Frédéric Cuppens
email: fcuppens@rennes.enst-bretagne.fr

Fabien Autrel
email: fautrel@rennes.enst-bretagne.fr

Yacine Bouzida
email: ybouzida@rennes.enst-bretagne.fr

Sylvain Gombault
email: sgombault@rennes.enst-bretagne.fr

Joaquin Garcia
email: jgarcia@deic.uab.es

Thierry Sans
email: tsans@rennes.enst-bretagne.fr

Anti-correlation as a criterion

Keywords: Computer security, Intruder detector, Information protection, Correlation, Modeling, Logic model. L'ANTI-CORRÉLATION COMME CRITÈRE DE SÉLECTION Sécurité informatique, Détecteur intrus, Protection information, Corrélation, Modélisation, Modèle logique

Contents

I. INTRODUCTION

Current systems that compose distributed computer infrastructures are increasingly vulnerable to intrusions and malicious activities. Several approaches have been suggested to detect such intrusions [START_REF] Bace | Intrusion Detection[END_REF][START_REF] Northcutt | Network Intrusion Detection[END_REF][START_REF] Roesch | Short -lightweight intrusion detection for networks[END_REF]. However, it is generally considered that current intrusion detection systems produce very large volume of alerts, including true alerts but also many false positives (see [START_REF] Cuppens | Managing alerts in a cooperative intrusion detection environnement[END_REF][START_REF] Julisch | Mining alarm clusters to improve alarm handling efficiency[END_REF] for instance). This is why recent research work attempts to understand and model intrusion strategies to provide a more global and precise diagnostic of the intrusion [START_REF] Cuppens | Alert correlation in a cooperative intrusion detection framework[END_REF][START_REF] Ning | Learning attack strategies from intrusion alerts[END_REF]. These approaches are interesting and represent a step in the right direction but detecting intrusion is not sufficient. It is also necessary to develop automated defenses capable of appropriate responses to counter intrusions when they occur.

Several response strategies are possible including launching counter measures against the intruder to prevent his or her malicious activity to proceed or act on the target system to stop the intrusion and recover in a safe state. Direct responses against the intruder is a complex problem that includes several technical difficulties (in particular, it is necessary to precisely identify the origin of the intrusion) and legal and ethic complications (directly acting on the intruder is generally viewed as illegal activities). In this paper, we shall not consider this type of response and actually focus on responses that consist in acting on the target system.

When an intrusion occurs, the appropriate response on the target system generally depends on the type of intrusion being performed. For instance, the response will not be the same in the case of a denial of service (DOS) attack or a user to root (U2R) attack. Thus, our approach is based on a library of responses that contains different types of possible countermeasures which may be launched to stop intrusions. The problem addressed in this paper is to choose the appropriate counter-measure when a given intrusion occurs. This may represent a complex task for the administrator to make such a choice and some support might be useful to help the administrator. It is also necessary to fix the parameters of the response. For instance when the response consists in closing a given connection, the IP addresses of the source and target must be appropriately fixed before launching the response.

In this paper, we suggest an approach to define decision mechanisms to help the administrator to choose, in the response library, the counter-measure candidates when an intrusion occurs and to present them to the administrator with the appropriate parameters to circumvent the intrusion. Once the administrator selects a counter-measure, this counter-measure along with the appropriate parameters is automatically executed to stop the intrusion in the target system.

Our approach is based on a logical formalization of both attacks and counter-measures. This formalism is used to derive, from the attack description (especially the effects of an attack on the target system), one or several counter-measures that may circumvent the attack. (15 ref.) For this purpose, we define the notion of anti-correlation. This notion is used to determine the counter-measures that will have a negative effect on the attack and therefore will enable the administrator to stop this attack.

The remainder of this paper is organized as follows. Section II presents the notion of response and suggests several types of response. In Section III, we present our formalism to model attacks and counter-measures. Our formalism is based on LAMBDA, a language suggested in [START_REF] Cuppens | LAMBDA: A language to model a database for detection of attacks[END_REF] to model attacks. In this section, we also suggest using LAMBDA to model counter-measures. Section IV recalls the definition of correlation [START_REF] Cuppens | Alert correlation in a cooperative intrusion detection framework[END_REF] and introduces the notion of anti-correlation. In Section V, we show how to use anti-correlation to determine relevant counter-measures (1) to act on the objective of an intrusion or [START_REF] Benferhat | Enhanced correlation in a intrusion detection process[END_REF] to cut an ongoing attack scenario by acting on a given step of this scenario. We also present how our approach provides means to parameterize the selected counter-measures. Section VI gives an example to illustrate the approach and presents an intrusion detection platform that includes the response mechanisms suggested in this paper. Finally, Section VII concludes the paper and suggests several possible extensions to our approach.

This paper is an extended version of the previous work presented at SAR 04 [START_REF] Cuppens | Selecting Appropriate Counter-Measures in an Intrusion Detection Framework[END_REF]. In particular, both the intrusion detection framework and the examples given in Section VI have been revised and enhanced.

II. RESPONSE MECHANISM AND COUNTER-MEASURES

Even though some improvements were made recently, current Intrusion Detection Systems (IDS) propose few response mechanisms in addition to alerts and reports. There is only a small variety of response techniques and the decision criteria that are used to activate the response remain often simplistic. Moreover, in a context of exploitation, security administrators generally balk at using the most interesting responses like automatic reconfiguration of firewalls or routers. This is due to lack of confidence in the capabilities of the IDS to take the right decision. Administrators also fear of not controlling the consequences of the automation of counter-measures.

Lastly, the objective of most responses consists in stopping an ongoing attack. More elaborate responses that are effective to automatically correct the detected vulnerabilities, remain marginal.

In [START_REF] Gombault | Response function[END_REF], the following taxonomy of counter-measures was suggested:

-Information: Specific action that raises an alert for the security administrator. This action can be launched after detecting an intrusion of sufficient severity. -Deterrence: Action performed against the intruder so that he or she will be willing to stop his or her malicious activity. For instance, a message sent to the intruder to notify that his or her malicious action were detected is the simplest (but not always effective) form of deterrence. -Correction: Action to modify the system state to correct an identified vulnerability or a system misconfiguration with respect to the security policy. For instance, installing a patch is a form of correction. -Compensation: Action performed to block the attack but without correction. The system is still vulnerable but the response prevents the intruder from performing his or her

We accept this taxonomy but we make a difference between actions that change the state of the system to be protected and other actions that do not cause such a change. In the remainder of this paper, we shall actually consider actions that change the system state, that is correction and compensation. Since information and deterrence have respectively an effect on the security administrator or the intruder, they are not included in our analysis.

To avoid confusion, we make a distinction between the notions of response and counter-measure. In the following, we call counter-measure any action used as a compensation or a correction. Therefore, a counter-measure changes the system state so that the intrusion is stopped. We define response as the decision mechanism used to choose the adequate counter-measure when an intrusion is detected.

Our approach of response mechanism is integrated in the recognition process of the intruder's intentions presented in [START_REF] Cuppens | Recognizing malicious intention in an intrusion detection process, Special session: "Hybrid Intelligent Systems for Intrusion Detection[END_REF]. When an intrusion scenario is identified, we can anticipate on the objective that the intruder attempts to achieve and on the future attack that he or she will perform to achieve it. Thus, a response is an action that modifies the system state to prevent the intruder to achieve his or her goal. As explained in the following section, a goal can be an intrusion objective or a future attack.

III. MODELLING INTRUSION AND COUNTER-MEASURE

In this section, we present our formalism, based on LAMBDA [START_REF] Cuppens | LAMBDA: A language to model a database for detection of attacks[END_REF], to model both intrusions and counter-measures.

III.1. Modelling attack and intrusion objective in LAMBDA

LAMBDA is the acronym for LAnguage to Model a dataBase for Detection of Attacks. It is used to provide a logical description of an attack. This description is generic, in the sense that it does not include elements specific to a particular intrusion detection process.

A LAMBDA description of an attack is composed of several attributes: -pre-condition defines the state of the system required for the success of the attack.

-post-condition defines the state of the system after the success of the attack.

-detection is a description of the expected alert corresponding to the detection of the attack.

-verification specifies the conditions to verify the success of the attack1 . We define an intrusion objective as a specific system state [START_REF] Cuppens | Recognizing malicious intention in an intrusion detection process, Special session: "Hybrid Intelligent Systems for Intrusion Detection[END_REF]. This state is characteristic of a violation of intrusion. For instance, it is possible to stop a vulnerable service, or close the connection between the intruder and the target (using a TCP-Reset), or reconfigure a firewall to block the attack source. the security policy. A LAMBDA description of an intrusion objective is composed by only one attribute: state defines the state of the system that corresponds to a security policy violation.

III.2. How to use LAMBDA

LAMBDA is used to describe possible violations of security policy (intrusion objective) and possible actions (attack) an intruder can perform on a system to achieve an intrusion objective. This database of LAMBDA descriptions is used to recognize an intrusion process and to predict the intention of the intruder. Let us present an example of intrusion modelled with LAMBDA. First, an intruder scans port 139. If it is open, he concludes that the Operating System is Windows and uses the Net-Bios service. The intruder can then execute a Winnuke attack on this target system that will cause a denial of service. Figures 1 and2 respectively give the description in LAMBDA of the Port-Scan and Winnuke attacks performed by an agent on a given host.

Attaque Winnuke réalisée par un attaquant A sur une machine H.

There is a violation of security policy when a web server goes down. This is represented by the intrusion objective presented in Figure 3.

As we can see in these examples, each LAMBDA description uses several variables (corresponding to terms starting with an upper case letter). When an alert can be associated with a LAMBDA description through the detection attribute, we can unify variables with values. We call attack occurrence a LAMBDA description where variables have been unified with values.

III.3. Using LAMBDA to model counter-measure

We suggest adopting the same formalism to model counter-measures. Thus, a counter-measure has similar attributes to an attack. The main difference is that the detection attribute associated with an attack is replaced by the attribute action. This leads to the following model for counter-measures:

-pre-condition defines the system state required for the success of the counter-measure.

-post-condition defines the system state after applying the counter-measure.

-action defines the actions necessary to perform the counter-measure.

-verification specifies the conditions to verify the success of the counter-measure.

IV. CORRELATION AND ANTI-CORRELATION

Our response mechanism is based on recognizing the intruder's intentions. Using LAMBDA, [START_REF] Cuppens | Alert correlation in a cooperative intrusion detection framework[END_REF] shows how to correlate detected attacks to identify a scenario. Section IV.1 recalls the definition for the correlation principle. It is then possible to extrapolate this scenario to predict future attacks that the intruder will probably perform and the objective that he attempts to achieve. When several possible scenarios are extrapolated, [START_REF] Benferhat | Enhanced correlation in a intrusion detection process[END_REF] suggests an approach to define an order of preference between these scenarios to select the most likely ones.

To design the response process, we suggest a second notion, called anti-correlation that is formally defined in Section IV.3 and then used in Section V to select the counter-measure candidates in the response process.

IV.1. Correlation

Our approach of correlation is based on the unification principle [START_REF] De Swart (h | [END_REF] on predicates 2 . Let a and b be two LAMBDA descriptions of attacks. post a is the set of literals of post-condition3 of a and pre b is the set of literals of pre-condition of b.

Direct correlation: a and b are directly correlated if the following condition is satisfied:

∃ E a and E b such that -(E a ∈ post a ∧ E b ∈ pre b ) or (not(E a ) ∈ post a ∧ not(E b ) ∈ pre b )
-and E a and E b are unifiable through a most global unifier θ. This definition of direct correlation represents the idea of positive influence between two attacks. We say that attack a has a positive influence over attack b if a is directly correlated to b. In such a case, the effects of a, namely the set of predicates in post a , allows to satisfy a subset of the pre-requisites of pre b . The notion of attack correlation allows us to find correlated attacks that are part of the same scenario.

As for the attacks and objectives, the approach is to use this formalism to specify a library of possible counter-measures that apply to the system to block an intrusion. We shall now define a response mechanism to select the adequate counter-measures for a detected scenario. This mechanism is based on a principle called anti-correlation which is close to the correlation principle suggested in [START_REF] Cuppens | Alert correlation in a cooperative intrusion detection framework[END_REF]. These two principles are formally presented in the following section.

[6] also defines the notion of Knowledge gathering correlation, a variation of the above definition of correlation that is useful to integrate, in the detection process, preliminary steps the intruder performs to collect data on the target system. Knowledge gathering correlation: a and b are knowledge gathering correlated if the following condition is satisfied:

∃ E a and E b such that

-(knows (Agent, E a ) ∈ post a ∧ E b ∈ pre b ) or (knows (Agent, not (E a ) ∈ post a ∧ not(E b ) ∈ pre b
) and E a and E b are unifiable through a most global unifier θ.

This definition generally applies to the first steps of an intrusion. We say "generally" because an intruder may have no knowledge about the target machine. An intruder may directly try to exploit a vulnerability on a machine without trying to know if this security hole is present on the machine, but we argue that most of the time, the intruder will try to gather some information about the target. Hence the gathered knowledge may influence the attacker on the next attacks he will execute.

As an example, there is a knowledge gathering correlation between the Port-Scan attack (see Figure 1) and the Winnuke attack (see Figure 2) through the predicate open and the unifier that matches variable H in both attack definitions and variable P in the Port-Scan attack to constant 139. This means that an intruder who knows that port 139 is open on a given host, can then perform a Winnuke attack on this host.

We now define the notion of correlation unifier that allows us to apply on-line correlation.

Correlation unifier: denoted Ξ ab , is the set of all possible unifiers 4 to correlate post a and pre b .

Since two attacks a and b are correlated as soon as they have one predicate in common in post a , and pre b , we may have several unifiers for two attacks. The set of correlation unifiers allows us to know which attack can be correlated with a given attack under some unification condition between their variables. Applying on-line correlation consists in exploring the set of correlation unifiers each time a new alert is received, given that the alert corresponds to an instance of an attack model.

We can apply the notion of direct correlation between two attacks to an intrusion objective and an attack. This allows us to detect that some attack may allow to reach or help to reach an intrusion objective. In this case, we simply have to substitute the term pre-condition by state in the definition of direct correlation.

IV.2. How to use correlation

Once attacks and intrusion objectives are specified in LAMBDA, we can generate all correlation unifiers between each pair of attacks (respectively between an attack and an intrusion objective). When two attack occurrences are detected, if some unifier in the unifier set is identified, we can then say that these attack occurrences are correlated in the same intrusion scenario.

Using this approach, it is possible to build a correlation graph. Figure 5 presents such a correlation graph where nodes are LAMBDA descriptions and edges are correlation unifiers.

When the first steps of a given intrusion scenario are identified, we can, with the same mechanisms, predict possible continuations of this scenario. We can generate hypothesis about future attacks and the intrusion objectives the intruder attempts to achieve. We shall call virtual attack an attack predicted by this process of intention recognition. A virtual attack becomes effective once its occurrence is detected. Thus, it is sometimes possible to anticipate on the actions performed by the intruder and develop a specific counter-measure in response. This means that our approach may be used to launch a counter-measure not only after a given intrusion objective is achieved by the intruder but also when the beginning of a given scenario is detected. In this latter case, the counter-measure will be used to prevent continuations of this starting scenario.

We shall now see how to define and use the anti-correlation principle to elaborate the counter-measure.

IV.3. Anti-correlation

Let a and b be respectively LAMBDA descriptions of a counter-measure and an attack. post a is the set of literals of post-condition of a and pre b is the set of literals of pre-condition of b. Anti-correlation: a and b are anti-correlated if the following condition is satisfied:

∃ E a and E b such that -(E a ∈ post a ∧ not(E b ) ∈ pre b ) or (not(E a ) ∈ post a ∧ E b ∈ pre b )
-and E a and E b are nnifiable through a most global unifier θ.

This definition formalizes the notion of negative impact of a counter-measure over an intrusion scenario. A counter-measure is an action which prevents the execution of an attack. Since our model of an attack includes the necessary conditions the system's state must meet in order to execute the attack, we can prevent the execution of an attack by making one of those conditions false. So a counter-measure c for an attack a is a LAMBDA model of which the post-condition contains a predicate that contradicts one predicate of pre a . We say that c is anti-correlated with a. It is sufficient for a counter-measure to anti-correlate an attack through only one predicate, but a counter-mesure can anti-correlate an attack through several predicates.

Anti-correlation unifier: denoted Ψ ab , is the set of all unifiers θ possible to anti-correlate post a and pre b .

As for a correlation unifier, an anti-correlation unifier defines which attacks can be anti-correlated to a counter-measure. It tells how the variables must be unified in the predicates which are involved in the anti-correlation link.

Using the same approach, it is possible to define anti-correlation between a counter-measure and an intrusion objective. We have simply to replace pre-condition by state in the previous definition.

In the following section we show how to use the anti-correlation notion to design a response mechanism to an intrusion scenario. In particular, Figures 6 and7 provide examples of anti-correlation and how to use it in a response mechanism.

V. USING ANTI-CORRELATION FOR RESPONSE

When a scenario is identified, the correlation process provides a graph of attack occurrences, virtual attacks and intrusion objective. A counter-measure will apply to invalidate future attacks or invalidate an intrusion objective. Thus, we have two response mechanisms, one that applies against virtual attacks and the other on an intrusion objective.

V.1. Response to an intrusion objective

In this case, response aims at updating the system state to invalidate the intrusion objective in an intrusion scenario.

In Figure 6, we assume that two occurrences of attack are detected: an occurrence of a with argument X = x and an occurrence of b with argument Y = y. The correlation process diagnoses that these two attacks are correlated with a given intrusion objective o and this objective is achieved. The response process finds two counter-measure candidates: (1) counter-measure r 0 with parameter X″ = X′, provided by Ψ ro,o , to invalidate condition p (and thus objective o) and ( 2) counter-measure r 1 with parameter Y″ = Y′, provided by Ψ r 1 ,o , that invalidates condition q (and thus also objective o). Combining Ξ a, o with Ψ ro,o we can derive that counter-measure r 0 may apply with parameter X″ = X′ = X = x and similarly counter-measure r 1 may apply with parameter Y″ = y′. Thus this provides means to derive which parameters must be selected when applying the counter-measure. In our approach, these two counter-measures are suggested to the administrator who can select one of them (or both). The verification field of the selected counter-measure is then evaluated to check if the counter-measure was executed successfully. If this is the case, we can reevaluate the state condition of the intrusion objective to false.

Let o be an intrusion objective. To invalidate this intrusion objective, we must find a LAMBDA definition r of a counter-measure such that Ψ r 0 ≠ θ . Then, it is possible to parameterize this counter-measure candidate with the unifier of correlation Ψ r 0 .

V.2. Response to an ongoing scenario

It is possible that a counter-measure may not apply directly to an intrusion objective if one of these conditions holds:

-There is not any counter-measure in the response library which may apply to invalidate the intrusion objective. -The counter-measure does not apply to the system state because the pre-condition of this counter-measure is evaluated to false. -All counter-measure candidates were launched without success. In these cases, a possible solution is to modify the system state to invalidate one attack in a sequence of virtual attacks. When the correlation engine receives a new alert, it tries to find a path of correlated virtual attacks leading to one (or more) intrusion objective(s). The path of virtual attacks and the intrusion objective found represents a possible evolution of the ongoing scenario. Let a 1 ...a n be a sequence of virtual attacks and o an intrusion objective such that for every i ∈ [1, n -1], a i is correlated with a i + 1 and a n is correlated with o. The affirmation stating that for every i ∈ [1, n -1], a i is correlated with a i + 1 and a n is correlated with o is not necessarily true for the entire set of virtual attack generated. But we can always find a subset of virtual attack satisfying this condition in the set of generated virtual attacks, given that the set of generated virtual attacks leads to an intrusion objective.

To block this sequence of attacks, we must find a valid LAMBDA counter-measure r such that r is anti-correlated with one of the attacks a k (k ∈ [1, n]).

For instance, let us assume, in Figure 7, that we detect an occurrence of a. The recognizing intention process identifies that the intruder may perform b after a to achieve the objec-

Graphe de corrélation avec réponse sur une séquence d'attaques virtuelles.

tive o. In this case, the response process can find a counter-measure r to invalidate the precondition of b. This will prevent performance of attack b and invalidate this scenario.

VI. EXAMPLES AND EXPERIMENTATION

This section presents the Prevention Cells framework [START_REF] Garcia | Decentralized publish-subscribe system to prevent coordinated attacks via alert correlation[END_REF], a cooperative intrusion detection platform that implements the response mechanism suggested in this paper. This framework is a research prototype implemented in C and C++, and has been tested on different versions of Linux 2.4.x series and on the versions 2.9.x and 3.x of GNU's gcc compiler. The global architecture of this platform is shown in Figure 8.

The platform works as follows. First, the event watcher component (ewatcher-ids) collects the set of events raised by different host and network based sensors and translates them into IDMEF (Intrusion Detection Message Exchange Format). These alerts, together with the IDMEF alerts collected by other third party IDS included in our platform (such as snort and prelude) are sent to an alert database (managed by PostgresSQL). An enhanced C++ version

Plateforme de détection d'intrusion coopérative.

of CRIM [START_REF] Cuppens | Alert correlation in a cooperative intrusion detection framework[END_REF] analyzes these IDMEF alerts using the approach presented in Section IV.1. To generate the corresponding counter-measures, CRIM uses the approach based on anti-correlation defined in Section V. These counter-measures are transmitted to the countermeasure manager component (cm-manager) as IDMEF assessment alerts. Finally, the counter-measure manager provides the administrator with a set of actions. The administrator in charge can then select one or several actions that automatically will be executed at the corresponding response unit.

The response units associated with the counter-measure manager, as well as the sensors associated to the ewatcher-ids component, are implemented in C and executed as linux 2.4 modules. To illustrate the use of two of these response units let us consider two attack scenarios: an illegal remote command based on the Mitnick attack and a distributed denial of service attack.

VI.1. Mitnick attack

This attack tries to exploit the trust relationship between two computers to achieve an illegal remote access using the coordination of three techniques. First, a SYN flooding DoS attack to keep the trusted system from being able to transmit. Second, a TCP sequence prediction against the target system to obtain its following TCP sequence numbers. And third, an unauthorized remote shell by spoofing the IP address of the trusted system (while it is in a mute state) and using the sequence number that the target system is expecting. The correlation graph for this attack is presented in Figure 9.

The LAMBDA models for each attack that composes the whole scenario, together with the intrusion objective, are shown in Figure 10. In the first step, A (the agent that performs the whole attack) floods a given host H 1 . In the second step, A sends a TCP sequence prediction attack against host H 2 to obtain its following TCP sequence numbers. Then, by using these TCP sequence numbers, A starts a spoofed remote shell session to the host H 2 as it would come from host H 1 . Since H 1 is in a mute state, H 2 will not receive the RST packet to close this connection. If the third and fourth step are successful, A will establish an illegal remote shell session to system H 2 . When alerts corresponding to different steps of this scenario are raised, CRIM applies the correlation mechanism recalled in this paper to recognize the global scenario. For example, if an alert corresponding to the attack syn_flood(A, H 1 ) and the attack tcp_sequence_prediction(A, H 2 ) are raised, the correlation mechanism of CRIM will generate the virtual alerts corresponding to the attack IP_spoofing(A, H 1 , H 2 ), the attack spoofed_remote_shell(A, H 1 , H 2 ) and the objective illegal_remote_shell(A, H 2 ). CRIM recognizes then the whole scenario since the post-condition deny_of_service (H 1 ) of the attack syn_flood(A, H 1 ) is correlated with the pre-condition deny_of_service (H 1 ) of the attack IP_spoofing(A, H 1 , H 2 ).

Likewise, the pre-condition spoofed_connection(A, H Once this diagnosis is obtained, the response module is used to select some counter-measures in the counter-measure library. Faced to this intrusion scenario, the response module can select two possible counter-measures. The LAMBDA models for these two counter-measures are also shown in Figure 10. On one hand, a counter-measure can apply directly on the intrusion objective. This counter-measure, called kill_remote_shell, kills the remote shell process. On the other hand, we can react before the intrusion objective is achieved. The counter-measure, called block_spoofed_connection, blocks the spoofed connection between the host and the intruder. The counter-measure block-spoofed-connection is chosen since its post-condition not (spoofed_connection (A, H 1 , H 2 )) is anti-correlated with the pre-condition spoof ed_connection(A, H 1 , H 2 ) from spoofed_remote_shell (A, H 1 , H 2 ). Likewise, the counter-measure kill_remote_shell is chosen since its predicate not(remote_shell(A, H 2 )) is then anti-correlated with the predicate remote_shell (A, H 2 ) of the intrusion objective illegal_remote_shell (A, H 2 ).

These two counter-measures are transmitted to the counter-measure manager as IDMEF assessment alerts, which provides the administrator with the actions showed in Figure 10. Thus, the administrator can select one of them, or both. For example, if the administrator chooses the first action, block_IP_datagrams(A, H 1 , H 2 , t), the counter-measure manager will send this information to the response unit pfilter_ru. The implementation of this response unit is based on the netfilter subsystem, a framework for packet manipulation that enables packet filtering, network address translation and other packet mangling on Linux 2.4.x and upper series. When the response unit pfilter_ru receives the information sent by the countermeasure manager, it produces the corresponding packet filtering on netfilter to block the spoofed IP datagrams during the timeout t.

On the other hand, if the administrator chooses the second action, kill_ _process(remote_shell(A, H 2 )), the counter-measure manager will send this information to the response unit kill_ru. The implementation of this response unit is based on the interception of the kill system call to provide a safe mechanism to invoke the original kill system call using the Netlink Sockets API. It allows us to find and to terminate the execution of the processes reported by the counter-measure manager (in that case, the execution of the remote-shell process to the host H 2 ).

After the execution of the chosen action, the counter-measure manager receives the acknowledgment from the corresponding response unit. Then, it will send an IDMEF alert to CRIM to tell that the given counter-measure has been launched. Finally, CRIM can apply the verification field of the counter-measure to check if the counter-measure has been effective.

VI.2. Distributed Denial of Service

In this section, we present how to use the alert correlation discussed in section IV.1 to detect an ongoing DDoS attack scenario and how to stop it using anti-correlation (section IV.3). Denial of Service (DoS) attacks, based on flooding, consist in putting out of service some physical or logical resource in a computer system. The attacker sends huge amounts of legitimate traffic in order to decrease, or stop a specific service on the victim machine. The excessive consumption of the victim's resources deprives legitimate clients from the offered victims' service for many minutes or hours as long as the attack is active.

Distributed Denial of Service attacks, based on flooding, use the architecture shown in Figure 11 where the attacker recruits many agents known as zombies to flood the designed victim(s). The different hosts which are between the attacker and the zombies are called masters (or handlers). These hosts are servers, which are recruited by the attacker(s), offering many commands facilities to launch the desired flooding attacks.

The LAMBDA model corresponding to the global scenario is shown in Figure 12. We mention that we do not take into account the early steps of the DDoS tools that consist in scanning and compromising the different hosts that will later play the role of masters and slaves. These intrusions may be detected with some IDSs and then some corresponding scenarios

VII. CONCLUSIONS

In this paper, we have presented a global approach to select and apply response mechanisms when an intrusion occurs. This approach is based on a logical representation in LAMBDA of both intrusions and counter-measures. This is used to build libraries of intrusions and counter-measures.

The library of counter-measure is organized into a taxonomy that takes its inspiration from [START_REF] Gombault | Response function[END_REF]. The notion of anti-correlation is then used to select relevant responses to a given intrusion in order to help the administrator to decide which appropriate counter-measures may be launched. This mechanism is integrated on an experimental platform of intrusion detection that collects and analyzes alerts generated by various intrusion detection systems. This platform is a research prototype implemented in C and C++.

The response units of our platform are implemented as Linux 2.4 modules and can interact with the other components via the Netlink Sockets API available for GNU/Linux systems.

Up to now, we only use this approach to provide a support to the administrator who takes the final decision to choose and launch a given response. This is a prudent strategy but it introduces an overhead that is sometimes incompatible with real time response. This is why we are currently analyzing situations where it would be possible to automatically decide to launch the response.

Notice that a possible response consists in reconfiguring the security policy to prevent a new occurrence of a given intrusion. However, as suggested in [START_REF] Petkac | Security agility in response to intrusion detection[END_REF], dynamic changes of the security policy may cause failure of some software components. This is why [START_REF] Petkac | Security agility in response to intrusion detection[END_REF] suggests the notion of security agility, a strategy to provide software components with adaptability to security policy changes. Security agility might be nicely included into the intrusion detection and response framework suggested in this paper. This represents a possible extension of our work.

When using anti-correlation, several responses may be selected. In this case, it would be interesting to rank these different responses and a possible ranking criteria would be to evaluate the effectiveness of the responses to stop the attack. For this purpose, we plan to extend the response formalism with temporal logic to include the fact that a given response will stop an intrusion until another additional event occurs. More difficult is performing an action that will cause this additional event, more effective is the response. This also represents further work that remains to be done.

FIG 1 .

 1 FIG 1. -Port-Scan Attack performed by an agent A on a given host H. Attaque Port-Scan réalisée par un attaquant A sur une machine H.

Figure 4

 4 Figure 4 provides an example of a counter-measure specified in this model. It consists in closing all connections between a given source S and a given target T.

FIG 4 .

 4 FIG 4. -Counter-measure: Closing a TCP connection. Contre-mesure: fermeture d'une connexion TCP.

FIG 5 .

 5 FIG 5. -Correlation graph example.Exemple de graphe de corrélation.

FIG 6 .

 6 FIG 6. -Correlation graph with direct response on objective. Graphe de corrélation avec réponse directe sur un objectif.

FIG 7 .

 7 FIG 7. -Correlation graph with response on a sequence of virtual attacks.

FIG 8 .

 8 FIG 8. -Cooperative intrusion detection platform.

FIG 9 .

 9 FIG 9. -Correlation graph for the Mitnick attack scenario. Graphe de corrélation pour le scénario d'attaque Mitnick.

FIG 10 .

 10 FIG 10. -Modelling the Mitnick attack scenario. Modélisation du scénario d'attaque Mitnick.

FIG 11 .

 11 FIG 11. -DDoS Attack Architecture. Architecture d'une attaque DDoS.

  1 , H 2 ) of the attack spoof ed_remote_shell(A, H 1 , H 2 ) is correlated with the post-condition spoofed-connection(A, H 1 , H 2 ) of IP_spoofing(A, H 1 , H 2 ), the pre-condition knows(A, tcp_sequence(H 2 )) of IPspoofing(A, H 1 , H 2 ) is correlated with the post-condition knows(A, tcp_sequence(H 2 )) of tcp_sequence_prediction(A, H 2 ), and the intrusion objective state remote_shell (A, H 2 ) is then correlated with the post-condition remote_shell (A, H 2 ) of the attack spoofed_ remote_shell(A, H 1 , H 2 ).

The alerts launched by IDS generally provide evidence of the occurrence of some malicious events but are not sufficient to conclude that these events will actually cause some damage to the target system. This depends on the system state when the malicious events occur. This is why a LAMBDA description also includes a verification attribute that provides conditions to be checked to conclude that the attack is a success.

As used in PROLOG.

Post-condition is represented in its conjunctive form.

Unifiers of direct or knowledge gathering correlation.

Acknowledgements

This work was supported by funding from the French ministry of research, under the ACI Daddi project, the Spanish Government project TIC2003-02041, and the Catalan Government grants 2003FI126 and 2005BE77

may be constructed which will be detected with the correlation method discussed above. However, if the attacker has a legitimate physical or remote access to the different machines then these first steps cannot be detected.

The scenario shown in Figure 12 corresponds to the different steps followed by an attacker, after compromising the different useful hosts, to launch a distributed denial of service against victims. In reality, it corresponds to the scenario of activating well known DDoS tools such as Trinoo, Stacheldraht, TFN, Mstream, Shaft, etc. Once activated on the compromised hosts, these DDoS tools perform classical DoS attacks such as syn-flooding or smurfing.

The LAMBDA models for each elementary attack corresponding to the scenario is shown in Figure 13.

The first step consists in opening a connection between the attacker with the master. The pre-condition of the first attack of the scenario mentions that the H host is a master host compromised by the attacker A. Its post-condition specifies that the attacker has opened a connection with the master.

When the attacker launches (automatically or not) the daemon(s) on the different compromised slaves hosts, these slaves hosts will send a message called "show alive message" to the masters that control them in order to inform their readiness to flood a victim. This action may be performed in parallel with the first step.

In the third step, the attacker sends a dos command to the master to start a DDoS attack using the detected slave computer(s). Thereafter, the master sends a DoS command to the slave in order to flood the desired victim(s).

Graphe de corrélation d'une Attaque DDoS.

Once the CRIM engine has recognized the global scenario using the approach explained in the previous sections, one appropriate counter-measure should be launched. It consists in killing the slave daemon process. In addition to this, the administrator where the daemon is located is warned about the host where the daemon is installed. He should find the vulnerability that permitted the installation of the daemon on that host and disinfect and patch the system. Without doing this, other daemons may be launched automatically from the same host. This is what is called counter counter-measure.

We mention that the main goal in using correlation technique to recognize the first steps of an ongoing DDoS scenario is to react against it before the objective is reached i.e. before the flooding is started where in this case it is difficult and too late to react.


Jean-François Giret

Christine Guégnard

Olivier Joseph

School-to-work transition in France: the role of education in escaping long-term NEET trajectories

Keywords: NEETs, France, school-to-work transition, labour market

Introduction

The term NEET (not in education, employment or training) was formally defined at the political level in the UK, by the government's Bridging the gap report from the Social Exclusion Unit as those 16-18 year olds who neither participate in education nor training and have not been employed for at least 6 months after leaving compulsory education [START_REF] Furlong | Not a very NEET solution[END_REF]. After the terms Status 0 [START_REF] Armstrong | Status 0: A Socio-Economic Study of Young People on the Margin[END_REF] and Status A or Status Zero (Social Exclusion Unit (SEU), 1999), this acronym NEET has been developed as a benchmark indicator first in British youth policy and later in the European community. In the US, some authors have introduced the term 'disconnected young people' [START_REF] Fernandes | Disconnected Youth. A look at 16-to 24-Year Olds Who are not Working or in School[END_REF]. This new concept brings attention to young people's problems and the multifaceted nature of their disadvantages. NEETs share a common, cross-cutting characteristic, i.e. that of not accumulating human capital, which puts them at a greater risk of poor future employment prospects and social exclusion. Since 2010, the European Commission has used this indicator to monitor the labour market and the social situation of young people. According to OECD in 2016, the percentage of NEETs in France, 17.9% of the population aged 15-24, is significantly above the OECD average (13.9%). The EU considers NEETs to be one of the most problematic groups in the context of youth unemployment. Eurofound (2014) estimated that in 2012 the economic costs of NEETs (due to the NEETs' absence from the labour market) to be approximately €162 billion for the 26 Member States' economies (€23.2 billion for France). As revealed by a number of studies (Eurofound, 2012(Eurofound, , 2016;;[START_REF] Carcillo | NEET youth in the aftermath of the crisis: Challenges and policies (OECD Social[END_REF], NEETs are a heterogeneous population that encompasses a very wide range of different situations: young people who are disengaged, unoccupied, disadvantaged, living with their parents, looking for a career, having family responsibilities, or taking a year off. Some of these situations are associated with considerable vulnerability; however, it is uncertain whether young people in all these situations should be considered at-risk. A body of critical reflection on the NEET concept [START_REF] Maguire | NEET, unemployed, inactive or unknown-why does it matter[END_REF][START_REF] Reiter | NEET in disguise? Rival narratives in troubled youth transitions[END_REF][START_REF] Serracant | A brute indicator for a NEET case: Genesis and evolution of a problematic concept and results from an alternative indicator[END_REF][START_REF] Thompson | Individualisation and social exclusion: The case of young people not in education, employment or training[END_REF] has emerged recently, which highlights this concept's ambiguity, particularly when it is based on a static approach. Moreover, 'NEETs' remain questionable as a label because, by defining them through their lack of education and employment, it tends to conceal their work experiences and hide the complexity of their life histories or their lack of social and monetary resources [START_REF] Couronné | Une jeunesse (in)visible: Les « Neets vulnérables » de la Garantie jeunes[END_REF][START_REF] Yates | Not so NEET? A critique of the use of 'NEET' in setting targets for interventions with young people[END_REF]. Despite the high number of NEETs in France, our understanding of this population is limited, especially when we would like to consider whether NEET is a temporary or long-lasting period. The object of this research is to examine the role of NEET status in the trajectories of young people who leave the French educational system and the factors that influence their exit from education and their experiences in NEET. In particular, we assume that the NEET label includes very different situations in the youth labour market and concerns temporary or long-lasting periods. In the highly segmented French labour market that gives preference to insiders, all students who leave high school or university are at risk of entering a period of NEET, at least to some extent. However, those who attain a lower level of education and who experience greater social and educational disadvantages face a higher risk of getting trapped in these situations. To test this hypothesis, we will use data from a French national and longitudinal survey, 'Génération 2010ʹ, carried out by Céreq (the French Centre for Research on Education, Training and Employment). This survey provides information on youths' first 3 years in the labour market after leaving education. Céreq contacted by telephone 38,600 young people who left schools in 2010 at various levels of education and entered the labour market in the same year. This survey has the advantage of including several factors that are considered in the literature to increase the risk of becoming a NEET (low level of education, immigrant origin, place of residence in an area with high unemployment or a remote area, etc.) and family background (low socioeconomic class, parents with low academic attainment) (Social Exclusion Unit (SEU), 1999; [START_REF] Coles | Literature review of the costs of being not in education, employment or training at age 16-18[END_REF][START_REF] Bynner | Social exclusion and the transition from school to work: The case of young people not in education, employment[END_REF][START_REF] Cusworth | Understanding the risks of social exclusion across the life course: Youth and young adulthood[END_REF]. Taking these elements into account, this research is made up of four sections. The first examines the main characteristics of the French school-to-work transition system and draws hypotheses on the importance of having a diploma on this transition, especially during periods of economic crisis. The second section presents the database and the methodological approach developed in the paper. The third section details the main results: firstly, highlighting the NEETs' pathways during the 3 years after they left education and the characteristics of the young people who belong to each pathway; secondly, presenting the determining factors for being in a NEET pathway, using descriptive statistics; thirdly, in order to test these effects, all other things being equal, summarising the results of a multinomial logit model, followed by another model explaining the probability of leaving the first sequence of NEET situation. Finally, in the fourth section, the conclusion discusses these results in relation to public policy that has been implemented in France to facilitate the integration of young people into the labour market.

The school-to-work transition in France: a bonus for a diploma Different typologies have been proposed to explain the different ways that youth are integrated into the labour market. Some of them are extensions of typologies of educational systems to levels of vocational training (for a recent review, see [START_REF] Pilz | Typologies in comparative vocational education: Existing models and a new approach[END_REF]: weight of track differentiation, standardisation of training programmes, the nature of in-firm vocational training structures, as well as the characteristics of students who leave secondary education in different countries [START_REF] Kerckhoff | Transition from school to work in comparative perspective[END_REF][START_REF] Müller | From school to work: A comparative study of educational qualifications and occupational destinations[END_REF]. Despite the development of apprenticeships 1 , France, compared to other countries, remains a country associated with formal schooling, even in the vocational track [START_REF] Greinert | Towards a history of vocational education and training (VET) in Europe in a comparative perspective[END_REF]. Moreover, in France, the vocational education track is often considered less valuable than the academic track because of the emphasis on general education. The secondary VET 2 track, compared to the academic track, is based on study choices that are often constrained as a 'default' option [START_REF] Broccolichi | Comment s'articulent les inégalités d'acquisition scolaire et d'orientation? Relations ignorées et rectifications tardives[END_REF]. These constraints produce less motivated young people with more limited knowledge of basic skills (Branche-Seigeot, 2013) and a higher drop-out rate. In addition, a number of studies have highlighted the fact that, despite the increase in the level of education, participation in education is highly stratified by families' socioeconomic background, school biographies, immigration history, differential educational decision-making, and institutional settings within educational systems, such as tracking and residential segregation [START_REF] Broccolichi | Comment s'articulent les inégalités d'acquisition scolaire et d'orientation? Relations ignorées et rectifications tardives[END_REF][START_REF] Duru-Bellat | The democratization of education in France: Controversy over a topical question (Population, 1, 2000)[END_REF][START_REF] Landrier | Comment l'orientation contribue aux inégalités de parcours scolaires en France[END_REF][START_REF] Di Paola | Comment l'école amplifie les inégalités sociales et migratoires?[END_REF]. Generally, the factors that channel some young people into the vocational track also become risk factors when entering the labour market. Although it is strongly debated, the apprenticeship tracks seem to guarantee better employability on the labour market [START_REF] Bonnal | School-to-work transition: Apprenticeship versus vocational school in France[END_REF]. However, as the comparative research of [START_REF] Brebion | L'apprentissage, un meilleur « rendement » professionnel en France qu'en Allemagne. Formation emploi[END_REF] shows, in France, this dual qualification is mainly considered as an advantage by firms operating in the external labour market, 1 Most of the vocational secondary education is based on a school training scheme although an apprenticeship system exists based on a dual education between a school and an enterprise. Only 5% of pupil choose this dual track at the end of the college, 28% the school vocational track and 61% the general of technological track [START_REF] Pesonel | Quelles sont les causes de la baisse de l'apprentissage dans l'enseignement secondaire ? Insee Références[END_REF]. This enrolment rate in the dual track decreased these last years in secondary education whereas it increased in higher education.

2 At the end of the college, pupils opt for vocational tracks to prepare during two years a CAP the Certificat d'aptitude professionnelle (Vocational training certificate listed as ISCED 3 in the international classification), the first level of vocational training.

whereas in Germany, it mostly stems from a high retention rate on the part of the training firms. Other classifications of types of transition systems, integrating the characteristics of the relation-ship between training and employment, make it possible to understand how young people differ in their access to the labour market. For [START_REF] Hannan | Cross-national research on school to work transitions: An analytical framework[END_REF], France is characterised by a rather weak relationship between training and employment, due to the absence of a professional market and especially to the strong weight of diplomas on young peoples' transitions into work. The credentialist value of diplomas in the labour market explains, in part, the situation of young people accessing different segments of the labour market, which can lead to a process of diploma inflation [START_REF] Duru-Bellat | L'inflation scolaire: Les désillusions de la méritocratie[END_REF]. Although their importance is declining, diplomas still provide very strong protection when young people are first entering the labour market, particularly in times of economic crisis. A degree facilitates the entry into the most stable segments of the labour market [START_REF] Dupray | The signaling power of education by size of firm and the longterm effects on workers' careers[END_REF] and, therefore, a quick school-to-work transition. [START_REF] Garona | Le travail des jeunes, les relations professionnelles et les relations sociales dans les économies avancées[END_REF] point to how different actors in both the educational system and the labour market shape the modes of regulating youth entry into the labour market in different countries. For these authors, France, in this comparative framework, appears to be a regime of selective exclusion characterised by strong government intervention in order to reduce the high rate of youth unemployment: young French people are offered training, state subsidised employment, and incentives to go back to school in order to not become NEET, but also not to compete with older workers. Moreover, the involvement of public authorities in employment policy partially improves the problems of the most vulnerable young people, who are often the least educated [START_REF] Couppié | The employment status of youth: Elements of a European comparison[END_REF]. In addition, during a period of job shortage, the effects of competition on the labour market lead employers to increase their demands when hiring and to reinforce the differ-entiation of jobs for young people according to their level of qualification. Young people with fewer skills and diplomas are therefore usually less likely to gain access to jobs, and also are more likely to lose their jobs, if employed. Moreover, the difficulties experienced during their studies and not only the final diploma may also have long-term signal effects on the labour market [START_REF] Brodaty | Does speed signal ability? The impact of grade repetitions on employment and wages[END_REF]. Young people with less qualifications and VET education are more likely to end up in the secondary segment of the labour market and have fewer opportunities to go back into training. Indeed, in these jobs the opportunities for acquiring experience appear poorer and poorer, which leads to risks of being trapped in a precarious situation or even of exclusion [START_REF] Amossé | Mobilité et segmentation du marché du travail: Quel parcours professionnel après avoir perdu ou quitté son emploi?[END_REF]. This labour market segmentation leads to very different levels of employability between graduates from higher education and students who left secondary school [START_REF] Paul | Higher education and graduate employment in France[END_REF]. If the former experience periods of unemployment, we can assume they are at the beginning of an extended period of search for qualified jobs. On the other hand, they enjoy security in the labour market more frequently than other diploma holders [START_REF] Mora | Tout se joue-t-il dès les premiers pas?[END_REF]. This is not the case for those who left secondary education, especially those without any qualifications, who are more often in precarious jobs or subsidised employment programmes and more frequently unemployed through-out their career pathway [START_REF] Bonnal | Evaluating the impact of French employment policies on individual labour market histories[END_REF]. There is, for the least educated, and in particular for young girls, a very strong link between situations of unemployment and inactivity. For example, girls leaving secondary vocational tracks have experiences characterised by periods of inactivity resulting from entering into a romantic relationship as well as from anticipating problems finding a job on the labour market [START_REF] Nicole-Drancourt | L'insertion des jeunes en France[END_REF]. Few longitudinal and comparative studies, at the moment, have dealt with the dynamics of NEET situations and their critical elements. A study by [START_REF] Carcillo | NEET youth in the aftermath of the crisis: Challenges and policies (OECD Social[END_REF], surveying 2,434 individuals aged 16 to 20 from 12 European countries, shows, however, that the longest NEET trajectories correspond more often to young people who drop out of school early. Only few young people have multiple NEET spells, but single spells in France can have long durations. These results confirm another study [START_REF] Quintini | Starting well or losing their way? The position of youth in the labor market in the OECD countries[END_REF] where France, along with Spain and Greece, was among the countries with the highest number of people who had been classified NEET at least once over a five-year period. Nevertheless, they show that turnover in this status was higher in France than in the other two countries. In fact, the NEET situation in France has been mainly analysed in the context of European comparative statistical studies (OECD, 2009;Eurofound, 2012Eurofound, , 2014 . . .) . . .). Little research in France had focussed on the NEET category with a few exceptions [START_REF] Kramarz | Ni en emploi, ni en formation: Des jeunes laissés pour compte[END_REF][START_REF] Reist | Les jeunes ni en études, ni en emploi, ni en formation (NEET): quels profils et quels parcours? Dares Analyses-Dares Indicateurs-Dares[END_REF]. This can be explained by the willingness of researchers to focus on the unemployment issue, especially for the youth more affected than other generations [START_REF] Cahuc | Youth unemployment in old Europe: The polar cases of France and Germany[END_REF]. Moreover, the emergence of the NEET concept has led to an interest in a much larger population suspected to hide the difficulties of the most vulnerable categories [START_REF] Demazière | Le devenir des frontières du chômage[END_REF]. The NEETs and their pathways have not yet been the subject of a specific survey or research in France, and remains to be investigated beyond the statistical profile.

On the basis of this literature review, one can expect to find, in France, very different NEET situations for dropouts according to their initial level of education. If the more educated experience a NEET spell, this situation will be temporary, whereas the less educated will be trapped in long term or recurrent NEET situations. These different elements lead us to consider the position of NEET status in the school-to-work transition and the pathways leading up to NEET situations.

Methodology

In this section we focus on the school-to-work transition of young people leaving school or university in 2010, using a French longitudinal survey, Céreq Génération 2010. This national survey conducted by Céreq allows to follow the career paths of young people at the end of their studies. The database was created after collecting data from schools and universities on all the youth who have completed their schooling in France (3,000 institutions forwarded their files to Céreq, representing a response rate of 73%). A balanced sampling design was used on the basis of strata corresponding to the French regions and the main educational levels. The survey was administered by telephone using a computer-assisted interviewing (CATI) procedure (with a response rate of 34%). A non-response adjustment method has been developed to reduce partial non-response bias by modelling the probability of response. This survey was approved by the National Council for Statistical Information (CNIS). Anonymity of individuals has been preserved throughout the study. This school-to-work transition survey, released after the economic crisis of 2007/2008, shows, month by month, the labour market pathways of over 38,000 young people representative of the 708,000 first-time school leavers at all levels of educational attainment in 2010 (Figure 1). We start with presenting a general description highlighting various aspects of NEET status. We examine whether this status can be understood as a transitory step taken by young people on their way to successful careers or whether NEET spells represent long-lasting departures from the labour market. To do so, we analyse a 45 month-long period starting in November 2009. In order to measure a consistent NEET category, we looked at young people aged 15 to 26 at the time of leaving the educational system (people 27 and older were excluded). This reduces the sample to 30,049 individuals. Note that the NEET indicator is calculated here on a cohort of young people entering the labour market in the same year, and not in relation to an age category as is the case for most international studies on the transition to the labour market. Up to the time of the survey, a calendar was used to collect, month by month, the following situations: employment, unemployment, study, training, and inactivity (with a minimum length of 1 month for each situation). This population started searching for jobs in 2010, facing unfavourable conditions in the labour market following the 2008 economic crisis. Three years after leaving the educational system, 66% of young people had a job, 9% were training or studying, and 25% were NEET (24% of women and 25% of men). This withdrawal from the labour market was more likely among non-graduates 3 (half), as well as those who left secondary school with a secondary VET diploma (CAP) (a third). The higher the level of education, the lower the share of NEETs, but baccalauréat4 holders (21%) and graduates from higher education (12%) are not spared. At the time of the survey in 2013 Table 1, 30% of the respondents had not experienced a NEET status and 70% of young people had experienced a NEET status at least once over the three-year period (8% one spell, 28% two spells and 33% more than two spells of NEET). For the total population, the average length of the first period of NEET was 6 months, and for all young people who have experienced a situation of NEET, the average length was 11 months. By spring 2013, the young people in the survey had been NEET for 17 consecutive months on average, from almost 2 years for women without a diploma to 1 year for male and female tertiary graduates. Often, the first NEET episode occurred immediately after leaving the educational system. Furthermore, 44% of the population spent more than 6 months in NEET status, of which 14% spent more than 2 years. Thus, many young people alternate between jobs and NEET episodes. In fact, the NEET situation in 2013 masks differentiated pathways. The trajectory of the population can be described using a comprehensive timeline, retracing month by month the situation of these young people. This representation allows us to visualise the evolution, over time, of the share of young people in employment, NEET, and education or training during the first 3 years following the end of their initial training. In the summer of 2011, nearly 70% of young people were employed, a proportion that remains relatively stable thereafter, with 67% employed at the time of the survey. Over the same period, the proportion of NEETs decreased from 29% to less than 25%. Our empirical strategy is divided into four stages. First, in order to account for the dynamics of the pathways, we constructed a longitudinal typology, depending on the time spent in a NEET status and on the final monthly situation observed. Indeed, we took into account the periods of at least 6 months spent in NEET status (excluding summer holiday months) as proposed by [START_REF] Furlong | Not a very NEET solution[END_REF]. In addition the timing of a NEET sequence in the trajectory may have different effects on the rest of the pathway. The absence in France of a dual system and the strong segmentation of the labour market lead to a first-job search time for which can be high for young people. High NEET periods are therefore less problematic at the beginning of the trajectory than at the end, where they can be seen as a signal of an inability to find or to keep jobs [START_REF] Allaire | Persistance du chômage et insertion[END_REF].

Second, we provide a descriptive comparative analysis of the characteristics of school-leavers in each pathway. Third, we estimate a multinomial logistic regression model to assess the variables that predict the different types of NEET pathways, everything else being equal. A large set of individual characteristics were investigated: gender, migrant origin, late entering secondary school, highest qualification reached, type of training (apprenticeship), field of study (industrial, services, general), reason for leaving studies (financial, had enough of studying, had reached the desired level, not admitted in further studies, no training nearby), parents' education level, parents' status and situation, place of residence upon leaving education (whether or not they live in a disadvantaged urban neighbourhood -ZUS), the rate of unemployment in the respondents' residential area upon leaving education, and whether their choice of study was constrained after secondary school (collège). Fourth, in order to learn more about the dynamics of moving in and out of NEET status, we focus on the first NEET sequence, which has a strong impact on the trajectory. We explain the probability of leaving the first sequence of NEET situation, using a semi-parametric duration model (Cox model).

Results

Four separate groups based on NEET status

Four groups were created by considering periods of at least 6 months spent in NEET, which does not account for months of summer holidays and allows for a consistent duration (cf. [START_REF] Furlong | Not a very NEET solution[END_REF]):

• Group 1 brings together young people who were not NEET for 6 months after leaving the school and are not NEET on the survey date in 2013 (19,108 young people named 'Never NEET', representing 60% of the population). • Group 2 comprises young people who were NEET for at least six consecutive months at the beginning of period but are no longer at the time of the survey in 2013 (4,238 young people 'Begin NEET', 15% of the population). • Group 3 covers young people who are NEET at the time of the survey in 2013 but not at the beginning (3,321 young people 'End NEET', 12%). • Finally, group 4 concerns young people who were NEET more than six consecutive months from the start of the path and are still NEET at the time of the survey (3,382 young people 'Always NEET', 13%).

The representation of their trajectories in the timeline highlights the different transitions of the four groups (Figure 2). Group 1, the 'Never NEET' young people or short-term NEET, experienced the most favourable transition with quick and sustained access to employment for most of the three-year period, and rare episodes of NEET. Eighty-four percent were in stable employment at the time of the survey, while 10% were in either education or training. In contrast, two-thirds of group 4, the 'Always NEET' or long-term NEET (at the beginning and in the spring 2013), were out of employment and education from the beginning until 2013, with rare episodes of employment (less than 20% and often temporary). At the time of the survey, they had been NEET for a long time (21 months on average), after having been in NEET for a long time upon their entry into the labour market (24 months on average). This population is the most vulnerable.

The young people of group 3, the 'End NEET' (in the spring 2013), experienced quick access to employment (in April 2011, 40% had a permanent contract and 20% had a fixed-term contract) but from mid-2012, they experienced upheaval and they had been NEET in the spring 2013 for 9 months on average. The young people of group 2, the 'Begin NEET', had a difficult initial transition with a long NEET spell (14 months on average) but they progressively got jobs, mostly on fixed-term contracts, then starting in late 2012 stabilised gradually, and, at the time of the survey, 70% of them were on permanent contracts and 20% were in education. Especially for young people who were already out of education or work at the beginning of the observation period, NEET status tended to be a long-term phenomenon (Table 2): when we look at time spent in employment compared to NEET, group 4 spent 83% of the time in NEET (63% in unemployment, 20% in inactivity) and 14% in employment. Group 2 is more evenly divided with 47% of the time in NEET and 43% in employment; group 3 spent more than half the time in employment and 42% of the time in NEET; as for group 1, the young people spent 84% of the time in employment and 10% in NEET over the three-year period. It may also be observed that, if the average time spent in NEET for the entire population is 10 months without any gender differences, it ranges from 3 months for group 1, 17 months for group 2, 15 months for group 3 to 30 months for group 4 (Table 3). These findings echo the previous results: 10% of young people have never experienced employment during their first 3 years in the labour market. This includes 28% of school-leavers without a diploma, 12% of those with a secondary VET diploma (CAP), 7% of Baccalauréat holders, and 3% of tertiary graduates. More than half of the women and men of group 4 have never had a job.

Strong differentiation of NEET pathways by level of diploma

We will present the specificities of the populations belonging to the four groups and their characteristics from the point of view of educational and social capital.

In terms of diplomas and degrees, there is a clear opposition between, on one side, group 1 'Never NEET', half of whom are tertiary graduates, and, on the other side, group 4 'Always NEET' for which half of the respondents left school without a diploma (Table 4). This table shows a strong structuring of trajectories based on the level of education and the overrepresentation of young people without a diploma in the more extreme NEET pathways. Group 4 combines struggling school careers with degree levels lower than the general population: nearly one-third, mostly male, were late in entering secondary school (compared to 18% of all young people) and onethird experienced constrained study choices in secondary VET track (compared to 22%). When asked about the reasons for ending their studies, the whole population gave the following responses, in order of importance (Table 5): they wished to enter working life (68%), had reached the level of education desired (43%), had enough of studying (40%), financial reasons (22%) or having found a job (36%). Eight percent stopped their studies because they were not admitted into courses to continue their studies and the remaining 8% due to lack of education opportunities close to their place of residence. Youth from group 4 often stressed fatigue with their studies (half compared to 40% of the whole population) and the lack of educational options nearby (14% versus 8%). Financial reasons and the fact of having found a job distinguish group 3 and partly explain the large number of jobs at the beginning of the trajectory. These results highlight the heterogeneity of young people's relationships with their studies when they leave the educational system: young people who experience the toughest NEET trajectories are those who leave the education system most often because they no longer want to attend school while, paradoxically, they are also the least likely to say they have reached their desired level of education. As expected, this strong differentiation of pathways according to diplomas also reflects a demarcation according to the social and ethnic origin of young people. NEETs are found in all family backgrounds although their share is higher among those with modest social origins and cultural backgrounds (Table 6). Thus, most young people from group 4 have a more modest family background: less than 10% have a father or a mother in a professional position (versus 20% of the population), and only 39% have both parents in employment at the end of their studies versus more than the half in the other groups, and two-thirds for group 1. Moreover, young people from immigrant families -particularly coming from North African (Maghreb) countries -are a little more numerous in group 4 (10% versus 6% of the population). Similarly, they are more likely to live in an economically disadvantaged area at the end of their studies if they belong to group 4 or 3 (13% and 10%, respectively, compared to 8% of the population). These first descriptive elements demonstrate the strong heterogeneity of the pathways in NEET status, structured by degree and social origin. Young people most at risk, in the longest NEET trajectories, are often young people with a low level of education, typically those who have dropped out of school, and who come from modest family backgrounds. The combination of these different factors worsens their situation in the labour market. On the other hand, better qualified young people, including those with tertiary degrees, may also be affected by NEET situations, but their situation is more temporary and generally limited to the beginning of their first job search.

Who is most at risk of becoming and remaining a NEET?

The transition between school and work is a critical period in the lives of young people because their entry into the labour market can have a significant effect on their trajectory and NEET status. This section focuses on the risk of being a NEET by using the set of key characteristics identified in the other studies, which places a special focus on educational and social factors. A multinomial model is conducted in order to better identify the characteristics related to the probability of being in one of the four groups, with reference to group 4. The main results show that the risk of becoming NEET for a short period is very different than the risk of being NEET for a long time (the reference category). This difference is influenced by a range of factors and characteristics. Education is the most important factor, and it has the strongest effect on the probability of never being NEET, being a short-term NEET, or a long-term NEET. However, educational level ratios also vary widely across NEET trajectories, with ratios of 0.67 to 2.7 for 'Begin NEET' trajectory and 0.48 to 5.2 for 'End NEET' trajectory. For those who left school without a diploma, the likelihood of belonging to the 'Begin NEET' group rather than 'Always NEET' group decreases by a factor of 0.66 compared to young people with a VET diploma. When controlling for similar educational levels, the reasons for which young people decide to end their studies have a stronger effect on the subsequent labour trajectory. For example, wishing to enter working life, having reached the desired level of education all have positive effects on the probability of being 'Never NEET' or being NEET at the end of the trajectory. These results may suggest a higher motivation to find a first job, but this motivation does not play a protective role later. Other educational characteristics influence the probability of being NEET: having an apprenticeship track appears also as short-term protection against a NEET situation. On the contrary, being more than a year behind in one's grade and constrained educational choice increase the probability of being NEET.

The gender effect is significant, although modest compared to other factors. For men, the odds-ratio of being 'Never NEET' rather than being in the 'Always NEET' category is 1.03. It is interesting to note that this ratio is higher in the first trajectory 'Begin NEET' (1.16), which suggests than men, with less family constraints, succeed in leaving a NEET situation more easily. However, we do not find any significant gender effect for being NEET at the end of the trajectory.

Other results from social and contextual variables confirm that cumulative factors influence the probability of being in a long-term NEET situation. The young people who come from more privileged family background (employed, high socioeconomic status) are more likely to be never NEETs or to avoid a long-term NEET situation.

Parents' education plays a minor role on the likelihood of NEET status although it is still significant: having a father and, notably, a mother without a diploma increases the child's probability of being a long-term NEET (compared to a never or temporary NEET situation). Having at least one parent of immigrant origin has a more contrasting effect: controlling for education and social background, secondgeneration immigrants (mainly from southern European countries) have a lower probability of being always NEET, whereas the effect is generally not significant for the second-generation immigrants from North Africa. In addition, coming from a large family increases the likelihood of being in a long-term NEET situation. Finally, the local economic and educational context is a penalising factor in terms of being NEET (living in ZUS, disadvantaged urban areas, or a region with a higher unemployment rate).

At the end of a first NEET sequence, 77% of young people moved to work, 12% returned to school or training, and 11% remained NEET. For youth who have experienced a first NEET situation, the average duration was 6 months. This section will end with the estimation of the probability of leaving NEET status after the first episode of NEET, using a model of semi-parametric duration (Cox regression model, see Table 8 in Annexe). All things being equal, the probability of leaving a first NEET experience towards employment was lower for youth without a diploma compared to those with a secondary VET diploma (CAP). The probability of transition from NEET status to a job increased with the level of qualifications, and was also higher for young people having completed an apprenticeship track. On the contrary, the transition from a first NEET experience to training and education shows another itinerary. Secondary school-leavers, especially those without a diploma or those who were previously not admitted to further studies, were more likely to return to study or to follow a training course. The situation of baccalauréat holders is unique: they are the only graduates to escape a first NEET experience by getting a job and a training. Indeed, the baccalauréat is in France the key diploma to access to higher education and vocational baccalauréat graduates also find jobs easily. The weight of the social background was, as expected, decisive to find a job: having both parents active, having a professional father, increased the probability. A mother with a tertiary degree played a role to find a job as well as to return to studies. However, social characteristics have no or few significant effects on the probability to return to studies.

Discussion and conclusion

In this paper, we used a dynamic approach to develop a better understanding of the factors that can explain how young people become NEET (individual characteristics, social and ethnic origin, school and family factors) in France. Our analysis of the youth pathways highlights more or less long episodes of NEET over a period of 3 years. Amid the diversity of these situations, our research allows to identify young people who remain locked in NEET status throughout their trajectory. It also highlights the weight of some major explanatory factors, such as the degree level and especially the absence of a diploma, which seem particularly penalising for escaping being a NEET in France. In this respect, this research suggests the limitations of a static approach to the NEET concept, the population being too heterogeneous to isolate at-risk youth. During the first 3 years following the end of the survey, 70% of the young people in the survey had become NEET at least once. In order to characterise this dynamic phenomenon, we studied the school-to-work transition of young people and observed their labour market history over 3 years. Four groups were distinguished according to the occurrence and the temporality of NEET status during the beginning of their professional life: the 'Never NEET', the 'Begin NEET', the 'End NEET' and the 'Always NEET'. They represent, respectively, 60%, 15%, 12% and 13% of the sample. Young people seem to have very different levels of vulnerability in each group. The labour situation of young people in group 4 is the most problematic: they are NEET at the date of the survey and were in a NEET situation for at least two-thirds of the study's duration. It also must be noted that tertiary graduates are represented in the four groups, at least to some extent. If they are overrepresented in group 1 'Never NEET', groups 2 and 3 include a quarter of higher education graduates. However, in both cases, NEET seems to be a temporary situation. One of the interests of the longitudinal approach is to stress that the individual characteristics are not the same between the young people who are NEET at the date of the survey after professional experiences (e.g. group 3) and those who remain NEET throughout their trajectory (group 4). In the latter group, almost half of young people are without qualification, against one quarter in group Overall, group 4 is the furthest from the other three in terms of individual characteristics. Groups 2 and 3, on the other hand, are closer, especially with a quarter of graduates. However, these two groups differ on the reasons for ending studies: group 3 underlines financial reasons, the wish to enter working life and getting a job while group 2 is closer to group 4 (Table 7 'all other things being equal'). Indeed focusing on the youth pathways in the labour market, linked to the NEETs characteristics since the beginning of their trajectories, allows to understand the NEET situation as a temporary experience or an enduring trap. Taking into account for the first time in research the reasons for leaving school in order to analyse the school-to-work transition shows that school experiences (repeating a class level, constrained studies, not admission in further studies, or the lack of training nearby), has an impact on a long recurrent NEET situation. Our main results show that educational factors are strongly related to the risk of being NEET for an extended period. To leave the educational system without a diploma or even with a diploma of secondary vocational education (VET) increases the risk of a long-term NEET situation. In addition, young people who have experienced difficulties at primary school (as shown by late entry to secondary school) or have faced constrained educational choices to have a higher probability of being NEET, which suggests that there is a strong correlation between the difficulties experienced during primary and secondary education and entry into the labour market. However, having an apprenticeship qualification seems to protect against becoming and remaining NEET. This dual qualification acts as positive credential for potential employers, even if young people are in a NEET situation at the beginning of their labour market history. However, our results do not take into account the potential selection bias in apprenticeship in favour of students with higher social and educational characteristics (Bonnal et al., 2012). This dual track remains selective and seems to be associated with forms of discrimination that exclude young people from migrant and low social backgrounds [START_REF] Kergoat | A reflection on inequalities at the crossroad of education and work[END_REF]. A low level of education (individual and parental) is the main determining factor for the long-term NEETs, since their parents are not always in the most favourable social position to support the professional integration of their children. These results can be put into perspective with the labour market public policies developed in France. For example, starting in 2013 on an experimental basis, a Youth Guarantee 5 programme called 'Garantie Jeunes' was gradually implemented. It aimed at supporting young vulnerable NEET towards employment and education through a financial allowance. From 2013 to 2018, 229,400 young people followed this one-year intensive support programme, combined with training and professional immersion. This type of policy prioritises a 'work first' approach to employment, instead of the human-capital approach [START_REF] Greenberg | Do welfare-to-work programmes work for long[END_REF]). An assessment of this Youth Guarantee progamme [START_REF] Loison-Leruste | La Garantie jeunes en action. Usages du dispositif et parcours de jeunes[END_REF] highlights its effects by identifying three types of pathways for young people. After a few months, one group of pathways is characterised by transition into (mostly precarious) jobs. Young people in the second group do not achieve a positive outcome but do seem to improve their employability. However, for the last group, the programme is unsuccessful because the young people are facing psychological, social or economic problems that cannot be solved simply by providing a job. The employability of the third group, which is the most disadvantaged and which resembles our fourth pathway ('Always NEET') remains highly question-able. A personalised training programme for these young people, which would develop a set of cognitive and non-cognitive skills, seems crucial in order to integrate them into the labour market. However, the supply of adapted training programmes, not based on school learning, seems decisive if they are sufficiently accessible. We found that young people in our third and fourth groups more frequently declare ending their studies because they have had enough of studying or because of the lack of nearby educational opportunities. However, a return to study allows the school-leavers with the lowest levels of education to escape the first NEET sequence whereas they have rather limited chances to find a 5 NEET become a target category of employment policy for the first time in France via the Youth Guarantee from October 2013 supported by the Youth Employment Initiative (YEI) and the European Social Fund (ESF) the key EU financial resources.

job. However, our quantitative approach remains unsatisfactory to fully characterise this group of long-term NEET, especially the most marginalised young people. In addition, in-depth qualitative interviews would be useful to get better information on the cumulative factors that result in a long-term NEET situation and to translate the statistical NEET category into more relevant conceptual subcategories [START_REF] Holte | Counting and meeting NEET young people: Methodology, perspective and meaning in research on marginalized youth[END_REF]. For example, [START_REF] Salvà-Mut | NEETs in Spain: An analysis in a context of economic crisis[END_REF], underline the different interacting factors (low education, health and drug problems) that lead to the 'discouraged-disengaged' group of young Spanish NEETs. Their biographical interviews allow them to go further in their under-standing of the dynamics of NEET experiences.

Disclosure statement

No potential conflict of interest was reported by the authors.

Figure 1 .

 1 Figure 1. Source: Céreq 'Génération 2010' survey (NEET in black).

Figure 2 .

 2 Figure 2. Source: Céreq 'Génération 2010' survey (NEET in black).

Table 1 .

 1 Situation in Spring 2013.

	Employment Neet	Study	Total	Age mean
	Without diploma	39	49	12	100	18
	CAP (VET)	61	34	5	100	19
	Baccalauréat	65	21	14	100	21
	Tertiary diploma	83	12	5	100	23
	Total	66	25	9	100	21
	Women	66	24	10	100	21
	Men	67	25	8	100	21
	Source: Céreq 'Génération 2010ʹ survey.
	Note: 67% of young men are in employment in spring 2013, 25% are NEET and 8% are
	in education or training.

Table 2 .

 2 Time spent in the diverse situations (in %).

		Group 4 Group 3	Group 2 Group 1	Total
	NEET	83	42	47	10	29
	-unemployment	63	34	33	7	22
	-inactivity	20	8	14	3	7
	Employment	14	53	43	84	65
	Study	3	5	10	6	6
	Total	100	100	100	100	100

Source: Céreq's Génération 2010 survey. Note: 83% of young people of the group 4 spent 83% of their time in NEET status (63% are unemployed and 20% are inactive).

Table 3 .

 3 Number of months spent in NEET status (in %).

		Group 4 Group 3 Group 2 Group 1	Total
	Mean of NEET duration 30 months 15 months 17 months 3 months 10 months
	0 month				50	30
	1-3 months		13	1	25	16
	4-6 months		12	12	10	9
	7-12 months	4	27	29	9	13
	13-18 months	10	19	27	4	10
	19-24 months	14	15	16	2	7
	24 months +	72	14	16		14
	Total	100	100	100	100	100
	Source: Céreq's Génération 2010 survey
	Note: the time spent in NEET status is 30 months for group 4; 72% of young people
	of group 4 spent more than 24 months in NEET status.

Table 4 .

 4 The highest diploma according the groups (in %).

		Group 4	Group 3	Group 2	Group 1	Total
	Without Diploma	47	22	28	8	18
	CAP (VET)	21	21	18	12	15
	Baccalauréat	21	32	28	32	30
	Tertiary diploma	11	25	26	47	37
	Total	100	100	100	100	100

Source: Céreq's Génération 2010 survey Note: In group 4, 47% of youth have no diploma, 21% are holders of secondary VET diploma, 21% have the baccalauréat and 11% have a graduate diploma.

Table 5 .

 5 The main reasons to stop studies (in %) .

		Group 4 Group 3 Group 2 Group 1 Total
	Wanted working life	57	69	61	72	68
	Had enough of studying	48	43	46	36	40
	Reached the level desired	25	36	34	51	43
	Financial reason	19	28	18	22	22
	Job found	8	35	12	49	36
	Not admitted in further studies 12	8	12	7	8
	No training nearby	14	9	10	6	8

Table 6 .

 6 The family background (in %).

		Group 4 Group 3 Group 2 Group 1 Total
	Two French parents	76	77	79	83	81
	Two North-African parents	10	8	6	5	6
	Parents in employment	39	52	51	62	56
	Parents not in employment	21	14	13	8	11
	Father professional	11	20	21	26	23
	Father worker/clerk	62	53	51	43	48
	Mother professional	9	12	14	18	16
	Mother worker/clerk	76	73	69	64	67
	Father without diploma	27	23	23	22	23
	Father with tertiary diploma	7	13	15	21	17
	Source: Céreq's Génération 2010 survey.
	Note: In group 4, 76% of young people have two parents of French nationality, 39% have
	both parents in employment . . .

Table 7 .

 7 The multinomial model on the probability of the four school-towork transition groups (reference group 4 'Always Neet'). Generation 2010 survey *** = significant to 1%; ** = significant to 5%; * = significant to 10%. Note: in the model, all things equal, youth without diploma are less likely to be in the group 1 'never neet' than in the reference group ('always neet').

	Population 1	Population 2	Population 3
	'Never Neet'	'Begin Neet'	'End Neet'

Table 8 .

 8 The probability of escaping from NEET towards employment or education. : in the model, all things equal, youth without a diploma are less likely to escape from the first NEET experience towards employment and more likely to escape from NEET towards education or training. The Cox model (semi-parametric estimation) is used in order to estimate the impact of socio-demographic variables on the probability of leaving the first period in NEET towards job or education.

	Employment Education &
	training
	Hazard Ratio Hazard Ratio

Note

Young people without any diploma (ISCED 0-2).

Baccalauréat (ISCED 3) is the standard final diploma of upper secondary education as far as the gateway to higher institutions is concerned

Source: Céreq's Génération 2010 survey. Note: In group 4, 57% young people give the reason to enter active life . . .

Funding

This research is a part of a project on NEETs funded by the French National Research Agency under Grant number ANR-15-ORAR-0005-01.; Agence Nationale de la Recherche [ANR-15-ORAR-0005-01].

Notes on contributors

Jean-François Giret is a Full Professor of Education at the University of Burgundy, as well as the Director of the Institute for Research in the Sociology and Economics of Education (IREDU) and the Director of the regional associated centre of the French Centre for Research in Education, Training and Employment (Céreq) for the Burgundy region. He obtained his PhD in Economics from the University Capitole-Toulouse 1 with a thesis titled 'An economic analysis of school to work transition' (1998). At the beginning of his career, he was a Marie Curie postdoctoral researcher at the Autonomous University of Barcelona and then a senior researcher at Céreq. His research interests include the transition from school to work, skill mismatch, and youth employability. He has published many scientific articles and several books in the fields of Economics and Education. His most recent international publications appeared in Gender and Education, Applied Economics, Applied Economics Letter, European Journal of Education, Journal Economics of Innovation and New Technology, Journal of Vocational Behavior, European Journal of Higher Education, International Journal of Educational Research, and International Journal of Manpower. He acts as an expert for several national and international institutions, such as the World Bank, PNUD, the French Ministry of Foreign Affairs, and CEDEFOP.

Christine Guégnard is a Senior Researcher in Educational Sciences at the Institute for Research in the Sociology and Economics of Education (IREDU) and the regional associated centre of the French Centre for Research in Education, Training and Employment (Céreq) at the University of Burgundy in France. Her research activities highlight the training and employment relationship, and more particularly youth transitions into the labour market (looking at the experience of apprentices as well as VET and higher education graduates). Her research interests include the assessment of educational and employment policies in terms of gender, social, and ethnic inequalities from a comparative perspective. For example, she studies access to higher education and careers in hospitality using both quantitative and qualitative methods. She has been involved in various European comparative research projects, such as EduLife, Low-Wage Workers, Reflex, Meda, and Leonardo da Vinci, and has published on these topics. She has published relevant articles in the Comparative Education Review, Rassegna italiana di Sociologia, International Journal of Manpower, and European Journal of Higher Education, as well as by the Cedefop Panorama and Russell Sage Foundation.

Olivier Joseph holds a master's degree from the University of Paris Panthéon Sorbonne. He then joined the French Centre for Research in Education, Training and Employment (Céreq) as a researcher. He works in the Céreq DEEVA department, which studies the school-to-work transitions of new entrants in the labour market, and how this depends on the level at which they left the educational system. His research topics include discrimination in the labour market, youth unemployment, public service employment, and internships. He is particularly interested in young people who participated in secondary vocational education and apprenticeships in France. He has published relevant articles in: Formation Emploi, Revue Economique, Labour Economics, Brussels Economics Review.