Agathe Blaise

Mathieu Bouet

Stefano Secci
email: stefano.secci@cnam.fr

Vania Conan

Split-and-Merge: Detecting Unknown Botnets

Keywords:

published or not. The documents may come

I. INTRODUCTION

In 2016, the Mirai botnet [START_REF] Antonakakis | Understanding the Mirai botnet[END_REF] launched a massive attack towards DNS servers of major Internet providers, cutting access to high-profile websites during several hours. Beforehand, it reunited nearby 50,000 devices in its bot army, but has not been detected until too late. Mirai acted like a revolutionary IoT-based malware since the release of its source code [2] that led to huge increase in other botnets development. Actually, malware that targets Internet-of-Things (IoT) devices is responsible for many Distributed Denial-of-Service (DDoS) attacks. It exploits the lack of security of connected objects to create botnets, spreading extremely fast. We expect to see an increase in such IoT attacks, along with the explosion of IoT devices that could grow up to 125 billion by 2030 [3]. Recently, DDoS attacks significantly increased in terms of number and duration; indeed, the first half of 2018 saw seven times more large attacks (higher than 300 Gbps) compared to the same period in 2017, as noted in a Kaspersky report [START_REF] Alexander Khalimonenko | DDoS attacks in Q1 2018[END_REF]. Furthermore, these botnets slightly propagate and affect whole networks without even being noticed, until they reach their real target. There is thus an urgent need to detect this kind of threats as soon as possible.

Designed to ensure cyber-security in networks, Intrusion Detection Systems (IDSs) aim to identify malicious activities and related threats. However, as a matter of fact most botnets go under the radars. Indeed, current IDSs work at different traffic granularities, e.g., flow, host or packet, to detect anomalies. However, they miss global changes on application ports that are involved during the infection and propagation of botnets. Ports can be scanned to fingerprint the target machine, to exploit known vulnerabilities or to communicate with a Command-and-Control (C&C) server [START_REF] Bhuyan | Surveying port scans and their detection methodologies[END_REF], and therefore new attempts on one port can be observed simultaneously in the whole Internet. Moreover, current IDSs work on small variations of traffic, generally using time-sliding windows that last a few seconds. Therefore, they cannot build long-term profiles for port and detect major changes in their usage. Finally, current IDSs are usually deployed at a single point in the network, while ISP-scale attacks are only visible by looking at a holistic view of a wide area network.

In this paper, we propose an anomaly detection technique that watches network trends and spots main changes in the usage of a single port. This aims at detecting botnets that use protocols in a particular way during their lifecycle. A split-and-merge technique ensures that changes in one port are distributed and not due to random traffic variations (that can be caused by ephemeral ports). Local detections modules, geographically split in the network, collect traffic and send anomalies to a central controller in charge of aggregating them, like a Collaborative IDS (CIDS) would do (Figure 1b). The number of false positives can hence be significantly lower as only anomalies detected in several places are confirmed.

Intuitively, the most obvious way to identify an attack is to observe a sudden rise in traffic towards a port. However, this may be inefficient as it can be a well-known vulnerable port, already massively scanned. Actually, some stealthy changes in its behavior can be identified as anomalies. In our algorithm, several features representing port usages are computed. Large packets batches picked at a frequency of several days enable to profile the evolution of features over time, then simple statistical measures spot anomalies in the features time-series. In addition, our solution does not require parsing packets payload, contrary to most botnet detection tools. Therefore it can be used in a network with end-to-end encryption.

For our evaluation, we use the MAWI dataset [START_REF]MAWI working group traffic archive[END_REF], containing daily traffic traces of a transpacific backbone link. The dataset is restricted to a single ISP, hence corresponds to what could be used at the ISP-level. We do not use it as background traffic but aim at detecting real attacks from it, providing a better knowledge of the dataset at the same time. Our source code is publicly available at [START_REF]Source code for split-and-merge detection algorithm[END_REF]. We present the intrusion detection results against known attacks arisen the last three years, not detected by the MAWILab detection algorithm [START_REF] Fontugne | Mawilab: Combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking[END_REF], and also what appear as unknown events. Subsequently, we demonstrate that our algorithm greatly reduces the number of false positives compared to a single IDS running on the whole dataset.

This paper is structured as follows. Section II addresses related work. Section III presents our methodology to detect distributed changes in port usages. In Section IV, we present the evaluation, highlighting the benefits of our method in terms of false detection rate and detection accuracy, and proposing a classification of the detected anomalies. Finally, Section V concludes the paper.

II. RELATED WORKS

In this section, we propose a classification of intrusion detection techniques and review related works.

A. Intrusion detection methodologies

Many algorithms are proposed in the literature for network intrusion detection [START_REF] Bhuyan | Network anomaly detection: Methods, systems and tools[END_REF]. We can classify them in two main families: knowledge-based and anomaly-based techniques.

Knowledge-based (or signature-based) solutions such as Snort [START_REF]Snort -network intrusion detection & prevention system[END_REF] and Bro [START_REF] Paxson | Bro: a system for detecting network intruders in real-time[END_REF] rely on a signature database to find attacks that match given patterns, such as malicious byte sequences or known malware signatures. Up to now, most companies rely on signature-based IDSs as they are expressive and understandable by network administrators, with precise information about the detection logic. Nevertheless, they are not able to detect zero-day attacks, i.e., attacks exploiting unknown vulnerabilities, for which no patch is available.

Anomaly-based approaches attempt to detect zero-day attacks, in addition to known ones. They model the normal net-work traffic and qualify an anomaly as a significant deviation from it, with statistical or machine learning techniques. Bot-Sniffer [START_REF] Gu | Botsniffer: Detecting botnet command and control channels in network traffic[END_REF] utilizes statistical methods to detect C&C botnets, by observing coincident behaviors among hosts, like messages to servers, network scan or spam. Machine learning techniques can be classified in three families: (i) Supervised ones learn from a labelled dataset what constitutes either normal traffic or attacks (ii) Unsupervised approaches learn by themselves what is normal or abnormal -among them, MAWILab [START_REF]MAWILab database[END_REF] finds anomalies by combining detectors that operate at different traffic granularities (the results against the MAWI dataset are in [START_REF]MAWILab database[END_REF]); numerous works compare themselves to MAWILab, as for instance change-detection techniques [START_REF] Tartakovsky | Efficient computer network anomaly detection by changepoint detection methods[END_REF], [START_REF] Callegari | Entropy-based network anomaly detection[END_REF] (defining an anomaly as a sudden change compared to a model), and ORUNADA [START_REF] Dromard | Online and scalable unsupervised network anomaly detection method[END_REF] (relying on a discrete time-sliding window to continuously update the feature space and cluster events); (iii) Hybrid approaches benefit from only a small part of labelled traffic, meant to be enough to learn from.

B. Large-scale intrusion detection

Coordinated attacks arise in multiple networks simultaneously and include large-scale stealthy scans, worm outbreaks and DDoS attacks [START_REF] Zhou | A survey of coordinated attacks and collaborative intrusion detection[END_REF]. Traditional IDSs tend to fail at detecting these attacks as they commonly monitor only a limited portion of network. Large-scale IDSs, instead, have a global view over the network, and they better scale by distributing the computational load between several detection agents. Two large-scale IDS approaches can be identified.

The first IDS approach consists in distributing flow collectors split in different subnetworks and in running a central detection engine against aggregated data, as shown in Figure 1a. Raw packets are transmitted from the flow collectors to the detection engine [START_REF] Shanmugam | DEIDtect: towards distributed elastic intrusion detection[END_REF]. Solutions exist to avoid the collection traffic overhead, as done by Jaal [START_REF] Aqil | Jaal: Towards network intrusion detection at isp scale[END_REF], which creates and sends concise packets summaries to the detector -with Jaal, one reaches a 35 % bandwidth overhead to get an acceptable true positive rate, which is still important.

The second IDS approach consists in the already mentioned CIDS, that is a two-level anomaly detection system where monitors are physically split in the network to perform local detection. They generate low-level alerts then aggregated to produce a high-level intrusion report. There are three types of CIDSs depending on their communication architecture:

1) Centralized CIDSs are composed of several monitors that transmit the alerts to a central correlation engine, as illustrated in Figure 1b. 2) Hierarchical CIDSs use a pyramidal structure of monitors to achieve an increasingly higher alert aggregation until the alerts reach the top correlation engine. 3) Distributed CIDSs share the detection and correlation tasks between all monitors. This approach can be set up by a peer-to-peer network. For instance, [START_REF] Singh | Collaborative IDS framework for cloud[END_REF] presents a centralized CIDS framework composed of IDS clusters implementing both the detection and the correlation; Snort signatures are therein used to detect known attacks, while an unsupervised learning algorithm detects unknown attacks. [START_REF] Francois | FireCol: A collaborative protection network for the detection of flooding DDoS attacks[END_REF] proposes a sort of distributed CIDS, composed of Intrusion Prevention Systems forming rings around the hosts to protect, in order to collaborate and forward the traffic adaptively depending on their findings.

C. Alert correlation design

A common issue behind CIDS is its alerts correlation. Alert correlation algorithms can be divided into three categories [START_REF] Mirheidari | Alert correlation algorithms: A survey and taxonomy[END_REF]: (i) similarity-based algorithms compute the similarity between an alert and a cluster of alerts, and based on the result either merge it with the cluster or create a new one; (ii) knowledge-based algorithms rely on a database of attacks definitions; (iii) probabilistic algorithms use similar statistical attributes to correlate attacks.

In our work, we leverage on the CIDS principles to build our system, and in particular centralized CIDS, and in terms of alert correlation we attempt at simplifying the search space using application ports, and more precisely destination ports. Up to our knowledge, we are the first to use the CIDS concept applied to port-centric detection. Aggregating alerts based on destination ports as we propose can strongly ease the aggregation challenge, avoiding too complex algorithms for that purpose.

A few works specifically focus on port-based detection but they do not apply to CIDS. In [START_REF] Bhuyan | Surveying port scans and their detection methodologies[END_REF], the authors propose a survey of the current methods to detect port scans. [START_REF] Panjwani | An experimental evaluation to determine if port scans are precursors to an attack[END_REF] aims to show the correlation between port scans and attacks. [START_REF] Kao | A predictive zero-day network defense using long-term port-scan recording[END_REF] analyzes the period during the release of a zero-day attack and its patching. [START_REF] Panjwani | An experimental evaluation to determine if port scans are precursors to an attack[END_REF], [START_REF] Kao | A predictive zero-day network defense using long-term port-scan recording[END_REF] analyze port-usage, but they do not use destination ports as primary key. Actually, this last setting generates a high number of false positives, which can be mitigated by CIDS.

III. SPLIT-AND-MERGE PORT-CENTRIC NETWORK ANOMALY DETECTION

We present our anomaly detection proposal, detailing the reference CIDS architecture and the features design.

A. Rationale

We already anticipated some of our key modeling choices: we aggregate traces based on destination ports, in a distributed CIDS setting, and target to design features minimizing the degree of arbitrarity in their choice and interpretation. Our objective is to model the usage of each port, by computing features each time the same day at the same daytime slot, in order not to be influenced by weekly or daily variations. The features characterize the port usage, e.g., if it is mainly targeted by port scan or not, if the hosts are numerous or not, etc. We work on a limited time window over a day, which we assume to represent port usages this day.

In our reference distributed CIDS setting, several detection module agents run on different subnetworks so that they can capture subnetwork peculiarities and cover the CIDS network context completely. Based on the time evolution of the features of a port, the detection modules detect anomalies and report them to a correlation module. Hereafter we provide in details the different steps of the detection module logic, as well as the anomaly aggregation logic of the correlation module. At each daytime slot, every detection module performs several tasks in a row (each task is then further detailed in the following subsections): Data collection: incoming packets are collected in a single group of N bat ch elements; only the following data is stored: the source and destination IP addresses and ports, the packet size and the TCP flags configuration.

Features computation: packet references are aggregated by destination port, filtering out those ports with less than N min packets in order not to be influenced by very light traffic on one port. Features are then computed for the remaining ports.

Anomaly detection: lastly, the local detection module analyzes the port-specific features time series over N day s in order to detect an anomaly with a change-detection algorithm. When an anomaly is spotted, based on a warning threshold T i on a given feature i, an alert is created and transmitted to the central correlation module.

The collection and detection parameters resumed in Table I are to be customized. At the end of the detection process, the correlation module aggregates the alerts received from all detection modules. It is then able to deduce and qualify an attack by noticing the distributed alerts.

B. Features design

To observe an anomaly on a port, looking at the number of packets over time is not sufficient. Indeed, subtle changes in the nature of packets can happen on a port already massively scanned. Therefore, we need to design significant features.

Our features choice is resumed in Table II. srcDivIndex and destDivIndex highlight significant variations in the proportion of unique source and destination IP addresses. An increase in srcDivIndex may be an attack perpetrated by bots, while its decrease can indicate an attack led by only a few actors. portDivIndex reflects the diversity in source ports. A variation in the meanSize feature suggests a change of packets nature, like crafted packets sent by bots. A variation in the stdSize feature can be caused by a change of packets nature as well, and in addition is not easy to fool for an attacker: if it increases, the diversity among packets is higher, so probably there are suddenly both crafted and regular packets; if it decreases, the diversity among packets is lower, hence the traffic more specific. This can be caused by a malicious software which kills other processes bound to the same port. Finally, a variation in perSYN implies an increase or decrease in port scan.

We denote the time series of feature i on N days (i.e., N day s ) for port p as being the value of feature i for port p on day j. The detection modules dispose of features tables to save the vectors. The tables constantly contain N entries so that for every new capture, the former value is deleted and the new one added.

f p i, N = (x p i,

C. Local anomaly detection

Assuming a feature is more or less likely to vary (standard deviation) depending on its type, and usually around the same (mean) value, the normal distribution logically quite fits as its distribution. Hence we model the time series f p i, N = (x p i,1 , ..., x p i, N ) over N days as a normal distribution N (µ p , σ p 2 ) of mean µ p and standard deviation σ p such that:

µ p = N j=1 x p i, j and σ p = 1 N N j=1 (x p i, j -µ p ) 2 .
(

In order to automatically detect a change in the time series of a port-specific feature, Z-score is a well-known simple statistical-based algorithm. More precisely, the Z-score is the measure of how many standard deviations below or above the mean a data point is. Basically, a Z-score equal to zero means that the data point is equal to the mean. The larger the Z-score, the more unusual the value. For the given time series f p i, N , the Z-score of the new value x p i, N +1 of feature i at time N + 1 is computed as follows:

Z p i, N +1 = x p i, N +1 -µ p σ p . (2)
However, the Z-score is computed from the mean, a metric influenced by outliers and especially extreme values. Alternatively, the modified Z-score uses the median and the median of the standard deviation from the median, instead of the classical mean and the standard deviation, respectively, which makes it outlier-resistant [START_REF] Iglewicz | How to detect and handle outliers[END_REF]. Given the time series median

f p i, N , the modified Z-score M p i, N +1 of the new value x p i, N +1 of feature i at N + 1 is computed as: M p i, N +1 = 0.6745 • (x p i, N +1 -f p i, N ) median(|x p i, N +1 -f p i, N |) (3)
An anomaly is then detected if the absolute value of the modified Z-score exceeds a threshold T i . For all i, we adopt a threshold value of 3.5 as recommended in [START_REF] Iglewicz | How to detect and handle outliers[END_REF].

Therefore, the modified Z-score is used to identify anomalies on all features, except nbPackets: it is only used to spot emerging ports, i.e., ports that were not in use before. That is, an anomaly is spotted if at least a given number of packets

D. Central correlation

The correlation module receives the low-level alerts from all detection modules. The distinction between localized (noticed in one subnet) and distributed (noticed in several subnets) alerts is made here. As we are searching for distributed attacks, the correlation module groups the low-level alerts to keep only the ones reported by at least k subnets; we set k = 2 in this work. In the example of Figure 2, several detection modules send alerts to the correlation module; among them, two subnets report a change in the portDivIndex feature on port 23. Hence the correlation module spots an anomaly on port 23.

It is even better if similar anomalies have been noticed on the same port for several features. We define the anomaly score as the number of anomalies noticed for one port by all monitors and for all features; e.g., if one monitor detects anomalies on two features, and another on six features, the anomaly score is 8; or if nine monitors see an anomaly on a single feature, the anomaly score is 9. A score higher than the number of monitors is already concerning, but we can define several levels of concern based on the anomaly score.

When the correlation module identifies top-level anomalies, it warns all detection modules about the anomalous ports. Thus they will analyze these ports as a priority next time. Ad-hoc actions can also be taken, as a function of the programmability of the local network, such as port blocking, mirroring, deeppacket-inspection, for the sake of reporting in a possible further detailed analysis.

IV. EVALUATION

In this section, we evaluate the performance of our splitand-merge anomaly detection process using real traffic traces. The detection accuracy is compared between two approaches: split-and-merge detection and a central detection made at a single point. We open source the source code used for splitand-merge analysis in [START_REF]Source code for split-and-merge detection algorithm[END_REF].

A. Network traffic dataset

The WIDE project provides researchers with daily traces of a transpacific link, named the MAWI archive [START_REF]MAWI working group traffic archive[END_REF]. Traces are collected between their network and the upstream ISP. Each file contains 15 minutes of traffic flows, captured between 14:00:00 and 14:15:00 local time. This represents usually between 4 and 10 GB of traffic for one file. Before being released, traces are anonymized so that no personal information can be extracted. Specifically, the application data is removed and IP addresses are scrambled with a modified version of tcpdpriv following two principles: 1) it is collision-free so that there is a one-to-one mapping between IP addresses before and after anonymization; 2) it is prefix-preserving so that if two IP addresses share k bits before anonymization, the two anonymized IP addresses will also share k bits. This enables to retrieve the subnetworks after anonymization.

However, the anonymization key changes everyday, so there is a need to retrieve the same subnetworks each day. We notice that from one day to another, several anonymizations of the same subnetwork always share the same first byte. Using this tip and a mapping with subnetworks masks, we can retrieve all MAWI subnetworks whatever the period. Finally, we found 7 different AS totalling 17 subnetworks in MAWI. We use only the 9 subnetworks containing incoming traffic, and apply our algorithm as 9 distinct monitoring points.

B. Local anomaly detection

First, we launch the local detection modules simultaneously, each of them being situated in a MAWI subnetwork. We pick each Thursday from March 31 to Oct. 20, 2016. Thresholds T i for an anomaly are all set to 3.5. The minimum number of packets N min is set to 20. The number of days in the model is N day s = 10. Therefore, the initialization stage needed to compute the feature vectors the first time lasts 10 weeks, and the detection begins on June 9. These parameters are used for next simulations too, in Sections IV-C and IV-D.

Below on Figure 3 is an example of the modified Zscore evolution for the srcDivIndex feature on port 3389. On Sept. 29, the absolute value of the modified Z-score is over the threshold for four detection modules situated in different subnetworks, resulting in an anomaly. The subnetwork F contains only a few points because most of the time, there is little (less packets than N min ) or no traffic on port 3389 in this subnetwork. The same explanation applies to subnetworks that do not appear at all in the legend. Figure 4 and 5 show the occurrences of anomaly scores for these two periods. In the squares are given the numbers of ports with this anomaly score this day. The highest the score, the most colored the case to highlight significant detections. Note that the y-axis is not linear. We choose to describe only anomalies whose score is strictly higher than 15. For each of them, the port and the volume percentage of traffic towards it are indicated: this highlights that our algorithm notices anomalies even on ports with light traffic. Hereafter we further described the detected anomalies, along with our assumption about their cause.

2016 period. Four noticeable scores appear on Figure 4 depicting this first period.

i) The IoT Mirai botnet [START_REF] Antonakakis | Understanding the Mirai botnet[END_REF] is a major attack arisen in 2016. First, Mirai infected hosts send TCP SYN packets to random IP addresses on Telnet ports 23 and 2323, except those on a blacklist. Hosts whose Telnet port is open send back a SYN/ACK packet. Then, infected hosts try to establish a Telnet connection to them using a hard-coded list of credentials, and send the credentials to another server if it is successful. From there, a separate program determines the environment and executes architecture-specific malware. The victim is now infected by Mirai and listens for attack commands from the C&C server, then starts scanning to infect other hosts. This is how Mirai spread into connected objects and form a worldwide army of bots. However, other IDSs did not detect it, while our algorithm detected the scans as soon as they arose. Indeed, the 26-score on Aug. 4 corresponds to the Mirai scan on port 23 and the 28-score on Sept. 15 corresponds to the Mirai scan on port 2323.

ii) The 20-score on June 30 corresponds to an exploit on port 6379 Redis, an in-memory key-value store used as a Fig. 4: Anomaly scores for the 2016 period. In the coloured squares are given the numbers of ports with this anomaly score this day.

database or a cache. This day a large SYN scan is detected from the same source IP address, targeting numerous hosts in several ASes of the MAWI network. This is either a large scan targeting the whole IPv4 space, through a tool like the ZMap tool [START_REF] Zakir Durumeric | ZMap: Fast internet-wide scanning and its security applications[END_REF] that performs Internet-wide network scan in under 45 minutes, or someone who wants to penetrate the MAWI network specifically. Redis servers do not require authentication by default and therefore are easy victim of this type of scan. Also, this happens only a few days after buffer overflow vulnerabilities were discovered, leading to arbitrary code execution (CVE-2016-8339, CVE-2016-10517).

iii) The 17-score on Sept. 29 reveals an anomaly on port 3389, of the Remote Desktop Protocol (RDP). This proprietary protocol enables a user to remotely connect to another computer with a graphical interface over a network connection. This day, as for the Redis anomaly, the same source IP address exchanged TCP packets with numerous hosts in several AS of MAWI network, with the same source port. It may be an update by an administrator connected to all machines through RDP, or a large scan to penetrate the network.

2018 period. Seven scores distinguish themselves during this second period on Figure 5.

i) On Feb. 8 and March 8, exploits on port 81 are noticed. These days almost the same IP address launched TCP SYN scans from the same source port number, targeting all MAWI subnetworks. This may be once again an Internet-wide network scan (e.g., by ZMap) or an attacker that targets the MAWI network specifically.

ii) The 16-score on Feb. 15 is actually a scan on port 5555. It comes from the ADB.Miner botnet, which identifies Android devices with Android Debug Bridge turned on, to control them and make them execute commands [START_REF]Miner: More information[END_REF]. Hence this day, numerous IP addresses sent TCP SYN packets to various hosts in the MAWI network using different source port numbers, as iii) An 18-score on Apr. 5 corresponds to a large scan on port 2000, coming from various source IP addresses with different source port numbers, and targeting many IP addresses from several ASes in the MAWI network. Cisco Skinny Call Control Protocol (SCCP) is often bound to this port, allowing terminal control for voice over IP. This scan is symptomatic of an IoT botnet, willing to exploit the few vulnerabilities disclosed last years for this protocol, and maybe IoTroop [START_REF]IoTroop botnet: The full investigation[END_REF].

iv) An 19-score on Apr. 5 highlights a scan on port 8291, carried out by Hajime bots. Hajime [START_REF] Edwards | Hajime: Analysis of a decentralized internet worm for IoT devices[END_REF] is an IoT worm revealed only a few days after the release of the source code for Mirai. The botnet is continuously evolving, taking advantage of newly released vulnerabilities. On May 2018, it exploits a vulnerability (CVE-2018-7445) published 13 days before. First, infected hosts scan random IP addresses on port 8291 to identify MikroTik devices. Once the bot has identified one device, it tries to infect it with a public exploit package sent via port 80 or an alternate port. If successful, the device infects new victims in turn under the same protocol. This day, as for the Mirai botnet, our program saw many IP addresses targeting the MAWI network on port 8291, using various source port numbers.

v) Finally, on Apr. 26 and March 3, two anomalies on port 23 are detected. We observe that these days, meanSize considerably rises while srcDivIndex and destDivIndex falls. The number of packets is also lower than usual. Thus it looks like there are less malicious scans towards this port these days. Actually, botnets tend to use alternate ports instead of port 23 because vulnerabilities on this port are progressively patched and devices are armed against possible exploits on this port.

D. Comparison between central and split-and-merge detection

To evaluate the benefits in splitting the detection process, we apply the same detection method under two different approaches and compare the results. The two approaches are:

Split-and-merge detection: in the first case, we split the detection between several detection modules, then we aggre-gate the results. Here an anomaly is defined for one feature if at least two detection modules compute a modified Z-score higher than the threshold. Thus its anomaly score corresponds to the number of detection modules that detected that.

Central detection: here we apply the same detection method, but at a single point in the network. An anomaly is defined for one feature if the modified Z-score is higher than the threshold while working on packets of the whole network. In this case, the anomaly score is equal to 1, else 0.

The evaluations below aim to compare both approaches by considering two main aspects: the number of false positives and the capacity to detect attacks.

1) Evaluation of the number of false positives: First, we compare the number of anomalies between both approaches. Table III shows the number of anomalies found for each feature on a day randomly chosen, on Aug. 4, 2016. For all features, the number of anomalies for the splitand-merge detection is significantly lower than for the central detection. Indeed it appears that the split-and-merge approach is very selective and enables to eliminate numerous alerts by keeping only the distributed ones. Operators at the Security Operation Center (SOC) of information systems are overwhelmed by alarms and thus tend to under utilize detection suites. Hence our solution could be considered in that case.

2) Evaluation of the detection accuracy of known attacks: We now compare the detection accuracy between split-andmerge and central detections on some attacks identified in the previous subsection. Tables IV to VI show the results. The two last columns show the total scores for all features. To get an idea of the rarity detection, the number of ports that notice a score higher or equal to the actual one is indicated in cases #ports ≥S. The total number of ports corresponds to the number of ports obtained after the filter on N min packets is applied. It is then different each day.

We indicate also for each attack if MAWILab detected it based on MAWILab anomaly reports. Indeed, these attacks are not traditionally detected by current IDSs for several reasons:

• Current IDSs work on small variations of traffic, generally using time-sliding windows that last a few seconds or less. Therefore, they fail at detecting major but progressive changes in the traffic. • They aggregate packets either by source IP or destination IP addresses, while these attacks focus on ports. • ISP-scale attacks stay invisible at a single network scale. Mirai botnet. Table IV presents the results of the Mirai botnet detection, on port 23 on August 4 t h , 2016. With the central detection, there are anomalies for five features, a score noticed for 132 ports in total. For split-and-merge detection, the score is equal to 26 out of 51, a score noticed only for this port (see Figure 4), so this is very rare and visible by the network administrator. The Mirai case is interesting since the Telnet port was already massively scanned before the Mirai scan. Therefore, it is not identifiable by sudden high traffic on this port, but it requires the use of precise features to notice a change. Moreover, MAWILab did not detect the scan.

ADB exploit. Table V presents the results of the ADB exploit detection. The central detection produces a total score of 4 out of 6. This score is not relevant enough since 455 other ports registered a score higher or equal to this one. On the contrary, the split-and-merge detection produces a score of 16 out of 51, a score highly relevant because noticed for only this port (see Figure 5). The MAWILab report of this day is not available, so we are not able to check if MAWILab detectors detected the attack.

Hajime botnet. Table VI presents the results of the Hajime botnet detection. The central detection produces a total score of 5 out of 6. Despite its high value, this score cannot be interpreted as relevant and distinct enough since 203 ports registered a score higher or equal to this one. On the contrary, the split-and-merge detection produces a score of 19 out of 51, which is truly relevant because noticed for only this port (see Figure 5). Furthermore, this day MAWILab report did not notify anything relatively to port 8291.

For all attacks, we observe that the split-and-merge detection is far more efficient than the central detection. Therefore there is a benefit in detecting anomalies by subnetwork and then aggregating low-level alerts, rather than performing anomaly detection with packets from the whole network. 3) Detailed characterization of major anomalies: Each anomaly is unique regarding the port usage before the anomaly and the type of change, thus any classification of anomalies would be non-exhaustive. However, looking at features conjointly enables insights on the anomalies. Figure 6 shows on the y-axis the most noticeable anomalies discovered in 2016, along with their destination port and date. For each one, the number of monitors that detected an anomaly for the feature in the x-axis is given in the coloured squares. We propose hereafter the description of three anomalies.

i) The anomalies on port 23 represent the Mirai scan. There is no anomaly in perSYN, as this port was already known for its vulnerabilities before Mirai, and thus largely scanned. destDivIndex rises in a majority of subnetworks as there are more hosts targeted by a scan than before. srcDivIndex rises as well but not over the threshold, and thus does not appear here. Also, meanSize decreases because crafted packets have a lower size than regular ones. stdSize rises, as the difference between Mirai and non-Mirai packets sizes expands. This is not shown in the picture but some days later, stdSize falls in several subnetworks as Mirai tends to stop other processes bound to this port, thus the diversity among packets is lower.

ii) The qualification of the Mirai scan on port 2323 is quite different. This time, perSYN rises because the port was not popular before and is now highly scanned. srcDivIndex rises as well since there are far more infected bots targeting port 2323 than previously.

iii) Finally, the RDP anomaly characteristics on port 3389 depict another kind of anomaly. We notice that srcDivIndex falls in several subnetworks while destDivIndex rises, therefore these are numerous connections coming from the same host. We also note that the diversity among packets is lower by observing stdSize, and that anomalous packets have a lower size than regular ones with meanSize.

V. CONCLUSION

Our split-and-merge port-driven anomaly detection procedure focuses on major attacks targeting servers and connected objects around the world. We propose a collaborative scheme to detect main changes in the usage of ports. The detection results are very promising, since our algorithm detected a number of world-wide attacks from 2016 to 2018, including Mirai. It is also able to provide precise details about the anomalies to help the administrator characterizing them. In contrast, current IDSs, among which the notorious MAWILab, have not detected them. Moreover, we demonstrate that our algorithm produces a very low number of false positives. At the same time, we provided a better knowledge of the MAWI dataset, raising the main attacks that happened the last three years, in open source.

In the future, we plan to implement a system that runs in near real-time. Hence, instead of running the algorithm at an appropriate frequency, we would have to remove the seasonal trend from time-series. This way, a dimensioning of our algorithm in terms of memory, storage and computing power could be elaborated too. We also aim at doing a better characterization of attacks by analyzing conjointly the features evolution. Finally, one can refine the detection accuracy by analyzing how the parameters impact the results.

  (a) Local collection and central detection. (b) Centralized CIDS: local collection and detection, and central correlation.

Fig. 1 :

 1 Fig. 1: Two possible approaches for large-scale NIDS.

Fig. 2 :

 2 Fig. 2: Split-and-Merge example. Local modules run at different points in the network and send alerts to the central correlation module, which spots an anomaly on port 23.

Fig. 3 :

 3 Fig. 3: Evolution of the modified Z-score of feature srcDivIndex on port 3389 over time (2016).

Fig. 5 :

 5 Fig. 5: Anomaly scores for the 2018 period.

Fig. 6 :

 6 Fig. 6: Characterization of anomalies in 2016. In the squares are given the numbers of subnetworks that detected a modified Z-score over (+) or below (-) the threshold for each feature.

  Number of packets collected per day N mi nMinimum number of packets per analyzed port N da y s Number of days in the sliding window T i Threshold to spot an anomaly for feature i

	Notation	Definition
	N bat c h

TABLE I :

 I Notations.

TABLE II :

 II Split-and-Merge features.

TABLE III :

 III Number of detected anomalies in central and splitand-merge approaches on Aug. 4, 2016.

TABLE IV :

 IV Evaluation on port 23 (Mirai botnet) the 4 t h of August, 2016 for central and split-and-merge detections.

	Detection	S	srcDivIndex #ports≥S S	destDivIndex #ports≥S S	portDivIndex #ports≥S S	meanSize #ports≥S S	stdSize #ports≥S S	perSYN #ports≥S	S	6 features #ports≥S
	Central	1/1	536/25400 1/1	515	0/1	25400	1/1	487	1/1	457	0/1	25400	4/6	455
	Split-Merge	3/9	3/21999	3/9	3	4/9	1	4/9	1	1/9	218	1/9	14	16/51 1

TABLE V :

 V Evaluation on port 5555 (ADB exploit) the 15 t h of February, 2018 for central and split-and-merge detections.

	Detection	S	srcDivIndex #ports≥S S	destDivIndex #ports≥S S	portDivIndex #ports≥S S	meanSize #ports≥S S	stdSize #ports≥S S	perSYN #ports≥S	S	6 features #ports≥S
	Central	1/1	256/25400 1/1	253	1/1	254	0/1	25400	1/1	224	1/1	30	5/6	203
	Split-Merge	4/9	2/21999	5/9	1	5/9	1	1/9	122	3/9	4	1/9	16	19/51 1

TABLE VI :

 VI Evaluation on port 8291 (Hajime botnet) the 5 t h of April, 2018 for central and split-and-merge detections.


Edith Petitfour

TEACHING GEOMETRY TO VISUAL-SPATIAL DYSPRAXIC PUPILS

LDAR (EA 4434) UA UCP UPD UPEC URN

. This approach allowed us to identify and categorize the actions required in elementary geometric tasks to better understand the pupils' difficulties and potential didactic actions to overcome them.

INTRODUCTION

In Grades 5 and 6 in France, the teaching and learning of geometry is based on the handling of objects (folding, assembling geometric shapes or drawing with ruler, compass and set square) and on a sharp perception of figures. Indeed school curriculum recommend situations which require actions with instruments such as to describe, to reproduce, to represent, to construct geometric figures. Learning geometry may hence appear to be inaccessible to visual-spatial dyspraxic pupils. As a consequence of such teaching, these pupils fail in geometry despite the fact that construction with instruments, a task that they are unable to complete, is not a teaching objective in itself: it is only a means that must lead the pupil to the conceptualization of geometric notions. In our research, we suggest the hypothesis that dyspraxic pupils are able to learn geometry by using their preserved abilities (language, memory and reasoning). To capitalize on these preserved capabilities, we had recourse to a classroom social organization based on pair work: the dyspraxic pupil worked in interactions with a peer (standard pupil), the teacher or a school special education assistant. The dyspraxic pupil gave the instructions to the other individual about what had to be done with the instruments (e.g., tracing a segment, measuring a length, etc.).

In the first part of this text, we present a few elements of a framework intended to analyze the process of accessing geometrical concepts (e.g., alignment, equality of length, right angle, etc.) through construction with instruments. In the second part we briefly discuss an application of the theoretical framework with special attention to gestures and language.

ELEMENTS OF THE THEORETICAL FRAMEWORK

Theoretical background

Elementary geometric activity regarding non-ostensive entities (intuition, concepts, ideas) can only develop through a plurality of different palpable registers (oral, written, graphical, gestural, material) [START_REF] Bosch | La sensibilité de l'activité mathématique aux ostensifs. Objet d'étude et problématique[END_REF]. These ostensive objects, signs produced through different intentional actions (speaking, writing, drawing, gesticulating, handling an artifact), with their production and transformation modes, are constituents of semiotic sets, as well as the relationships between these signs and their meanings [START_REF] Radford | The seen, the spoken and the written. A semiotic approach to the problem of objectification of mathematical knowledge[END_REF]. Considering that learning processes are multimodal, we rely on concept of semiotic bundle [START_REF] Arzarello | Semiosis as a multimodal process[END_REF], in order to consider the dynamic development of interactions between semiotic sets. During a pair-work activity based on construction with instruments, these sets are composed of one or several ostensive objects (actions with artifact, language, gestures and graphical objects). Our analysis framework aims at studying their articulations and their links to geometrical learning.

The approach is based on semiotics, on two disciplines in cognitive sciences: cognitive ergonomics according to an instrumental approach [START_REF] Rabardel | Les hommes et les technologies[END_REF] and neuropsychology [START_REF] Mazeau | L'enfant dyspraxique et les apprentissages[END_REF][START_REF] Mazeau | Neuropsychologie et troubles des apprentissages chez l'enfant. Du développement typique aux « dys[END_REF] and on observations of several fifth and sixth-grade visual-spatial dyspraxic pupils, in interaction with others, involved in different tasks based on constructions with instruments.

Analysis framework to study actions with instruments

In his/her working environment, the individual must implement a complex sequence of actions with instruments in order to obtain the graphical representation of geometric objects (e.g., tracing the symmetric of a point with respect to an axis, using square and compass). The effective implementation of an action with instruments requires the initiation of effector, sensory and motor organs: it is the neuromotor and muscular aspect of the action. Every action with instrument is preceded by its representation, which is its cognitive aspect.

At a cognitive level, we first consider that the project to perform an action with instrument is constituted by a dual intent: intent to act and motor intention. Intention to act relates to an anticipation of the action in which individual himself represents the final purpose and the theoretical project of the action with the instrument. Motor intention relates to planning and programming of the action in concrete implementation, taking into account the context (environment and material instrument). Moreover, we consider that the action with the instrument is divided into four components characterized by relationships activated between geometric objects, graphical objects, instruments, individual's body and environment:

• the semiotic one is the set of relationships between graphical objects and geometric objects,

•
the technical-figural one is the set of relationships between instruments and graphical objects, • the motor manipulation one is the set of relationships between the individual's body and instruments, • the organizational one consists of the interaction of the individual with his/her environment's artifacts related to the practical organization of the action.

We call aim how the individual's intention manifests itself in these four components.

For the individual, the intention to act is generated by the project to represent a geometric object by a graphical object (e.g., tracing a straight line). This project corresponds to the semiotic aim of the action. This intention is part of the semiotic component, focused on the action effects (geometric object or graphical object) and is independent of the working environment and instruments to be used. It involves geometric knowledge about objects, relationships and properties.

The project to represent a geometric object leads to elaborate the project of an action with a technical tool. The technical-figural aim of the action consists of the intention of executing the action to be performed this time taking into consideration the instrument in order to obtain the graphical object. But it remains a step of a technical construction developed theoretically by the individual, regardless of practical aspects of implementation concerning body's abilities and the hardware features of the technical tools. For instance, in paper-pencil environment, the three following elementary actions can be considered: taking the instrument, positioning the instrument, drawing. (e.g., drawing a line through two given points leads to: taking a ruler and a pencil, positioning the ruler on the two points, making sure to leave a portion of the ruler beyond each point, drawing a line along the ruler edge with the pencil, starting before one of the point and finishing after the other). Such a construction involves technical knowledge about the instrument functionality, its use to get the graph and the theoretical relationship between the graphical trace and part(s) of the instrument. For example, a ruler edge enables to draw a straight line. For that purpose, the ruler edge must be placed on the site of the wanted line before drawing the line. Moreover, the aforementioned construction also involves semiotic knowledge about the links between the geometrical objects or properties and their graphical representations (a line is represented by a straight line whose length does not matter, the line may be extended on both sides, the line is infinite: just a part of it may be represented, when you draw a line through two points, the line that you draw must go beyond these points). The construction thus relies on geometrical knowledge carried by the instruments (a line is defined by two points, a line is infinite).

The intention to act generates a motor intention, which leads to carry out in practical terms the project of the action with instrument. The motor manipulation aim of the action relates to corporeal aspects of the action to be performed with the instrument: movements to grasp the instrument and body manipulation with instruments (body posture, hands position, press hold, speed, etc.). In the previous example, motor manipulation relates to movements to grasp the ruler and the pencil, movements to position the ruler (successive adjustments by sliding the ruler held with the two hands or placing the pencil's mine at one precise point, put the ruler against the mine and make it pivot to the other point). Furthermore, the individual must maintain the ruler with the non-dominant hand, fingers wide apart in the middle of the ruler, without protruding over the edge, while the dominant hand draws along. At last, a stronger pressure of the non-dominant hand must be done. Such a contextualized construction involves specific praxis skills: it is up to the individual to organize and coordinate his/her movements in time and space in order to carry out the expected action. Practical skills are required too: the individual has to be able to carry out practical knowledge to efficiently handle technical tool considering its hardware features.

A part of the motor intention is in the organizational component too. The organizational aim of the action consists of the conception of the elementary actions organization in the working environment. The individual should be able to plan basic actions. At the same time he/she must cope with the organization of those actions according to a defined plan in order to promote the realization of the complex action project. Moreover, this organizational component is constituted of necessary interactions between the individual and the artifacts of his/her working environment to establish good conditions to obtain a graphical object: searching and finding or borrowing the technical objects (e.g., a ruler), making them fully operational (e.g., take the ruler out of its bag, sharpen the pencil), having a flat working place (e.g., positioning the working sheet correctly -not half on the notebook, half on the table). Organizational skills are required: the individual has to be able to plan and to organize basic actions in order to promote complex actions achievement. Visuo-spatial skills are involved in the motor intention of the individual about the implementation of the action: he/she must mentally anticipate the spatial dimensions and the relative position of the graphical objects, artifacts and body in the environment.

At last, intention to act and motor intention lead to the decision to implement the action: the individual can choose to do the action with instrument mentally or in concrete terms. The previous components of action with instrument are summarized in Figure 1.

APPLICATION OF THE THEORETICAL FRAMEWORK

The technical-figural aim and the semiotic aim of the action (the intention, the project, the decision) are conscious for the individual and dyspraxic pupils have no problem in this respect. The other two aims (motor manipulation and organizational) are automatic for the standard individual, whereas they are not for the individual with dyspraxia, despite the repetition and training, which leads him/her very often to failure in the effective implementation of his/her actions (see an example of constructions realized by a dyspraxic pupil in Figure 2). We therefore suggest abandoning these practical aspects of the action (organizational and motor manipulation), which have no contribution in terms of geometric knowledge, and focus on the technical-figural component of the action representation, by using the language skills of the dyspraxic pupil, through pair work, where the actual manipulation is carried out by the other pupil. In this context of oral communication, the dyspraxic pupil is brought to give instruction pertaining to the technical-figural component to whoever is realizing the actions with instruments. She/he can do it in a verbal language, accompanied by gestures.

Graphic knowledge

Language

In our study, we consider different languages to communicate about the action with instrument based on the individual's aims: semiotic, technical-figural, motor manipulation and organizational.

In the semiotic component, we have two kinds of verbal language. First, the geometric language consists of the mathematical tongue with its lexicon and its specific expressions [START_REF] Laborde | Langue naturelle et écriture symbolique : deux codes en interaction dans l'enseignement mathématique[END_REF], for example: "circle with centre A and radius r," "line constructed through a point and parallel to another line," etc. This language aims to define geometric objects, relationships and properties. Second, the common language consists of lexicon on spatial relationships (e.g., obliquely, next to, above) and on graphical objects (e.g., a stroke, a cross). This language aims to define graphical objects and their spatial relationships.

In the technical-figural component, we define the geometric technical language and the common technical language. The former uses a geometric lexicon; the latter uses a common lexicon. These languages are used to inform about the actions to be performed with the instruments in order to obtain the graphical representations of the geometric objects in question: these actions are related to unexpressed geometric properties (for instance: put the ruler over the two points, as opposed to: draw the straight line passing through the two points).

In the motor manipulation component, the language expresses corporeal action to be performed with instruments in order to obtain graphical objects in practical terms. (e.g., "Hold your compass by the top, not by the legs!" "Press more on the ruler than on the pencil!")

In the organizational component, the language relates to peripheral actions (to the principal action with instruments) and to temporal organization of the action with instruments. This language uses a common lexicon with time indicators as "first," "then," "after," "to begin," "to continue," "to finish," etc.

Gestures

Gestures can complement or reinforce the oral language in communication. Moreover, according to [START_REF] Mcneill | Hand and Mind : What gestures reveal about thought[END_REF] gesture plays a role in the process of conceptualization, not just in communication:

"gestures, together with language, help constitute thought" (McNeill, 1992, p. 245). We call mathematical gestures any body movement, spontaneous or deliberate, performed in the air or on a support, and in relation to the geometric activity. We consider the following gesture categories, in support of communicative gestures [START_REF] Kendon | The significance of gesture: how it is achieved[END_REF][START_REF] Mcneill | Hand and Mind : What gestures reveal about thought[END_REF]: deictic, mimetic, iconic, metaphoric and beats. These gestures play a role not only in communication but also in the process of conceptualization, by allowing the pupil for example to convey information that he/she is not yet able to express in a purely verbal manner. Thus, these gestures are bearers of geometrical knowledge.

The gesture is deictic when the finger moves along or points a graphical object or part of an instrument. This gesture is prototypically performed with the pointing finger, although any body part or manipulated artifacts can be used. For example, on Figure 3, you can see deictic gestures: left, in the motor manipulation aim, the finger is pointing the right place where the compass has to be held; in the middle, in the technical-figural aim, the pencil is moving along set square right-angle sides, then is moving along the straight line (d) and is pointing the point A (in order to construct the perpendicular line to the line (d) through the point A); right, in the semiotic aim, the finger is moving along the symmetry axis.

Motor manipulation aim Technical-figural aim Semiotic aim The gesture is metaphoric in the semiotic aim when it expresses a mathematical concept. This type of gesture, closely related to mimetic and iconic gestures, exhibits decontextualized images of abstract concept. The same gesture may refer both to the activity with the instrument, their meanings are personal and related to the experience of the individual, but also to the geometric concept represented thanks to the construction with instruments. As a consequence these gesture can be considered as a pivot sign that mark a process of generalization [START_REF] Bartolini Bussi | Semiotic mediation in the mathematics classroom : artifacts and signs after a Vygotskian perspective[END_REF]. For example, on Figure 6, you can see metaphoric gestures: left, gestures with fingers represent the conservation of length property; right, gestures with the hands represent symmetrical figures. These gestures can be based on mimetic gestures, the former for using compass and the latter for folding a sheet along a line in order to see the superposition of symmetrical figures. Beats are gestures that emphasize off-propositional relations. These gestures are mere flicks of the hand(s) up and down or back and forth that give rhythm to the speech. For example, on Figure 7, you can see beats that emphasize geometric properties to be taken into account to trace the symmetric of a point with respect to an axis, using set square and compass. skills (practical, praxical, organizational, visuo-spatial) involved in component of the action. Then, we have distinguished language and gesture linked to each of them.

Our theoretical framework allows us to envision a teaching method, which is likely to lead a pupil with visual spatial dyspraxia towards geometric learning. Our hypothesis is that the dyspraxic pupil is able to go through a process of conceptualization in geometry without handling tools by him/herself, but rather by guiding someone else using a defined appropriate technical language, accompanied by mathematical gestures, in a pair-work setting. Previous experimentation out of the classroom with a dyad of fifth-graders'pupils (one dyspraxic and the other standard) allowed to see that the dyspraxic pupil is able to reason and to solve geometric problems within a context of oral communication with a peer or with a school special education assistant when he/she is freed from any organizational and motor manipulation tasks [START_REF] Petitfour | Enseignement de la géométrie à des élèves en difficulté d'apprentissage : étude du processus d'accès à la géométrie d'élèves dyspraxiques visuo-spatiaux lors de la transition CM2-6 ème[END_REF]. We are currently leading experimentations in order to test our teaching method in the classroom.

Figure 1 :

 1 Figure 1: Actions with instruments

Figure 2 :

 2 Figure 2: Left, a square construction; right, a rhombus construction

Figure 3 :Figure 4 :Figure 5 :

 345 Figure 3: Examples of deictic gesturesThe gesture is mimetic when the handling of the instrument is mimicked. For example, on Figure4, you can see mimetic gestures: left, in the motor manipulation aim, right and wrong hand positions to draw along the ruler; right, in the technical-figural aim, mime of using the compass in order to draw a circle.Motor manipulation aim

Figure 6 :

 6 Figure 6: Examples of metaphoric gestures (semiotic aim)

Figure 7 :

 7 Figure 7: Examples of beats


L Kamgaing Souop

A Daidie
email: alain.daidie@insa-toulouse.fr

Y Landon
email: yann.landon@univ-tlse3.fr

J Senatore
email: johanna.senatore@univ-tlse3.fr

M Ritou

Investigation of aluminum alloy properties during helical roller burnishing through finite element simulations and experiments

Keywords: Helical roller burnishing, Residual stresses, Hardening, Finite element method, Aluminum alloy

Industry is always looking for ways to increase the lifetime of assemblies, especially the fatigue lifetime, from the production phase of fastening holes onwards. Helical roller burnishing is presented here as an innovative mechanical surface treatment. Applied directly after orbital drilling, this technique induces superficial plastic strains that reduce surface roughness and increase hardening and compressive residual stresses. Several studies on 3D finite element models of burnishing have been carried out but they are very time-consuming. In this review, a comparative numerical study of helical burnishing (in terms of calculation time and results on residual stress) between one 3D and two 2D plane strain finite element simulations is performed on 2024-T351 aluminum alloy drilled parts. The impact of the process operating parameters is also investigated. This comparison shows fairly similar results regarding the residual stress profiles but levels are rather different. This could be explained by the kinematics of complex helical roller burnishing, which is strongly three-dimensional. The numerical results of one of the cases studied reveal compressive residual stresses of around -100 MPa and -490 MPa in the radial and circumferential directions of the hole, respectively. Burnishing depth and spindle rotation speed have a great impact on the final residual stress profiles. These simulations are then confronted with experimental results obtained during tests carried out using an orbital drilling unit (ORBIBOT). This demonstrates the interest of the modeling implemented and also points out ways to improve the models developed.

Introduction

Orbital drilling (or helical milling) is a hole-making process in which a milling tool moves along a helical path while spinning on its axis (Figure 1a). It has become increasingly popular in hole drilling processes, particularly in the aerospace industry. Compared to conventional drilling, orbital drilling has proved to be particularly advantageous to achieve aeronautical-quality drilling through complex assemblies of metallic materials in a single operation [START_REF] Iyer | Helical milling: An enabling technology for hard machining precision holes in AISI D2 tool steel[END_REF] [2] [START_REF] He | Helical milling of CFRP/Ti-6Al-4V stacks with varying machining parameters[END_REF]. However, this process needs to be improved, mainly in terms of the mechanical properties of the drilled parts. In fact, the enhancement of fatigue lifetime is constantly requested for drilled parts. This is generally achieved by the production of compressive residual stresses and hardening in the surface layers of parts. Several authors [START_REF] Yen | Finite Element Modeling of Roller Burnishing Process[END_REF] [5] [START_REF] Wagner | Mechanical surface treatments on titanium, aluminum and magnesium alloys[END_REF] [7] [START_REF] Balland | Mechanics of the burnishing process[END_REF] have shown that burnishing introduces compressive residual stresses, and improves the roughness and the hardening of parts. Delgado et al. also noted that roller burnishing gives a better state of residual stresses and hardening compared to shot peening and laser shock peening [START_REF] Delgado | State of the art of Deep Rolling[END_REF]. Hassan and Al-Bsharat have shown that burnishing increases the fatigue life of aluminum pieces [START_REF] Hassan | Improvements in some properties of non-ferrous metals by the application of the ball-burnishing process[END_REF]. As a novel mechanical surface treatment, helical roller burnishing (or orbital roller burnishing) appears to be an excellent solution to the lifetime problem insofar as it can be applied immediately after orbital drilling. The main specificity of this innovative roller burnishing technique lies in the kinematics of the tool. As an orbital drilling tool, the burnisher (which is shaped like a torus) rotates around its own axis and simultaneously describes a helical path around the hole axis (Figure 1b). But the benefits of helical burnishing need to be investigated in depth. A 3D finite element simulation of conventional roller burnishing has been carried out by Balland et al. and the results (in terms of geometric state of the surface and residual stresses), obtained in a reasonable simulation time, demonstrate the possibility of using this type of modeling as an efficient replacement for 2D plane strain finite element simulation, which is rather limited and approximate [START_REF] Balland | An investigation of the mechanics of roller burnishing through finite element simulation and experiments[END_REF]. Nevertheless, the simulation time is still considered as huge and the results are in only qualitative agreement. Thus, in this review, a comparative numerical study (in terms of calculation time and results on residual stress) between one 3D and two 2D plane strain finite element simulations is performed first of all. The impact of operating parameters (burnishing depth, spindle rotation speed) is then studied. These simulations are finally confronted with experimental results. All these studies were performed on 2024-T351 aluminum alloy drilled parts using the finite element software ABAQUS ® . 2 Finite element modeling of helical roller burnishing process

Geometry, material characterization and modeling

As mentioned earlier, we first simulated a 3D model on the one hand and two 2D models (which are very time cost effective) on the other. It is important to start by precisely defining the different interactions that occur in the planes involved. Figure 2-a represents the directions of the different forces on a half hole during orbital burnishing. Figures 2-b and2-c show the decomposition of orbital burnishing kinematics and forces in the 2 planes where 2D models were run. The purpose here is to compare the results obtained by the 2D and 3D models and to assess whether they are reliable. The 3D model was used to give the radial, orthoradial and axial residual stresses ( R , ,  Z ) while the first 2D model gave radial and orthoradial residual stresses ( R , ) and the second 2D model gave axial residual stresses ( Z ). In order to further reduce computation time, all these simulations were run on a portion of the hole (one eighth). Mathurin has shown that this portion achieves a good compromise between the process studied and the calculation time [START_REF] Mathurin | Etude du processus de vissage par vis autoformeuse et élaboration d'une méthode de dimensionnement adaptée[END_REF]. The length of the specimen considered was 25.4 mm. It was chosen large enough to minimize edge effects. Its thickness was 1 mm. The hole diameter was 6.35 mm and the radius of the helical path was 0.8 mm. In order to study the impact of the burnishing depth, the different tool diameter values were 4.762 mm, 4.79 mm, 4.81 mm and 4.83 mm, which gave burnishing depths "e" of 6 µm, 20 µm, 30 µm and 40 µm respectively. The tool height was 0.6 mm.

(1)

A: Yield stress B: Strain factor C: strain rate factor n: strain exponent

T f : Melting temperature T 0 : Ambient temperature m: temperature exponent
This study was performed on AA2024-T351 aluminum alloy parts. It was fundamental to determine a robust material for the constitutive model so that the strains could be modelled accurately. The constitutive model used for this material is generally a Johnson-Cook model as defined by [START_REF] Iyer | Helical milling: An enabling technology for hard machining precision holes in AISI D2 tool steel[END_REF] [11] [START_REF]Verification of Johnson-cook Material Model Constants of Aa2024-t3 for Use in Finite Element Simulation of Friction Stir Welding and Its Utilization in Severe Plastic Deformation | Welding | Continuum Mechanics[END_REF]. However, the parameters of this constitutive model depend on the type of simulation and the experimental operating conditions used to assess them. As we were using severe plastic deformation and high strain rate process modeling, the following parameters were considered. The tool was made of a tungsten carbide material, which had much greater hardness than our specimen (HV WC =2242 and HV AA2024-T351 =137). It could, therefore, be represented as a rigid body, which brought two main benefits. Firstly, rigid body modelling allowed the tool to be controlled by a single reference point. Then, strains of the tool were not assessed during analysis. All this helped to reduce calculation time drastically.

Like the constitutive model, contact between parts is another very critical criterion in numerical studies. This parameter governs the modeling of the surface interactions of helical burnishing. The contact model usually used is a Coulomb model [START_REF] Balland | An investigation of the mechanics of roller burnishing through finite element simulation and experiments[END_REF] [13] [START_REF] John | An investigation of ball burnishing process on CNC lathe using finite element analysis[END_REF]. Like Balland et al. [START_REF] Balland | An investigation of the mechanics of roller burnishing through finite element simulation and experiments[END_REF], we used a master-slave contact algorithm where the friction was taken into account using a penalty method and a value of 0.2.

Meshing and boundary conditions

In order to obtain a suitable balance between results and calculation time, our models were meshed with different types of elements. In fact, it is important to have a very fine mesh near the domain of contact between parts. Thus, C3D8R elements of 0.02 mm dimensions were used in this area. The domain near the specimen edges was meshed with C3D8R elements of 0.12 x 1.705 x 1.75 mm 3 . The intermediate domain was meshed with C3D4 elements to ensure the link between them (Figure 3-a). The specimens in the two 2D models were meshed with CPE4R elements. As the tool was modelled as rigid, there was no need to mesh it.

The part was embedded on the external edge. This condition allowed material flow along the z-axis. Symmetric conditions along the radial axis were applied on the edge where the tool and the part intersected each other at the beginning; the other edge was free. These boundary conditions were established in accordance with Mathurin's findings [START_REF] Mathurin | Etude du processus de vissage par vis autoformeuse et élaboration d'une méthode de dimensionnement adaptée[END_REF]. He showed that these conditions, although too restrictive, are more realistic than free edge conditions. However, these conditions impose the determination of a region where the results will be observed. Symmetric conditions along the axial axis were also applied on the top and bottom edges of the part. Figure 3-b shows all these boundary conditions.

On the tool, we applied the following boundary conditions: -= 40 mm/min (Axial feed V fa ) -N orb = 1000 rpm (Orbital velocity) -VR3 = 40000 rpm and VR3 = 0 rpm (Spindle velocity N). Two velocity values were selected to study the impact on the results. In order to reduce calculation time still further, we just simulated 3 passages of the tools at the surface middle plane. The experimental study was done with a CNC machine (DMG DMU85eVo) equipped with an ORBIBOT orbital drilling unit (Figure 4). Before helical burnishing was executed on the aluminum alloy specimens, they were previously drilled with a 6.35 mm diameter hole. The burnishing depth was 10 µm and the operating conditions were V fa = 40 mm/min, N = 40000 rpm, Norb = 1000 rpm. The orbital rotation was clockwise and the process was conducted without lubrication. The CNC machine was also equipped with a Kistler 9257B measurement system (which measures helical burnishing forces). The software used for data acquisition and processing was WITIS.

Results and discussion

Simulations were run on a computer having 32 GB RAM and an Intel® Xeon® CPU of 1.70 GHz (2 processors). The mean values of simulation calculation time are shown in the table below: It can be seen that the three-dimensional models need several days while the twodimensional ones only need a few hours. This could be very helpful regarding the study of different operating conditions (burnishing depth, spindle and orbital velocities, axial feed, etc.). Despite the fact that the stress levels obtained with 3D and 2D models are quite different, the stress state profiles around the hole are nevertheless quite comparable. The differences in stress levels could be explained by the complex kinematics of the tool during orbital burnishing. The hypotheses of plane strains (especially the plane stress hypothesis in the first 2D model) cannot be used despite the fact that the dimensions of the parts are large. In fact, the axial component of the kinematics might not be negligible in comparison with the radial and orthoradial components. An axial speed decrease could reduce the axial force, thus bringing the predictions of these hypotheses closer to observations. Further modeling in this direction should provide more information.

Comparison between 2D and 3D models

Impact of operating conditions

-Impact of burnishing depth We observe that the levels of radial residual stresses increase with the burnishing depth. The conclusion seems to be the same for orthoradial and axial residual stresses. Moreover, the position of the compressive peak and the domain in compressive residual state also increase with the burnishing depth. This can be explained by the high strain rates generated with the increase of the burnishing depth: the greater the depth, the greater the pressure and the greater the strains. But the last observation needs to be investigate more thoroughly by refining the meshing of the part. In fact, the curve obtained for e = 40 µm appears to be more accurate (more defined points) because this model mesh was less coarse over a certain distance from the hole.

-Impact of spindle speed Figure 7 shows the highest compressive residual stresses for 2 spindle velocities (N = 0 rpm and N = 40000 rpm).

Fig.7. Impact of spindle velocity on residual stresses

The spindle velocity suppression leads to a smaller residual stress, especially in the orthoradial and axial directions. This could be explained by the greater friction of the tool when the spindle velocity is zero (The tool slips intensively on the borehole). This hypothesis could be confirmed by using a kinetic instead of a static friction law in future models. It would have been preferable to compare all these numerical results with the experimental ones in terms of residual stresses. However, because the residual stress assessment relies on techniques that are rather difficult to set up, we firstly investigated this comparison in terms of global data (burnishing forces). We noted a slight overestimation of numerical forces (70 N vs 25 N). In addition, a considerable amount of material was observed to adhere to the tool during experiments (Built Up Layer). Figure. 9 presents the burnisher outlines before and after helical burnishing (height variation Z with position on the burnisher revolution axis l), obtained with an optical profilometer (Alicona InfiniteFocus SL). The Built-Up Layer indicates a large temperature increase and strong friction. This could explain the difference in the levels of forces between experiments and modeling. It would be interesting to refine thermal effects and define a more suitable friction model in future models. Nevertheless, the experimental residual stress measurements remain the best way to correlate all our numerical results. This operation is planned.

Burnishing forces

Conclusion

We carried out a numerical study of the helical burnishing process on an AA2024-T351 aluminum alloy specimen. First of all, a comparison was made between two 2D plane strain models and a 3D model. This was done with a view to significantly reducing the calculation time of the simulations. The different geometries and assemblies of our model were implemented in ABAQUS™ software, then a Johnson-Cook constitutive model and a rigid body were used to represent the part and the tool, respectively. The contact model defined between these two parts was a Coulomb model with friction penalty µ = 0.2. The results obtained showed that the 2D models were much more cost-effective than the 3D one (2 hours against 4 days). But the levels of residual stresses acquired with the 2D models were lower than those obtained with 3D despite the fact that outlines were comparable. An axial feed reduction might be helpful in strong deformation strain hypotheses. In all cases, these results show that helical burnishing introduces compressive residual stresses into surface layers. We also noted that the operating conditions had a marked impact on the levels and depth of compressive residual stresses. The greater the burnishing depth was, the higher were the levels of compressive residual stresses and the greater were the depths they reached. However, numerical burnishing forces did not agree well with experiments: burnishing without lubrication exhibited thermal and tribological impacts which should be refined in modeling (material conductivity, specific heat, kinetic friction law). To obtain a more accurate contact model and thermal effects, tribological and temperature measurement experiments are planned. It will also be important to investigate the impact of other operating conditions (axial feed, direct or clockwise spindle rotation, etc.). Nevertheless, it is important to compare these numerical studies with experimental measurements of residual stresses obtained by helical burnishing, with a view to validating the models.

Fig. 1 .

 1 Fig. 1. Schematic drawing of orbital drilling (a) and helical roller burnishing process (b)

Fig. 2 .

 2 Fig. 2. Decomposition of orbital burnishing kinematics

Fig. 3 .Fig. 4 .

 34 Fig. 3. Helical milling: mesh (a) and boundary conditions (b)

Figure 5

 5 Figure 5 compares residual stresses obtained with our different models for a burnishing depth e = 40 µm and a spindle velocity N = 40000 rpm.

Fig. 5 .

 5 Fig. 5. Comparison of radial (a), orthoradial (b) and axial (c) residual stresses between 3D and 2D models for e = 40 µm and N = 40000 rpm

Figure. 6

 6 Figure. 6 shows the residual stresses obtained for different burnishing depths for a spindle velocity N = 40000 rpm.

Fig. 6 .

 6 Fig. 6. Impact of burnishing depth on radial (a), orthoradial (b) and axial (c) residual stresses

Figure. 8

 8 Figure. 8 shows the helical burnishing forces obtained numerically and experimentally (axial forces Fz and normalized transversal forces Fxy). Numerical forces are represented only on one tool pass because simulations were not done on the total hole height and circumference.

Fig. 8 .

 8 Fig. 8. Helical burnishing forces: experimental (a) and numerical (b)

Fig. 9 .

 9 Fig. 9. Burnisher outlines before and after helical burnishing

Table 1 .

 1 Material constants for the Johnson-Cook strain rate dependent yield stress[START_REF] Johnson | A constitutive model and data for metals subjected to large strains, high strain rates and high temperatures[END_REF]

	A (MPa)	B(MPa)	C	n	(s -1 )	T f (K)
	265	426	0.015	0.34	10 3	775

Table 2 .

 2 Time calculation for the different models

	Model	3D	2D plane strain_1	2D plane strain_2
	Calculation time	4 days 10 hrs 13 min	46 min 17 sec	2 hrs 07 min 18 sec

Acknowledgments

This work was carried out within the framework of the RODEO project, which received funding from the Clean Sky 2 Joint Undertaking under the European Union's Horizon 2020 research and innovation program, grant agreement No 738219. The authors are grateful to all the project participants for their support: PRECISE France, MITIS Engineering, KUKA Systems Aerospace France.


Olivier Las Vergnas

autour de l'apprenance » (2016-2) de la revue Education permanente, revue classée ACL http://www.education-permanente.fr/public/articles/articles.php?id_revue=1739 Résumé : Les spécificités du bac scientifique font que de nombreux adultes se sentent incapables d'explorer toute question liée aux sciences scolaires. Les effets de cette catégorisation scolaire peuvent être décrits en considérant une apprenance « en général » et un spectre d'« apprenances » thématiques, selon deux approches empiriques complémentaires : la mise en évidence d'un déficit thématique d'apprenance a posteriori ; l'étude de « déviants positifs » qui, malgré leur catégorisation scolaire initiale, s'approprient des savoirs scientifiques, comme certains malades chroniques ou scientifiques amateurs. ___________________________________________________________________________ L'enseignement secondaire est en partie fondé sur une catégorisation des jeunes en scientifiques ou non. Cette catégorisation scientifique scolaire (CSS) a des conséquences en termes de compétences, de pouvoir d'agir ou de résolution de problèmes. Cet article se focalise sur les méthodes et outils d'exploration de celles-ci pour un adulte, en particulier en termes de variation thématique de leur apprenance, au sens introduit par Carré (2005), comme nouveau moyen de décrire un « rapport au savoir ». Deux approches symétriques sont développées : l'une consiste à étudier les obstacles dus à la CSS et l'autre les conditions de leur dépassement.

La catégorisation des lycéens en scientifiques ou non

La catégorisation scientifique scolaire (CSS) et les obstacles en résultant

Avec le rôle ambivalent tenu par la filière S, l'enseignement secondaire français mélange les fonctions de formation aux sciences algébriques et la gestion d'une filière d'excellence. Chaque année, seuls 25% de chaque classe d'âge obtiennent ainsi le droit d'être déclarés « scientifiques » au niveau du baccalauréat (RERS, 2014). En d'autres termes, le système éducatif juge et déclare non compétente en « Sciences » la majorité de chaque classe d'âge, d'autant que de nombreux élèves sont écartés de la filière S par des notes insuffisantes en Maths. Ainsi, pour une grande partie des non reçus au Bac S, les obstacles cognitifs (Bachelard, 1938) sont-ils doublés de deux autres, liés à cette sanction d'incompétence et qualifiables de « conatif » et « scholastique » (Las Vergnas, 2011). L'« obstacle conatif » exprime le fait que des individus se sentent incapables de traiter d'une question de nature scientifique, à cause de la sanction d'inaptitude reçue lors de leur vécu scolaire antérieur. En référence au « sentiment d'efficacité personnelle » (SEP) introduit par [START_REF] Bandura | Auto-efficacité[END_REF], on peut émettre l'hypothèse que l'obstacle conatif s'apparente à un « sentiment d'inefficacité personnelle » (SIEP) vis-à-vis de ce qu'on a appris à appeler « sciences » au collège ou lycée.

L' « obstacle scolastique » permet de décrire le fait que la « relation à la science » d'une action conduite par la personne est masquée à celle-ci, scotomisée ; cet obstacle apparait chez des adultes pour qui la qualification de « scientifique » ne peut être attribuée qu'à ce qui leur rappelle les disciplines scientifiques scolaires. Il empêche l'individu de voir que certains des résultats positifs qu'il obtient ont un rapport avec des capacités qualifiables de « scientifiques ».

La CSS est un fait social total

D'un point de vue sociologique, la CSS, est indubitablement un fait social total, mécaniquement lié à la répartition des résultats aux diplômes du secondaire, renforcé par la faible volumétrie des trop rares filières hybrides et le rôle de filière d'excellence du Bac S. Cette CSS génère plusieurs autres effets observables à l'échelle sociétale : certains en sont des conséquences directes, comme les difficultés systématiques de la majorité des non Bac S à envisager d'utiliser tout formalisme algébrique même rudimentaire ; d'autres sont des conséquences secondaires, comme la vaine répétition de discours sur une présumée désaffection des sciences et la nécessité de la compenser par des politiques de « culture scientifique et technique [qui doivent être portées au niveau d'] une priorité nationale » [START_REF] Blandin | La culture scientifique et technique, une priorité nationale, Sénat Brewer, S[END_REF] ou d' « un impératif » (Olivier et Leleux, 2014) d'où découle l'institutionnalisation de ce champ de pratiques (Las Vergnas, 2012).

Les obstacles affectifs ont bien été mis en évidence

Dans le monde anglophone, de nombreux auteurs utilisent une échelle « d'anxiété en mathématique » [START_REF] Suinn | The mathematics anxiety rating scale, a brief version[END_REF] et ont montré que ceux qui y atteignent un haut niveau d'anxiété « obtiennent de moins bons résultats et tentent d'éviter les maths ou les situations qui y ont trait, ce qui peut les faire renoncer aux cours de maths ou même à des cursus entiers à cause des maths ». (Lyons et Beilock, 2012, trad. personnelle) ; plusieurs auteurs français ont aussi montré l'existence d'obstacles affectifs [START_REF] Nimier | Les Modes de relations aux mathématiques[END_REF][START_REF] Baruk | Echec et maths[END_REF] dans des travaux d'orientation thérapeutique. [START_REF] Klinger | Challenging negative attitudes, low self-efficacy beliefs, and math-anxiety in pre-tertiary adult learners. Connecting voices: Practitioners, researchers & learners in adult mathematics and numeracy[END_REF] indique que, même s'il y a eu peu de travaux sur les attitudes des adultes visà-vis des maths, « la peur de l'échec induite par certaines pratiques d 'enseignement et d'évaluation [a été relevée par Singh(1993)] comme cause de l'anxiété chez les adultes ». Klinger complète ce constat par sa propre synthèse des effets du vécu scolaire :

« Les conceptions mathématiques peuvent être fortement influencées par les expériences de l'école primaire et les attitudes des parents ; de premières expériences d'apprentissage traumatisantes étant capables d'exercer un effet à long terme de sorte que beaucoup se perçoivent dès un âge précoce comme non-matheux ce qui conduit à une absence de motivation. [...] Les opinions négatives sur les maths l'emportent clairement au cours de la scolarité et, en l'absence de preuve contraire, il ne fait guère de doute que les enfants conservent leurs points de vue à l'âge adulte et dans la population plus large. » (p.165-166) L'existence d'un obstacle conatif est donc avérée et dans la même publication, Klinger poursuit en indiquant que ses propres travaux confirment que les attitudes négatives, le manque de SEP et l'anxiété mathématique des adultes sont « fortement influencés par les expériences d'apprentissage précoce ».

En revanche, n'a pas vraiment été mis en avant le lien que cet obstacle entretient avec le caractère total, incontournable de la CSS. On peut cependant faire l'hypothèse que la corrélation entre SEP des adultes vis à vis des mathématiques et expérience scolaire antérieure est largement amplifiée par la représentation d'une frontière qui ferait que l'on sera -à vied'un côté ou de l'autre, renvoyant à l'image d'Épinal d'une « bosse des maths ».

L'apprenance, un analyseur des effets individuels de la CSS

Plusieurs travaux en cours s'appuient sur la comparaison d'adultes susceptibles d'avoir développé des rapports aux sciences différents : ils cherchent des corrélations entre des variables potentiellement explicatives de ces différences. Leur point de départ est que l'apprenance, définie comme « un ensemble de dispositions […] favorables à l'acte d'apprendre » [START_REF] Carré | L'apprenance, vers un nouveau rapport au savoir[END_REF] peut, tout en restant durable d'un jour à l'autre, se révéler plus ou moins développée chez une même personne en fonction de grandes thématiques, dès lors que complète la définition « à l'acte d'apprendre… dans tel domaine ». Cette apprenance pourrait ainsi être systématiquement plus élevée pour ce que la personne a identifié durablement comme étant un centre d'intérêt et/ou de SEP que pour d'autres domaines qui lui paraitraient ennuyeux ou pénibles.

Ces travaux menés par l'auteur et certains de ses doctorants visent ainsi à objectiver des écarts thématiques d'apprenance qui résulteraient d'un « trou de SEP » lié à la mémoire de la sanction scolaire, qui l'aurait en quelque sorte « brulé ». Ils s'appuient sur l'échelle de mesure d'apprenance qui a été définie et testée en particulier par Jore (2012) que nous thématisons afin de mesurer les apprenances spécifiques et de distinguer une mesure de l'apprenance « en général » d'une mesure de l'apprenance « pour des sujets liés aux sciences ».

Deux voies symétriques

Concrètement, deux approches empiriques symétriques sont utilisées, la première se proposant de décrire au mieux les contours de l'obstacle conatif tandis que la seconde cherche à mettre en évidence des moyens de le contrebalancer, c'est-à-dire de voir en quoi certaines motivations peuvent faire que certains adultes non scolairement scientifiques se révèlent malgré cela spécifiquement impliqués dans des activités réflexives qualifiables de « scientifiques ».

La mise en évidence d'un déficit thématique d'apprenance

L'hypothèse est simple : les personnes victimes de l'obstacle conatif ont une apprenance en matière de sujets « scientifiques » ou technoscientifiques plus faible que leur apprenance en général, d'où l'idée de parler d'un « spectre d'apprenance » avec lequel on peut balayer les différentes thématiques et les comparer avec l'apprenance « en général » : on cherche ainsi des trous dans le spectre des intérêts : des points aveugles, des zones où la curiosité aurait été « brulée », dégoutée de manière durable.

Cette question est en exploration selon trois angles complémentaires, celui de la reprise d'études par des adultes au Cameroun, par Temkeng (en cours), celui de l'allergie à la formulation algébrique par Kubryk (en cours) et enfin celui du caractère localisé des compétences de calculs pour des jeunes du dispositif avenir jeunes par Ben Nejma, (en cours). Ces travaux étant en cours, il est prématuré d'en présenter ici des résultats, mais on peut néanmoins indiquer qu'ils confortent l'utilisation d'échelles thématisées : ainsi, les premières analyses factorielles des questionnaires de Temkeng indiquent que l'apprenance scientifique d'adultes reprenant des études au Cameroun est fortement corrélée à leur passé scolaire et non à leur apprenance en général.

La recherche d'intérêts en déviance de la CSS

Cette idée est symétrique à celle de l'étude des déficits dans le spectre d'intérêt ou d'apprenance. Plutôt que d'observer les modalités et les caractéristiques du présumé désintérêt dû à la CSS, il s'agit de chercher des personnes qui développeraient, malgré la CSS, des activités qualifiables de scientifiques et d'étudier leurs caractéristiques. Cette méthode est une transposition de l'approche par la « déviance positive » appliquée en intervention sociale par [START_REF] Singhal | Transformer l'éducation de l'intérieur. Développer l'apprentissage et la mémorisation par la déviance positive[END_REF].

Là aussi, le point de départ est simple : un ensemble de motivations pourrait chez certaines personnes annuler les obstacles résultant de la CSS ; les étudier permettrait de décrire en quoi consistent vraiment ces obstacles en voyant ce qui peut les annuler. Pour analyser ces profils d'engagement, le modèle des « déviants positifs » (DP) permet d'identifier puis de décrire de tels « non-scientifiques » au sens scolaire, qui en dépit de la CSS s'investissent dans des situations où ils vont s'approprier des savoirs scientifiques et les résoudre avec des problèmes qualifiés (au moins académiquement) de scientifiques.

Les apprenances générale et thématique sont aussi à invoquer dans ces études comme variables potentiellement explicatives, au même titre bien sûr que celles décrivant l'environnement et que les caractéristiques socio-culturelles. En général, les variables de sortie sont celles qui permettent l'analyse de l'action et éventuellement de l'efficacité des apprentissages ou des résolutions de problèmes. Si la déviance positive s'est suffisamment installée dans la durée pour avoir fait un peu évoluer des apprenances thématiques, celles-ci peuvent être aussi des variables de sortie, étudiées longitudinalement dans le temps. Dans ces cas, le spectre d'apprenance (et ses éventuels trous) peut être à la fois en partie prédicateur et conséquence de telles déviances positives.

Deux études vont ainsi être mises en place par l'auteur selon le même protocole, l'une vis-àvis d'astronomes amateurs et l'autre vis-à-vis de malades impliqués dans des associations.

Les rapports à sa santé, un champ propice

En attendant ces résultats, des indications provisoires peuvent être tirées de l'observation du paysage des DP, en considérant une typologie 1 d'engagement scientifique en quatre niveaux : (DP1) curieux occasionnels ; (DP2) autodidactes pérennes, abonnés ou membres actifs de clubs ou réseaux ; (DP3) pratiquants associés comme exécutants à des recherches collaboratives, mais ni au protocole ni aux conclusions ; (DP4) coopérateurs, reconnus comme co-chercheurs par des interlocuteurs académiques.

Ces DP4 sont peu nombreux. On en rencontre dans trois circonstances :

(1) la pratique de sciences traditionnellement « à amateurs » (astronomie, entomologie …), (2) l'implication de malades chroniques dans un réseau d'échange contribuant à une auto clinique collective, (3) l'implication de militants dans une recherche d'épidémiologie populaire [START_REF] Brown | Retour sur l'épidémiologie populaire[END_REF], par rapport à un problème de pollution, de risque alimentaire ou de défense de la biodiversité. Cependant, même s'ils sont « amateurs », de nombreux pratiquants des loisirs scientifiques se révèlent en fait ne pas avoir été classés « non scientifiques » dans le secondaire. C'est donc plus dans les catégories des malades (2) et des militants de l'épidémiologie populaire (3) que l'on rencontre des « vrais » DP4, pour lesquels la réflexivité se nourrit simultanément des expériences et des savoirs expérientiels des profanes et des savoirs cliniques ou académiques des scientifiques [START_REF] Jouet | Nouvelles coopérations réflexives en santé[END_REF]. Ainsi ces « vrais » DP4 s'observeraient surtout quand une motivation intrinsèque est d'intensité suffisante pour contrebalancer l'obstacle conatif, ce qui renvoie à l'idée de besoin vital de savoirs.

Concrètement, le champ de sa propre santé (qu'elle soit bonne ou dégradée par une maladie chronique) constitue donc un lieu pertinent d'observation des effets de la CSS. Dans les représentations des malades et proches, les problèmes posés et à résoudre sont certes liés au registre scientifique, sans pour autant être trop formellement arides. Les motivations intrinsèques à aller mieux (ou ne pas aller plus mal) peuvent y être suffisamment fortes pour contrecarrer l'obstacle conatif.

Mais pour autant, la motivation intrinsèque est loin de suffire pour faire de chacun un DP4. Vicherat (en cours) étudie justement les spécificités des personnes qui au mitan de leur vie prennent soin de leur bonne santé : est-ce par ce qu'elles sont simplement plus apprenantes que les autres ? La recherche est encore en cours, mais on peut faire l'hypothèse que pour qu'une motivation permettre de dépasser l'obstacle conatif, encore faut-il que l'appropriation de savoirs produise des résultats, car alors l'attitude de déviance positive peut soulager et produire du SEP. Encore faut-il aussi que cela soit en accord avec les représentations de ce qui peut être utile de faire ou d'apprendre : si l'on pense que notre maintien en bonne santé dépend avant tout du destin ou des possibilités de la médecine curative, il n'y a que peu d'intérêt à apprendre à s'en préoccuper soi-même au quotidien. L'étude que conduit actuellement Renet (en cours) sur les échanges de savoirs entre malades pulmonaires chroniques et pharmaciens regarde ainsi si l'apprenance en général et l'apprenance pour les questions de santé sont corrélées entre elles et comment l'une ou l'autre joue éventuellement sur ces échanges.

L'apprenance et les autres « rapports à des savoirs spécifiques»

L'apprenance et les échelles associées constituent ainsi des instruments pertinents pour étudier les effets de la CSS sur les adultes, dès lors que l'on considère aussi un spectre d'apprenances thématisées. En les utilisant avec les autres variables descriptives des personnes et de l'environnement, on dispose d'une batterie de variables potentiellement explicatives des activités d'apprentissage, voire de leur efficacité.

Un lien peut être fait avec la typologie des dialogues de phénoménologies établies par l'auteur pour les malades chroniques DP(Jouet et al.

2014, p 118).