diff --git a/sds/detectors_evaluation/images/complexity.png b/DSD/sds/detectors_evaluation/images/complexity.png
similarity index 100%
rename from sds/detectors_evaluation/images/complexity.png
rename to DSD/sds/detectors_evaluation/images/complexity.png
diff --git a/sds/detectors_evaluation/images/complexity.svg b/DSD/sds/detectors_evaluation/images/complexity.svg
similarity index 100%
rename from sds/detectors_evaluation/images/complexity.svg
rename to DSD/sds/detectors_evaluation/images/complexity.svg
diff --git a/sds/detectors_evaluation/images/detection_freeze.png b/DSD/sds/detectors_evaluation/images/detection_freeze.png
similarity index 100%
rename from sds/detectors_evaluation/images/detection_freeze.png
rename to DSD/sds/detectors_evaluation/images/detection_freeze.png
diff --git a/sds/detectors_evaluation/images/image2.svg b/DSD/sds/detectors_evaluation/images/image2.svg
similarity index 100%
rename from sds/detectors_evaluation/images/image2.svg
rename to DSD/sds/detectors_evaluation/images/image2.svg
diff --git a/sds/detectors_evaluation/images/images.svg.svg b/DSD/sds/detectors_evaluation/images/images.svg.svg
similarity index 100%
rename from sds/detectors_evaluation/images/images.svg.svg
rename to DSD/sds/detectors_evaluation/images/images.svg.svg
diff --git a/sds/detectors_evaluation/main.tex b/DSD/sds/detectors_evaluation/main.tex
similarity index 100%
rename from sds/detectors_evaluation/main.tex
rename to DSD/sds/detectors_evaluation/main.tex
diff --git a/sds/detectors_evaluation/scripts/priority_threshold_technics.ipynb b/DSD/sds/detectors_evaluation/scripts/priority_threshold_technics.ipynb
similarity index 100%
rename from sds/detectors_evaluation/scripts/priority_threshold_technics.ipynb
rename to DSD/sds/detectors_evaluation/scripts/priority_threshold_technics.ipynb
diff --git a/README.md b/README.md
deleted file mode 100644
index cda736b..0000000
--- a/README.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# Presentations
-
-This repo contain all my presentations. Do not read stuff you are not supposed to.
-
-
-## Usage:
-
-```
-tlmgr install `cat requirements.txt`
-latexmk main.tex -pdf
-```
diff --git a/hp_psu/notes.typ b/hp_psu/notes.typ
deleted file mode 100644
index e1ceccf..0000000
--- a/hp_psu/notes.typ
+++ /dev/null
@@ -1,27 +0,0 @@
-#import "@preview/acrostiche:0.3.1": *
-
-
-#init-acronyms((
- "PSU": ("Power Supply Unit","Power Supplu Units"),
- "PCB": ("Printed Circuit Board",),
-))
-
-= Exploration of the retrofitting of HP Power Supplies to EET
-
-The objective is the build a proof-of-concept for using an EET capture card on the 12V rail of a server #acr("PSU") without changing the form factor.
-The targets are as many HP server-grade #acr("PSU") as possible.
-At the time of writing this note, we have access to three #acrpl("PSU"):
- - // fill with infos
-
-
-= Current Share ISHARE pin
-Because the server #acrpl("PSU") are tightly integrated, it is very difficult to tap into their 12V rail.
-The difficulty comes from the fact that the current gets generated directly on the #acr("PCB") and is not carried over a wire that we can cut.
-Cutting a trace of tampering with the #acr("PCB") is completely out of the question.
-
-Fortunately, server #acr("PSU") have a feature called ~Current Sharing~ that enables using multiple sources to provide more current to a system.
-The simplest implementation would be to connect multiple #acr("PSU") in parallel to the same 12V rail.
-This solution is presented to be non-robust by many sources although they all recomend to use an external system that share the load between the sources, which is exactly what this solution is doing.
-In any case, the server #acr("PSU") often include an analog output that is proportional to their current and enables an external circuit to adjust their voltage based on their current to spread the load.
-This analog output can also serve as an information source for remote monitoring system.
-The actual reason why this output is there remain somewhat hidden but the important fact is that the #acrpl("PSU") provides us with their current information, which is all we nned.
diff --git a/lv/capture_presentation/power_pipeline.pdf b/lv/capture_presentation/power_pipeline.pdf
deleted file mode 100644
index 828f9ac..0000000
Binary files a/lv/capture_presentation/power_pipeline.pdf and /dev/null differ
diff --git a/palitronica/bell/l3-setup.svg b/palitronica/bell/l3-setup.svg
deleted file mode 100644
index 0a9d250..0000000
--- a/palitronica/bell/l3-setup.svg
+++ /dev/null
@@ -1,137 +0,0 @@
-
-
-
-
diff --git a/palitronica/bell/overview.typ b/palitronica/bell/overview.typ
deleted file mode 100644
index a69d221..0000000
--- a/palitronica/bell/overview.typ
+++ /dev/null
@@ -1,57 +0,0 @@
-#let title = "Overview of the Bell System Architecture"
-
-
-#set page("us-letter",
-header: [
- #set text(8pt)
- #smallcaps[#title]
- #h(1fr) Arthur Grisel-Davy for Palitronica Inc.
- ],
-footer: [
- #set align(right)
- #set text(8pt)
- #counter(page).display(
- "1",
- )
- ]
-)
-
-#align(center)[#text(weight:"bold",size:20pt)[#title]]
-
-#v(2cm)
-#outline(indent: 1em)
-
-#pagebreak()
-= Schematic
-#align(center)[
-#figure(
- image("schematic.svg",width:100%)
-)
-]
-
-#pagebreak()
-= Technical Information
-
-Here is the information that we have or suppose about the different components of the system.
-
-== Chassi
-The chassi of the VMC is an ELMA COTS 3u VPX Tower Enclosure.
-The chassi include a backpane and an integrated PSU that provides DC power to the boards.
-The PSU accepts from 90 to 264 VAC and inclued Power Factor Control technology (limit reactive power).
-
-#text(fill:red)[Q: It would be helpful to get a schematic or a photo of how the boards are installed in the chassi, and how they receive power.]
-
-== 68PPC2 SBC
-The board in the first slot of the chassi is a 68PPC2.
-This board is connected to the Mission Computer (via the Comm. Converter Board).
-It is unclear if this board processes some data or if it is only responsible for communication.
-This board does have a quad-core CPU so it might be procesing data.
-
-#text(fill:red)[Q: Info about the role of this card would be helpful in identifying the points of interest.]
-
-== 68G5
-The second board, installed in slot 3, is a 68G5.
-The role of this board needs to be clarified. It is connected to the Software Control Module (SCM) but the role of both these components is unclear.
-
-
-#text(fill:red)[Q: Info about the role of this card would be helpful in identifying the points of interest. In particular this board can be equipped with up to 3 modules. Knowing which module is installed can help assessing the interest.]
diff --git a/palitronica/bell/schematic.png b/palitronica/bell/schematic.png
deleted file mode 100644
index 996be5b..0000000
Binary files a/palitronica/bell/schematic.png and /dev/null differ
diff --git a/palitronica/bell/schematic.svg b/palitronica/bell/schematic.svg
deleted file mode 100644
index 7f794fc..0000000
--- a/palitronica/bell/schematic.svg
+++ /dev/null
@@ -1,529 +0,0 @@
-
-
-
-
diff --git a/bip_boop/related_work.svg b/pococha/related_work.svg
similarity index 100%
rename from bip_boop/related_work.svg
rename to pococha/related_work.svg
diff --git a/lv/capture_presentation/power_pipeline.svg b/procver/lv/capture_presentation/power_pipeline.svg
similarity index 100%
rename from lv/capture_presentation/power_pipeline.svg
rename to procver/lv/capture_presentation/power_pipeline.svg
diff --git a/lv/correlation/notes.typ b/procver/lv/correlation/notes.typ
similarity index 100%
rename from lv/correlation/notes.typ
rename to procver/lv/correlation/notes.typ
diff --git a/lv/initial_presentation/presentation/images/2d_p1.svg b/procver/lv/initial_presentation/presentation/images/2d_p1.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/2d_p1.svg
rename to procver/lv/initial_presentation/presentation/images/2d_p1.svg
diff --git a/lv/initial_presentation/presentation/images/2d_p2.svg b/procver/lv/initial_presentation/presentation/images/2d_p2.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/2d_p2.svg
rename to procver/lv/initial_presentation/presentation/images/2d_p2.svg
diff --git a/lv/initial_presentation/presentation/images/2d_p3.svg b/procver/lv/initial_presentation/presentation/images/2d_p3.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/2d_p3.svg
rename to procver/lv/initial_presentation/presentation/images/2d_p3.svg
diff --git a/lv/initial_presentation/presentation/images/2d_p4.svg b/procver/lv/initial_presentation/presentation/images/2d_p4.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/2d_p4.svg
rename to procver/lv/initial_presentation/presentation/images/2d_p4.svg
diff --git a/lv/initial_presentation/presentation/images/2d_p5.svg b/procver/lv/initial_presentation/presentation/images/2d_p5.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/2d_p5.svg
rename to procver/lv/initial_presentation/presentation/images/2d_p5.svg
diff --git a/lv/initial_presentation/presentation/images/2d_p6.svg b/procver/lv/initial_presentation/presentation/images/2d_p6.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/2d_p6.svg
rename to procver/lv/initial_presentation/presentation/images/2d_p6.svg
diff --git a/lv/initial_presentation/presentation/images/2d_view.svg b/procver/lv/initial_presentation/presentation/images/2d_view.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/2d_view.svg
rename to procver/lv/initial_presentation/presentation/images/2d_view.svg
diff --git a/lv/initial_presentation/presentation/images/2w_experiment.svg b/procver/lv/initial_presentation/presentation/images/2w_experiment.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/2w_experiment.svg
rename to procver/lv/initial_presentation/presentation/images/2w_experiment.svg
diff --git a/lv/initial_presentation/presentation/images/Page 11.svg b/procver/lv/initial_presentation/presentation/images/Page 11.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/Page 11.svg
rename to procver/lv/initial_presentation/presentation/images/Page 11.svg
diff --git a/lv/initial_presentation/presentation/images/Page 13.svg b/procver/lv/initial_presentation/presentation/images/Page 13.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/Page 13.svg
rename to procver/lv/initial_presentation/presentation/images/Page 13.svg
diff --git a/lv/initial_presentation/presentation/images/aproach_all.svg b/procver/lv/initial_presentation/presentation/images/aproach_all.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/aproach_all.svg
rename to procver/lv/initial_presentation/presentation/images/aproach_all.svg
diff --git a/lv/initial_presentation/presentation/images/aproach_p1.svg b/procver/lv/initial_presentation/presentation/images/aproach_p1.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/aproach_p1.svg
rename to procver/lv/initial_presentation/presentation/images/aproach_p1.svg
diff --git a/lv/initial_presentation/presentation/images/aproach_p2.svg b/procver/lv/initial_presentation/presentation/images/aproach_p2.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/aproach_p2.svg
rename to procver/lv/initial_presentation/presentation/images/aproach_p2.svg
diff --git a/lv/initial_presentation/presentation/images/aproach_p3.svg b/procver/lv/initial_presentation/presentation/images/aproach_p3.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/aproach_p3.svg
rename to procver/lv/initial_presentation/presentation/images/aproach_p3.svg
diff --git a/lv/initial_presentation/presentation/images/aproach_p4.svg b/procver/lv/initial_presentation/presentation/images/aproach_p4.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/aproach_p4.svg
rename to procver/lv/initial_presentation/presentation/images/aproach_p4.svg
diff --git a/lv/initial_presentation/presentation/images/aproach_p5.svg b/procver/lv/initial_presentation/presentation/images/aproach_p5.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/aproach_p5.svg
rename to procver/lv/initial_presentation/presentation/images/aproach_p5.svg
diff --git a/lv/initial_presentation/presentation/images/aproach_p6.svg b/procver/lv/initial_presentation/presentation/images/aproach_p6.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/aproach_p6.svg
rename to procver/lv/initial_presentation/presentation/images/aproach_p6.svg
diff --git a/lv/initial_presentation/presentation/images/aproach_p7.svg b/procver/lv/initial_presentation/presentation/images/aproach_p7.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/aproach_p7.svg
rename to procver/lv/initial_presentation/presentation/images/aproach_p7.svg
diff --git a/lv/initial_presentation/presentation/images/aproach_p8.svg b/procver/lv/initial_presentation/presentation/images/aproach_p8.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/aproach_p8.svg
rename to procver/lv/initial_presentation/presentation/images/aproach_p8.svg
diff --git a/lv/initial_presentation/presentation/images/aproach_p9.svg b/procver/lv/initial_presentation/presentation/images/aproach_p9.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/aproach_p9.svg
rename to procver/lv/initial_presentation/presentation/images/aproach_p9.svg
diff --git a/lv/initial_presentation/presentation/images/areas.svg b/procver/lv/initial_presentation/presentation/images/areas.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/areas.svg
rename to procver/lv/initial_presentation/presentation/images/areas.svg
diff --git a/lv/initial_presentation/presentation/images/dsd_acc.svg b/procver/lv/initial_presentation/presentation/images/dsd_acc.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/dsd_acc.svg
rename to procver/lv/initial_presentation/presentation/images/dsd_acc.svg
diff --git a/lv/initial_presentation/presentation/images/metric.svg b/procver/lv/initial_presentation/presentation/images/metric.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/metric.svg
rename to procver/lv/initial_presentation/presentation/images/metric.svg
diff --git a/lv/initial_presentation/presentation/images/overview.svg b/procver/lv/initial_presentation/presentation/images/overview.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/overview.svg
rename to procver/lv/initial_presentation/presentation/images/overview.svg
diff --git a/lv/initial_presentation/presentation/images/overview_test.svg b/procver/lv/initial_presentation/presentation/images/overview_test.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/overview_test.svg
rename to procver/lv/initial_presentation/presentation/images/overview_test.svg
diff --git a/lv/initial_presentation/presentation/images/preds.svg b/procver/lv/initial_presentation/presentation/images/preds.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/preds.svg
rename to procver/lv/initial_presentation/presentation/images/preds.svg
diff --git a/lv/initial_presentation/presentation/images/proof.svg b/procver/lv/initial_presentation/presentation/images/proof.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/proof.svg
rename to procver/lv/initial_presentation/presentation/images/proof.svg
diff --git a/lv/initial_presentation/presentation/images/rules_pipeline.svg b/procver/lv/initial_presentation/presentation/images/rules_pipeline.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/rules_pipeline.svg
rename to procver/lv/initial_presentation/presentation/images/rules_pipeline.svg
diff --git a/lv/initial_presentation/presentation/images/timeline_pastwork.svg b/procver/lv/initial_presentation/presentation/images/timeline_pastwork.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/timeline_pastwork.svg
rename to procver/lv/initial_presentation/presentation/images/timeline_pastwork.svg
diff --git a/lv/initial_presentation/presentation/images/wein.svg b/procver/lv/initial_presentation/presentation/images/wein.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/wein.svg
rename to procver/lv/initial_presentation/presentation/images/wein.svg
diff --git a/lv/initial_presentation/presentation/images/wein_p1.svg b/procver/lv/initial_presentation/presentation/images/wein_p1.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/wein_p1.svg
rename to procver/lv/initial_presentation/presentation/images/wein_p1.svg
diff --git a/lv/initial_presentation/presentation/images/wein_p2.svg b/procver/lv/initial_presentation/presentation/images/wein_p2.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/wein_p2.svg
rename to procver/lv/initial_presentation/presentation/images/wein_p2.svg
diff --git a/lv/initial_presentation/presentation/images/wein_p3.svg b/procver/lv/initial_presentation/presentation/images/wein_p3.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/wein_p3.svg
rename to procver/lv/initial_presentation/presentation/images/wein_p3.svg
diff --git a/lv/initial_presentation/presentation/images/wein_p4.svg b/procver/lv/initial_presentation/presentation/images/wein_p4.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/wein_p4.svg
rename to procver/lv/initial_presentation/presentation/images/wein_p4.svg
diff --git a/lv/initial_presentation/presentation/images/wein_p5.svg b/procver/lv/initial_presentation/presentation/images/wein_p5.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/wein_p5.svg
rename to procver/lv/initial_presentation/presentation/images/wein_p5.svg
diff --git a/lv/initial_presentation/presentation/images/wein_p6.svg b/procver/lv/initial_presentation/presentation/images/wein_p6.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/wein_p6.svg
rename to procver/lv/initial_presentation/presentation/images/wein_p6.svg
diff --git a/lv/initial_presentation/presentation/images/xpsu_illustration.svg b/procver/lv/initial_presentation/presentation/images/xpsu_illustration.svg
similarity index 100%
rename from lv/initial_presentation/presentation/images/xpsu_illustration.svg
rename to procver/lv/initial_presentation/presentation/images/xpsu_illustration.svg
diff --git a/lv/initial_presentation/presentation/presentation.typ b/procver/lv/initial_presentation/presentation/presentation.typ
similarity index 100%
rename from lv/initial_presentation/presentation/presentation.typ
rename to procver/lv/initial_presentation/presentation/presentation.typ
diff --git a/lv/ongoing_notes/example_logs_lag.svg b/procver/lv/notes_logs/example_logs_lag.svg
similarity index 100%
rename from lv/ongoing_notes/example_logs_lag.svg
rename to procver/lv/notes_logs/example_logs_lag.svg
diff --git a/lv/ongoing_notes/graph_init_2.svg b/procver/lv/notes_logs/graph_init_2.svg
similarity index 100%
rename from lv/ongoing_notes/graph_init_2.svg
rename to procver/lv/notes_logs/graph_init_2.svg
diff --git a/lv/ongoing_notes/lag.svg b/procver/lv/notes_logs/lag.svg
similarity index 100%
rename from lv/ongoing_notes/lag.svg
rename to procver/lv/notes_logs/lag.svg
diff --git a/lv/ongoing_notes/notes.typ b/procver/lv/notes_logs/notes.typ
similarity index 100%
rename from lv/ongoing_notes/notes.typ
rename to procver/lv/notes_logs/notes.typ
diff --git a/procver/lv/ongoing_notes/example_logs_lag.svg b/procver/lv/ongoing_notes/example_logs_lag.svg
new file mode 100644
index 0000000..2e56790
--- /dev/null
+++ b/procver/lv/ongoing_notes/example_logs_lag.svg
@@ -0,0 +1,35079 @@
+
+
+
diff --git a/procver/lv/ongoing_notes/graph_init_2.svg b/procver/lv/ongoing_notes/graph_init_2.svg
new file mode 100644
index 0000000..94a3b22
--- /dev/null
+++ b/procver/lv/ongoing_notes/graph_init_2.svg
@@ -0,0 +1,1519 @@
+
+
+
+
+
diff --git a/procver/lv/ongoing_notes/lag.svg b/procver/lv/ongoing_notes/lag.svg
new file mode 100644
index 0000000..b5d8302
--- /dev/null
+++ b/procver/lv/ongoing_notes/lag.svg
@@ -0,0 +1,10070 @@
+
+
+
diff --git a/procver/lv/ongoing_notes/notes.typ b/procver/lv/ongoing_notes/notes.typ
new file mode 100644
index 0000000..10421f3
--- /dev/null
+++ b/procver/lv/ongoing_notes/notes.typ
@@ -0,0 +1,66 @@
+/*#set text(font: "Essays1743")*/
+
+= Redundancy Check
+
+To cut through the noise in the logs, I am bringing back from retirement the log verification algorithm.
+This algorithm applies hierarchical clustering to the logs using a custom distance metric.
+The main thing to remember is that the only parameter is the ~distance threshold~ that is expressed as a number of second.
+This threshold represents the maximum average time two logs can be apart to be considered redundant.
+A value around 1s should be a pretty good value for this type of data.
+
+Quick stats.: as of April 16, the machine b-06 generated 9002 log entries across 170 unique logs.
+This number is missleading because the uniqueness of the logs is determined based on the path of the application that starts or stops.
+However, this path changes for two may reason:
+
+- When the user changes, the same application start from a different user directory. It is not clear if the same application runing from two different user directory should be considered different applications or not.
+- Sometimes, an application will have a change in capitalization in its name. For example, `C:\\[...]\BackgroundTaskHost.exe` exists also as `C:\\[...]\backgroundTaskHost.exe` or even simply `backgroundTaskHost.exe` without absolute path. This makes it difficult to combine back together the different version of the same app.
+
+#figure(caption: "Initial redundancy graph with threshold 2s",
+image("graph_init_2.svg", width:100%)
+)
+
+The initial exploration does not try to clean the logs.
+The log selection algo runs with a distance threshold of 2 seconds and produces the result in #label("graph_init").
+There are some good results in this graph.
+Mostly, most clusters seems to make sense. For example cluster Z groups together maple-related apps, cluster L groups chrome-related apps, and cluster Q groups things I don't know about but have similar names.
+However, we can identify a number of issues and mainly:
+
+- Some apps name appear twice or more. This is likely due to inconsistencies in the path or user sessions.
+- The clusters do not take into accound the type of log --- starting or stoping the app.
+
+The initial idea would be to clean to logs to get a better or more clustering.
+However I have made this mistake too many time so I first need to assess if the clustering is good or not.
+No need to leak info into the data if the clustering is good.
+If it is not, I need a quantitative way of evaluating if I make it better or not.
+How do you evaluate if a clustering is good? No idea.
+Lets start by visualizing what these clusters look like in a time series.
+
+
+= Lag
+If only this was lab data, we would make sure the timings a synced up before the experiment.
+However, this is the real world and in the real world the university does not consult me when setting up their log collection system.
+As a result, the logs seems to lag behind the power traces (or the other way around, but let's say its them).
+Given that we are considering patterns of logs in the order of < 1s, any lag of more than one second is game breaking.
+Visually, we can estimate that the lag is around 1h (so game is so broken there is no game anymore).
+We can also hypothesized that, for each machine, the lag is constant in time (but may not be constant accross machines).
+
+#figure(caption: "Example of log vs power lag",
+image("example_logs_lag.svg", width:100%)
+)
+
+To estimate a constant lag, the cross-correlation is an obvious choice.
+The cross correlation presents the corelation of two signals for all possible values of lag between them.
+With the strong assumption that the density of logs should be exactly correlated with the power consumption, we can compute the correlation between the log series and the time series.
+
+#align(center)[~Hold up a minute, the log series is not a time series, so it cannot be compared with the power consumption data trivially.~]
+That is true. We first need to convert the log series in a time series to compute the cross-correlation.
+There are many ways to do that so I started with the simplest:
+1. Create an array of all zeros with the same shape as the power trace.
+2. Place a one at each time stamps where a log happens. Add thelm if multiple.
+3. Apply a moving average filter multiple times to smooth the data.
+4. Compute the cross correlation between the power trace and the logs.
+
+
+#figure(caption: "Lag computation using cross correlation.",
+image("lag.svg", width:100%)
+)
diff --git a/lv/seminar/images/intro_normal_hids.svg b/procver/lv/seminar/images/intro_normal_hids.svg
similarity index 100%
rename from lv/seminar/images/intro_normal_hids.svg
rename to procver/lv/seminar/images/intro_normal_hids.svg
diff --git a/lv/seminar/images/overview_verification_step.svg b/procver/lv/seminar/images/overview_verification_step.svg
similarity index 100%
rename from lv/seminar/images/overview_verification_step.svg
rename to procver/lv/seminar/images/overview_verification_step.svg
diff --git a/lv/seminar/presentation.typ b/procver/lv/seminar/presentation.typ
similarity index 100%
rename from lv/seminar/presentation.typ
rename to procver/lv/seminar/presentation.typ
diff --git a/requirements.txt b/requirements.txt
deleted file mode 100644
index 64b3232..0000000
--- a/requirements.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-ulem
-pgfplots
-dateplot
-
diff --git a/scheduling/images/polyfit.svg b/scheduling/images/polyfit.svg
deleted file mode 100644
index 69880ae..0000000
--- a/scheduling/images/polyfit.svg
+++ /dev/null
@@ -1,1297 +0,0 @@
-
-
-
diff --git a/scheduling/scheduling.typ b/scheduling/scheduling.typ
deleted file mode 100644
index 0e49ddd..0000000
--- a/scheduling/scheduling.typ
+++ /dev/null
@@ -1,61 +0,0 @@
-#import "@preview/acrostiche:0.3.2": *
-
-#init-acronyms((
- "EBS": ("Equation-Based Scheduling",),
-))
-
-#align(center)[#text(size:2em)[Equation-Based Scheduling]]
-
-
-The principle of #acr("EBS") is to use a function to determine which task is allowed to communicate at anypoint in time.
-This principle provide a mathematically proovable way for each task to determine when to communicate without collision.
-
-*Problem Statement:*
-#grid(
- columns: (1fr,15fr,1fr),
- [],[
- Given $n$ tasks $t_i, i in [0,n-1]$,
- and a schedule array of $m$ time periods $A = [x_0, dots.h.c, x_(m-1)]$
- where each element $x_i in [t_0,dots.h.c, t_(n-1)]$ is the task allowed to communicate at time $tau_i$,
- provide a scheduling functions $s$ such that,
- for each time period $tau_i$, $s(tau_i) = A[tau_i]$.
- ],
- []
-)
-
-= Polynomials
-
-Contrary to popular beliefs, polynomials are not boring.
-Let us consider a problem with four tasks $(t_0,t_1,t_2,t_3)$ and a schedule array of 20 time periods
-$
-A = [0,1,2,3,0,0,1,2,0,1,2,3,0,3,0,2,3,2,0,1]
-$
-
-#figure(
- image("images/polyfit.svg", width:100%),
- caption: "Scheduling function defined as a polynomial fit of the scheduling array."
-)
-
-== Clock Sensitivity
-In order for every task to know when they can transmit, they all need to evaluate the scheduling function at the same times.
-In the real world, that could be very difficult as the clock of each task can drift over time.
-Some people suggested to use atomic clock chips as the RTC of clock so that, after a syncronisation phase, all timings across tasks would remain exact #footnote[Atomic clocks drift is estimated at one second per hunred million year (Wikipedia).].
-However, I suspect that the person proposing this solution have atomic clock in their office drawer and don't think of us, mere students, that do not have 6k to invest in a fancy clock.
-
-This raises the question; How sensitive is a scheduling function to clock imprecision?
-After all, the function is exact on the start of the period but has no constraint during the period.
-We define the clock sensitivity of a scheduling function $"cs"(s)$ as the maximum time delta around any period start without an incorrect task decision.
-$
-"cs"(s) = max_(delta t)(s(tau_i plus.minus delta t) = A[tau_i]; forall tau_i)
-$
-
-Let us consider again the example displayed in @fig-polyfit.
-As the degree of the polynomial grows to perfectly fit the schedul, extreme variations appear during the periods.
-These extreme variations induce high derivative of the function at the sampling time that makes the clock sensitivity very small.
-
-== Problems with Polynomials
-A single polynomial fitted to the schedul does not seem like a good approach as it require a very precise clock to obtain the correct values.
-Moreover, storing the polynomial coefficient for the function requires at least as much memory as storing the schedule itself.
-Finally, evaluating the function is more computation-intensive than looking up a value in a table.
-
-= Regression, imprefect fit, and flatten scheduling array.
diff --git a/scolarship_CPI/biblio.yml b/scolarship_CPI/biblio.yml
deleted file mode 100644
index c2c72d0..0000000
--- a/scolarship_CPI/biblio.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-bpv:
- type: Article
- title: Independent Boot Process Verification using Side-Channel Power Analysis
- author:
- - Grisel-Davy, Arthur
- - Fischmeister, Sebastian
- date: 2023-10-22
- parent:
- - type: Conference
- title:
- value: IEEE International Conference on Software Quality, Reliability and Security
- short: QRS 2023
- location: Chiang Mai, Thailand
-
-wip-bpv:
- type: Article
- title: "Work-in-Progress: Boot Sequence Integrity Verification with Power Analysis"
- author:
- - Grisel-Davy, Arthur
- - Bhogayata, Amrita Milan
- - Pabbi, Srijan
- - Narayan, Apurva
- - Fischmeister, Sebastian
- date: 2022-10-07
- parent:
- - type: Conference
- title:
- value: 2022 International Conference on Embedded Software
- short: EMSOFT 2022
- location: Shanghai, China
-
-
-
-eet1:
- type: Article
- title: "Side-channel Based Runtime Intrusion Detection for Network Equipment"
- author:
- - Grisel-Davy, Arthur
- - Guler, Goksen
- - Dicket, Julian
- - Vibien, Philippe,
- - Khan, Waleed,
- - Morgan, Jack,
- - Moreno, Carlos,
- - Fischmeister, Sebastian
- date: 2023-09-22
- parent:
- - type: Conference
- title:
- value: 5th Workshop on Machine Learning for CyberSecurity
- short: MLCS 2023
- location: Torino, Italy
-
-
-
-mad:
- type: Article
- title: "MAD: One-Shot Machine Activity Detector for Physics-Based Cyber Security"
- author:
- - Grisel-Davy, Arthur
- - Fischmeister, Sebastian
- date: 2023-10-22
- parent:
- - type: Conference
- title:
- value: IEEE International Conference on Software Quality, Reliability and Security
- short: QRS 2023
- location: Chiang Mai, Thailand
-
-
-
diff --git a/scolarship_CPI/letter.typ b/scolarship_CPI/letter.typ
deleted file mode 100644
index e16b17c..0000000
--- a/scolarship_CPI/letter.typ
+++ /dev/null
@@ -1,53 +0,0 @@
-#import "@preview/acrostiche:0.3.0": *
-
-#init-acronyms((
- "IDS": ("Intrusion Detection System"),
- "BPV": ("Boot Process Verification"),
-))
-
-
-#set page("us-letter")
-
-
-
-I am recommending Arthur Grisel-Davy for the Cybersecurity and Privacy Excellence Graduate Scholarships.
-
-I supervised Arthur first in 2019 when he was a visiting student discovering the world of research, and then again in 2021 during his doctoral studies.
-Building on all the previous projects he was involved in, he decided to dedicate his studies to the use of side-channel information for intrusion detection. He is now a third-year Ph.D. candidate.
-
-The first project Arthur took part in explored the potential of side-channel analysis for defensive applications on embedded systems.
-This work led to the publication of a paper in @eet1.
-The results from this first project highlighted several axis for future work on bootup verification, runtime analysis and log verification.
-Arthur dedicated his Ph.D. to this topic and eventually explored all these branches of phycis-based defense.
-
-After the exploration phase, Arthur worked on bootup verification.
-He proposed an approach for the problem of assessing the integrity of a machine using only a few known-good examples of bootup traces.
-This approach led to two publications: first a work-in-progress paper in @wip-bpv and then an aticle presented in @bpv that present the approach in more details and use-cases.
-For each of these articles, Arthur was the main author and had to write all the publications, integrate reviewers comments, and travel to the conferences to present his work.
-These were his first experiences with the presentation of research work.
-
-The second axis of research that Arthur explored was the runtime verification of embedded systems.
-Arthur developed a few-shot pattern recognition algorithm for univariate time series to bridge the gap between raw side-channel information and rule-based intrusion detection systems.
-His work was published at @mad and received the best paper award for this edition.
-
-Arthur's current project aims to verify the logs emitted by a machine using power consumption, providing more trust to the log for later evaluation.
-
-Along with his studies, Arthur also undertook the advisor role for younger students.
-He shares his experience of conducting experiments and writing articles with a few students each term.
-This role led to multiple collaborations on topics like the study of power consumption patterns from battery-powered devices or pattern mining algorithms.
-Collaborations naturally arise with other students, for example, on the topic of trust management.
-
-Arthur also took the opportunity of his Ph.D. studies to learn new topics for personal research projects.
-He proposed to learn PCB design to build a new power trace capture system for USB-C charging cables.
-He also reached out to other labs in the university to explore his idea of using power cables as bi-directional covert channels.
-Outside of the university, Arthur often collaborates with the Palitronica Inc. startup on designing detection algorithms or evaluating applications in the domain of side-channel defense.
-
-Arthur has consistently demonstrated dedication, creativity, and scholarly achievement throughout his studies in our research group.
-His commitment to advancing the field of cybersecurity and privacy is evident in his motivation, ideas, accomplishments, and publications in reputable conferences.
-
-Arthur is a person of integrity, professionalism, and a collaborative spirit, making him a valuable member of our academic community.
-
-Arthur Grisel-Davy would be a deserving recipient of this scholarship.
-
-#pagebreak()
-#bibliography("biblio.yml")
diff --git a/scolarship_CPI/research.typ b/scolarship_CPI/research.typ
deleted file mode 100644
index e909b38..0000000
--- a/scolarship_CPI/research.typ
+++ /dev/null
@@ -1,64 +0,0 @@
-#import "@preview/acrostiche:0.3.0": *
-
-#set page("us-letter",
-margin: (x:1.8cm, top:2cm, bottom:1cm),
- header: [
- #set text(8pt)
- #smallcaps[Arthur Grisel-Davy]
- #h(1fr) _CPI Scholarship Application_
- ],
-
-)
-
-#init-acronyms((
- "IDS": ("Intrusion Detection System"),
-))
-
-#let cn = {text(fill:purple, weight:"bold")[#smallcaps[\[citation needed\]]]}
-
-#set par(
- first-line-indent: 1em,
- justify: true,
-)
-
-#text(weight: "bold", size: 2em)[Areas of Research]
-#v(0pt)
-#line(length:100%, stroke: 2pt)
-
-As a Ph.D. student, my research projects revolve around enforcing security policies or detecting abnormal behaviour
-using embedded systems’ power consumption. The power consumption, like other side-channel emissions — noise,
-temperature, or timing information for example —, are, from a computation point of view, a necessary but useless by-product that the machine has to deal with. However, for a few decades, researchers have found ways to leverage theseseemingly useless information channels to extract insights about machine states and activities. Although primarily
-leveraging this information to design attacks, the research on side-channel analysis also proposes considering them
-as a source of information to power defense mechanisms with their own intrinsic characteristics. These mechanisms
-require the use or development of a processing algorithm to overcome the non-actionable nature of raw time series
-and extract the information embedded in the collected data. My projects focus on exploring the applicability of side-channel (or physics-based) Intrusion Detection System (IDS) through the development of processing algorithms and
-decision models.
-
-= Boot Process Verification
-The boot sequence of a machine is a critical state for the machine’s security. The bootloader and firmware that executes
-during this sequence control the lowest level of software, which sets important security parameters. Moreover, this
-is a particularly vulnerable sequence as no host-based IDS is running. There are hardware-based mechanisms, often
-leveraging cryptographic signatures, that strive to prevent firmware tampering, but studies illustrated the possibility of bypassing them. One of my research projects was the development of a boot sequence verifier based on power traces.
-This approach is fully independent from the target system — and thus not bypassable —, can leverage data even before
-the machine starts and provides an additional layer of protection against firmware tampering.
-
-= Device State Detection
-Once the machine starts, the power consumption is a useful runtime monitoring input. The ability to detect a machine’s
-state is crucial for anomaly detection, rule mining, policy enforcement, and predictive maintenance. However, log collection systems can be the target of attackers, suffer malfunction, or simply not be compatible with bespoke embedded
-systems. The power consumption, on the other hand, is ubiquitous across all embedded systems, easy and reliable to
-measure, and contains information about the target state. Leveraging this power consumption to infer the state of a
-machine requires the development of a pattern recognition algorithm. I proposed an approach to this problem in the
-context of rare events in which training data is reduced to a single sample per label.
-
-= Log Verification
-Logs from applications and operating systems are a valuable source of information for host-based IDS. However, logs
-are not reliable as they are produced and reported by software running on the machine to protect. This means that the
-logs that help detect intrusions are only trustworthy when there is no intrusion. Once again, power consumption can
-provide a secondary, independent and trusted source of information for validating the integrity of a log journal. This
-problem is complex due to the high dimensionality of both time and event series and the intrinsic hybrid nature of the
-input data. It is, however, a compelling problem to study with broad applications that I am currently working on.
-
-= Miscellaneous
-In addition to these broad projects, my studies led me to explore satellite projects and domains such as a power-cable-based bidirectional covert channel, the design of a PCB for the automated capture and analysis of USB-C power
-for laptops and mobile devices, and the collaboration on a trust-management system leveraging physics-based state
-recognition.
diff --git a/sds/detectors_evaluation/images/Page 3.pdf b/sds/detectors_evaluation/images/Page 3.pdf
deleted file mode 100644
index c4b3711..0000000
Binary files a/sds/detectors_evaluation/images/Page 3.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/cautious.pdf b/sds/detectors_evaluation/images/cautious.pdf
deleted file mode 100644
index bf361e1..0000000
Binary files a/sds/detectors_evaluation/images/cautious.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/confident.pdf b/sds/detectors_evaluation/images/confident.pdf
deleted file mode 100644
index 2da0c7f..0000000
Binary files a/sds/detectors_evaluation/images/confident.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection.pdf b/sds/detectors_evaluation/images/detection.pdf
deleted file mode 100644
index 6aa419a..0000000
Binary files a/sds/detectors_evaluation/images/detection.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_0.5.pdf b/sds/detectors_evaluation/images/detection_0.5.pdf
deleted file mode 100644
index bb0d8e9..0000000
Binary files a/sds/detectors_evaluation/images/detection_0.5.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_0.7.pdf b/sds/detectors_evaluation/images/detection_0.7.pdf
deleted file mode 100644
index 7484908..0000000
Binary files a/sds/detectors_evaluation/images/detection_0.7.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_1.pdf b/sds/detectors_evaluation/images/detection_1.pdf
deleted file mode 100644
index 6aa419a..0000000
Binary files a/sds/detectors_evaluation/images/detection_1.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_real_1.5.pdf b/sds/detectors_evaluation/images/detection_real_1.5.pdf
deleted file mode 100644
index e7327e8..0000000
Binary files a/sds/detectors_evaluation/images/detection_real_1.5.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_real_1.pdf b/sds/detectors_evaluation/images/detection_real_1.pdf
deleted file mode 100644
index 111a704..0000000
Binary files a/sds/detectors_evaluation/images/detection_real_1.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_real_NUC1_1_1.pdf b/sds/detectors_evaluation/images/detection_real_NUC1_1_1.pdf
deleted file mode 100644
index e61a262..0000000
Binary files a/sds/detectors_evaluation/images/detection_real_NUC1_1_1.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_real_NUC1_2_1.pdf b/sds/detectors_evaluation/images/detection_real_NUC1_2_1.pdf
deleted file mode 100644
index 4041840..0000000
Binary files a/sds/detectors_evaluation/images/detection_real_NUC1_2_1.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_real_NUC1_3_0.9.pdf b/sds/detectors_evaluation/images/detection_real_NUC1_3_0.9.pdf
deleted file mode 100644
index 96ac750..0000000
Binary files a/sds/detectors_evaluation/images/detection_real_NUC1_3_0.9.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_real_asus_1_1.pdf b/sds/detectors_evaluation/images/detection_real_asus_1_1.pdf
deleted file mode 100644
index 8b44a1a..0000000
Binary files a/sds/detectors_evaluation/images/detection_real_asus_1_1.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_real_linksys_1.pdf b/sds/detectors_evaluation/images/detection_real_linksys_1.pdf
deleted file mode 100644
index 29cabda..0000000
Binary files a/sds/detectors_evaluation/images/detection_real_linksys_1.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/detection_real_linksys_1_1.pdf b/sds/detectors_evaluation/images/detection_real_linksys_1_1.pdf
deleted file mode 100644
index d33e9bd..0000000
Binary files a/sds/detectors_evaluation/images/detection_real_linksys_1_1.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/inter_distances.pdf b/sds/detectors_evaluation/images/inter_distances.pdf
deleted file mode 100644
index 41f8985..0000000
Binary files a/sds/detectors_evaluation/images/inter_distances.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/overlap.pdf b/sds/detectors_evaluation/images/overlap.pdf
deleted file mode 100644
index 5ec3b5c..0000000
Binary files a/sds/detectors_evaluation/images/overlap.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/overlap_explained.pdf b/sds/detectors_evaluation/images/overlap_explained.pdf
deleted file mode 100644
index 9be058c..0000000
Binary files a/sds/detectors_evaluation/images/overlap_explained.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/protos.pdf b/sds/detectors_evaluation/images/protos.pdf
deleted file mode 100644
index d42c900..0000000
Binary files a/sds/detectors_evaluation/images/protos.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/real_labeled_data_1.pdf b/sds/detectors_evaluation/images/real_labeled_data_1.pdf
deleted file mode 100644
index ff900db..0000000
Binary files a/sds/detectors_evaluation/images/real_labeled_data_1.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/simplest.pdf b/sds/detectors_evaluation/images/simplest.pdf
deleted file mode 100644
index 1f7a6fd..0000000
Binary files a/sds/detectors_evaluation/images/simplest.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/images/trace.pdf b/sds/detectors_evaluation/images/trace.pdf
deleted file mode 100644
index 4ed18cc..0000000
Binary files a/sds/detectors_evaluation/images/trace.pdf and /dev/null differ
diff --git a/sds/detectors_evaluation/main.pdf b/sds/detectors_evaluation/main.pdf
deleted file mode 100644
index d8a2a4c..0000000
Binary files a/sds/detectors_evaluation/main.pdf and /dev/null differ