single photon state can be measured, allowing an improved uncertainty to be
achieved, bounded by $\Delta\hat{\phi}_{N}>1/\sqrt{N}$. While it is true that
the magnitude of the quantum phase imparted onto the $N$-photon entangled
state is greater than the phase imparted onto the single photon state, it is
not correct to say that the uncertainty in estimating that phase is $N$-fold
greater when entanglement is used, because it is in fact $\sqrt{N}$ worse.

Uncertainty below $N=1$ limit? The uncertainty is bounded by unity, this
cannot beat the $N=1$ limit.

_Estimation of angle of the phase-shifter in the interferometer_

Loophole 5, 6: Taking into account all of the $N$ photon resources that Nagata
et. al. have at their disposal, the phase shift in the interferometer sends
the state after the first beam-splitter to the state before the second beam-
splitter according to:
$\left(\left|I0\right>+\left|0I\right>\right)/\sqrt{2}\rightarrow\left(\left|I0\right>+e^{iIxt}\left|0I\right>\right)/\sqrt{2}$,
where $I$ is the number of photons in the entangled input state which is less
than $N$, and now we are explicitly measuring some parameter $x$ of the phase-
shifter which interacts with the photons for a duration of $t$. We have that
$x$ produces a relative quantum phase on the photon state according to
$\phi_{I}=Ixt$, and now the expectation (or imputation by Nagata et. al.) is
that this parameter can be estimated with improved precision when exploiting
entanglement. However, to achieve an entanglement advantage, the factor of $I$
enhancement provided by the entangled state must compensate for the loss of
photons in the generation of the entangled state. Nagata et. al. do not
address this question.

In Figs. 3, 4 Nagata et. al. explicitly discuss and report measuring the angle
of the phase shifter with enhanced precision, so we shall conduct the analysis
where $A\equiv xt$, is the angle of the phase shifter. For simplicity, we
exclude increasing the interaction time with the phase shifter as a method to
improve the precision, rather, we shall show that the probability to produce
and detect the entangled photons results in a worse sensitivity than if the
input light to the spontaneous parametric down-conversion was simply put
directly into the interferometer instead.

Actually, Nagata et. al. spend considerable space discussing the type of
loophole that we are addressing here. In their discussion, they show that if
the probability $\eta$, to detect the four-photon state multiplied by the
fringe visibility of this four-photon state does not exceed some value, then
the SQL cannot be beaten. I already disagree with the basic analysis Nagata
et. al. provide here. The theoretical detection probability of the state with
four-fold phase sensitivity is less than $1/2$, therefore the SQL cannot be
exceeded even assuming perfect fringe visibility and perfect detection
efficiency. We have that four entangled photons provide at most a factor
$1/\sqrt{4}$ improvement compared to the SQL, however for $\eta<1/2$ the
overall improvement is less than 1. It seems in their citation of ref (11),
that Nagata et. al. again conflate measurement of observable $A$, with
measurement of the quantum phase $\phi$ in performing this analysis. The minor
issue of the theoretical impossibility of achieving any uncertainty
improvement, Nagata et. al. then neglect to actually measure the probability
to detect the four-photon state, and instead assume the theoretical value
$\eta=3/8$. This avoids the fact that the photo-detection efficiency of 0.6
greatly reduces the probability to detect the four-photon state. In
particular, the probability to detect the four-photon state is $0.6\times
0.6\times 0.6\times 0.6=0.13$. Compared to detection of the single photon
state this is a probability reduction by 0.2. In addition, Nagata et. al.
neglect to consider if the probability to generate the four-photon state is
also reduced with respect to the probability to generate the single photon
state.

Analysis: The record efficiency for generation of photon pairs via spontaneous
parametric downconversion is on the order of $10^{-6}$. If these $10^{6}$
photons which were used to generate photon pairs or quadruplets, were instead
inserted into the interferometer, a much lower uncertainty would be achieved.
Nagata et. al. report a generation rate of photon pairs of $1.7\times 10^{-2}$
per pulse, and a generation rate of the four-photon state of $2.8\times
10^{-4}$ per pulse, however the number of input photons per pulse is not
given. Even if we exclude the poor efficiency per optical pulse and just look
at the rate of single photon generation and detection compared to generation
and detection of photon pairs or four-photon states, then a much lower
uncertainty is achieved when employing single photons compared to the four-
photon states. Fig. 3 shows that the single photon count rate is $1.5\times
10^{5}$ Hz compared to a four-photon count rate of $0.1$ Hz. Therefore it is
clear that even allowing for a factor $\sqrt{4}$ improvement (which Nagata et.
al. do not demonstrate due to reduced visibility and non-optimal sensing
state), the reduced probability to generate and detect the four-photon state
does not outperform the uncertainty when all of the single photons are
utilised. In this analysis we have not needed include the reduced visibility
of the four-photon state, however the photo-detector efficiency is implicity
included in photon count rate.

Uncertainty below $N=1$ limit? The uncertainty that Nagata et. al. achieve
with a four-photon entangled state is orders of magnitude worse than the
uncertainty achieved with single photon input states in the same amount of
time.

### Interaction-based quantum metrology showing scaling beyond the Heisenberg
limit. _Nature_ (2011) 10.1038/nature09778

Napolitano et. al. measure the magnetisation of an ensemble of $\sim 10^{6}$
cold rubidium-87 atoms by passing detuned light through the ensemble and
measuring the polarisation shift that the photons experience. Although no
entanglement is exploited in their scheme, Napolitano et. al. claim to surpass
both the SQL and the HL for estimating the atomic magnetisation as a function
of the number of probe photons. This claim seems to be primarily based on a
scaling argument, in that the uncertainty displays a better scaling with
photon number in comparison to both the SQL and the HL. However, Napolitano
et. al. claim multiple times during the manuscript to demonstrate an
uncertainty that is below both the SQL and the HL, not just a superior
scaling.

Loophole 3: An uncertainty that scales as
$\Delta\hat{\phi}\propto\frac{1}{N^{3/2}}$ is demonstrated, but the absolute
uncertainty does not go below $\Delta\hat{\phi}=\frac{1}{\sqrt{N}}$. As
Napolitano et. al. measure a multiplicative factor in a time-independent
Hamiltonian, their experimental uncertainty must be bounded by Eq. 1, and for
measurement of the atomic magnetisation $F_{z}$ in particular $\lambda=1$, so
we have (assuming an interaction time sufficient for absorption of each
photon): $\Delta\hat{F}_{z}>1/\sqrt{N}$.

Analysis: Figure 3 shows the uncertainty that Napolitano et. al. demonstrate
for estimating the atomic magnetisation. With $10^{6}$ photons the
_fractional_ uncertainty in the atomic magnetisation is 10, giving an absolute
uncertainty of $\Delta\hat{F}_{z}\approx 10^{5}$ or eight orders of magnitude
worse than the SQL. Near the maximum photon number that Napolitano et. al.
investigate with $5\times 10^{7}$ photons, a _fractional_ uncertainty of $\sim
0.05$ is reported, giving an absolute uncertainty of $\Delta\hat{F}_{z}\approx
5\times 10^{3}$, which is more than seven orders of magnitude worse than the
SQL.

Uncertainty below $N=1$ limit? No entanglement is exploited, so it is a moot
point.

###  4 Objections to the bound of Eq. (6)

In achieving a frequency uncertainty below the T-E uncertainty limit with a
single spin sensor, one might object that we are taking advantage of
additional resources not available to other Heisenberg limited techniques. In
particular, one might argue that the enhanced precision comes from measurement
of a classical parameter rather than a quantum parameter, which allows the
precision to be increased by performing more than one measurement. Another
common objection is that the enhanced precision comes from access to a stable
clock which is unavailable to other measurements. In addressing these
objections, we need to precisely keep account of the resources that are
utilized in defining the quantum uncertainty limits. This is a perilous task.
First the basic resources necessary for any quantum measurement should be
defined. As we are unaware of a complete definition, we attempt to provide a
minimal list below. Further excess resources beyond this basic list that are
generally required for quantum measurements that reach the standard quantum
limit in estimating some classical parameter are accounted for below. Rather
than perfectly quantify the physical amount of each resource, this following
list is a first attempt at noting what resources are needed.

####  4.1 Resources required for any quantum measurement

  1. 1.

A quantum system to be used as a sensor. Here we precisely count the number of
atomic/indivisible components which the system contains and which are used to
extract information about a physical parameter. We implicitly require that the
state of the system can be controlled, readout and initialised. This first
requirement demarcates our definition of a quantum measurement where – a
‘quantum’ system measures a ‘classical’ parameter – from another commonly used
definition where – a classical detector is used to measure a quantum system –
in quantum state tomography for example.

  2. 2.

A physical parameter to be measured, which is assumed to have a fixed,
constant and finite value in our treatment. Often this parameter considered to
have some platonic existence which does not require physical resources, but
this is an abstraction. A more precise treatment should additionally consider
the number of resources that the measured parameter contains. For example,
when measuring the amplitude of some magnetic field, a precise treatment of
the uncertainty bounds should consider the number of photons in the magnetic
field. The SQL (and HL) generally assumes that the field contains a large
number of photons. Alternatively, one can also allow that the state of the
quantum sensor or a particular eigenvalue of the sensor is the parameter to be
measured. In this treatment, the state should be well defined (i.e. not a
mixed state), and the bounds are not derived in terms of the number of
particles, but rather the number of copies that are available. However, for
simplicity we exclude this from our definition (see point 1 above).

  3. 3.

An additional classical measuring device which is used to perform projective
readout of the quantum sensor. Normally, these resources are not explicitly
included and one assumes that perfect, instantaneous, projective measurements
are possible in deriving the limits. However, physical resources are required
to perform projective measurements, and in general, employment of more
resources allows for faster measurements with higher fidelity.

  4. 4.

A well defined spatial reference frame. This reference frame provides the
measurement basis, see for example [92].

  5. 5.

A clock. Just as a well defined spatial reference frame is required for a
quantum measurement, we posit that a well defined measure of time is also
required. Although not commonly discussed in the literature, we are unaware of
any quantum measurement which does not implicitly use a stable clock. To me it
is intuitively obvious, and should be taken as true that a clock is required,
since it allows one to define a spatial reference frame at any given moment in
time.

####  4.2 Additional resources required for quantum measurements in general
and saturation of the SQL

  1. 1.

Control fields for controlling the evolution of the quantum sensor. These
fields are additional to the fields which are required to readout and
initialize the sensor. We assert that a well defined spatial frame and a clock
are required to generate the control fields. As this possibility for control
over the entire experimental duration is assumed in deriving quantum
uncertainty limits, a stable clock is implicitly included as a requirement.

  2. 2.

Perfect knowledge and control over all other parameters in the Hamiltonian.

  3. 3.

No systematic errors. This relates to having perfect knowledge and control
over all other elements of the Hamiltonian, but it can also be that systematic
errors fundamentally arise even assuming perfect knowledge and control over
all other parameters. In this case one would not be able to reach the SQL.

  4. 4.

Spatial resources. The requirement for independent sensors in the SQL means
that there is no interaction between sensors, therefore they need to be
infinitely apart. Thus the classical parameter to be estimated should also
have infinite spatial extent.

  5. 5.

Resources to generate the parameter to be estimated, so that there is no
absorption/destruction of the signal by the sensors, since increasing $N$
should not decrease signal seen by each atom. Can also be in the form of a low
entropy source so that after each measurement of the parameter, the value of
the parameter can be reinitialised (see Point 2).

  6. 6.

Prior knowledge on the parameter to be estimated. For parameters that have an
unbounded range of values, in general some prior information on the range of
values that the parameter can take is required.

  7. 7.

Computational resources to extract the best estimator from the measurement
data-set.

Even assuming all of these resources are available, it can be that no
efficient estimator for the parameter exists which saturates the SQL.

####  4.3 Comparison of resources needed for Ramsey interferometry and Qdyne
type measurements in estimation of the oscillator frequency

We compare estimation of the oscillator (e.g. a near-resonant microwave or
laser field) frequency using Ramsey interferometry as performed with atomic
clocks to estimation using a heterodyne measurement as implemented with the
Qdyne technique. When comparing estimation strategies we endeavour to ensure
that no extra resources are employed for one strategy that is not available to
the other, and thus show that the same basic resources are available in each
situation.

Stable clock: We claim that with access to a single atom, and a (classical)
clock that is less stable than the atomic frequency, one can outperform any
state-of-the-art atomic clock in terms of absolute frequency uncertainty for
some finite amount of time. The minimal requirement to achieve a lower
frequency uncertainty than the atomic clock is that the classical clock has a
minimum stability longer than $t_{\pi}$, thereby allowing more than one
measurement to be performed. In addition to stability, the classical clock
must also have a finite accuracy to allow generation of a control field at the
correct frequency. The systematic error on the control frequency should be
much better than $1/t_{\pi}$. In this case, if we have a total measurement
time allowing one to perform several measurements, $T>t_{\pi}$ in Eq. 6, then
an uncertainty below $1/T$ is obtained. The magnitude of reduction below the
$1/T$ limit depends on the stability of the classical clock and the systematic
error, but if the above requirements are satisfied, then we ensure that the
T-E limit can be overcome.

We also assert that the same resources are required for atomic clocks. A
stable clock, in addition to an atomic system with stable Larmor frequency is
also needed for the duration of one Ramsey sequence in atomic clock operation.
This clock is used to stabilise the microwave/laser source which acts as local
oscillator to perform the $\pi/2$-pulses. Indeed the classical clock must be
stable, not only for the time taken to do a single Ramsey sequence, but much
longer since it takes several runs to accumulate enough statistics to estimate
the local oscillator. This is because of quantum projection noise which cannot
be overcome, meaning that the frequency of the local oscillator must be stable
to much better than $1/t$ to allow efficient estimation. The clock used for
this stabilisation is called the flywheel oscillator in atomic clocks, and its
stability is often the limitation to $t$, and not the atomic dephasing time.
Beyond stability, the clock must also have an accuracy or systematic error to
much better than $1/t$ so that the correct fringe is identified. Finally, we
have that $t$ must be much longer than $t_{\pi}$ in atomic clocks, in order to
achieve approximately $1/T$ estimation uncertainty. We have thus shown that
the clock used for Qdyne is not better than the clock required for atomic
clock operation.

Although it is perhaps not clear, we are not claiming that with a less
accurate clock, one can ever outperform atomic clocks in terms of fractional
frequency uncertainty, which is the figure of merit for time standards. Rather
this analysis addresses the absolute frequency uncertainty, which is less
valuable for time standards, but perhaps a more appropriate figure of merit
for spectroscopy. The resources required to achieve this uncertainty are
exactly the same as the resources required by atomic clocks, they are simply
put to more efficient use to achieve a slightly modified goal. We are also not
claiming to achieve an absolute frequency uncertainty that outperforms atomic
clocks at very long timescales. Due to systematic errors, the ultimate
absolute uncertainty that is achievable in the limit of infinite measurement
time will be better in atomic clocks. Note, the Cramer-Rao lower bound assumes
that there are no systematic errors, and it turns out that systematic errors
quickly become greater than statistical errors in many experiments. This is
true for both atomic clocks and heterodyne type measurements.

How about estimation of other physical parameters? Let’s take estimation of
the magnetic field amplitude using Ramsey spectroscopy. A stable clock is
needed to set the phase of the final $\pi/2$-pulse with relation to the
initial $\pi/2$-pulse. This timescale sets the maximum duration over which one
can achieve the Heisenberg limit, in addition to the constraint set by a
stable qubit frequency. Thus a stable clock is also needed for this strategy
and the clock must be stable (and accurate) for at least time $T$ to achieve
$1/T$ uncertainty reduction.

Classical signal: A further objection could be that the ‘signal’ that atomic
clocks are measuring is really the atomic frequency and not some additional
classical frequency. In this case, measurement back-action destroys the
quantum state, and this prohibits one from achieving sub-linewidth estimation
by performing more than one measurement. While that may be true, now we are
comparing apples with oranges, since estimation of the Larmor frequency of a
single atom is not equivalent to estimating the frequency of a classical field
composed of many photons. This argument also neglects the fact that atomic
clocks do indeed measure the frequency of a classical oscillator which is
composed of many photons. I.e. the laser or microwave field which is resonant
to the atomic transition and used as the distributed clock. Excluding this
comparison and instead insisting we focus on the atomic Larmor actually
introduces asymmetries that we are trying to avoid. In particular, it forces
that we compare estimation of $\omega_{0}$ in one technique to estimation of
$\omega$, so we are not even comparing estimation of the same physical
parameters.

Put simply, atomic clocks estimate the frequency of some classical oscillating
field using $N$ particles, the Qdyne technique also estimates the frequency of
the same classical oscillating field using $N$ particles. It seems like a fair
comparison to me.

Prior information: The amount of prior information on the signal frequency
required for Qdyne is much less than needed for atomic clocks, and much less
than $1/T$. For Qdyne, the signal frequency should be known to well within
$1/t_{\pi}$, which is a bigger prior uncertainty than $1/t\ll 1/t_{\pi}$ for
atomic clocks. The amplitude of the signal is assumed to be known in Qdyne,
but this is also assumed for atomic clocks, and both techniques have quadratic
dependence on the amplitude of the signal field. The phase of signal does not
need to be known for Qdyne just as in atomic clocks.

Computational resources: One fair criticism could be that the computational
resources required to achieve a reduced frequency uncertainty in Qdyne are
much greater than required for atomic clocks. The reason for this is that the
enhanced frequency uncertainty in Qdyne is obtained from analysis of a data-
set containing many data-points. For $R\gg 1$ datapoints, an uncertainty
improvement approximately $1/\sqrt{R}$ is obtained. A simple algorithm that
achieves this uncertainty involves performing a fast-fourier transform, taking
order $R\log(R)$ steps, performing a peak search, taking approximately $R/2$
steps, and then performing curve fitting on the peak to obtain sub-linewidth
precision. If it ultimately turns out that the only advantage that
entanglement provides for precision sensing is a reduction in computational
resources to obtain an efficient estimator, this would in itself be a
remarkable discovery.


# A gallery of diagonal stability conditions with structured matrices (and
review papers)

Zhiyong Sun  Control Systems Group, Department of EE, TU Eindhoven, the
Netherlands

###### Abstract

This note presents a summary and review of various conditions and
characterizations for matrix stability (in particular diagonal matrix
stability) and matrix stabilizability.

###### keywords:

Matrix stability, matrix stabilizability, diagonal stability.

††journal: Nowhere

##  1 Definitions and notations

  * •

A square real matrix is a Z-matrix if it has nonpositive off-diagonal
elements.

  * •

A Metzler matrix is a real matrix in which all the off-diagonal components are
nonnegative (equal to or greater than zero).

  * •

A Z-matrix with positive principal minors is an M-matrix.

    * –

Note: There are numerous equivalent characterizations for M-matrix (Fiedler
and Ptak, 1962; Plemmons, 1977). A more commonly-used condition is the
following: A matrix $A\in\mathbb{R}^{n\times n}$ is called an M-matrix, if its
non-diagonal entries are non-positive and its eigenvalues have positive real
parts.

  * •

A square matrix $A$ is (positive) stable if all its eigenvalues have positive
parts. Equivalently, a square matrix $A$ is (positive) stable iff there exists
a positive definite matrix $D$ such that $AD+DA^{T}$ is positive definite.

    * –

Note: in control system theory we often define stable matrix as the set of
square matrices whose eigenvalues have negative real parts (a.k.a. Hurwitz
matrix). The two definitions of stable matrices will be distinguished in the
context.

  * •

A square complex matrix is a P-matrix if it has positive principal minors.

  * •

A square complex matrix is a $P^{+}_{0}$-matrix if it has nonnegative
principal minors and at least one principal minor of each order is positive.

  * •

A real square matrix $A$ is multiplicative D-stable (in short, D-stable) if
$DA$ is stable for every positive diagonal matrix $D$.

  * •

A square matrix $A$ is called totally stable if any principal submatrix of $A$
is D-stable.

  * •

A real square matrix $A$ is said to be additive D-stable if $A+D$ is stable
for every nonnegative diagonal matrix $D$.

  * •

A real square matrix $A$ is said to be Lyapunov diagonally stable if there
exists a positive diagonal matrix $D$ such that $AD+DA^{T}$ is positive
definite.

    * –

Note: Lyapunov diagonally stable matrices are often referred to as just
diagonally stable matrices or as Volterra–Lyapunov stable, or as Volterra
dissipative in the literature (see e.g., (Logofet, 2005)).

  * •

A matrix $A=\\{a_{ij}\\}\in\mathbb{R}^{n\times n}$ is generalized row-
diagonally dominant, if there exists
$x=(x_{1},x_{2},\cdots,x_{n})\in\mathbb{R}^{n}$ with $x_{i}>0$, $\forall i$,
such that

$\displaystyle|a_{ii}|x_{i}>\sum_{j=1,j\neq i}^{n}|a_{ij}|x_{j},\forall
i=1,2,\cdots,n.$ (1)

  * •

A matrix $A=\\{a_{ij}\\}\in\mathbb{R}^{n\times n}$ is generalized column-
diagonally dominant, if there exists
$x=(x_{1},x_{2},\cdots,x_{n})\in\mathbb{R}^{n}$ with $x_{i}>0$, $\forall i$,
such that

$\displaystyle|a_{jj}|x_{j}>\sum_{i=1,i\neq j}^{n}|a_{ij}|x_{i},\forall
j=1,2,\cdots,n.$ (2)

    * –

Note: the set of generalized column-diagonally dominant matrices is equivalent
to the set of generalized row-diagonally dominant matrices (Varga, 1976; Sun
et al., 2021). They are also often referred to as quasi-diagonally dominant
matrices (Kaszkurewicz and Bhaya, 2012).

  * •

For a real matrix $A=\\{a_{ij}\\}\in\mathbb{R}^{n\times n}$, we associate it
with a comparison matrix $M_{A}=\\{m_{ij}\\}\in\mathbb{R}^{n\times n}$,
defined by

$\displaystyle m_{ij}=\left\\{\begin{array}[]{cc}|a_{ij}|,&\text{ if
}\,\,\,\,j=i;\\\ -|a_{ij}|,&\text{ if }\,\,\,\,j\neq i.\end{array}\right.$

A given matrix $A$ is called an H-matrix if its comparison matrix $M_{A}$ is
an M-matrix.

    * –

The set of H-matrix is equivalent to the set of quasi-diagonally dominant
matrices (Kaszkurewicz and Bhaya, 2012; Sun et al., 2021).

  * •

A square matrix $A$ is diagonally stabilizable if there exists a diagonal
matrix $D$ such that $DA$ is stable.

Note: Many definitions above for real matrices also carry over to complex
matrices; the distinction between real and complex matrices will be made clear
in the context.

##  2 Conditions for diagonally stabilizable matrices

A key motivating question: Given a square matrix $A$, can we find a diagonal
matrix $D$ such that the matrix $DA$ is stable?

Fisher and Fuller (Fisher and Fuller, 1958) proved the following result:

######  Theorem 1.

(Fisher and Fuller, 1958) If $P$ is a real $n\times n$ matrix fulfilling the
condition:

  * •

(A): $P$ has at least one sequence of non-zero principal minors $M_{k}$ of
every order $k=1,2,\cdots,n$, such that $M_{k-1}$ is one of the $k$ first
principal minors of $M_{k}$;

then there exists a real diagonal matrix $D$ such that the characteristic
equation of $DP$ is stable.

The Fisher-Fuller theorem is also formulated as the following alternative
version:

######  Theorem 2.

Let $P$ be an $n\times n$ real matrix all of whose leading principal minors
are positive. Then there is an $n\times n$ positive diagonal matrix $D$ such
that all the roots of $DP$ are positive and simple.

Fisher later gave a simple proof for a similar yet stronger result (Fisher,
1972).

######  Theorem 3.

(Fisher, 1972) If $P$ is an $n\times n$ real matrix that has at least one
nested set of principal minors, $M_{k}$, such that $(-1)^{k}M_{k}>0,\forall
k=1\cdots,n$, then there exists a real diagonal matrix $D$ with positive
diagonal elements such that the characteristic roots of $DP$ are all real,
negative, and distinct.

######  Remark 1.

Some remarks on the conditions of diagonally stabilizable matrices are in
order.

  * •

The above theorems involve determining the sign of (at least) one nested set
of principal minors. In (Johnson et al., 1997), sufficient conditions are
determined for an $n$-by-$n$ zero-nonzero pattern to allow a nested sequence
of nonzero principal minors. In particular, a method is given to sign such a
pattern so that it allows a nested sequence of $k$-by-$k$ principal minors
with $\text{sign}(-1)^{k}$ for $k=1,\cdots,n$.

  * •

The condition in the Fisher-Fuller theorem appears as a sufficient condition
for matrix diagonal stabilizability. A necessary condition for matrix diagonal
stabilizability is: for each order $k=1\cdots,n$, at least one $k\times k$
principal minor of $P$ is non-zero. It is unclear what would be the necessary
and sufficient condition.

Ballantine (Ballantine, 1970) extended the above Fisher-Fuller theorem to the
complex matrix case.

######  Theorem 4.

(Ballantine, 1970) Let $A$ be an $n\times n$ complex matrix all of whose
leading principal minors are nonzero. Then there is an $n\times n$ complex
diagonal matrix $D$ such that all the roots of $DA$ are positive and simple.

######  Remark 2.

It is shown in (Hershkowitz, 1992) the above Ballantine theorem cannot be
strengthened by replacing “complex diagonal matrix D” by “positive diagonal
matrix D”. A counterexample is shown in (Hershkowitz, 1992) involving a
$2\times 2$ complex matrix $A$ with positive leading principal minors that
there exists no positive diagonal matrix $D$ such that the eigenvalues of $DA$
are positive.

A related problem to characterize diagonal stabilizable matrix is the Inverse
Eigenvalue Problem (IEP), and Friedland (Friedland, 1977) proved the following
theorem.

######  Theorem 5.

(Friedland, 1977) Let $A$ be a given $n\times n$ complex valued matrix. Assume
that all the principal minors of $A$ are different from zero. Then for any
specified set $\lambda=\\{\lambda,\cdots,\lambda_{n}\\}\in\mathbb{C}^{n}$
there exists a diagonal complex valued matrix $D$ such that the spectrum of
$AD$ is the set $\lambda$. The number of such $D$ is finite and does not
exceed $n!$. Moreover, for almost all $\lambda$ the number of the diagonal
matrices $D$ is exactly $n!$.

######  Remark 3.

The Friedland theorem of the IEP problem in the complex matrix case cannot be
directly carried over to the real case. Further, it is easy to show with a
counterexample of a $2\times 2$ matrix that eigenvalue positionability in the
real case cannot always be guaranteed, even with nonzero principal minors.

In (Hershkowitz, 1992) the following two theorems are proved.

######  Theorem 6.

(Hershkowitz, 1992) Let $A$ be a complex square matrix with positive leading
principal minors, and let $\epsilon$ be any positive number. Then there exists
a positive diagonal matrix $D$ such that the eigenvalues of $DA$ are simple,
and the argument of every such eigenvalue is less in absolute value than
$\epsilon$.

######  Theorem 7.

(Hershkowitz, 1992) Let $A$ be a complex square matrix with real principal
minors and positive leading principal minors. Then there exists a positive
diagonal matrix $D$ such that $DA$ has simple positive eigenvalues.

######  Remark 4.

The above theorems all present certain sufficient conditions to characterize
diagonally stabilizable matrix and the IEP problem, and they are not
necessary. A necessary condition for the diagonal matrix $D$ to exist is that
for each order $i$, at least one $i\times i$ principal minor of A is nonzero.
However, a full characterization (with necessary and sufficient condition) for
diagonally stabilizable matrix still remains an open problem.

A variation of the diagonal matrix stabilization problem is the following:

  * •

Problem (*): Given a real square matrix $G$, find a real diagonal matrix $D$
such that the product $GD$ is Hurwitz together with all its principal
submatrices.

Surprisingly, a necessary and sufficient condition exists for solving the
above problem as shown in (Locatelli and Schiavoni, 2012). Let
$\mathcal{M}:=\\{1,2,\cdots,m\\}$ and
$\mathcal{F}:=\\{f|f\subset\mathcal{M}\\}$. Further, for any $m\times m$
matrix $\Delta$, denote by $\Delta(f)$ the principal submatrix obtained from
it after removing the rows and columns with indexes in $f$, $f\in\mathcal{F}$.
The main result of (Locatelli and Schiavoni, 2012) proves the following:

######  Theorem 8.

(Locatelli and Schiavoni, 2012) Problem (*) admits a solution if and only if

$\displaystyle\text{det}(G(f))\text{det}(G_{D}(f))>0,\forall f\in\mathcal{F}$
(4)

where $G_{D}=\text{diag}\\{g_{ii}\\}$. Moreover, if the above condition is
satisfied, then there exists $\bar{\epsilon}>0$ such that, for any given
$\epsilon\in(0,\bar{\epsilon})$, the matrix

$\displaystyle
D:=G_{D}Z(\epsilon),Z(\epsilon):=-\text{diag}\\{\epsilon^{i}\\}$ (5)

solves the stabilization problem (*).

##  3 Conditions for diagonally stable matrices

We give a short summary of available conditions for diagonally stable matrices
(excerpts from (Barker et al., 1978), (Cross, 1978) and (Hershkowitz, 2006)).

  * •

(Barker et al., 1978) Lyapunov diagonally stable matrices are P-matrices.

  * •

(Barker et al., 1978) A matrix $A$ being Lyapunov diagonally stable is
equivalent to that there exists a positive diagonal matrix $D$ such that
$x^{T}DAx>0$ for all nonzero vectors $x$.

  * •

(Barker et al., 1978) A $2\times 2$ real matrix is Lyapunov diagonally stable
if and only if it is a P-matrix.

  * •

(Cross, 1978) For a given Lyapunov diagonally stable matrix $P$, all principal
submatrices of $P$ are Lyapunov diagonally stable.

  * •

(Barker et al., 1978) A real square matrix $A$ is Lyapunov diagonally stable
if and only if for every nonzero real symmetric positive semidefinite matrix
$H$ the matrix $HA$ has at least one positive diagonal element.

    * –

Note: this result is termed the BBP theorem, and is proved again in (Shorten
et al., 2009) with a simpler proof.

  * •

(Cross, 1978) The set of Lyapunov diagonally stable matrices is a strict
subset of multiplicative D-stable matrices.

  * •

(Cross, 1978) The set of Lyapunov diagonally stable matrices is a strict
subset of additive D-stable matrices.

    * –

Note: Multiplicative D-stable and additive D-stable matrices are not
necessarily diagonally stable.

  * •

A Z-matrix is Lyapunov diagonally stable if and only if it is a P -matrix
(that is, it is an M-matrix).

  * •

A non-singular H-matrix with nonnegative diagonal parts is Lyapunov diagonally
stable.

  * •

A quasi-diagonal dominant matrix with nonnegative diagonal parts is Lyapunov
diagonally stable. Note the equivalence of Hurwitz H-matrix and quasi-diagonal
dominant matrix (Sun et al., 2021).

The following facts are shown in (Cross, 1978) and (Kaszkurewicz and Bhaya,
2012):

  * •

For normal matrices and within the set Z, D-stability, additive D-stability,
and diagonal stability are all equivalent to matrix stability.

  * •

If a matrix $A$ is Hurwitz stable, D-stable, or diagonally stable, then the
matrices $A^{T}$ and $A^{-1}$ also have the corresponding properties.

In (Shorten and Narendra, 2009) Shorten and Narendra showed the following
necessary and sufficient condition for matrix diagonal stability (an
alternative proof of the theorem of Redheffer via the KYP lemma):

######  Theorem 9.

(Shorten and Narendra, 2009) and (Redheffer, 1985) Let
$A\in\mathbb{R}^{n\times n}$ be a Hurwitz matrix with negative diagonal
entries. Let $A_{n-1}$ denote the $[n-1\times n-1]$ leading sub-matrix of $A$,
and $B_{n-1}$ denote the corresponding block of $A^{-1}$. Then, the matrix $A$
is diagonally stable, if and only if there is a common diagonal Lyapunov
function for the LTI systems $\Sigma_{A_{n-1}}$ and $\Sigma_{B_{n-1}}$.

The above theorem involves finding a common diagonal Lyapunov function for a
set of LTI systems, which may be restrictive and computationally demanding in
practical applications especially when the dimension of the matrix $A$ is
large.

##  4 Relations of matrix stability and diagonal stability

The paper (Berman and Hershkowitz, 1983) characterizes the relations of
certain special matrices for matrix diagonal stability. They define

  * •

$\mathscr{A}=\\{A:\text{there exists a positive definite diagonal matrix $D$
}\,\text{such that}\,\,AD+DA^{T}\text{ is positive definite}\\}$;
i.e., $\mathscr{A}$ denotes the set of diagonally stable matrices;

  * •

$\mathscr{L}=\\{A:\text{there exists a positive definite matrix $D$
}\,\,\text{such that}\,\,AD+DA^{T}\text{ is positive definite}\\}$; i.e.,
$\mathscr{L}$ denotes the set of (positive) stable matrices;

  * •

$\mathscr{P}=\\{A:\text{the principle minors of $A$}\,\text{ are
positive}\\}$;
i.e., $\mathscr{P}$ denotes the set of P-matrices;

  * •

$\mathscr{S}=\\{A:\text{there exists a positive vector $x$ such that $Ax$ is
positive}\\}$;
i.e., $\mathscr{S}$ denotes the set of semipositive matrices.

The main result of (Berman and Hershkowitz, 1983) is cited and shown in Fig.
1. In general, these different sets of structured matrices are not equivalent,
and the set $\mathscr{A}$ is a subset of the other sets. However, for
Z-matrices, these sets are equivalent. In particular, for the case of
Z-matrices, the characterizations of these sets give equivalent conditions for
M-matrices (upon a sign change). Note there are yet many more conditions to
characterize M-matrices; see e.g., (Plemmons, 1977).

Figure 1: Relations of matrix stability under different matrix types: the main
theorem in (Berman and Hershkowitz, 1983)

.

Figure 2: The implication relations between matrix stability conditions, cited
from (Hershkowitz, 1992)

.

Figure 3: For Z-matrices, all the stability types are equivalent. Cited from
(Hershkowitz, 1992)

The review paper (Hershkowitz, 1992) presents the implication relations
between matrix stability conditions, and the equivalent relations of matrix
stabilities for Z-matrices, as cited in Figs. 2 and 3. Again, as shown in
Figs. 3, for Z-matrices, all the stability types are equivalent.

The survey paper (Logofet, 2005) presents some beautiful flower-shaped
characterizations of the relations among matrix stabilities, as cited in Figs.
4 and 5.

.

Figure 4: Relations among matrix stabilities. Cited from (Logofet, 2005,
Fig.2)

.

Figure 5: Petals of sign-stable matrices within the Flower. Cited from
(Logofet, 2005, Fig.4)

##  5 Stability conditions with submatrices and Schur complement

Stability conditions of ‘structured’ matrices often involve stability
properties of submatrices, which employ block submatrices and their Schur
complements to determine stability.

In (Narendra and Shorten, 2010), Narendra and Shorten presented necessary and
sufficient conditions to characterize if a given Metzler matrix is Hurwitz,
based on the fact that a Hurwitz Metzler matrix is diagonally stable. These
conditions are generalized in (Souza et al., 2017). We recall some main
stability criteria from (Souza et al., 2017).

######  Lemma 1.

Let $A\in\mathbb{R}^{n\times n}$ be a Metzler matrix partitioned in blocks of
compatible dimensions as $A=[A_{11},A_{12};A_{21},A_{22}]$ with $A_{11}$ and
$A_{22}$ being square matrices. Then the following statements are equivalent.

  * •

$A$ is Hurwitz stable.

  * •

$A_{11}$ and its Schur complement $A/A_{11}:=A_{22}-A_{21}A_{11}^{-1}A_{12}$
are Hurwitz stable Metzler matrices.

  * •

$A_{22}$ and its Schur complement $A/A_{22}:=A_{11}-A_{12}A_{22}^{-1}A_{21}$
are Hurwitz stable Metzler matrices

######  Remark 5.

Some remarks are in order.

  * •

For a structured matrix, the property that its Schur complements also preserve
the same stability and structure properties is termed Schur complement
stability property. Other types of structured matrices that have Schur
complement stability property include symmetric matrices, triangular matrices,
and Schwarz matrices. See (Souza et al., 2017).

  * •

The result on M-matrix in Lemma 1 can be generalized to H-matrix: Let $A$ be a
H-matrix partitioned in blocks of compatible dimensions as
$A=[A_{11},A_{12};A_{21},A_{22}]$ with $A_{11}$ and $A_{22}$ being square
matrices. If $A$ is Hurwitz stable, then $A_{11}$ and its Schur complement
$A/A_{11}:=A_{22}-A_{21}A_{11}^{-1}A_{12}$ are Hurwitz stable H matrices, or
$A_{22}$ and its Schur complement $A/A_{22}:=A_{11}-A_{12}A_{22}^{-1}A_{21}$
are Hurwitz stable H matrices.

  * •

Schur complement and its closure property for several structured matrices
(including diagonal matrices, triangular matrices, symmetric matrices,
P-matrices, diagonal dominant matrices, M-matrices etc.) are discussed in
(Zhang, 2006, Chap. 4).

##  6 Application examples of matrix diagonal stability conditions

The Fisher-Fuller theorem on diagonal matrix stabilizability (Theorem 1 and
its variations) has been rediscovered several times by the control system
community, and has been applied in solving distributed stabilization and
decentralized control problems in practice. This section reviews two
application examples.

###  6.1 Conditions for decentralized stabilization

In (Corfmat and Morse, 1973) Corfmat and Morse solved the following problem:

  * •

For given and fixed real matrices $A$ and $P$, find (if possible) a non-
singular diagonal matrix $D$ such that $I+ADP$ is Schur stable (i.e., all
eigenvalues of $I+ADP$ are located within the unit circle in the complex
plane.

To solve the above problem they proved the following:

######  Theorem 10.

If $A$ is an $n\times n$ strongly non-singular matrix, then there exists a
diagonal matrix $D$ such that $(I+DA)$ is Schur stable.

Note: in (Corfmat and Morse, 1973) a matrix is termed strongly non-singular,
if its all $n$ leading principal minors are nonzero.

######  Theorem 11.

If $A$ is a fixed non-singular matrix, then there exists a permutation matrix
$P$ such that $PA$ is strongly non-singular.

Solution to decentralized stabilization: the non-singularity of $A$ is a
necessary and sufficient condition for the existence of a permutation matrix
$P$ and a non-singular diagonal matrix $D$ such that $(I+ADP)$ is Schur
stable.

###  6.2 Distributed stabilization of persistent formations

In (Yu et al., 2009), the problem on persistent formation stabilization
involves studying the stabilizability of the following differential equation

$\displaystyle\dot{z}=\Delta Az$

where $\Delta$ is a diagonal or possibly block diagonal matrix, and $A$ is a
rigidity-like matrix on formation shapes. To solve the formation stabilization
problem in (Yu et al., 2009) the following result is employed ((Yu et al.,
2009, Theorem 3.2)):

######  Theorem 12.

Suppose A is an $m\times m$ non-singular matrix with every leading principal
minor nonzero. Then there exists a diagonal $D$ such that the real parts of
the eigenvalues of $DA$ are all negative.

We remark that this is a reformulation of the Fisher-Fuller theorem.

##  7 A selection of key review papers and books on matrix stability and
diagonal stability conditions

  * •

The survey paper (Hershkowitz, 1992) that presents a summary of relevant
matrix stability results and the developments, up until 1992.

  * •

The paper (Bhaya et al., 2003) that presents comprehensive discussions and
characterizations for various classes of matrix stability conditions.

  * •

The paper (Hershkowitz and Keller, 2003) that studies the relations between
positivity of principal minors, sign symmetry and stability of matrices.

  * •

The review paper (Hershkowitz, 2006) that presents an concise overview on
matrix stability and inertia.

  * •

The book (Kaszkurewicz and Bhaya, 2012) on matrix diagonal stability in
systems and computation.

  * •

The summary paper (Logofet, 2005) that presents a review and some beautiful
connections/relations on different matrix stabilities.

  * •

The very long survey paper (Kushel, 2019) that provides a unifying viewpoint
on matrix stability, and its historical development.

  * •

The recent book (Johnson et al., 2020) on positive matrix, P-matrix and
inverse M-matrix.

## References

  * Ballantine (1970) Ballantine, C., 1970.  Stabilization by a diagonal matrix.  Proceedings of the American Mathematical Society 25, 728–734.
  * Barker et al. (1978) Barker, G., Berman, A., Plemmons, R.J., 1978.  Positive diagonal solutions to the Lyapunov equations.  Linear and Multilinear Algebra 5, 249–256.
  * Berman and Hershkowitz (1983) Berman, A., Hershkowitz, D., 1983\.  Matrix diagonal stability and its implications.  SIAM Journal on Algebraic Discrete Methods 4, 377–382.
  * Bhaya et al. (2003) Bhaya, A., Kaszkurewicz, E., Santos, R., 2003.  Characterizations of classes of stable matrices.  Linear algebra and its applications 374, 159–174.
  * Corfmat and Morse (1973) Corfmat, J., Morse, A., 1973\.  Stabilization with decentralized feedback control.  IEEE Transactions on Automatic Control 18, 679–682.
  * Cross (1978) Cross, G., 1978.  Three types of matrix stability.  Linear algebra and its applications 20, 253–263.
  * Fiedler and Ptak (1962) Fiedler, M., Ptak, V., 1962\.  On matrices with non-positive off-diagonal elements and positive principal minors.  Czechoslovak Mathematical Journal 12, 382–400.
  * Fisher (1972) Fisher, F.M., 1972.  A simple proof of the Fisher–Fuller theorem, in: Mathematical Proceedings of the Cambridge Philosophical Society, Cambridge University Press. pp. 523–525.
  * Fisher and Fuller (1958) Fisher, M.E., Fuller, A., 1958\.  On the stabilization of matrices and the convergence of linear iterative processes, in: Mathematical Proceedings of the Cambridge Philosophical Society, Cambridge University Press. pp. 417–425.
  * Friedland (1977) Friedland, S., 1977.  Inverse eigenvalue problems.  Linear Algebra and Its Applications 17, 15–51.
  * Hershkowitz (1992) Hershkowitz, D., 1992.  Recent directions in matrix stability.  Linear Algebra and its Applications 171, 161–186.
  * Hershkowitz (2006) Hershkowitz, D., 2006.  Matrix stability and inertia, in: Handbook of Linear Algebra. Chapman and Hall/CRC, pp. 19–1.
  * Hershkowitz and Keller (2003) Hershkowitz, D., Keller, N., 2003\.  Positivity of principal minors, sign symmetry and stability.  Linear algebra and its applications 364, 105–124.
  * Johnson et al. (1997) Johnson, C.R., Maybee, J.S., Olesky, D., Van den Driessche, P., 1997\.  Nested sequences of principal minors and potential stability.  Linear Algebra and its Applications 262, 243–257.
  * Johnson et al. (2020) Johnson, C.R., Smith, R.L., Tsatsomeros, M.J., 2020.  Matrix positivity. volume 221.  Cambridge University Press.
  * Kaszkurewicz and Bhaya (2012) Kaszkurewicz, E., Bhaya, A., 2012\.  Matrix diagonal stability in systems and computation.  Springer Science & Business Media.
  * Kushel (2019) Kushel, O.Y., 2019.  Unifying matrix stability concepts with a view to applications.  SIAM Review 61, 643–729.
  * Locatelli and Schiavoni (2012) Locatelli, A., Schiavoni, N., 2012\.  A necessary and sufficient condition for the stabilisation of a matrix and its principal submatrices.  Linear algebra and its applications 436, 2311–2314.
  * Logofet (2005) Logofet, D.O., 2005.  Stronger-than-Lyapunov notions of matrix stability, or how “flowers” help solve problems in mathematical ecology.  Linear Algebra and its Applications 398, 75–100.
  * Narendra and Shorten (2010) Narendra, K.S., Shorten, R., 2010\.  Hurwitz stability of metzler matrices.  IEEE Transactions on Automatic Control 55, 1484–1487.
  * Plemmons (1977) Plemmons, R.J., 1977.  M-matrix characterizations. I–nonsingular M-matrices.  Linear Algebra and its Applications 18, 175–188.
  * Redheffer (1985) Redheffer, R., 1985.  Volterra multipliers ii.  SIAM Journal on Algebraic and Discrete Methods 6, 612–623.
  * Shorten et al. (2009) Shorten, R., Mason, O., King, C., 2009.  An alternative proof of the Barker, Berman, Plemmons (BBP) result on diagonal stability and extensions.  Linear Algebra and its Applications 430, 34–40.
  * Shorten and Narendra (2009) Shorten, R., Narendra, K.S., 2009\.  On a theorem of Redheffer concerning diagonal stability.  Linear algebra and its applications 431, 2317–2329.
  * Souza et al. (2017) Souza, M., Wirth, F.R., Shorten, R.N., 2017.  A note on recursive schur complements, block hurwitz stability of metzler matrices, and related results.  IEEE Transactions on Automatic Control 62, 4167–4172.
  * Sun et al. (2021) Sun, Z., Rantzer, A., Li, Z., Robertsson, A., 2021.  Distributed adaptive stabilization.  Automatica 129, 109616\.
  * Varga (1976) Varga, R.S., 1976.  On recurring theorems on diagonal dominance.  Linear Algebra and its Applications 13, 1–9.
  * Yu et al. (2009) Yu, C., Anderson, B.D.O., Dasgupta, S., Fidan, B., 2009\.  Control of minimally persistent formations in the plane.  SIAM Journal on Control and Optimization 48, 206–233.
  * Zhang (2006) Zhang, F., 2006.  The Schur complement and its applications. volume 4.  Springer Science & Business Media.


# MalIoT: Scalable and Real-time Malware Traffic Detection for IoT Networks

Ethan Weitkamp, Yusuke Satani, Adam Omundsen, Jingwen Wang, Peilong Li
Elizabethtown College, Computer Science Department weitkampe, sataniy,
omundsena, wangjingwen, lip @etown.edu

###### Abstract

The machine learning approach is vital in Internet of Things (IoT) malware
traffic detection due to its ability to keep pace with the ever-evolving
nature of malware. Machine learning algorithms can quickly and accurately
analyze the vast amount of data produced by IoT devices, allowing for the
real-time identification of malicious network traffic. The system can handle
the exponential growth of IoT devices thanks to the usage of distributed
systems like Apache Kafka and Apache Spark, and Intel’s oneAPI software stack
accelerates model inference speed, making it a useful tool for real-time
malware traffic detection. These technologies work together to create a system
that can give scalable performance and high accuracy, making it a crucial tool
for defending against cyber threats in smart communities and medical
institutions.

## 1 Introduction

Since the emergence of the Internet of Things (IoT), the problem of malware
attacks on IoT devices has remained a constant problem. Technology
improvements have caused the difficulty to increase over time, both in terms
of the volume and the variety of the attacks [?]. According to research,
malicious attacks on IoT devices have significantly increased recently.
Zscaler’s research shows that during the pandemic in 2022, malware attacks on
IoT devices linked to business networks have risen by 700% [?]. The
development of the internet, social networks, smartphones, and IoT devices
have allowed bad actors to produce malware that is more advanced than ever
before.

To protect against online attacks and maintain network stability, real-time
and scalable malware detection solutions are required to identify and stop
malware traffic in IoT networks. Due to its capacity to automatically detect
and react to emerging malware threats in real-time, machine learning (ML) is a
key strategy in IoT malware traffic detection [?], [?], [?]. ML models can
swiftly scan this data to identify and prevent malware activity because IoT
devices create enormous amounts of data that make it challenging to detect
malware using conventional approaches. Because ML techniques are flexible and
adaptable, it is possible to continuously upgrade the models to detect new
varieties of malware as they appear. Additionally, ML models have the capacity
to learn from enormous volumes of data and recognize patterns in the data that
can point to malware activity, enabling them to detect malware of previously
unidentified forms.

However, current machine learning-based solutions for detecting malware in
network traffic often struggle to handle the growing number of IoT devices and
detect malicious traffic with low latency. To address these issues, this paper
proposes a scalable end-to-end network traffic analysis system that can detect
malware in real-time. The system utilizes distributed systems such as Apache
Kafka and Apache Spark, allowing for efficient scalability as the number of
IoT devices grows. Furthermore, the use of Intel’s oneAPI software stack for
both machine learning and deep learning models has been shown to improve the
inference speed of the model three-fold. Specifically, there are three main
contributions to this paper. (1) We seek to overcome the class imbalance and
model over-fitting issues from the prior works by enriching the “IoT-23”
dataset and adding a more diversified dataset named “ToN_IoT”. (2) We
accelerate the malware traffic detection inference speed with the use of
Intel’s oneAPI software. (3) We boost the system scalability and
responsiveness by implementing a big data platform that includes Apache Kafka
as the streaming engine and Apache Spark as the data processor.

The organization of this paper is as follows. Section §2 summarizes the
previous works on IoT malware detection. Section §3 depicts the overall design
of the data pipeline. Section §4 evaluates the performance of the methods.
Lastly, Section §5 concludes the paper.

## 2 Related Works

One of the traditional approaches for detecting malware traffic is through the
use of signature-based detection methods [?], [?], which use a database of
known malware signatures to identify and block traffic that matches these
signatures. While this method can be effective in detecting known malware, one
of its biggest limitations is its incapability to detect unknown attacks, and
it does not cover the detection of large-scale attacks.

To solve this problem, network behavior-based detection is proposed for
malware traffic detection [?]. Behavioral modeling methods focus on
identifying and blocking malicious traffic based on its behavior rather than
its signature [?], [?], [?]. This approach is more effective at detecting new
or unknown malware as it is not reliant on a database of known malware
signatures. However, it can be more resource-intensive and may produce false
positives. Most existing studies in this area have limited scope, focusing on
specific malware types, such as Bots, or on particular attack types, such as
DoS, and anomalies in specific protocols or network layers [?]. Another
limitation of traditional detection solutions is that the conventional
solution depends on one network premises; this cannot detect attacks that
originated at different network premises. Another problem is there is the case
that devices might still operate for a long time, even after infection.

Another technique used in malware traffic detection is sandboxing, which
involves creating a virtual environment in which to analyze and test suspected
malware [?], [?]. This allows analysts to safely observe the behavior of the
malware and determine its potential threats.

Machine learning methods are introduced in the previous works for malware
traffic detection [?]. Kaluphahana et al. [?] proposed Adept, a security
framework that detects bots attack and classifies them into attack stages
across space and time. Adept utilizes alert-level and pattern-level
information to classify the type and stages of attacks into categorical
classification by using machine learning models, k-nearest neighbor, random
forest, and support vector machine. Moreover, an end-to-end monitoring system
RTC was proposed to identify new threats by manually extracting features from
different protocols and network layer traffic data [?]. However, machine
learning methods rely heavily on manual feature extraction, which is a time-
consuming and resource-intensive process.

Since deep learning methods are efficient in feature extractions and automatic
learning, the research on malware traffic attack detection is shifting from
machine learning to deep learning [?], [?], [?], [?]. Sahu et al. [?] present
a security framework for IoT attack detection using a hybrid Deep Learning
model with two stages. Specifically, a CNN model first learns the features
from the IoT network traffic, then the feature representation generated from
the previous step is used as the input of an LSTM model for attack detection.
However, whenever the network is scaled up by adding additional IoT devices,
then an additional CNN module should be accompanied by the connected network
switch.

Table 1 shows the performance of machine learning and deep learning models in
classifying large-scale offensive accesses within IoT systems. Goyal et al.
[?] observe that SVM and ANN models generate similar accuracy scores, while
the precision score of ANN model outperforms SVM by 4.3%. Long-Short-Term
Memory (LSTM) is used to determine whether an attack or a benign attack can be
detected from a relatively small amount of data. Liang et al. [?] conclude
that the SVM model has an accuracy score of 88.18%, but the recall and F1
scores are below 50. On the other hand, the LSTM model has an accuracy score
of 99.98%, and both recall and F1 are close to 100.

Table 1: Model Accuracy in Surveys Reference | Model | Accuracy | Precision | Recall | F1
---|---|---|---|---|---
Goyal et al. [?] | ANN | 99.74 | 95.99 | 100 | 97.95
| SVM | 99.86 | 91.98 | 100 | 95.82
Liang et al. [?] | LSTM | - | 99.98 | 100 | 99.99
| SVM | - | 88.18 | 45.43 | 59.97

## 3 Design

In this section, we present the design of the MalIoT system by describing the
overall data pipeline, data collection and generation, offline model training,
and online model inference.

###  3.1 Overview to the Data Pipeline

The overall data pipeline is illustrated in Fig. 1. The information originates
from IoT devices within a local network, which transmits their network
activity through a smart gateway that houses the subsequent steps in the
process. Initially, the network activity is intercepted by a software sniffer
Bro on the smart gateway, which generates PCAP files from the received data.
These PCAP files are subsequently dispatched to a Kafka producer, which
transmits the data to a Kafka topic. The Kafka producer ensures that the
pipeline can be scaled to accommodate additional IoT devices on the network.
The data is then ingested from the Kafka topic using Spark streaming, which
maintains the pipeline’s scalability for any number of IoT devices. The data
can then be utilized for the purposes of retraining ML or DL models, or for
conducting an online inference on the network activity using previously
trained ML or DL models.

Figure 1: Overall Design Pipeline

###  3.2 Data Generation

To train various models, we need an initial dataset and a method to retrain
the models using fresh data to adjust to new types of attacks. The retraining
process is illustrated in Figure 2. When PCAP files are produced from the
packet sniffer, they can subsequently be used to retrain the models with the
real-time network traffic on the network. We employed the IoT-23 Dataset and
TON_IoT Dataset as our starting datasets for training the original models. We
tested the accuracy of machine learning and deep learning models using various
feature subsets provided by the dataset and opted to use most of the features,
excluding the host and recipient IP addresses and ports. These attributes
didn’t boost model accuracy, as they should not be linked with a malicious or
benign attack and would merely overfit our models. Once the foundational
models are established using the existing dataset, they can be retrained as
needed using the newly generated PCAP files. For machine learning models, the
desired features must be extracted from the PCAP files before retraining, as
well as any other data preprocessing procedures.

Figure 2: Model Training Process

Datasets: Aposemat IoT-23 datasets [?] are captured from the network traffic
of Internet of Things(IoT) devices. The dataset was first released in January
2020 and covers captures from 2018 to 2019. The IoT-23 datasets include 20
instances of malware captured from IoT devices, along with 3 instances of
benign IoT device traffic.

ToN_IoT datasets [?] are new generations of Internet of Things (IoT) and
Industrial IoT (IIoT) datasets captured from a realistic and large-scale
network with heterogeneous data sources. It consists of datasets from IoT and
IIoT sensors, Operating systems datasets of Windows 7 and 10, Operating
systems datasets of Ubuntu 14 and 18 TLS, and Network traffic datasets.

The basic information of each dataset is listed in Table 2. IoT-23 datasets
consist of 325,307,990 captures from different IoT network traffics, including
294,449,255 malware captures executed in infected IoT devices and 30,858,735
captures from benign IoT device traffic. In the ToN_IoT datasets, the Windows
7 dataset has 28366 records and 132 features, the Windows 10 dataset consists
of 35,975 records and 124 features, and the Network dataset has 21,978,632
records and 42 features. To generate the final synthesized training dataset,
we integrate TON_IoT and IoT-23 together and then supplement the synthesized
dataset with extra benign traffic from the CIC IoT datasets [?] to balance the
classification categories.

Table 2: Dataset Information Dataset | IoT-23 | ToN_IoT
---|---|---
Benign | 30,858,735 | 300,000
Anomaly | 294,449,255 | 161,043
Total | 325,307,990 | 461.043
# of features | 23 | 45
# of IoT devices | 3 | 9

Features: The common features shared in between the two datasets are listed in
Table 3. In the experiments, we utilized two types of feature selection for
our machine learning models: 1) the “Full Feature Set”, which contains all
features except for timestamp and unique identifier, and 2) the “De-identified
Feature Set”, which removes the TCP/UDP IP address and port information of
both the originating and responding endpoints. We removed this information to
avoid potential biases in the machine learning models when classifying
malicious traffic based on IP addresses and ports.

Table 3: IoT-23 and TON_IoT Features Selection IoT-23 Feature | TON_IoT Feature | Description
---|---|---
ts | ts | Timestamp of connection
id.orig_h | src_ip | originator’s IP address
id.orig_p | src_port | originator’s TCP/UDP port
id.resp_h | dst_ip | responder’s IP address
id.resp_p | dst_port | responder’s TCP/UDP port
proto | proto | transport layer protocol of connection
service | service | service
duration | duration | duration
orig_bytes | src_bytes | originator’s payload bytes
resp_bytes | dst_bytes | responder’s payload bytes
conn_state | conn_state | connection state
missed_bytes | missed_bytes | missed_bytes
orig_pkts | src_pkts | number of ORIG packets
orig_ip_bytes | src_ip_bytes | number of ORIG IP bytes
resp_pkts | dst_pkts | number of RESP packets
resp_ip_bytes | dst_ip_bytes | number of RESP IP bytes

###  3.3 Offline Model Training

As time progresses, new malicious attacks emerge and are designed. What was
once considered secure must adapt to maintain its security in the present and
future. This is especially true in the field of machine learning. To ensure
our predictive models remain secure, they must be trained on more up-to-date
data. To support this, we have integrated a means of retraining our various
models with our own generated data. The data passing through the pipeline is
saved in a format that enables easy retraining of our models at a later point
in time. Therefore, we need not rely solely on existing datasets to keep our
models up to date.

We evaluated five machine learning models and five deep learning models. The
machine learning model classifiers include random forest, decision tree,
logistic regression, linear SVC, and Gaussian-NB. The deep learning models
consist of artificial neural networks (ANN), 1D convolutional neural networks
(1DCNN), two-dimensional CNN (2DCNN), long short-term memory (LSTM), and a
combination of CNN and LSTM. Each model possesses unique strengths and
benefits that prompted our decision to evaluate them. Regarding the
hyperparameters of our deep learning models, we used ReLU as the activation
function for all of the ANN and CNN models, except for the LSTM model, which
uses ‘tanh‘ as the activation function and sigmoid as the recurrent activation
function. The ANN only uses one layer, while all of the other models use two
layers. More details about our model hyperparameters can be found in Table 4.

Table 4: Deep Learning Hyper-Parameters Parameter | Value
---|---
learning_rate | 1e-3
decay_rate | 1e-5
dropout_rate | 0.5
dense_units | 128
n_batch | 100
n_epoch | 1
filters | filters
kernel_size | 4
strides | 1
CNN_layers | 2
clf_reg | 1e-5

###  3.4 Online Inference

After the network traffic is converted into PCAP files and processed by Spark
streaming, our previously trained model(s) can make an inference on the data.
As mentioned previously, we have trained five types of machine learning models
and five types of deep learning models.

Upon entering the Spark streaming stage of the pipeline, all new data is
evaluated by one of the trained models based on the data’s timestamp. Machine
learning models generally require longer preprocessing times since feature
extraction is necessary, but inference/prediction times are quick as these
models are not very complex. On the other hand, deep learning models have less
preprocessing time but longer inference times due to their complexity. These
models tend to be more accurate on complex data, like that found in our
pipeline. At present, the pipeline concludes once an inference is made on the
network traffic, but the resulting inferences may be used as desired.

## 4 Evaluation

This section of the paper evaluates the performance of our proposed system.
Specifically, we will talk about the specifications of the testbed, and the
accuracy and timing performance of each machine learning and deep learning
model.

###  4.1 Experiment Testbed

We summarize the system specifications and software versions for the testbed
in Table 5. We use built-in Python tools in order to collect our data, like
training time, inference time, accuracy, and CPU usage.

Table 5: Experiment Platform Specification Item | Specification
---|---
CPU | Intel(R) Core(TM) i9-9920X CPU @ 3.50GHz
GPU | GTX 2080 Ti with 11 GB DDR6 Memory
Memory | 64 GB DDR4 @ 3600MHz
Storage | 2TB SSD
Host OS | Ubuntu 18.04 LTS
Tensorflow | 2.7
Apache Spark | 3.0.1
Apache Kafka | 2.6.0
Accelerator | Intel DAAL v2020.1

###  4.2 Model Accuracy Comparison

We calculated the prediction accuracy from machine learning and deep learning
models. In the machine learning inference section, we design five machine
learning models (Random-forest, Decision-Trees, Logistic-Regression, Linear-
SVC, and Gaussian-NB) and two feature sets, the full feature set, and the de-
identified feature set.

Figure 3 shows the outcomes of machine learning models. In addition, Figure 4
shows the outcomes from five deep learning models, Artificial Neural Network,
Convolutional Neural Network, Convolutional Neural Network_2D, Long-Short-
Term-Memory, and a combination of Convolutional Neural Network and Long-Short-
Term-Memory.

Figure 3: Model Accuracy Comparison in ML

In the machine learning experiments, generally full feature set marked a
higher score. The first two models, random-forest and decision-trees, almost
reached 100%. The score of the de-identified feature set is 75% on the whole.

Figure 4: Model Accuracy Comparison in DL

In the deep learning section, the first three models were marked as almost
100%. LSTM and LSTM+CNN, on the other hand, scored about 75%.

###  4.3 Inference Time Comparison

We measured the time of average time it takes for inference per each line from
CSV files. As same with before experiment, we tested machine learning and deep
learning. Figure 5 Shows the results from machine learning models, and Figure
6 Shows the results from deep learning models

Table 6: Inference Time for Machine Learning Models on Two Different Feature Sets | De-identified feature set (ms) | Full feature set (ms)
---|---|---
Random-Forest | 33.18 | 34.20
Decision-Trees | 10.40 | 10.78
Logistic-Regression | 10.30 | 10.71
SVC-Linear | 10.30 | 10.68
Gaussian-NB | 10.48 | 10.87
Table 7: Inference Time for Deep Learning Models | Time per row (ms)
---|---
ANN | 0.056
CNN | 0.118
CNN2D | 0.102
LSTM | 0.378
CNN+LSTM | 0.226
Figure 5: Inference Time Comparison in ML (ms)

This experiment shows that the random-forest model takes longer than othez1r
models. The reason seems that random-forest runs decision trees in parallel.
The other models make inference per line around 2.6ms. In addition, the full
feature set requires a little longer time to predict than the De-identified
feature set.

Figure 6: Inference Time Comparison in DL (ms)

This experiment shows that all deep learning models make inferences much
faster than machine learning models. LSTM models take a little longer than
other models, but only 0.4 ms per line

###  4.4 Scalability

Another key component of our research is scalability. We measured the change
in inference time depending on the number of supporting devices. In the test,
we added the number of devices from one to nine. Figure 7 Shows the outcome of
the trial.

Figure 7: Time Comparison Depending on the Numbers Devices(ms)

The experiment shows the scalability of our model. Generally, the inference
time per line decreases as the number of connected devices gradually
increases. Random-forest takes longer to predict than other models, the same
as the previous experiment.

## 5 Conclusion

In our project, we were able to achieve the objectives of real-time and
scalable malicious network traffic detection by utilizing Apache Kafka
producer and Apache Spark. Our models were trained on an enriched dataset that
comprises IoT-23 and TON_IoT which contains millions of network flows with
information on both malicious and benign network traffic. Upon preprocessing
the data, we were able to perform inferences on it using the various models we
developed. This process could be automated on a smart gateway to enable real-
time detection on a local network. We have made the source code for this
project available on GitHub for future research purposes. It can be accessed
via the following link: https://github.com/BlueJayADAL/NetSec.

## Acknowledgment

This work is supported in part by a grant from Intel Corporation, and a grant
from the Summer Scholarship, Creative Arts and Research Projects (SCARP)
Program of Elizabethtown College.

## References

  * [1] D. Gibert, C. Mateu, J. Planes, The rise of machine learning for detection and classification of malware: Research developments, trends and challenges, _Journal of Network and Computer Applications_ , _153_ :(2020), 102526\.
  * [2] Zscaler study confirms iot devices are a major source of security compromise, reinforces need for zero trust security.
  * [3] C. Jindal, C. Salls, H. Aghakhani, K. Long, C. Kruegel, G. Vigna, Neurlux: dynamic malware analysis without feature engineering, in _Proceedings of the 35th Annual Computer Security Applications Conference_ , pages 444–455 (2019).
  * [4] R. Vinayakumar, M. Alazab, K. Soman, P. Poornachandran, S. Venkatraman, Robust intelligent malware detection using deep learning, _IEEE Access_ , _7_ :(2019), 46717–46738.
  * [5] Y. Fang, Y. Gao, F. Jing, L. Zhang, Android malware familial classification based on dex file section features, _IEEE Access_ , _8_ :(2020), 10614–10627.
  * [6] S. Hajiheidari, K. Wakil, M. Badri, N. J. Navimipour, Intrusion detection systems in the internet of things: A comprehensive investigation, _Computer Networks_ , _160_ :(2019), 165–191, ISSN 1389-1286, doi:https://doi.org/10.1016/j.comnet.2019.05.014.
  * [7] M. Masdari, H. Khezri, A survey and taxonomy of the fuzzy signature-based intrusion detection systems, _Applied Soft Computing_ , _92_ :(2020), 106301\.
  * [8] S. Nari, A. A. Ghorbani, Automated malware classification based on network behavior, _2013 International Conference on Computing, Networking and Communications (ICNC)_ , pages 642–647.
  * [9] Ö. Aslan, M. Ozkan-Okay, D. Gupta, Intelligent behavior-based malware detection system on cloud computing environment, _IEEE Access_ , _9_ :(2021), 83252–83271.
  * [10] H. S. Galal, Y. B. Mahdy, M. A. Atiea, Behavior-based features model for malware detection, _Journal of Computer Virology and Hacking Techniques_ , _12_(2):(2016), 59–67.
  * [11] W. Liu, P. Ren, K. Liu, H.-x. Duan, Behavior-based malware analysis and detection, pages 39–42.
  * [12] B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. A. Kemmerer, C. Krügel, G. Vigna, Your botnet is my botnet: analysis of a botnet takeover, in _Conference on Computer and Communications Security_ (2009).
  * [13] N. Miramirkhani, M. P. Appini, N. Nikiforakis, M. Polychronakis, Spotless sandboxes: Evading malware analysis systems using wear-and-tear artifacts, in _2017 IEEE Symposium on Security and Privacy (SP)_ , pages 1009–1024 (IEEE, 2017).
  * [14] S. Liu, P. Feng, S. Wang, K. Sun, J. Cao, Enhancing malware analysis sandboxes with emulated user behavior, _Computers & Security_, _115_ :(2022), 102613\.
  * [15] O. Barut, M. Grohotolski, C. DiLeo, Y. Luo, P. Li, T. Zhang, Machine learning based malware detection on encrypted traffic: A comprehensive performance study, in _7th International Conference on Networking, Systems and Security_ , 7th NSysS 2020, page 45–55 (Association for Computing Machinery, New York, NY, USA, 2020), ISBN 9781450389051, doi:10.1145/3428363.3428365.
  * [16] K. L. K. Sudheera, D. M. Divakaran, R. P. Singh, M. Gurusamy, Adept: Detection and identification of correlated attack stages in iot networks, _IEEE Internet of Things Journal_ , _8_(8):(2021), 6591–6607.
  * [17] D. Bekerman, B. Shapira, L. Rokach, A. Bar, Unknown malware detection using network traffic classification, _2015 IEEE Conference on Communications and Network Security (CNS)_ , pages 134–142.
  * [18] O. Barut, Y. Luo, T. Zhang, W. Li, P. Li, Multi-task hierarchical learning based network traffic analytics, in _ICC 2021 - IEEE International Conference on Communications_ , pages 1–6 (2021), doi:10.1109/ICC42927.2021.9500546.
  * [19] O. Barut, T. Zhang, P. Li, Weakly supervised learning for network traffic classification, in _NAS 2022 - IEEE International Conference on Networking, Architecture and Storage_ , NAS ’22, pages 1–4 (Philadelphia, PA, USA, 2022).
  * [20] O. Barut, Y. Luo, P. Li, T. Zhang, R1dit: Privacy-preserving malware traffic classification with attention-based neural networks, _IEEE Transactions on Network and Service Management_ , pages 1–1, doi:10.1109/TNSM.2022.3211254.
  * [21] T.-L. Huoh, Y. Luo, P. Li, T. Zhang, Flow-based encrypted network traffic classification with graph neural networks, _IEEE Transactions on Network and Service Management_ , pages 1–1, doi:10.1109/TNSM.2022.3227500.
  * [22] A. K. Sahu, S. Sharma, M. Tanveer, R. Raja, Internet of things attack detection using hybrid deep learning model, _Computer Communications_ , _176_ :(2021), 146–154, ISSN 1873703X, doi:10.1016/j.comcom.2021.05.024.
  * [23] M. Goyal, I. Sahoo, G. Geethakumari, Http botnet detection in iot devices using network traffic analysis, in _2019 International Conference on Recent Advances in Energy-efficient Computing and Communication (ICRAECC)_ , pages 1–6 (IEEE, 2019).
  * [24] X. Liang, T. Znati, A long short-term memory enabled framework for ddos detection, in _2019 IEEE global communications conference (GLOBECOM)_ , pages 1–6 (IEEE, 2019).
  * [25] S. Garcia, A. Parmisano, M. J. Erquiaga, Iot-23: A labeled dataset with malicious and benign iot network traffic (version 1.0.0) [data set], doi:http://doi.org/10.5281/zenodo.4743746.
  * [26] N. Moustafa, A new distributed architecture for evaluating ai-based security systems at the edge: Network ton_iot datasets, _Sustainable Cities and Society_ , _72_ :(2021), 102994.
  * [27] S. Dadkhah, H. Mahdikhani, P. K. Danso, A. Zohourian, K. A. Truong, A. A. Ghorbani, Towards the development of a realistic multidimensional iot profiling dataset, _2022 19th Annual International Conference on Privacy, Security & Trust (PST)_, pages 1–11.