Marcelo Menezes Morato
email: marcelomnzm@gmail.com

Tito L M Santos

Julio E Normey-Rico

Explicit Dead-Time Compensation in Linear Parameter Varying

Keywords: Dead-time, Model Predictive Control, Linear Parameter Varying Systems

INTRODUCTION

Model Predictive Control (MPC) is very well recognised and widely applied for constrained processes. Over the last decade, there has been astounding progress on enhancing the real-time capabilities of MPC algorithms [START_REF] Gros | From Linear to Nonlinear MPC: Bridging the Gap via the Real-time Iteration[END_REF]. In parallel to this advance, the Linear Parameter Varying (LPV) toolkit has been widely popularised [START_REF] Sename | Robust control and linear parameter varying approaches: application to vehicle dynamics[END_REF]. For many nonlinear and complex systems, LPV realisations stand for an elegant modelling strategy, with no nonlinear state transitions but rather linear maps scheduled by (known, bounded) parameters ρ. Accordingly, recent progress has been established on LPV MPC algorithms, refer to (Morato et al., 2020a) and references therein.

Dead-time (DT) phenomena are observed in many reallife situations, such as when time is required to transport energy, mass, or information, or due to the accumulation of lags when a series of low-order systems are connected in series, as argues [START_REF] Normey-Rico | Control of dead-time processes[END_REF]. With regard to this matter, we note that DT compensation is one of the inherent advantages of MPC algorithms [START_REF] Santos | On the explicit dead-time compensation for robust model predictive control[END_REF]. In these controllers, DTs are taken into account by systematically augmenting the prediction model, using additional state variables that linearly relate to the magnitude of the DT (da Silva et al., 2020). Nevertheless, recur-⋆ This work has been supported by CNPq (304032/2019 -0). sive feasibility and stability properties of the closed-loop system are typically demonstrated using terminal ingredients based on delay-free (nominal order) models [START_REF] Köhler | Stability and performance analysis of NMPC: Detectable stage costs and general terminal costs[END_REF] or via complex delay-dependent Lyapunov-Krasovskii maps [START_REF] Kharitonov | Lyapunovkrasovskii approach to the robust stability analysis of time-delay systems[END_REF]. Therefore, it is reasonable to conclude that implicit delay compensation in MPC is not very practical in some cases, especially since: (i) the resulting algorithm has an increase on numerical demand, which complicates real-time applications; and (ii) stability-related tools, such as terminal invariant sets, also become harder to determine [START_REF] Normey-Rico | Robustness of nonlinear MPC for dead-time processes[END_REF].

A widely used solution for the control of delayed processes is the use of DT compensators (DTCs). Based on the seminal work of Smith [START_REF] Smith | Close control of loops with dead time[END_REF], these schemes are used to eliminate the DT from the closed-loop characteristic equation. DTCs have been studied and diversified over the last six decades, with recent extensions for nonlinear [START_REF] Lima | Robust nonlinear predictor for dead-time systems with input nonlinearities[END_REF] and time-varying DT (Morato and Normey-Rico, 2021) cases. Recent debate on the topic clearly indicates that these scheme are still relevant [START_REF] Skogestad | Should we forget the smith predictor?[END_REF][START_REF] Da Silva | Controlling industrial dead-time systems: When to use a pid or an advanced controller[END_REF].

Taking into account the previous discussion, our goal in this paper is to assess on how MPC algorithms can handle DT LPV systems by explicitly compensating the effect of DT under a corresponding DTC. Specifically, we build upon the ideas of [START_REF] Santos | On the explicit dead-time compensation for robust model predictive control[END_REF], generalising the prior result for the LPV case, while exploiting the parameter-dependent stability conditions recently developed by the authors [START_REF] Morato | Sub-optimal Recursively Feasible Linear Parameter-Varying Predictive Algorithm for Semiactive Suspension Control[END_REF](Morato et al., , 2021a)). The contributions are as follows:

• An explicit DTC scheme is presented for the case of delayed LPV processes (Sec. 2). • A corresponding LPV MPC scheme is proposed with parameter-dependent terminal ingredients (Sec. 3). • Robustness analyses regarding DT estimation errors are given (Sec. 4). • A solar collector benchmark simulation is given in order to illustrate and discuss the advantages of the proposed method when compared to a standard LPV MPC algorithm with an implicit DT model (Sec. 5).

Notation. The index set N [a,b] represents {i ∈ N | a ≤ i ≤ b}, with 0 ≤ a ≤ b.
The identity matrix of size j is denoted as I j ; I {j} denotes the j-th row of I j ; col{•} denotes the vectorization of the entries and diag{v} denotes the diagonal matrix generated with the line vector v. The prediction of a given variable v(k) at time instant k + i, computed based on the information available at instant k, is denoted as v(k + i|k). K ∞ -class scalar functions are positive,increasing, and pass through the origin. A realC1 function f : R m → R n is such that it is differentiable and holds continuous first derivatives. Π b i=a (A(ρ(i)) denotes the left-side matrix product from i = a to i = b, i.e. A(ρ(a))A(ρ(a + 1)) . . . A(ρ(b)). The Minkowski set addition is defined by

A ⊕ B := {a + b | a ∈ A , b ∈ B}, while the Pontryagin set difference is defined by A ⊖ B := {a | a ⊕ B ⊆ A}.

PRELIMINARIES

Process model

Consider the following discrete-time LPV system:

x(k + 1) = A(ρ(k))x(k) + B(ρ(k))u(k -d) , ρ(k) ∈ P , (1)
being k ∈ N the sampling instant, x(k) ∈ R nx the vector of the current state variables, u(k) ∈ R nu the vector of the current control inputs, and ρ(k) ∈ R np the current scheduling variables. This LPV system is prone to DT, since the control action u(k) takes d samples to have an effect on the state dynamics.

The system in Eq. ( 1) is subject to state and input constraints:

x ∈ X := {x ∈ R nx : H x x ≤ g x } and u ∈ U := {u ∈ R nu : H u u ≤ g u }, which imply ∥x j ∥ ≤ x j , ∀j ∈ N [1,nx] , ∥u i ∥ ≤ u i , ∀i ∈ N [1,nu]
, respectively. Slewrate constraints are implied over the control increments, this is δu ∈ δU := {δu ∈ R nu : H δu δu ≤ g δu }, where δu(k + 1) = u(k + 1) -u(k). Without loss of generality, the origin is considered an equilibrium point of Eq. (1). Moreover, the state transition map is of class C 1 over Z := X × U, ∀ ρ ∈ P. Assumption 1. The scheduling variables exhibit bounded rates of variation, i.e. δρ(k+1) = (ρ(k + 1) -ρ(k)) ∈ δP, with: δP := {δρ j ∈ R :

δρ j ≤ δρ j ≤ δρ j , ∀j ∈ N [1,np] }.
Remark 1. Bounded rates of scheduling parameter variations is standard in LPV control [START_REF] Mohammadpour | Control of linear parameter varying systems with applications[END_REF]. If δρ is unbounded, the following discussions can still be used, but rather using ρ(k + 1) ∈ P (which implies in further conservatism).

Problem statement

The states x and scheduling variables ρ are measurable for all sampling instants. Therefore, we use a parameterdependent state-feedback

u(k) := κ(ρ(k))x(k)
(2) to ensure that the closed-loop dynamics adheres to desired specifications. W.r.t. this matter, the main objective is, thus, to derive an MPC control law u(k) := κ(ρ(k))x(k), based on a prediction model without DT, that is able to steer x to the origin (regulation), while guaranteeing input-to-state stability (ISS), recursive feasibility of the optimisation, and constraint satisfaction.

Implicit DT Compensation in LPV MPC

As exposed in (Morato et al., 2020a), the stability of an LPV system, as in Eq. ( 1), under state-feedback MPC laws, as in Eq. ( 2), boils down to the existence of terminal ingredients (a terminal offset cost, a terminal state constraint, and a local stabilising feedback). Nevertheless, in systems with DT, the following state measure x(k + 1) cannot be inferred from (x(k), u(k)). As of this, Eq.

(1) cannot be used directly in the synthesis of the MPC scheme; it requires one to consider all control inputs (from u(k -d) to u(k -1)) in order to represent the complete set of state dynamics and, thus, derive the stabilising terminal ingredients. As argued in [START_REF] Lima | Robust nonlinear predictor for dead-time systems with input nonlinearities[END_REF], one can use an implicit dead-time model to find a DT-free realisation of Eq. (1), which is given as follows:

ξ(k + 1) = A d (ρ(k))ξ(k) + B d u(k) , (3) where ξ(k) := [x(k) ′ u(k -d) ′ . . . u(k -1) ′ ] and 1 : A d (ρ) :=         A(ρ) B(ρ) 0 0 . . . 0 0 0 I nu 0 . . . 0 0 0 0 I nu . . . 0 . . . . . . . . . . . . . . . . . . 0 0 0 0 . . . I nu 0 0 0 0 . . . 0         , B d :=         0 0 0 . . . 0 I nu         .
The underlying concept in using implicit DT compensation, via the augmented state-space representation in Eq. 3, is that a regular LPV model is used to conceive the stabilising terminal ingredients, with the same tools as in DTfree LPV MPC, e.g. [START_REF] Köehler | A nonlinear model predictive control framework using reference generic terminal ingredients[END_REF][START_REF] Morato | Novel qLPV MPC design with least-squares scheduling prediction[END_REF]. Nevertheless, since ξ stores all past control signals, the extended state representation grows linearly with the length of the DT, which causes an undesirable increase of the resulting numerical demand of the MPC (in terms of numerical cost during the online implementation and also in the sense of the offline synthesis of the stabilising components).

Explicit DT Compensation

In this paper, we follow the idea of explicit DT compensation in MPC design, as proposed in [START_REF] Santos | On the explicit dead-time compensation for robust model predictive control[END_REF]. The idea is to obtain a prediction for x(k + d) based on the data available at the current sampling instant k. This prediction, namely x(k+d|k), is directly obtained from the DT model in Eq. ( 1), since the current control input u(k) has no effect over x(k + j|k), ∀j ∈ N [1,d] , due to the DT phenomena. Due to this fact, x(k + d|k) depends only on the prior state and scheduling parameter trajectory, and, thus, we can express this prediction as in Eq. ( 4). We stress that Eq. ( 4) can be presented in a compact form, for when the scheduling parameters do not vary, i.e. ρ(k + j|k) = ρ, given by:

x(k + d|k) = (A(ρ)) d x(k) + d j=1 (A(ρ)) j-1 B(ρ)u(k -j) .
We note, nevertheless, that the future scheduling variables ρ(k + j|k), ∀j ∈ N [1,d-1] are unknown, from the viewpoint of the current sample, by definition. These future scheduling variables could be estimated under a variety of strategies, as those presented in [START_REF] Morato | A fast dissipative robust nonlinear model predictive control procedure via quasi-linear parameter varying embedding and parameter extrapolation[END_REF][START_REF] Cisneros | Fast nonlinear MPC for reference tracking subject to nonlinear constraints via quasi-LPV representations[END_REF]. For ease of notation, we use the simpler formulation from [START_REF] Morato | Novel qLPV MPC design with least-squares scheduling prediction[END_REF], using

ρ(k + j|k) = ρ(k), ∀j ∈ N [1,d-1] .
In Sec. 4, we assess on how this "frozen" scheduling trajectory guess affects the robustness of the controller.

Taking into account the previous discussions, we cast Eq. ( 4) into the explicit compact form from Eq. ( 5), where x(k) := x(k + d|k). Note that this prediction model can be considered to generate the desired MPC feedback policy. The advantage is that, due to the DTC structure, the derived model is free from DT and does not have any additional state variable, as in the implicit DT model from Eq. (3). Thus, from this fact, a traditional LPV MPC synthesis procedure can be followed, using terminal ingredients based on this same DT-compensated model.

x

(k + 1) = A(ρ(k))x(k) + B(ρ(k))u(k) + w(k) . (5)
We note that the offset disturbance term w(k) ∈ W in Eq. ( 5) is used to bound the differences between the real system prediction for the first sample ahead of the delay, i.e. x(k

+ d + 1|k) = A(ρ(k))x(k + d|k) + B(ρ(k))u(k),
and the nominal DT-compensated prediction made at the following instant, i.e. x(k

+ d + 1|k + 1) = x(k + 1). By including w(k) = x(k + d + 1|k + 1) -x(k + d + 1|k) in
Eq. ( 5), we are able to limit the error propagation between these predictions and, thus, ensure recursive feasibility of the corresponding MPC. The explicit representation of w(k) is given in Sec. 4, where we discuss properties of the corresponding closed-loop.

The overall control structure is given in Fig. 1. This scheme is very close to those seen in traditional DTC literature, i.e. [START_REF] Normey-Rico | Control of dead-time processes[END_REF][START_REF] Normey-Rico | Unified approach for robust dead-time compensator design[END_REF]Morato and Normey-Rico, 2021). In this paper, due to brevity, we do not include input disturbances, which will be dealt with in future works. We stress that corroborating analyses on the robustness properties of LPV MPC schemes against the frozen scheduling trajectory estimate

(ρ(k + j|k) = ρ(k), ∀j ∈ N [1,d-1]
) are brought to focus in (Morato et al., 2021a).

Fig. 1. Proposed LPV MPC with explicit dead-time compensation.

LPV MPC WITH EXPLICIT DT COMPENSATION

The LPV system from Eq. ( 1), now represented under the explicit DT compensated model in Eq. ( 5) must be regulated in such way that the state trajectories are steered to the origin, in an admissible manner (with all constraints respected).

As discussed in the prequel, we apply a state-feedback control policy, generated under the LPV MPC scheme from Fig. 1. Therefore, we now use u(k) := κ(ρ(k))x(k), since the state feedback measure, from the viewpoint of the MPC, is given in terms of x.

Accordingly, at each sampling instant k, we measure the DT-compensated state x(k) and the scheduling parameter ρ(k), and solve the following optimization problem, which embeds all process constraints given in Sec. 2:

min U k V (x(k + N p |k)) + Np-1 j=0 ℓ (x(k + j|k), u(k + j|k))(6) s.t. x(k + j + 1|k) = A(ρ(k))x(k + j|k) +B(ρ(k))u(k + j|k), ∀j ∈ N [0,Np-1] , x(k + j|k) ∈ X W (j), ∀j ∈ N [0,Np-1] , u(k + j|k) ∈ U, ∀j ∈ N [0,Np-1] , δu(k + j|k) ∈ δU, ∀j ∈ N [1,Np] , x(k + N p |k) ∈ X f , where ℓ(x, u) = ∥x∥ 2 Q + ∥u∥ 2 R is a quadratic stage cost, V (x) is a terminal cost and X f is a terminal set. V (x)
and X f are together named the terminal ingredients, which are used to ensure ISS. The MPC considers a moving-window horizon of N p steps. The first entry of solution of this optimisation, namely is applied to the process under statefeedback form. We note that the prediction model in this optimisation problem does not include the w term from Eq. ( 5). Thus, sets X W (j) are related to the problem uncertainties, used to tighten the state constraints over the prediction horizon. These sets are presented in Sec. 4.

U ⋆ k = col{u ⋆ (k + j)}, ∀j ∈ N [0,
We note that the prediction model in Eq. ( 6), used to describe the behaviour of the system along the horizon window of N p steps is simply the forward expansion of Eq. ( 5). Accordingly, the horizon does not have to comprise

x(k + d|k) := Π d-1 j=0 A(ρ(k + j|k)) x(k) + d-1 j=1 Π d-j m=d-1 A(ρ(k + m|k) B(ρ(k + d -1 -j|k))u(k -j -1) + B(ρ(k + d -1|k))u(k -1).(4)
the size of the DT, as in implicit strategies, which require N p > d.

Terminal Ingredients

In order to ensure input-to-state stability of the closedloop and recursive feasibility of the MPC optimisation, the cost functions must satisfy the following assumptions [START_REF] Mayne | Constrained model predictive control: Stability and optimality[END_REF]:

ℓ(x, v) ≥ β ℓ (∥x∥), ∀x ∈ X , β ℓ (•) ∈ K ∞ -class, 0 ≤ V (x) ≤ β V (∥x∥), ∀x ∈ X , β V (•) ∈ K ∞ -class.
Accordingly, in order to tacitly ensure these requirements, we use parameter-dependent terminal ingredients: an ellipsoidal terminal set

X f (ρ) := {x | x′ P (ρ)x ≤ 1} and a sub-level cost V (x, ρ) = x′ P (ρ)x.
Likewise, we consider a terminal local stabilising feedback gain K(ρ), which derives from P (ρ).

The terminal set X f must be a positively invariant set for the DT-compensated dynamics from Eq. ( 5), as provides the following Theorem. Theorem 1. [START_REF] Mayne | Constrained model predictive control: Stability and optimality[END_REF] Suppose ∃u = K(ρ)x. Consider that the MPC is given by Eq. ( 6), with a terminal state set given by X f (ρ) and a terminal cost V (x, ρ). Then, input-to-state stability is ensured if the following conditions hold ∀ρ ∈ P: (C1) The origin lies in the interior of X f (ρ); (C2) Any consecutive state to x, in closed-loop given by (A(ρ) + B(ρ)K(ρ)) x + w lies within X f (ρ + δρ), ∀δρ ∈ δP and w ∈ W; (C3) The discrete Lyapunov equation is verified within this invariant set, this is, ∀ x ∈ X f (ρ) and ∀ ρ ∈ P and

∀ δρ ∈ δP: V ((A(ρ + B(ρ)K(ρ)) x, ρ + δρ) -V (x, ρ) ≤ -x ′ Qx -x ′ (K(ρ) ′ RK(ρ)x. (C4)
The image of the nominal feedback lies within the admissible control domain: K(ρ)x ∈ U , ∀ρ ∈ P.

(C5) The terminal set X f (ρ) is a subset of X , ∀ρ ∈ P.

Assuming that the initial solution of the MPC problem U ⋆ k is feasible, then, the MPC is recursively feasible, stabilising the state x to the origin. Proof 1. Refer to [START_REF] Mayne | Constrained model predictive control: Stability and optimality[END_REF]. □

Taking into account the requirements for ISS and recursive feasibility presented in Theorem 1, the following Lemma provides a Linear Matrix Inequality (LMI) solution that generates the corresponding terminal ingredients. Lemma 1. Terminal Ingredients (Morato et al., 2021a) The conditions (C1)-(C5) of Theorem 1 are satisfied if there exist a symmetric parameter-dependent positive definite matrix P (ρ) : R np → R nx×nx , a parameterdependent rectangular matrix W (ρ) : R np → R nu×nx , and a scalar 0 < λ ∈ R, with Y (ρ) = (P (ρ)) -1 > 0, and 7)-( 10) hold for all (ρ, δρ) ∈ P × δP, under min log det{Y (ρ)}. Use (

W (ρ) = K(ρ)Y (ρ), s.t. (
•) * = (•) -1 .   λY (ρ) ⋆ ⋆ 0 (1 -λ) ⋆ A(ρ)Y (ρ) + B(ρ)W (ρ) w Y (ρ + δρ)   > 0 ,(7)    Y (ρ) ⋆ ⋆ ⋆ (A(ρ)Y (ρ) + B(ρ)W (ρ)) Y (ρ + δρ) ⋆ ⋆ Y (ρ) 0 Q * ⋆ W (ρ) 0 0 R *    ≥ 0, ( 8
)
u 2 i I {i} W (ρ) ⋆ Y (ρ) ≥ 0, i ∈ N [1,nu] , (9)
x

2 j I {j} Y (ρ) I ′ {j} Y ′ (ρ) Y (ρ) ≥ 0, j ∈ N [1,nx] . ( 10
)
Proof 2. This Theorem generates a positive definite parameter dependent matrix P (ρ) which is used to compute the MPC terminal ingredients V (•) and X f such that the conditions from Theorem 1 are fulfilled. The full demonstration is enable through consecutive Schur complements, refer to (Morato et al., 2021a). The BMI (7) ensures the positive invariance of X f w.r.t. the offset w in Eq.

(5). LMI (8) ensures energy dissipation of the MPC cost, while LMIs ( 9) and ( 10) imply in admissible input and state trajectories, respectively. The corresponding result is that for any initial condition x(0) ∈ X f , the MPC is recursively feasible for all k > 0 and ensures that the closed-loop dynamics are ISS. Remark 2. LMIs ( 9)-( 10) in Theorem 1 require box-type constraints on each u i and x j . Nonetheless, these can be converted into more generic polyhedral constraints, if necessary. The BMI (7) can be converted into an LMI using simple bisection search over the optimisation plane. Remark 3. Theorem 1 provides infinite-dimensional inequalities, which must hold ∀ ρ ∈ P and ∀ δρ ∈ δP.

In practice, the solution can be found by enforcing the inequalities over a sufficiently dense grid of points (ρ, δρ) along the P × δP plane. Then, the solution can be verified over a denser grid. The parameter-dependency of P may be dropped if the system is quadratically stabilisable, but this may result in quite conservative performances. Remark 4. Tracking objectives are out of the scope of this paper, and thus we reference to [START_REF] Köehler | A nonlinear model predictive control framework using reference generic terminal ingredients[END_REF]Morato and Normey-Rico, 2021). Nevertheless, it is worth mentioning that the proposed scheme can be used for tracking under slight modifications. Specifically, instead of steering x to the origin, the MPC should be set to steer (x, u) to some steady-state target (x r , u r ) ∈ Z. In this case, an offline reference selector can be used to determine such possible steady-state pairs. Moreover, the MPC stage cost and terminal ingredients should be stated in terms of the tracking error dynamics x(k + 1) -x r .

ROBUSTNESS ANALYSIS

In this Section, we analyse the stability of the corresponding closed-loop system, as well as the robustness of the controller against uncertainties on the delay. First, we demonstrate the model uncertainty that arises when prediction the state trajectories after the DT at sampling instants k + j and k + j + 1. Then, we discuss on how the "frozen" scheduling trajectory guess affects the prediction error of the system. Finally, robustness, and recursive feasibility of the optimisation are demonstrated by the means of constraints tightening.

Model Uncertainty

As previously detailed, we include w(k) = x(k + d + 1|k + 1) -x(k + d + 1|k) in Eq. ( 5) in order to bound the error propagation between these predictions at different samples. Using ρ(k +j|k) = ρ(k) and ρ(k +j|k +1) = ρ(k + 1), we obtain x(k

+ d + 1|k + 1) = A(ρ(k + 1)) d x(k + 1) + d j=1 A(ρ(k + 1)) j-1 B(ρ(k + 1))u(k + 1 -j), while x(k + d+1|k) = A(ρ(k)) d+1 x(k)+ d+1 j=1 A(ρ(k)) j-1 B(ρ(k))u(k+ 1-j)
. By subtracting these expressions, and using x(k +1) from Eq. ( 1), we are able to obtain:

w(k) := A(ρ(k + 1)) d -A(ρ(k)) d A(ρ(k))x(k) (11) + A(ρ(k + 1)) d -A(ρ(k)) d B(ρ(k))u(k -d) + d j=1 A(ρ(k + 1)) j-1 B(ρ(k + 1))u(k + 1 -j) - d j=1 A(ρ(k)) j-1 B(ρ(k))u(k + 1 -j) .
Since all the involved variables in Eq. ( 11) are bounded by definition, we get w(k) ∈ W, ∀k ≥ 1, where W can be generated by the means of zonotopes or interval algebra. In App. A, we provide the corresponding full development.

Prediction Error

One has not only to take into account the prediction bias of the nominal system trajectory, but also the error that arises due to the mismatches between the nominal model x and the real system trajectories x. We consider two factors: (a) the error that arises due to the differences between the real scheduling parameter ρ(k + j) and the frozen trajectory estimate ρ(k +j|k) = ρ(k); and (b) badly estimated DTs in the nominal model, which often occurs in practice. Thus, we consider the error dynamics as follows e(k+d) = x(k+d)-x(k) = x(k+d)-x(k+d|k). This error variable is split as follows:

e(k + d) = e ρ (k + d) + e d (k + d),
where the first term relates to (a), and the latter to (b).

Firstly, we assess (a): e ρ (k +d) derives from the differences caused by the scheduling trajectory estimate. Thus, when spanning Eq. ( 5) forward, we get x(k

+ d + j + 1|k) = A(ρ(k + j + d|k))x(k + d + j|k) + B(ρ(k + j + d|k))u(k + j).
Thus, for ρ(k + d + j|k) = ρ(k), we obtain: 12) Due to the nature of the considered LPV system, we have it ensured by design that e ρ (k) ∈ E ρ , ∀k ≥ 0, where E ρ is a compact and convex set that contains the origin.

e ρ (k + d + j) := [A(ρ(k + d + j)) -A(ρ(k))] x(k + d + j|k) + [B(ρ(k + d + j)) -B(ρ(k))] u(k + j) . (
Remark 5. We stress that e ρ is directly related to the strategy used to describe the values of the scheduling parameter along the horizon which comprises the whole prediction horizon, i.e. ρ(k + j|k), ∀j ∈ N [0,Np-1] . When scheduling trajectory extrapolation strategies are used, such as those presented in [START_REF] Cisneros | Fast nonlinear MPC for reference tracking subject to nonlinear constraints via quasi-LPV representations[END_REF][START_REF] Hanema | Stabilizing Non-linear MPC using Linear Parameter-varying Rep-resentations[END_REF][START_REF] Morato | A fast dissipative robust nonlinear model predictive control procedure via quasi-linear parameter varying embedding and parameter extrapolation[END_REF], we are able to accurate descriptions for ρ(k + j|k), which does reduce the magnitude of e ρ over the horizon. Through the sequel, we consider the more generic case, for when only ρ(k) is known and thus one uses ρ(k + j|k) = ρ(k). Remark 6. For quasi-LPV (qLPV) systems, ρ(k + j), ∀j ∈ N [0,d] depends on the system variables (x(k + j) and u(k + j)). We note that in some of theses cases, when ρ(k + j) = f ρ (u(k + j), the corresponding DT-compensated model from Eq. ( 5) becomes much simpler. For these, ρ(k + j) becomes known variables, since the control inputs u(k + j) are inherently available from j = 0 to j = d. Thence, no trajectory estimate for the future scheduling parameters along the DT becomes necessary, and e ρ naturally becomes null.

With regard to (b): Consider that the nominal DT is given by d, while the real DT is d r = d + δd, for δd ≥ 1. Then, taking this into account, we can express the real state trajectories by

x(k + 1) = A(ρ(k))x(k) + B(ρ(k))u(k - d r )
, whereas the DT-compensated predictions are given by x(k +1). Thereof, using u(k

-d r ) = u(k -d)- δd j=1 δu(k - d -j)
, we obtain, for e ρ = 0, and for any δd > 1:

e d (k) := -B(ρ(k))   δd-1 j=0 δu(k -d -j)   . ( 13
)
Taking into account the previous discussions, we stress that the under-estimated DT leads to a cumulative effect upon the prediction error e d (k) due to the control input variations over samples. Accordingly we obtain e d (k) ∈ E d , ∀k ≥ 0, where:

E d := δd times (BδU) ⊕ • • • ⊕ (BδU) , (14)
where B stands for B(ρ) evaluated for the maximal energy transfer due to ρ ∈ P. Synthetically, we use e

(k) = e ρ (k)+ e d (k) ∈ E, ∀k ≥ 0, where E = E ρ ⊕ E d .

Properties

Now, we pay special attention to the robust constraint satisfaction and ISS over the real state trajectories x (instead of x). For this reason, we must take into account how the prediction error e(k) affects the closed-loop. Lemma 2. Constraints Tightening Take X W (j) in the MPC optimisation (Eq. ( 6)) as follows:

X W (0) = X ⊖ E and X W (j) := X W (j -1) ⊖ S(j), ∀j ∈ N [1,Np] . Moreover, consider S(0) = W and S(j) := [A(ρ(k + j|k + 1)) -A(ρ(k + j|k))] S(j -1), ∀j ∈ N [1,Np] .
These sets ensure the open-loop propagation of w over the prediction model and the according compensation in the state constraints. Proof 3. Refer to (Morato et al., 2021a).

Remark 7. Note that a nominal static feedback can be used to attenuate the propagation of w over the state predictions. Nevertheless, in such case, the input constraints must also be accordingly tightened.

We stress that E grows with the size of the DT estimation error δd, while S(j), ∀j ≥ 1 depends on the scheduling parameter changes between samples. In consonance with [START_REF] Mayne | Robust output feedback model predictive control of constrained linear systems[END_REF], Lemma 2 provides conditions such that the MPC is able to ensure that x(k+j) ∈ X W (j), ∀j ∈ N [1,Np] , which conversely implies that x(k)-x(k) belong to some subset of X ⊕E, thus ensuring that x(k) ∈ X , ∀k ≥ d.

We stress that E is a compact polytope with contains the origin, but grows in size w.r.t. the size of the DT estimation error δd. The following Lemma provides ISS conditions for the closed-loop under the action of the constrainttightened MPC algorithm.

Lemma 3. ISS under DT Estimation Error Let u(k) = κ(ρ(k))z(k) be a control law such that z(k + 1) = A(ρ(k))z(k)+B(ρ(k))u(k) is ISS. Moreover, let x(k+ 1) = A(ρ(k))x(k)+B(ρ(k))u(k-d)+ w(k), with w(k) ∈ W be controlled by u(k) = κ(ρ(k))x(k)
, where x(k) follows from Eq. ( 4). Let the prediction error bound be E. Then: (a) The dynamics of z are ISS for all w(k)

∈ W; (b) If x(k) ∈ X ⊖ E, ∀k ≥ 0, then x(k) ∈ X , ∀k ≥ d.
Proof 4. Follows directly from [START_REF] Santos | On the explicit dead-time compensation for robust model predictive control[END_REF]Morato et al., 2021a), using w(k) as gives Eq. ( 11). Remark 8. We stress that the convex set E defines the admissible values for the prediction error e(k) = x(k +d)x(k), i.e. differences between the real system dynamics, Eq. ( 1), and the DT-compensated ones, Eq (5), thus encompassing the error from DT estimation (when δd ̸ = 0) and from the scheduling trajectory guess (when ρ(k + j|k) ̸ = ρ(k + j)). The disturbance propagation set W bounds the step-ahead nominal prediction discrepancy, which is non-null due to the variance between ρ(k + j + 1) and ρ(k + j). Remark 9. In the case of time-varying delay estimation errors d r = d + δd(t), we recommend using the unified method for time-varying delay compensation recently proposed in (Morato and Normey-Rico, 2021).

CASE STUDY: A SOLAR COLLECTOR BENCHMARK

In order to demonstrate the performances achieved with the proposed control system, we consider a solar collector benchmark, as illustrated in Fig. 2. In this plant, the temperature of the heated fluid must be regulated, while the input flow and temperature of the plates must stay within predefined admissible sets. The solar plates are heated due to solar irradiance, but also affected by the external temperature. In accordance with [START_REF] Pipino | Nonlinear temperature regulation of solar collectors with a fast adaptive polytopic LPV MPC formulation[END_REF], we use a qLPV model to represent this process: k) ) .

x(k + 1) = A(ρ(k))x(k) + B(ρ(k))u(k -d) + B w w(k) , ρ 1 (k) = α 1 (1 -e -τ1x1(k) ) , ρ 2 (k) = α 2 (1 -e -τ2x2(
This model has two states x, which describe the deviation of the plate and fluid temperatures to a given constant set-point. The control input u corresponds to flow of the fluid that circulates the collector, while w stands for the two known disturbances which affect this system (solar irradiance and external temperature). We note that this process exhibit a constant input dead-time d, which corresponds to the time needed for the flow to pass through the system, since the fluid temperature is only measured at the exit of the collector. The model matrices and sets are presented in [START_REF] Pipino | Nonlinear temperature regulation of solar collectors with a fast adaptive polytopic LPV MPC formulation[END_REF], Tables 1,2, Eqs. ( 12)-( 14), whereas not shown herein due to lack of space. The process constraints are x ∈ X , u ∈ U, and ρ ∈ P, which are all convex and compact sets. The system operates under a sampling period of T s = 0.5 s; the dead-beat is d = 20 discrete-time samples. 3). Since d = 20, we stress that the latter approach uses a state-space description with 22 states encompassed within ξ, whilst the proposed method uses the DT-compensated description from Eq. ( 5), with only 2 states. From this, as previously discussed, we can already expect the proposed MPC to run much fast during the implementation. Accordingly, this phenomenon is observed in Fig. 4, which depicts the average computational time (t c ) required to solve the optimisation corresponding to each approach. The proposed method is over twice faster than the IDTC MPC, which is a significant advantage. We also stress that the terminal ingredients from Sec. 4 are (numerically) much simpler to synthesise for the proposed method. Next, we show the system trajectories under two different situations: (a) for the case of perfectly known DT, considering both controllers and (b) for the case of different DT estimation errors, considering only the EDTC controller. We note that scenario (b) does not include the IDTC controller since it embeds no robustness ingredients against badly estimated DTs.

For the first scenario, Fig. 5 shows the state trajectories and the fluid temperature behaviour under the action of both controllers. As one can see, both methods ensure very similar performances, with relatively small offsets to the steady-state temperature goals (we stress that both MPCs do not analytically include integral action, for simplicity, see Remark 4). The results indicate that the proposed EDTC MPC method can indeed well control the considered solar collector process, despite using the DT-compensated model from Eq. ( 5). We recall that this nominal DT-compensated model is exposed to more prediction errors than the implicit DT model from Eq. ( 3), since it includes the presence of the scheduling parameter prediction discrepancies, compacted in e ρ . Even though e ρ turns null in steady-state, this model-mismatch variable is not measured or estimated, but rather accounted for robustly, since the proposed MPC takes only the upper bound of e ρ ∈ E ρ into account. The reason for this resides on the use of the tightened constraints mechanism (Lemma 2), which evens out the prediction error caused by e ρ .

Considering more abrupt solar irradiance variation (twice the size of those from Fig. 3), we show how the magnitude of the delay estimation error δd affects the system dynamics (plate temperature, e.g. Fig. 6). As δd increases, the size of the corresponding uncertainty propagation set E d grows, as gives Eq. ( 14). Thereof, larger offsets toward the steady-state goal are observed. Nevertheless, we stress ISS is ensured (as of Lemma 3), which is an elegant feature of the proposed LPV MPC DTC scheme, ensuring stability and robustness towards DT estimation errors.

CONCLUSIONS

In this paper, we briefly studied how explicit dead-time compensation can be incorporated to the design of LPV MPC algorithms. Accordingly, we provided a synthesis procedure which ensures input-to-state feasibility of the closed-loop system, as well as recursive feasibility of the MPC optimisation. The method used parameterdependent terminal ingredients, offered via standard LMI synthesis. We also debate the issue of uncertain delay estimation and how this can be counter-acted directly in the MPC formulation. A solar collector benchmark example is used to illustrate the features of the proposed method, which is compared against a nominal LPV MPC with implicit DT compensation. The proposed method is significantly faster, while providing similar regulation performances. We recall the main features of the proposed method:

(1) It does not require any augmented state representation, thus maintaining the order of the system from a prediction viewpoint. (2) It offers reduced numerical burden in the sense of online implementation of the MPC optimisation as well as in terms of computing the terminal ingredients. (3) It allows the computation of a scheduled response of the free state dynamics x(k) = x(k + d|k). These responses can be expressed linearly in an LPV setting. (4) It offers simple robustness tools to directly tackle delay estimation uncertainty.

For future works, we aim at generalising the proposed scheme for the case of time-varying delays. We also pretend to assess on how the uncertainty propagation (due to delay estimation errors) can be better attenuated in closed-loop, as well as how qLPV DT predictors can be used to enhance the DT-compensated predictions (reducing mismatches).

Fig. 2 .Fig. 3 .

 23 Fig. 2. Solar Collector Field. We consider a simulation scenario 2 with the following temperature set-points: 120 o C (plates) and 100 o C (fluid). The initial conditions are: 100 o C (plates) and 90 o C (fluid). The disturbances w(k) vary over time, as shown in Fig. 3. These variables are measured at each sampling instant k, whereas assumed constant for prediction purposes, which means that its effect over the state dynamics can be analytically compensated, converting the previous model into the likes of Eq. (1).

  Fig. 4. Results: Computational Time.

Fig. 5 .

 5 Fig. 5. Results: State Trajectories under nominal DT.

Fig. 6 .

 6 Fig. 6. Results: State Trajectories under uncertain DT.

In the case of models with DTs in the scheduling parameter dependence, i.e. B(ρ(k -d))u(k -d), one can use an extended scheduling variable Θ(k) := [ρ(k -d) ′ , . . . , ρ(k)] in a similar fashion.

Results were obtained in a 2.4 GHz, 8 GB RAM Macintosh computer, using Matlab, yalmip, and SDPT3.

Both MPC are tuned with unitary stage cost weights Q and R.

Appendix A. COMPLEMENTARY DEVELOPMENT Take the nominal DT-compensated model using different samplings, i.e. at k and at k +1, using a prediction horizon of n samples ahead:

Thus, using the real system trajectories x(k + 1) = A(ρ(k))x(k) + B(ρ(k))u(k -d), we obtain:

Complementary, we have:

Using w(k) = x(k + d + 1|k + 1) -x(k + d + 1|k), we can subtract Eq. (A.2) from (A.1) in order to get Eq. ( 11).


Keywords: Wireless sensor networks, Intrusion detection systems, Symmetric cryptography, Attacks I

On the one hand, intrusion detection systems (IDSs) have shown their ability to detect internal and external attacks with a high accuracy. On the other hand, cryptography techniques have proved their ability to assure the privacy of communication, i.e. data confidentiality. In this paper, we propose to develop and implement a lightweight Security Framework for Wireless Sensor Networks (WSNs) that combines the advantages of both cryptography and IDS techniques to assure the privacy of communication and detect the most dangerous attacks such as spoofed, altered or replayed routing information, man-in-the-middle, and denial-of-service attacks. However, the execution of both techniques at each node generates high overhead and energy consumption, even if we consider a cluster-based WSN. To economize nodes' energy, the cryptography operation is launched during a certain period determined mathematically and only within the cluster where a malicious node is detected. The proposed framework is evaluated analytically and implemented under TOSSIM simulator. According to our simulation results, our framework outperforms other security frameworks proposed in the literature in terms of detection rate, false positive rate, energy consumption and average efficiency.

INTRODUCTION

Wireless sensor networks (WSNs) have attracted much attention due to their broad applications in military and civilian areas. They are an invaluable resource for realizing the vision of the Internet of Things (IoT). However, energy, memory constraints and the hostile environment in which they can be deployed make them more vulnerable to attacks. As a result, there is a strong need for security solutions that protect these kinds of networks from malicious attacks. In this context, intrusion detection systems (IDSs) have the capability to detect both internal and external attacks; unlike other security solutions such as cryptography, which simply prevents from external attacks to enter the network. Furthermore, cryptography techniques have the ability to assure data confidentiality, i.e. communication's privacy, unlike IDS techniques. Thereby, in this paper, we propose to develop and implement a new Lightweight Hybrid Security Framework in a cluster-based WSN (LHSFW), i.e based on the advantages of both intrusion detection and symmetric cryptography techniques.

The purpose of LHSFW is to prevent the occurrence of two kinds of attacks: (i) active attacks that aim to alter the packets' content of a target node or disrupting the smooth operation of a network. These kinds of threats are detected and removed from the network by applying a set of detection policies detailed in the next sections, and (ii) passive attacks, such threats that focus only on listening to the nodes' communication activity. In this case, LHSFW uses a symmetric cryptography technique to avoid the malicious node to eavesdrop the packets that pass within its radio range. However, running simultaneously these both techniques at each node generates a high overhead and degrades the network performances [START_REF] Kumarage | Distributed anomaly detection for industrial wireless sensor networks based on fuzzy data modelling[END_REF], even if we consider a cluster-based topology. Thereby, we propose a new security solution that aims to launch the cryptography operation only during a certain period determined mathematically and only within the cluster where a malicious node was detected. Furthermore, according to simulation results, we demonstrate that with the help of cryptography, LHSFW can remove almost all passive attacks from the network since such technique makes the information more attractive (i.e. by encrypting the message), which leads the passive attack to become an active one.

LHSFW aims to detect, using the IDS technique, several well-known and most dangerous active attacks such as spoofed, altered or replayed routing information, man-in-themiddle and denial-of-service attacks. Our approach outperforms other security frameworks proposed in the current literature [START_REF] Shin | An experimental study of hierarchical intrusion detection for wireless industrial sensor networks[END_REF][3], and exhibits a high accuracy of attacks detection with low energy consumption and high efficiency as demonstrated in simulation results.

The outline of this paper is organized as follows: In Section 2, we highlight some related works by indicating their advantages and weaknesses. In Section 3, we explain the characteristics of the most dangerous active attacks that occurred in WSN and detail the detection policy applied by the IDS to detect such attacks. Section 4 gives more details about the functioning of LHSFW framework and details its main components. Section 5 provides LHSFW's analytical and simulation results. Finally, conclusion and future work conclude this paper.

II. RELATED WORK

Recently, some researchers [2][3] aim to combine between the advantages of cryptographic technique defined as first line of defense and intrusion detection technique defined as second line of defense. The purpose of these hybrid mechanisms is to detect internal and external attacks with a high accuracy by using an intrusion detection technique, and assure the privacy A Lightweight Hybrid Security Framework for Wireless Sensor Networks

Hichem Sedjelmaci and Sidi Mohammed Senouci

University of Bourgogne, DRIVE Lab 49 Rue Mademoiselle Bourgeois, 58000, Nevers, France {Sid-Ahmed-Hichem.Sedjelmaci, Sidi-Mohammed.Senouci}@u-bourgogne.fr of communication by applying a cryptography technique. However, these mechanisms exhibit some weaknesses that are detailed in the following.

In [START_REF] Shin | An experimental study of hierarchical intrusion detection for wireless industrial sensor networks[END_REF], the authors conceive and implement an intrusion prevention and detection schema for cluster-based WSN. In the intrusion prevention protocol, a symmetric cryptography operation is used to assure an authentication of data source and provide a communication confidentially. In the intrusion detection protocol, the IDS agent monitors the nodes that are located within its radio range by applying a set of rules related to a set of attacks. According to experimental results, their schema exhibits a high detection rate when a certain number of attacks occur such as hello flooding, packet spoofing and impersonation attacks. However, both protocols work in a simultaneous way. Therefore, a high communication and computation overhead are generated, which leads to decrease the network lifetime.

In [START_REF] Su | An energy-efficient hybrid intrusion prohibition system for cluster-based wireless sensor networks[END_REF], the authors propose an energy efficient secure mechanism called eHIP, integrated in a LEACH (Low Energy Adaptive Clustering Hierarchy) protocol [START_REF] Heinzelman | Energy efficient communication protocol for wireless microsensor networks[END_REF]. This mechanism applies an authentication algorithm to verify control message and sensed data. In addition, the authors propose a collaborative intrusion detection algorithm, where cluster members monitor their cluster-head and vice versa. According to simulation results, the authors claim that their approach is efficient in terms of energy conservation even when the number of sensors is important (i.e. scaling mode). However, this mechanism aims to secure the network against only one kind of denial of service attack.

In this paper, we propose to conceive and implement a new lightweight hybrid security mechanism that handles the weaknesses of the hybrid mechanisms proposed in the literature [START_REF] Shin | An experimental study of hierarchical intrusion detection for wireless industrial sensor networks[END_REF] [START_REF] Su | An energy-efficient hybrid intrusion prohibition system for cluster-based wireless sensor networks[END_REF].

III. ATTACKS' DESCRIPTION AND DETECTION POLICY

Anomaly-based detection has the capability to detect unknown attacks by modeling only the normal behavior, and then identifying anything that deviates from this model as anomalous [START_REF] Sedjelmaci | An efficient intrusion detection framework in cluster-based wireless sensor networks[END_REF]. In this research, the IDS uses a specific category of anomaly detection defined as specification-based detection [START_REF] Farooqi | Intrusion detection systems for wireless sensor networks: a survey[END_REF], which relies on a set of rules related to the most dangerous attack such as Spoofed, altered or replayed routing information, Man-in-the-middle and Denial of Service (DoS) attacks to model the normal behavior. The advantage of this detection policy is the ability to detect the attacks with a high accuracy and less energy consumption [START_REF] Farooqi | Intrusion detection systems for wireless sensor networks: a survey[END_REF]. Therefore the LHSFW's intrusion detection module relies on this policy to detect the above attacks by using the rules cited above. We note that, these rules hold on the applications, where sensors continuously sensing the environment to send reports to the CH, which aggregates and forwards them to a base station.

A. Spoofed, altered or replayed routing information attack's detection rule

The intruder aims to monitor the communication, intercepts legitimate packets and thus alters or replays relevant information. The detection process of such attack is as follows: As illustrated in Fig. 1, during a time period, the IDS agent captures the same packets that are sent from A to B and B to CH, then computes the bytes' sum of each packet's payload, i.e. which are defined as: Sp → and Sp → . After that, the subtraction of these two results defined as is computed using equation 1. The IDS stores this value and carries out the same operation for each packet sent from A to B and B to CH. Finally, the normal distribution concept is used, by computing the standard deviations (SD) using equation 3. We note that, in a normal distribution concept, the normal node's behavior such as number of packets send or dropped, Received Signal Strength Intensity (RSSI) follow a normal distribution over time, i.e. the value of the behavior lies within (mean -3*SD) and (mean +3*SD) [START_REF] Li | Group-based intrusion detection system in wireless sensor networks[END_REF].

sub=Sp → -Sp → (1)

mean (sub) = ∑ (2)
In equation 2, we note that i ={1, ….., n} where n is the number of a same packet sent from A to B and B to CH.

( ) = ∑ ( - ( )) (3)
The IDS attempts to determine whether these sums follow a normal distribution, as stated above by checking if the lies within (mean -3*SD) and (mean + 3*SD). In contrast case, the node B is designed as intruder that carries out spoofed, altered or replayed routing information attack.

B. Man-in-the-middle attack's detection rule.

The malicious node makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection [START_REF] Udgata | Wireless sensor network security model using zero knowledge protocol[END_REF]. The attacker collects the packets from these victims' nodes and injects new ones. In addition, according to the wok undertaken by the authors in [START_REF] Hussain | Using received signal strength indicator to detect node replacement and replication attacks in wireless sensor networks[END_REF], they claim that such attack generates a high Received Signal Strength Intensity (RSSI) compared to it neighbors node. To detect such attack, first of all the IDS applies the previous detection rule (see subsection III.A) to check whether the same packet which is sent from A to B and B to CH is different or not by applying the normal distribution concept. When doesn't lie within the interval (mean -3*SD) and (mean + 3*SD), the IDS compares RSSI values of the nodes located within its radio range; and the node with a higher RSSI is designed as an intruder that could carry out a man in the middle attack.

C. Denial of Service (DoS) attack's detection rule.

Such attack aims to exhaust the network resources or disrupt its proper operation. In the literature, a node that carries out a DoS attack can be launched by a variety of threats such as [START_REF] Han | A proposed security scheme against Denial of Service attacks in clusterbased wireless sensor networks[END_REF]: Selective forwarding, which removes an important number of received packets, and Resource exhaustion that sends a considerable number of packets to waste the energy resource of targeted nodes. In this study, we focus to detect these two kinds of DoS: Selective forwarding and Resource exhaustion. The detection process of such attacks is as follows: the IDS agent monitors the number of sent and received packets by the nodes within a target link as illustrated in Fig. 1. Afterward, it computes the rate of sent packets over received packets of the nodes located within its radio range. In case, when a node (within a target link) exhibits a very high or very low rate compared to its neighbors, it will be designed as an intruder that could perform resource exhaustion or selective forwarding attacks, respectively.

IV. LIGHWEIGHT HYBRID SECURITY FRAMEWORK FOR WSN (LHSFW)

The proposed security framework, named LHSFW, aims to assure data's confidentiality and prevents the occurrence of the most dangerous attacks within a cluster-based wireless sensor network by using both symmetric cryptography and intrusion detection techniques. To improve the network lifetime, we focus to address the following issue: the cryptography and intrusion detection mechanisms don't run at all time in a simultaneous way within the same node as they incur a high communication and computation overhead [START_REF] Kumarage | Distributed anomaly detection for industrial wireless sensor networks based on fuzzy data modelling[END_REF]. Therefore, in our solution the cryptography operation is activated within a specific period (Td) only by the cluster members located within the same cluster as the malicious node detected by IDS agents.

We embed LHSFW in a cluster-based topology since it permits to increase the network lifetime compared to flat one. The purpose of a clustering protocol is to group a sensor into a set of cluster and elect at each one of them a node that has a high residual energy called cluster-head (CH). This later aggregate the received packets from it cluster members and forward the aggregated packet to the base station. Furthermore, the CH must coordinate the sensor nodes to ensure that the cluster reduces energy on average [START_REF] Yahya | Towards a classification of energy aware MAC protocols for wireless sensor networks[END_REF]. In this research, we use a Hybrid Energy Efficient Distributed protocol (HEED) [START_REF] Younis | HEED: a hybrid energy efficient distributed clustering approach for ad hoc sensor networks[END_REF] for the cluster formation and CH election. In order to simplify the process of intrusion detection and network's management, we fix the number of hops at each cluster equal to max two hops.

LHSFW is composed of two main components: the first and second security layers that apply respectively intrusion detection and symmetric key encryption techniques. These components are detailed in the following.

A. First security layer (FSL) component: Intrusion detection process

This component relies on an intrusion detection module, which is detailed in the following.

The IDS agent follows a detection policy, detailed in section III, to detect the attacker and prevent the occurrence of any malicious behavior within a cluster. When a suspected node is detected by the IDS, it sends a Check message to its corresponding CH to take a final decision about the behavior of this suspected node. This message includes the IDS'id and suspected node's id. The CH computes a Malicious Behavior Level (MBL) of each suspected node detected by the IDSs and compares it with a trust formula (see equation 4). The MBL is computed as the number of IDS' detection over the number of IDS neighbors of the suspected node and it value belongs to the interval [0, 1]. When the MBL's value is more than a threshold (0.5) as shown in equation ( 4), this suspected node is designed as a malicious one. Therefore, the CH removes this attacker from the cluster and informs all the cluster members, i.e. by sending an Encryption_message to the second security layer (SL) component to activate and update their messages encryption operation and keys, respectively.

Node is Malicious if 0.5 ≤ MBL ≤ 1 Node is Normal if 0 < < 0.5

When a CH is suspected to be an attacker, the IDS agent sends a Remove_broadcast to the IDSs located within a neighborhood of this CH. This message includes the CH's id, Time To Live (TTL) and a malicious counter, incremented by 1 when CH exhibits a malicious behavior. We note that, TTL is defined as the number of IDS per each cluster over 2. When an IDS receives such message, it decrements by 1 the TTL value and checks the malicious behavior of the CH. When this attractive node is detected as an intruder, a malicious counter is incremented by 1, after that the IDS agent re-broadcasts such message to the other agents. This process will be completed when the two following situations occur: (i) malicious counter across a threshold Th, defined as the number of CH's IDS neighbors over 2. In this case an Encryption_message is forwarded to the SL component to launch the encryption operation and assure a data confidentiality (see SL component). Therefore, the CH is removed from the cluster and process of new CH's election is launched (see protocol HEED [START_REF] Younis | HEED: a hybrid energy efficient distributed clustering approach for ad hoc sensor networks[END_REF] for CH election). (ii) When the malicious counter doesn't reach the threshold Th and TTL value is equal to 0, such packet is removed. As a result, this process avoids the routing loops' issue (i.e. infinite packet circulation).

B. Second security layer (SL) component: symmetric key encryption

This component is integrated at each node to perform the encryption and decryption operations. In this research work, we propose a key distribution mechanism inspired from [START_REF] Cheng | An improved key distribution mechanism for large-scale hierarchical wireless sensor networks[END_REF]. The process of the proposed key distribution is described as follows: Before, the nodes' deployment, we store a unique key at each node in order to crypt the keys sent by the nodes as described in the following. When the clusters are formed, the base station sends to each CH a key k where j= {1,…, k} and k is the number of clusters. After that, each CH generates keys ℎ from k for each CH's child using a hash function ( ℎ = hash ( 0 +i)) and sends for each one of them a key ℎ as illustrated in Fig. 2. We note that, i={1,…, c} and c is the number of CH's childs. At the end, the nodes that receive such key, compute a final key ki from this previous one (ki = hash (kchi )) and send it to the leaf nodes (i.e. nodes with zero child) as illustrated in Fig. 2. When the keys distribution is completed, the leaf nodes encrypt the message with and send this encrypted message to it corresponding CH's child, which decrypt it with this key, then send an [START_REF] Heinzelman | Energy efficient communication protocol for wireless microsensor networks[END_REF] encrypted message (by using a key ℎ ) to its corresponding CH . Finally, the cluster-head decrypts the message and sends an encrypted one with a key k to the base station.

This component has the responsibility to assure the confidentiality of data, which is activated when a malicious node is detected. As explained above, in order to improve the network lifetime, the encryption and decryption processes are activated only within a cluster where an attack was detected by an IDS node. This component is equipped with two main modules: Key updating and data encryption modules. 1. Data encryption module: When CH confirms the malicious behavior of suspected node or malicious CH is detected by the IDSs (see intrusion detection module), the selected CH (a new CH in case when the older is an attacker) informs all nodes located within the same cluster, i.e. by sending an Encryption_message, to activate data encryption processes with computing new keys (see key updating module). We note that, this module uses a simple and fast cipher algorithm called Skipjack [START_REF]SKIPJACK and KEA algorithm specification[END_REF] to encrypt and decrypt data. As a result, an external passive attacker cannot eavesdrop the packets that pass thought its radio range, which allow data privacy within the network. It is important to note that, choosing Skipjack lies in the fact that it is very simple in both its operation and its key schedule and also it is the best algorithm in terms of memory requirements, with approximately 2,600 bytes of ROM [START_REF] Roman | A Survey of cryptographic primitives and implementations for hardware-constrained sensor network nodes[END_REF].

In order to improve the energy consumption, when IDS agents located within the same cluster don't detect any malicious node during a time period Td; cluster members switch their exchanged messages from an encrypted one to a plaintext message. We note that the value of Td is determined mathematically in Subsection V.B.

Key updating module:

This module has the responsibility to update the keys within a cluster where an attacker is detected. When a malicious node is detected within a cluster, the selected CH computes new keys ℎ _ from the older ones for each CH's child, which are equal to ℎ ℎ ( ℎ + ), where n is the number of nodes within the cluster. After that, it sends an Encrypt_broadcast message to each CH's child, which contains a key ℎ _ encrypted by using a key _ =hash ( + ). At the end, the CH's child computes a key _ , which is equal to hash ( ℎ _ ) and sends this encrypted key to its leafs nodes (by using a key _ ). We note that, s is the number of attacks detection at a cluster j by the IDSs. When this process is done, all the exchanged messages are encrypted during a time period Td.

V. PERFORMANCE EVALUATION

In this Section we embed and evaluate our framework under TOSSIM [START_REF]Simulating tinyOS networks[END_REF] and POWERTOSIM [START_REF]Efficient power simulation for TinyOS applications[END_REF] simulators, a simulators of Tinyos sensor nodes. First, we determine the value Td defined as a required time to encrypt messages by nodes located within the same cluster before to switch to a plaintext message. In this study, we fix the number of passive attacks equal to 30 % of overall nodes. Afterward, LHSFW is compared to the two hybrid security mechanisms proposed in [START_REF] Shin | An experimental study of hierarchical intrusion detection for wireless industrial sensor networks[END_REF] [START_REF] Su | An energy-efficient hybrid intrusion prohibition system for cluster-based wireless sensor networks[END_REF]. Specifically we compute the following metrics: detection rate, false positive rate, average efficiency and energy consumption, when the following active attacks occur: spoofed, altered or replayed routing information, man in the middle and denial of service attacks.

Detection rate (DR):

the ratio between the number of correctly identified attacks over the total number of attacks; False positive rate (FPR): the ratio between the number of normal nodes that are incorrectly classified as malicious and the total number of normal nodes; Average efficiency: the required time for IDS agents to detect all attacks in the network, which is computed as follow: = ∑ where, is the required time for the IDS agent to detect the occurrence of an attacker [START_REF] Sedjelmaci | An efficient intrusion detection framework in cluster-based wireless sensor networks[END_REF] and n is the number of attackers.

Energy consumption (EC): the total amount of energy consumed by all sensors over the total number of nodes in the network.

A. Simulation setup

The main key parameters of the simulation are illustrated in Table I .We note that, in order to provide an accurate result, we carry out a set of 40 simulations, then compute the average of these simulation results (i.e. detection rate, false positive, energy consumption and average efficiency).

B.Mathematic analysis of time's period Td

In this subsection, we first define the average number of malicious link's neighbors. Based on this, we determine the most appropriate value of time's period Td defined as the required time to encrypt messages by nodes located within the same cluster before to switch to a plaintext message.

(5)

The number of neighbors for the malicious link (i.e. nodes A and B) lie within the communication range of A and B as illustrated in Fig. 3. The area where the neighbors are located is calculated as follows [START_REF] Khalil | LITEWORP: A lightweight countermeasure for the wormhole attack in multi hop wireless networks[END_REF]:

area (x)=2 -2 -
The average number of neighbors for each malicious link is equal to E[area(x)]d and computed as follows:

E[area(x)]= ∫ area(x)g(x)dx
The probability distribution of x is computed by

G(x) = x r g(x) = ( ) =
, which is the probability density function

E[area(x)]=∫ 2 -2 - dx ⇔ [area(x)] ≈0.29
At the end, the average number of neighbors for each malicious link, which depends on the network density d is given by: Fig. 3. Neighbors of a malicious link A-B According to the works [START_REF] Agah | A non-cooperative game approach for intrusion detection in sensor networks[END_REF], an attacker is always encouraged to attack specifically when he detects relevant information, such encrypted messages. In this study, we take into account this fact and force the passive threat to act as an active one in order to lead IDS agents to detect it. Furthermore, we demonstrate in the following according to our simulation that within a cluster when a time's period Td is elapsed and none of active attacks are occurring, the passive attack switches to an active one. In other word, as stated before, this period is a required time of nodes within a same cluster to encrypt their exchanged messages before switching to a plaintext message. The time's period Td is computed as follows:

= m0.29

Here, m is the average number of links at a cluster. In the following, we study the detection rate of our approach only under the occurrence of a passive attack by varying the value . In this case, as stated above, we fix the number of passive attacks equal to 30% of overall nodes. This study relies on the following assumption: the passive attack is mobile and can move from one place to another in order to hear the packets that traverse its radio range.

According to Fig. 4, when the value of increases (i.e exceed 80 milliseconds) the detection rate of passive attacks tends to 98 %. However, the optimal value of δ that suits the requirements of our application, i.e. high detection rate and low overhead is equal approximately to 20 milliseconds, in such case the detection rate is equal to 97%. In addition, according to our result, we found out that the time Td depends on the average number of neighbors of malicious links at each cluster. Therefore, when this number increases, the encryption time within a cluster becomes important. As a result, a tradeoff between the security level and energy consumption must be taken into account. At the end we conclude that, with the help of cryptography technique, the intrusion detection can remove almost all passive attacks from the network since such technique makes the information more attractive for the intruder to attack. In addition, even when the passive attack doesn't switch to an active one, such threats cannot overhear at all time the plaintext message as the keys are updated several time during the network lifetime and thus data confidentiality is assured.

C. Results and analysis

In this subsection, as stated above we evaluate the performance of LHSFW by compare it with hybrid security mechanisms proposed by S. Shin and all [START_REF] Shin | An experimental study of hierarchical intrusion detection for wireless industrial sensor networks[END_REF], and W.T. Su and all [START_REF] Su | An energy-efficient hybrid intrusion prohibition system for cluster-based wireless sensor networks[END_REF]. This study relies on the evaluation of the detection rate, false positive rate, average efficiency and energy consumption for each framework when the attacks cited above occur. In addition, we vary the number of attackers from 5 % to 50% of overall nodes.

Detection and false positive rates. According to Fig. 5 (a) and (b), we can see that LHSFW outperforms the hybrid security mechanisms proposed in current literature [START_REF] Shin | An experimental study of hierarchical intrusion detection for wireless industrial sensor networks[END_REF][3], in terms of attacks detection's accuracy, i.e. high detection and low false positive rates. Moreover, unlike these two security frameworks [START_REF] Shin | An experimental study of hierarchical intrusion detection for wireless industrial sensor networks[END_REF][3], LHSFW has the ability to detect passive attacks with a high accuracy by attracting such threat to switch to an active attack as proved above. . Average Efficiency. LHSFW spends a short time compared to hybrid security mechanisms [START_REF] Shin | An experimental study of hierarchical intrusion detection for wireless industrial sensor networks[END_REF][3] (see Fig. 6(a)), specifically when the number of malicious nodes is important. This result occurred due to the fact that our framework relies on cooperative detection between the IDS agents and their respective CH to detect suspected nodes in a less time, unlike the frameworks [2][3] where there is no cooperation between IDS nodes, which leads them to spend a considerable amount of time to confirm the malicious behavior of a monitored node. According to the Fig. 6 (b), it is apparent that LHSFW exhibits the lowest energy consumption to detect all attacks cited above compared to the hybrid security mechanisms [START_REF] Shin | An experimental study of hierarchical intrusion detection for wireless industrial sensor networks[END_REF][3], specifically when the number of nodes is important (equal to 50% of overall nodes). This result is achieved due to the fact that LHSFW aims to launch the cryptography operation only if necessary (as described above). In this paper, we develop a lightweight security framework for WSN, which aims to assure data confidentiality by using a cryptography technique and an intrusion detection approach to detect the internal attacks. However, such combination could generate a high overhead. In this research work, our aim is to address this issue by launching the cryptography operation only at the attacked clusters. According to our simulation results, when the active attacks occur, LHSFW framework outperforms other security frameworks in terms of detection rate, false positive rate, energy consumption, and efficiency. Furthermore, we prove that, by using cryptography technique our intrusion detection approach removes almost all passive attacks from the network as such technique makes the information more attractive for the intruder.

In the near future, we will take into account the context of mobility with embedding our framework on such network and will evaluate the delay and the amount of overhead generated in a scaling mode.

Fig. 1 .

 1 Fig. 1. Monitoring process of IDS agent

Fig. 2 .

 2 Fig. 2.Symetric key encryption: keys distribution and encryption process

Fig. 4 .

 4 Fig. 4. Passive attacks' detection rate versus δ

  Sensors energy is a very important point in the design and implementation of the application.

Fig. 5 .Fig. 6 .

 56 Fig. 5. LHSFW performances in terms of: (a) Detection rate, (b) False positive rate

TABLE I

 I

	. SIMULATION PARAMETERS
	Simulation time	600 Seconds
	Simulation area	100*100
	Number of sensors	220
	Number of clusters	10
	Routing protocol	HEED
	Radio range	15m
	Sensor initial energy	5J
	Passive attacks	30 % of overall nodes
	Active attacks	From 5 % to 50% of overall nodes