual machine images available in four different data centers of Amazon [START_REF]Amazon elastic compute cloud (amazon ec2)[END_REF] and reported several security issues, some of them are:

(i) The confidential files were deleted while preparing the virtual machine image but these file are easily recoverable such as password files, SSH private keys, PGP private keys, etc. (ii) Discovered instances of SSH, different services and Web. (iii) History of files of VNC, MySql, DNS, WebApp, and SQL. Bugiel et al. [START_REF] Bugiel | Amazonia: when elasticity snaps back[END_REF] also highlighted the similar issues discussed by Balduzzi et al. [START_REF] Balduzzi | A security analysis of amazon's elastic compute cloud service[END_REF], but they performed experiments on 1255 Amazon images and the scope of their experiments was limited in covering security issues. The main focus of both the findings is to emphasis that there exist some serious security threats in cloud computing infrastructures. Garfinkel and Rosenblum [START_REF] Garfinkel | When virtual is harder than real: security challenges in virtual machine based computing environments[END_REF] highlighted the use of third party virtual images and their security issues. They also discussed other security issues exist in user generated virtual images. Glott et al. [START_REF] Glott | Trustworthy clouds underpinning the future internet[END_REF] highlighted the security issues that occurs when the virtual images are shared within multiple users in cloud infrastructure. They proposed some assessments to find out the vulnerabilities present in the virtual image. Ristenpart et al. [START_REF] Ristenpart | Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds[END_REF] only presented the introduction of side channel attacks in cloud computing networks. Bleikertz at al. [START_REF] Bleikertz | Security audits of multi-tier virtual infrastructures in public infrastructure clouds[END_REF] used graph theory techniques to deploy virtual machine images in AmazonEC2 infrastructure. The objective of their work is to focus on the security issues that are present at the infrastructure level which is a different approach as others focus more on the virtual images security. Their propositions are based on configuring network and setting the security policies properly.

III. DESIGN GOALS

In this section four types of problems are discussed namely; early detection of attacks, scalability and fault-tolerance, an intensive attack which last for very short period of timed, and minimization of false positives.

(I) Early detection of Attacks: In large computing infrastructures such as grids and clouds early detection of attacks is very important. Due to the nature of these networks where the network is shared by many users dispersed globally. Those attacks that are detected with a slight delay can cause very serious consequences for all the users. As we know that users from different organization can have access to cloud computing infrastructures. It is highly possible that some of the users that use the cloud and its services are not very secure within there network. It includes numerous factors such as vulnerabilities present in their machines, lack of anti-virus and firewalls in the network, no or poor security policies are in place in their local network. These users are the main source which can be exploited by attackers and can be used as zombies. They can become the cause of attack distribution to other secure users, which are part of the organization that has spend a lot of money and resources to make their network secure. One possible vulnerable area which is discussed in the related work are the reused of the virtual machines images that are shared among the users. Although the users for highly important experiments does not uses the virtual images of other users but there are chances that the virtual images that are used by other users does have some back-doors open in for form of root-kits. These back-door are used by the attackers to collect sensitive information of the other participating members of the network.

(II) Scalability and Fault-Tolerance: In large size computing infrastructure scalability is a key factor because the size of the networks always grows dynamically. This increase in the size leads to condition where the Security Management System (SMS) that manages the security of that network becomes overloaded by huge number of security alerts. Current SMSs struggle a lot under intensive attacks discussed by Raheel et al. in [START_REF] Hassan | Minimization of security alerts under denial of service attacks in grid computing networks[END_REF] and [START_REF] Hassan | Fast attack detection using correlation and summarizing of security alerts in grid computing networks[END_REF]. Their experiments show that the performance of the SMSs degrade after certain period of time. As large networks are distributed to many locations therefore the SMS is also distributed in order to monitor every site of the network. Fault-Tolerance is mandatory when any component of the SMS fails to works or targeted by the attackers. If the replacement of that component is not provided on time the SMS cannot not detect the attacks that are in place at the premises of that local site of the cloud network.

(III) An intensive attack which last for very short period of time: When attackers are distributed across different sites of the network they use slow timed pace attacks. The reason to use low iteration of the attempts is to hide the attacks from the SMS. For example a brute force attack that has a dictionary which contains thousands of passwords. If the attacker uses it from one place by one instance, he needs to keep trying at a high iteration rate to break the password of the machine. There are high chances that due to the high number of attempts the attacker is identified by the SMS. If the attack uses slow iteration rate than it might take too long to get success. Therefore the best approach is to divided the dictionary of passwords in small chunks of multiple files. The attacker uses multiple instances of the attacks and uses these small dictionary of passwords simultaneously. The attacker slows down the number of attempts from each instance and get the same iteration rate if combined together. This technique is very common and quite effective if the SMS has some threshold defined to generate the attack alarm. The attacker keep the iteration of the attempts below this threshold value and gets success in its attacks.

(IV) Minimization of false positives: The events are collected and analyzed in order to produce an alert. For generating an attack alarm there are two possibilities. First; the SMSs mostly use some threshold value before generating an attack alarm. This threshold triggers an alarm if any specific alert reaches a defined limit of iterations. Second; the SMS has some defined security rules, On the basis of these rules, SMS decides whether it is an attack or a normal activity. The wrong attack alarm can be reduce if the common attack alerts are combined at a specific time. This mechanism is effective in minimizing the false positive rates and enhances the performance of the SMSs.

IV. PROPOSED SOLUTION

To address all the above mentioned problems a SMS called Cloud Distributed Intrusion Detection System (CDIDS) has been proposed. Only the overview of the CDIDS has been discussed in this paper. Figure 1 is the internal view of CDIDS. It shows that CDIDS is based on log collection model. CDIDS collects logs from multiple collectors that are distributed and placed across the cloud infrastructure. Collectors are the modules that are programmed to receive logs from computing elements present in the network. Similarly computing elements are configured to send their logs to the collectors. Several collectors are distributed across all the local sites of the network. The number of collectors can be increased or decreased depending upon the numbers of logs generated in that local site. The collectors analyze the logs to detect the attack incidents. If some incidents are found, they are marked as alerts and forwarded to the log manager. The main controller and the analyzer of the systems is the log manager that holds the security alerts which come from different cloud networks. The log manager formates the received local alerts and correlate them to report whether it is really an attack incident or not. It further analyzes all the local alerts received to detect the distributed attacks lunched on multiple local sites of the network. The detected attacks are formatted in a standard formate that is defined in the CDIDS. All the detected alerts with a specified formate of CDIDS are forwarded to match with the general security rules that are written by the security manager. In general security rules, if the security alerts are matched with any of the defined rule. One alarm generates containing all the necessary information about the attack, its re-occurrence, the time it was started and the elapsed time. At the final stage a further analysis of the attack is done to calculate its intensity. Once all the parameters are marked it is saved into the cloud service provider's database for further forensic analysis.

Figure 2 represents the overview of the cloud security management system which composes of multiple public & hybrid clouds. Each cloud consists of several Administrative Domains (AD) which are further divided into many local sites. It shows that how events are collected and correlated to detect the attacks which can occur in different cloud networks. The CDIDS helps to handle all the above mentioned problems. It detects the attacks at a very early stage by summation of security alerts globally. Summation of alerts can be done securely by using Secure Multi-party Computation (SMC). The SMC is first proposed by Andrew Chi in [START_REF] Yao | Protocols for secure computations (extended abstract)[END_REF]. In an SMC setting [START_REF] Goldreich | The Foundations of Cryptography[END_REF][17], a number of participants, each having a piece of private data, wishes to compute the value of a public function. A protocol is secure if the computation yields, to all participants, no more information than their own inputs and the final result. In the proposed approach, secure sum and secure comparison protocols can be used to sum the number of security alerts from individual administrative domains and to determine if it exceeds a given threshold. The secure sum and secure comparison protocols can be implemented using the SEPIA framework [START_REF] Burkhart | Sepia: Privacy-preserving aggregation of multi-domain network events and statistics[END_REF] based on Shamir's secret sharing scheme. It even detects those attacks that lasts for very short period of time. CDIDS has a scalable architecture and it is fault-tolerant. In order to minimize the false positives and accurately detect the attacks a distributed security alert summation technique has been adopted. It helps in detecting the attack by adding all the reported security alerts occurred during the same period of time within all the member of the cloud computing network. In CDIDS security alerts sharing mechanism between intra cloud can be further improved using privacy preserving data release techniques such as those based on k-anonymity [START_REF] Ciriani | k-Anonymity[END_REF][23] and differential privacy [START_REF] Fung | Privacy-preserving data publishing: A survey of recent developments[END_REF][20] [START_REF] Dwork | A firm foundation for private data analysis[END_REF].

V. EXPERIMENTS FOR OPTIMIZING DETECTION OF DISTRIBUTED ATTACKS IN CLOUD COMPUTING NETWORKS

In this section three types of experiments are performed in order to handle the problems discussed above. CDIDS which

A. Smurf Attack detection

Smurf attack is a type of DoS attack in which the attacker uses spoofed IP addresses in order to generate huge traffic at the victim machine. In smurf attack one attacker or group of attackers use large amount of ICMP packets to a specific or broadcast IP addresses. In this attack scenario the group of attackers launched the attack simultaneously on four Cloud Network (CN). They spoofed their IP addresses which makes it harder to detect early by the security management system. Using the summation of the sites the attacks are detected earlier. Multiple attackers use multiple commands of hping to launch the attacks, which are as under, Attacker1: hping3 -a spoofed IP address -i u1 -S victim IP address Attacker2: hping3 -a spoofed IP address -i u10 -S victim IP address Attacker3: hping3 -a spoofed IP address -i u100 -S victim IP address Attacker4: hping3 -a spoofed IP address -i u1000 -S victim IP address

The parameter of the hping command are, "-a" is used to set any IP address, "-i u" is the delay in transmitting another packet in micro seconds and "-S" is used to set the SYN TCP flag.

Figure 3 shows the early detection of Smurf attack using the security alerts summation mechanism. The received alerts from the members of the cloud are further analyzed at each CN to detect distributed attacks. Three thresholds are set globally to detect the distributed attacks. The reason to set these thresholds is to detect the attacks as early as possible Fig. 2. General View of Intra-public Cloud Architecture and to minimizing the false positives. The threshold values are adjustable according to the size of the network and the capacity to handle and store the security alerts globally. The low threshold is set to 100000 number of security alerts. The medium threshold is set to 250000 number of alerts. The high threshold is set to 400000 number of alerts. Using the low threshold the Smurf attack is detected on CN 1,3&4 between 1 to 2 minutes. The medium threshold detects the Sumurf attack on CN 3&4 is detectable between 3 to 4 minutes whereas on CN 2,3&4 the same attack is detected in between 1 to 2 minutes. The high threshold can only detect the summation of CN 2,3&4 at the fourth minute. This experiment shows that early detection of attacks explained in problem I can be improved by using the summation of security alerts. It can also help the SMS to minimize the false positives discussed in problem IV, because the alarm of attack that has the iteration rate in thousands of alerts proves that SMS has detected a real attack.

B. SYN Flooding Attack Detection

TCP protocol uses three-way handshake mechanism which is vulnerable to SYN flood attacks. (i) Attacker sends "SYN" to victim. (ii) Victim sends "SYN-ACK" back to the attacker.

(iii) Attacker does not sends "ACK" and keeps sending "SYN" packet to the victim. The SYN flood attack is one kind of DoS attack where high number of "SYN" packets are send by the attackers to the victim machine. The victim machine allocates resources for each request sent by the attackers. The victim machine sends back the "SYN-ACK" to the source IP of the attackers. The attackers use the spoofed IP addresses which does not exists in the network. This results in no "ACK" response from the attackers. The attackers continue sending high amount of "SYN" packets to the victim machine and victim waits for the "ACK" request. After some time these SYN packets sent by the attackers consume all the resources of the victim machine and makes it unstable which results in blocking all the requests coming from legitimate users. The SYN attack can halt the entire network operations if uses the broadcast address mixing with IP spoofing.

Figure 4 shows the SYN attack case, where the thresholds are set to detect the instability in the security management system. Four CNs are shown in the graph which are the member of one cloud network. The curves show that after passing of 2 minutes the CNs does not detect the attacks at the same rate and continue to work at a constant rate. This case occurs when the CN does not have much resources to handle the intense attacks. Here the summation of alert The parameter of the commands are, "-syn" is to set the SYN tcp flag, "-desport 80" is to set the port number of the victim and "-i u1000" is to send the packet after the delay of 1000 micro seconds. IPtable rules to detect the malicious packets is, iptables -A INPUT -d 0/0 -s0/0 -p tcp -tcpflags SYN,ACK,FIN,RST SYN -j LOG -log-prefix "SYN ATTACK "

This rule logs the packets that are coming from any source to any destination using TCP protocol having any of the bit set SYN,ACK,FIN,RST. It saves every attempt of this type with the tag "SYN ATTACK" in the system logs. This experiment handles the instability issues discussed in problem II and shows that the attacks are detected before the SMS becomes unstable.

C. Distributed SYN and PoD Attack Detection in Seconds

In this attack multiple attackers use SYN and PoD attacks together. Figure 5 shows the behavior of the SYN and PoD attack. The commands that are used for these attacks are, Attacker1: hping3 -syn -destport 80 -i u10 Victim Machine Attacker2: hping3 -syn -destport 80 -i u100 Victim Machine Attacker3: ping -s 64000 -i 0 IP Attacker4: ping -s 65000 -i 0 IP

The parameter of the Ping command are, "-s" defines the packet size, "-i" is the interval between two packets. Here "0" means it is set to flood mode.

In this scenario the attackers increase and decrease their attack intensity in order to camouflage their malicious activities from the SMS. Therefore the attack detection is more optimized by setting the thresholds in seconds. Multiple attackers launches the SYN and PoD attack at the CN 1&2. The objective of these attacks is to destabilize the security management system and hide the real attacks such as Brute Force. The graph shows that low threshold detects the distributed PoD attack on CN 1&2 in between 6 to 7 seconds. The medium threshold detects the distributed SYN attack on CN 1&2 in between 3 to 7 seconds. This experiment addresses problem III and shows that camouflaging the malicious activities are now detectable.

VI. CONCLUSION & FUTURE WORK

In this paper the internal architecture of CDIDS and its core features are presented. The general view of CDIDS has been explained that shows it is scalable and fault-tolerant. Some experiments are conducted to show that how the early detection of distributed attacks is possible. Few advantages are highlighted such as minimization of false positives and detection of attacks even when the SMS become unstable. The summation of security alerts method helps in detection of very powerful attacks which last for very short period of time.

Future modification in the design of the CDIDS needs to be done, some of the propositions are:

(i) New boxes should be introduced at each service, that means one box for infrastructure, one for platform and one for software. (ii) These boxes must be programmed to handle the specific security issues occurred at each service level. (iii) For every service there must be a separate analyzer which communicates with the boxes located in its vicinity. (iv) If needed the analyzers can also collaborate with each other to detect the attacks that are launched using all the three service levels. (v) The analyzers at each service level must report to the Main analyzer which will handle the security of the entire cloud. (vi) There may exist multiple dedicated boxes which are allowed to share the security information with each other. (vii) The manager of all the boxes will be the Cloud Box that will present the global view of the security.

Fig. 1 .

 1 Fig. 1. Cloud Distributed Intrusion Detection (CDIDS) Core Design

Fig. 3 .

 3 Fig. 3. Detection of Smurf Attack

ACKNOWLEDGMENT Thanks to the Laboratory of Computer Science University of Franche-Comte France, the Higher Education Commission and Quaid-e-Awam University of Engineering, Science & Technology Pakistan for supporting our work financially. The Department of Computer Science of the University of Emory USA for technical assistance and collaboration.


Charles Hirlimann

François Bardou

Understanding Branly's effect through Induced Tunnelling

Keywords: Branly, tunnelling, granular medium, electrical spark, radioconduction, divided metal

At the end of the nineteenth century Édouard Branly discovered that the electrical resistance of a granular metallic conductor could drop by several orders of magnitude when excited by the electromagnetic field emitted by a distant electrical spark [i]. Despite the fact that this effect was used to detect radio waves in the early days of wireless telegraphy and more recently, studied in the field of granular materials, no satisfactory explanation of the physical origin of the effect has been proposed.

In this contribution, we relate the Branly effect to the induced tunnelling effect first described by

Introduction

The discovery and characterisation of electromagnetic waves by Hertz at the end of the nineteenth century ignited studies on the interactions of these waves with materials. One of the first major findings was that of the radioconduction of granular conductors by Branly in 1890 [1]. He found that when an insulator tube filled with metal filings is submitted to a DC potential difference and it receives transient electromagnetic waves generated by an electrical spark at some distance away, its electrical resistance drops by several orders of magnitude. Many aspects of this effect were revealed in other work during the following decade. It has been established firmly that the presence of a thin resistive layer between the grains is necessary to achieve high resistance before exposure to the electromagnetic waves. As the effect does not occur with noble metal grains cleaned of any surface contaminant, the nature of the resistive layer was recognised as an oxide or vacuum by Dorn [iii]. It has been observed previously that a permanent and unique conductance percolation path is the reason for the drop in resistance of the granular medium [iv,v], which led to the understanding that the welding of the grains was the result of radioconduction or the coherer effect. Because of this welding of the grains the effect is non-reversible, although the electrical path can be broken easily by gently striking the tube containing the filings, which restores the original large resistance of the granular medium. This effect was used by Lodge [vi,vii] to devise a practical radio detector that ensured the pioneering developments of radiotelegraphy. Pressing the grains against each other reduces the original resistance by reducing the thickness of the oxide layers and thus, increasing the sensitivity of the radioconductor to the external excitation [viii]. It has always been observed that the effect is inherently noisy and that the final resistance fluctuates within a rather large range of results [ix].

Above some critical applied DC potential, the resistance of a granular medium drops without any external excitation [3]. This effect, which must not been confused with the Branly effect, even though in recent times it has been called the continuous Branly effect, is what we wish to discuss here [x].

Ashkinass studied the resistance drop of a unique contact between two tin needles and found a critical voltage of 0.2 V, independent of the current [xi]. Guthe and Trowbridge recorded the U(I) curve of the contact between two metallic spheres and showed that without any external excitation, it exhibits a critical voltage P that characterises the resistance transition of the metal-insulator-metal (MIM) system. They found the value P = 0.23 V for the DC potential drop between two centimetre-sized steel balls. As can be seen, these experiments involve only one barrier of potential made of the oxide of the two metals in contact. Therefore, we understand now that this "continuous Branly effect" is the "classical" tunnelling of an electron through a barrier of potential with an energy level of the order of 0.2 eV, under the experimental situations that have been explored. The resistance of the device drops as soon as the applied voltage accelerates the conducting electrons to an energy that is larger than the barrier height.

Interest in the effect under its various forms resumed during recent decades in relation to a renewed interest in granular media. The uniqueness of the conduction path, which results from a percolation of the welding of the grains through the granular medium, was confirmed using infrared optical imaging [xii]; the welding of the grains has been firmly and quantitatively established. Careful experiments in the CW mode on conduction between metal spheres, has shown through sophisticated modelling that high electric current through contacts with 100-nm diameters produces a temperature as high as 1050 °C, which is large enough to ensure welding between the metallic conductors [10].

The Branly effect itself, in which a direct voltage of less than the critical voltage is applied to the granular medium and an electromagnetic pulse dramatically changes its total resistance, was studied in ordered lattices of lead beads by Dorbolo et al. [xiii].

Briefly, we consider here the radio conduction effect discovered by Branly in which oxidised metal particles set under a DC voltage are welded together when an electromagnetic pulse is applied. Despite the great wealth of results that have been collected over more than a century, no physical understanding has yet been proposed regarding the physical origin of this radioconduction effect. This paper proposes an explanation based on the "induced tunnelling effect" that has been theoretically described recently and evidenced in an optical experiment [2,xiv].

Experimental results

Radioconduction

The discussion can be first simplified by noting that the granular structure of the conducting medium and the related percolation effects are not relevant to the radioconduction effect, as Branly himself showed in a very elegant experiment performed with a couple of conductors separated by a thin oxide layer [xv]. We can assert then that the Branly effect is governed by the electrical tunnel effect that occurs in what is nowadays called a MIM structure [START_REF] Simmons | Poole-Frenkel Effect and Schottky Effect in Metal-Insulator-Metal Systems[END_REF]. In a typical experiment, Branly observed that when a spark in the surroundings emits electromagnetic waves, the electrical resistance of a granular medium drops. In these experiments a Daniell battery applies a U = 1 V DC potential difference to the medium, which comprises iron filings that are compressed slightly in a glass tube; a galvanometer measures the current flowing through the filings. Extreme drops in the resistance were measured at the time an electrical spark was ignited in the vicinity of the experiment. A typical measurement of change of resistance of the tube was from R 0 = 10 6 Ω to R = 100 Ω; a change of four orders of magnitude.

According to Ohm's law, the original current flowing through the unperturbed granular medium in that case is i 0 = 10 -6 C.s -1 , which corresponds to a flow of electrons of n 0 = 6.10 12 s -1 . This current increases up to i f = 10 -2 C.s -1 = 10 mA when the Branly effect occurs and the granular medium starts conducting.

In this conducting state, the flow of electrons becomes n f = 6.10 16 s -1 .

The CW Branly effect

Recent experiments [10] have been performed very carefully with chains of stainless steel balls in the CW regime with no external excitation. In these experiments, the steel balls are separated by nanometre-thick oxide layers acting as barriers of potential for the conducting electrons. By applying a DC voltage to the set of contacting balls, the authors found a value of P = 0.4 V per contact (equivalent to per barrier of potential) for the critical voltage above which the resistance of the chains of balls drops. Below the critical value, the kinetic energy of the electrons in the balls is less than the height of the barrier and thus, conduction is governed by the tunnelling of electrons through the barriers and the electrical resistance is high. Above the critical voltage, the kinetic energy of the conducting electrons is greater than the barrier height and thus, they behave like free electrons in a metal; the conductivity increases by orders of magnitude and the resistance of the device drops. The value of the critical voltage is in very good agreement with the historical observations referred to above. These authors were able to establish through modelling that the drop of resistance is a consequence of local heating with a peak temperature of 1050 °C; high enough to allow for the local destruction of the barrier of potential and for the local welding of the steel balls. Therefore, when the current flowing through the MIM contacts of a coherer is forced to increase, a threshold can be reached such that a localised welding of the metallic parts occurs and hence, the resistance of the contacts drops irreversibly.

At this point, we understand that the physics at the core of the Branly radioconduction effect, which was used previously for detecting electromagnetic pulses, is based on the transmission of electrons through a barrier of potential equal to a few hundred meVs. These barriers are fabricated from nanometre-thick layers of oxide separating two non-noble metal parts (e.g., filings, spheres, wires, tips). We also understand that the potential difference applied to the tube of filings in Branly's experiments was always such that the voltage applied to one contact was always less than the critical voltage above which the electrons would have energy greater than the barrier height. The mode of electrical conduction in Branly's experiment was therefore classical tunnelling, leading to high electrical resistances of the medium and low electron flows.

Discussion

Induced tunnelling

Once the radioconduction effect is understood, the question that remains to be addressed is why the electrons in the metal parts in the filings tube behave as if they had an energy larger than the height of the barrier of potential that separates the grains, at the time when a spark emits an electromagnetic pulse in the vicinity of the experiment.

Let us first consider the order of magnitude of the energy of the electromagnetic field emitted by the exciting spark that could be deposited on the electrons in the metal particles. Branly used the classical setup designed by Hertz for generating electromagnetic pulses [1]. The primary source of energy was a chemical battery. A Ruhmkorff induction coil was used in the experiment to generate trains of sparks emitting gigahertz electromagnetic (em) waves. The energy in the spark plasma is estimated to be of the order of 10 mJ [START_REF] Reinmann | Temporal investigation of a fast spark discharge in chemically inert gases[END_REF] and because of the poor yield of the conversion of this energy into em waves, these waves could not be detected at distances greater than a few metres.. In Branly's experiment, the spark generator was placed at a distance of 20 m from the experiment. At this point, two regimes must be distinguished depending on whether the spark generator is close to the experiment. In the experiment by Dorbolo et al. [13], for instance, the distance does not exceed one metre; in that situation, the energy transferred by the em wave to the electrons in the metal parts is sufficient for them to energetically overcome the barrier energy height. This does not differ from the continuous Branly effect described above, in which high temperatures are reached and welding of the contacts occurs when the flow of electrons is sufficiently large. This energy transfer does not stand in experimental situations where the distance is larger and where the energy deposited by the em wave bursts becomes much smaller than the barrier height. It is the purpose of this paper to propose the "induced tunnelling effect" as the physical mechanism responsible for induced conduction when the energy of the electrons in the metal parts is smaller than the barrier of the potential that separates them.

In a work published in 2001, Bardou and Boosé established theoretically that the probability of a particle tunnelling through a barrier of potential could be increased significantly by gently striking the particle at the time when the centroid of its wave packet is reflecting on the barrier [2]. The onedimensional model calculation they performed stands for a square potential barrier of height U 0 and an electron with energy E, which is described as a wave packet (Fig. 1a). It was shown that a small momentum transfer to the particle ∆p x (such that the energy transfer   h 2  p x 2m  E , m being the mass of the particle) at the time of its reflection on the barrier of potential has the dramatic effect of projecting its wave functions on the full set of its Eigen-functions. This full set of wave functions comprises the stationary wave functions of the undisturbed Schrödinger equation. Therefore, the result of the momentum transfer is such that the weight of the continuum of wave functions, corresponding to the particle energies lying in the continuum far above the height of the barrier of potential, becomes dominant in the final wave function. As the probability of the transmission of the particle through the barrier is obtained by integrating the contributions of all the wave functions, the effect of the momentum transfer is to increase the transmission probability because of the large contribution of the passing wave functions (Fig. 1b). These authors have shown that the excitation of the particle at the time of its reflection on a barrier of potential increases it transmission probability by several orders of magnitude. Specifically, below the transfer limit, the transmission T of the barrier is proportional to the square of the momentum transfer T(∆p x )  (∆p x ) 2 . As a consequence, the tunnelling effect does not depend on the sign of the momentum transfer, i.e., the effect is the same whether the particle is pushed towards the barrier or pulled away from it. This is significantly different from the regular tunnel effect in which the transmission probability varies as

 T ( E )  exp(  a U 0  E )
, in which a is a constant of proportionality that depends on the thickness of the barrier and hence, it increases when the particle is pushed towards the barrier (the energy increases) and decreases when the particle is pulled away (the energy decreases). shown as a wave packet on the left, hits the barrier of potential of height U 0 . The particle has a probability T given in the main text, to be transmitted through the barrier and a probability R to be reflected. If a small momentum transfer ∆p x transferred to the particle before it reaches the barrier, its energy changes according to the sign of the momentum transfer   h 2  p x 2m  E and the probabilities change only slightly. b) Induced tunnelling. If the momentum transfer occurs at the time the incoming and the reflected wave functions are superimposed, then the transmitted probability is greatly enhanced. This enhancement is quadratic with the momentum transfer and therefore, it does not depend on the sign of the kicking of the particle. This enhanced probability is due to the projection of the particle wave function on its full set of Eigen-functions and as a consequence, it is due to the large contribution of the passing wave functions.

One important feature of the induced tunnelling effect lies in the fact that it reaches its maximum amplitude at a time that corresponds to the exact reflection on the barrier, when one half of the incoming wave packet interferes with the reflected other half. It is therefore important to estimate the duration of the reflection of a particle on the barrier of potential, because the duration of the momentum transfer has to be of the same order of magnitude or less. This transient interference process is, of course, not instantaneous and its duration is related to the time it takes for an evanescent wave to establish inside the barrier of potential [START_REF] Cohen-Tannoudji | Mécanique Quantique[END_REF]. This reflection delay is quite general in wave physics and in optics, it is known as the Goos-Hänchen effect when total reflection occurs [START_REF] Goos | Ein Neuer und fundamentaler Versuch zur Total reflexion[END_REF]. A textbook calculation shows that the duration  of the reflection of a particle on a barrier of potential can be written as:

    2m h k  0 2  k 2 ,  0 2  2mU 0 h 2 , k 2  2m E h 2 ,   0.66 E(U 0  E )
in fs when m is the mass of an electron.

(1)

Under physical conditions where the height of the barrier is chosen to be U 0 = 0.5 eV, representative of the critical potentials found in the literature, the energy of the particle is chosen here to be E = 0.25 eV and this time delay is equal to 2.65 fs. To make the point more precise, Fig. 2 shows the variation of this delay in the reflection on the barrier of potential of an electron as a function of the energy of this electron.

Figure 2 Variation of the reflection delay for a particle reflecting on a barrier of potential with height U 0 as a function of its energy. As can be observed, the reflection delay increases greatly for particles with either energy close to the barrier height or for slow particles with low energy, is less intuitive. These relatively large durations are favourable to the perturbation of a reflecting particle by an incoming short-lived excitation.

The very interesting point that arises from the calculation is that both high and low energy electrons have rapidly increasing sticking delays when their energy increases or decreases, respectively. This situation is highly favourable to their efficient kicking through an external excitation. Outside of this sticking time interval, any momentum transfer is inefficient and equivalent to a very small energy change of the impinging electron in the regular tunnelling effect [2]. Therefore, the external excitation of a particle reflecting on a barrier must contain dynamical structures on the time scale as the sticking delay. We shall now scrutinise the temporal structure of the electromagnetic pulse that is emitted by a spark and verify whether it could act as the external excitation.

Electrical sparks' temporal structure

As early as at the beginning of last century, Abraham and Lemoine discovered experimentally that the duration of an electric spark is less than one nanosecond [20]. Recently, Descoeudres made exhaustive spectral measurements of electrical sparks and found a bandwidth of the order of 400 nm in the visible range [START_REF] Decoeudres | Characterization of electrical discharge machining plasma[END_REF]. An electrical spark is the result of electronic de-excitation of electrons and ions in gas plasma and the various emitted electromagnetic waves do not have any reproducible phase relationship, i.e., the emission is incoherent in nature. As with any incoherent emission, spikes or bursts of emission intensity occur erratically. Because from the measured spectral width of a spark emission, a coherence time as short as one femtosecond can be inferred from the standard Fourier relationship [START_REF] Hirlimann | Femtosecond laser pulses, principles and experiments[END_REF], it seems clear that the condition of shortness in the momentum transfer to the electron can be fulfilled by the electromagnetic field emitted by an electric spark. It is therefore assessed that induced tunnelling can result from the kicking of the electrons in a metal particle reflecting onto a barrier of potential.

At this point, it becomes clear that the induced tunnelling effect gives the appropriate framework for an interpretation of the Branly effect. In a granular oxidised metallic medium, microscopic grains are isolated electrically from one another by a nanometre-thick metal oxide layer, forming a large population of MIM's. When a voltage is applied to the medium, electrons are accelerated and they reflect on the barriers of potential that separate the grains of the medium. At the time of the reflection, these electrons can be kicked forwards or backwards by short electromagnetic bursts present in the external electromagnetic field emitted by a spark, as a small momentum is transferred to them. The large transmission enhancement induced by the momentum transfer produces an increased electrical current, which for some events becomes sufficiently large to permit local heating in the metal grains and thanks to the Joule effect, leads to the welding of pairs of grains. When a percolation path has formed due to the welding of the grains, the electrical resistance of the medium drops changing from an exponential dependence on the applied voltage to a linear one (Ohm's law).

This theory should be easy to falsify. For instance, excitation of a coherer by a smooth, long-lasting electromagnetic field should be inefficient because a fast momentum transfer is needed, one that lasts no longer than the reflection time of the electrons on the oxide barriers in the framework of the induced tunnelling effect. Gold dots deposited on a resistive surface and separated by 1-nm-thick vacuum (air) barriers should behave as instantaneous coherers, because the resistance drop would be controlled only by the induced tunnelling effect and no welding between the dots would be possible in that experimental situation.

Conclusion and perspective

The drop of electrical resistance of a granular oxidised medium under the influence of an external incoherent electromagnetic burst has not received a satisfactory physical explanation for more than a century, despite the fact that it was used by Lodge [7] to design the coherer, the first sensitive electromagnetic wave detector and despite it making possible the first long-distance wireless telecommunication by Marconi in 1895 [START_REF] Gardiol | Salvan, berceau de la Télégraphie Sans Fil[END_REF]. In this paper, we have discussed the possibility that the induced tunnelling effect, which was discovered theoretically by Bardou and Boosé and experimentally verified by Hirlimann et al., could be responsible for the Branly effect, which was at the heart of early wireless telecommunications.

This physical interpretation given to the Branly effect can be applied to various other manifestations of resistance changes under external excitation of a granular medium that have been observed. In 1898, Auerbach demonstrated that a coherer could be made conducting by an acoustic excitation in the audible range of the spectrum [START_REF] Auerbach | Ueber Widerstandsverminderung duch electrische und durch akustische Schwingungen[END_REF]. As mentioned in [2] and described more precisely in [14],

exist other ways to produce induced tunnelling, which rest on the fact that particles receive additional momentum when they impinge on a moving potential barrier [START_REF] Landau | Mécanique Quantique[END_REF]. Therefore, acoustic waves, by inducing vibration in the tunnel barriers between the grains of a coherer, could be responsible for an induced tunnelling. Moreover, acoustically induced tunnelling could also be at the very heart of the microphone effect between carbon grains, which has been abandoned by the telephone industry only during the last decade [START_REF]The carbon microphone was invented[END_REF]. Related to these experiments is the increase of resistance observed when metallic filings are replaced by what is nowadays called semiconductor grains. A typical experiment was performed by Ashkinass using PbO 2 ; when excited externally by a strong electrical spark, the resistance of a tube filled with PbO 2 powder increases by several orders of magnitude [11]. Here again, tunnelling induced by an external electromagnetic wave burst could be responsible for a charge (electrons and holes) migration on both sides of the tunnels separating the grains. The charge separation, by creating a region of space, would increase the thickness of the tunnels and therefore, increase the resistance of the medium.

The new concept of induced tunnelling has a strong unifying power on the various effects that occur in situations where quantum tunnels are present. As has been described above, the effect is sensitive to any excitation from surrounding mechanical and electromagnetic noise. The result is a noisy intrinsic behaviour of any device that can exhibit the Branly effect. As a matter of fact, coherers used in the early stages of radio telegraphy have been difficult to handle because of the large variation of their output; carbon granular microphones are known to exhibit specific "carbon hiss" noise and large noise levels are observed in the MIM structures [11,[START_REF] Costa | Statistical properties of currents flowing through tunnel junctions[END_REF] used nowadays in memory devices. Since the first measurement of the electrical resistance of a single C 60 molecule in 1995 [START_REF] Joachim | Electronic Transparence of a Single C 60 Molecule[END_REF], the growth in the number of experiments in the field of molecular electronics has been exponential. A large number of these experiments rely on the use of tunnel effects and should therefore be sensitive to induced tunnelling. Thus, care should be taken to strictly isolate the experimental setups from external excitations, either electromagnetic or acoustic. Last but not least, it has been known for a long time that alpha radioactivity [START_REF] Gamow | Zur quantentheorie des atomkernes[END_REF][START_REF] Gurney | Quantum mechanics and radioactive disintegration[END_REF] is due to the tunnelling of a hydrogen nucleus out of large and unstable nuclei. This consideration opens the opportunity of exploring the possibility for gamma rays with energy less than the barrier height to induce tunnelling of hydrogen particles; hence, decreasing the radioactive lifetime of the emitting nuclei. This could also be explored in case of beta emission.

In memoriam. This work is dedicated to François Bardou †.

Figure 1

 1 Figure 1 Sketch of the induced tunnelling effect. a) Classical one-dimensional quantum tunnelling. One particle,

Acknowledgement. The author thanks Romeo Michelangelo for reproducing Branly's experiments in the course of this work. Dr Jean-François Morhange performed a very careful reading of the manuscript, many thanks to him.