11institutetext: Center for Computational Engineering and Networking, Amrita
School Of Engineering, Amrita vishwa vidyapeetham, Coimbatore, India. 11email:
<EMAIL_ADDRESS><EMAIL_ADDRESS>22institutetext: Division of
Biomedical Informatics, Cincinnati Children’s Hospital Medical Centre,
Cincinnati, OH, United States.
22email<EMAIL_ADDRESS><EMAIL_ADDRESS>
# Deep Learning Approach for Intelligent Named Entity Recognition of Cyber
Security

Simran K 11 Sriram S 11 Vinayakumar R 22 1 1 Soman KP 11

###### Abstract

In recent years, the amount of Cyber Security data generated in the form of
unstructured texts, for example, social media resources, blogs, articles, and
so on has exceptionally increased. Named Entity Recognition (NER) is an
initial step towards converting this unstructured data into structured data
which can be used by a lot of applications. The existing methods on NER for
Cyber Security data are based on rules and linguistic characteristics. A Deep
Learning (DL) based approach embedded with Conditional Random Fields (CRFs) is
proposed in this paper. Several DL architectures are evaluated to find the
most optimal architecture. The combination of Bidirectional Gated Recurrent
Unit (Bi-GRU), Convolutional Neural Network (CNN), and CRF performed better
compared to various other DL frameworks on a publicly available benchmark
dataset. This may be due to the reason that the bidirectional structures
preserve the features related to the future and previous words in a sequence.

###### Keywords:

Information Extraction Named Entity Recognition Cyber Security Deep learning.

##  1 Introduction

Technology has evolved tremendously in the previous couple of decades making
diverse online web sources (news, forums, blogs, online databases, etc.)
available for common use. Newfound information regularly seems first on these
kinds of online web sources in unstructured text format. Mostly, it requires a
ton of time, sometimes years, for this information to properly classify into a
structured format. However, cases related to Cyber Security does not have that
kind of time, so timely extraction of this information plays an imperative job
in numerous applications. Information modeling of cyber-attacks can be used by
many individuals such as auditors, analysts, researchers, etc [1]. At the
core, knowledge extraction task is recognition of named entities of a domain,
such as products, versions, etc. The best accuracy given by the current Named
Entity Recognition (NER) devices, in this area of Cyber Security, depend on
feature engineering. However, feature engineering has many issues, for
example, depending on look-ups or dictionaries to recognize known entities
[2]. With profoundly dynamic fields such as Cyber Security, it is difficult to
fabricate as well as harder to keep up the word references and in turn,
consumes a lot of time for creating these NER tools. The limitation of these
tools is that they are domain-specific and cannot accomplish good accuracy
when applied to any other domain. These issues can be overcome by using Part
of Speech (POS) tagging. POS tagging is a task of identifying the words as
nouns, adjectives, verbs, adverbs, and so on (Distributed Denial of Service
(DDoS) is mostly taken as a noun). POS tagging can also diminish the time
delay in this domain.

Conditional Random Fields (CRFs) emerged in recent years as the most
successful method for entity extraction. CRFs are best for tagging and
sequential data as they can predict sequences of labels for a set of input
samples, taking the context of the input data into account. Mikolov et al. [7]
proposed a method called word2vec which converts every word in a corpus into a
low dimensional dense vector representation. These vectors can reflect the
semantic relationship between the words which was not possible in classical
one-hot vectors. For example, the difference between the vectors representing
the words ‘king’ and ‘queen’ is similar to the difference between the vectors
representing the words ‘man’ and ‘woman’. These relationships result in the
clustering of semantically similar words in the vector space.

Another leap forward in the ongoing years is the Deep Learning (DL) field. DL
is an enhanced classical neural network model which naturally learns non-
linear combinational features on its own whereas classical methods, for
example, CRFs can just learn linear combinations of the defined features. This
reduces the user work of tedious feature engineering [1, 34, 35, 36]. The
expansion in information accessibility, increase in hardware processing power
particularly GPUs, different activation functions, etc has made DL
exceptionally practical and feasible. Recent days, the applications of DL have
been leverage towards various applications in the field of Cyber Security [3,
4, 5, 6].

The hybrid model of Long Short Term Memory (LSTM) and CRF architecture
proposed by Lampal et al. [8] for NER is a blend of LSTM, CRFs, and word2vec
model. As this architecture is domain and entity type agnostic, it very well
can be connected to any area as long as the input is an annotated corpus of
the same format as the CoNLL-2000 dataset. This architecture is applied to the
domain of Cyber Security NER in [9]. As the corpus of Cyber Security is not
widely available, they utilized the corpus created in the work done by Bridges
et al. [1] for training the model. The author compared the performance of
LSTM-CRF with CRFSuite and LSTM-CRF beat CRFSuite with two percent accuracy.

The major contributions are:

  1. 1.

This work proposes a deep learning based framework for NER in Cyber Security.

  2. 2.

Various deep learning architectures are evaluated on well known and benchmark
data set.

  3. 3.

The importance of non-linear text representation is discussed in the context
of Cyber Security NER.

The remaining paper is arranged as follows. Section 2 documents the related
works followed by background related to deep learning architectures in Section
3. Section 4 describes the details of the data set used and Section 5 provides
a description of proposed architecture. Section 6 reports the experiments,
results, and observation whereas section 7 will conclude this paper with
remakes on future work of research.

##  2 Related Works

A lot of efforts are made for automatically labeling Cyber Security entities
in the past years. Concepts in Common Vulnerability Enumeration (CVE-3) were
annotated to instantiate a security ontology in [10]. Reuters [11] likewise
did with the assistance of his web journals and OpenCalais. Mulwad et al. [12]
searched the web to identify security relevant text and then train an SVM
classifier to identify the descriptions of potential vulnerability. Afterward
utilizing OpenCalais alongside the taxonomy of Wikipedia to identify and
classify vulnerability entities. In spite of the fact that these sources rely
upon standard entity recognition software, they are not prepared to recognize
domain specific ideas. This is because of the general nature of their training
data [13, 14]. Joshi et al. [15] noted comparative discoveries where NERD
system [16], Open-Calais and Stanford Named Entity Recognizer were all
commonly helpless to recognize Cyber Security domain entities. This is due to
the fact that these tools do not utilize domain-specific corpus. Stanford NER
system with hand-labeled domain specific training corpus was created in [15]
and delivered better outcomes for the greater part of their domain-specific
entities.

Joshi et al. [15] additionally performed hand annotating for a small corpus.
This small corpus was then encouraged to Stanford NER “off-the-shelf ” layout
for train a CRF entity extractor [13]. Their work has recognized the
equivalent Cyber Security issue yet they didn’t address a more broad issue of
automatically the labeling process.

Semi-supervised methods are additionally utilizing entity extraction rather
than supervised methods as they function admirably with very small training
data also. [17] have used semi-supervised methods for entity extraction and
have got beneficial outcomes. A bootstrapping algorithm created by McNeil et
al. [18] depicts a prototypical execution to extract data about
vulnerabilities and exploits. [19] utilizes known databases for seeding
bootstrapping strategies. [20] developed an exact strategy to automatically
label text from different data sources and then provide public access to a
data set which is annotated with Cyber Security entities. [21] proposed an
algorithm for extracting security entities and their relationships using semi-
supervised NLP with a small amount of input data. The precision of 0.82 was
achieved using small corpus. Either rule-based or machine learning [22]
approaches are utilized for NER and regularly the two are mixed [23]. Rule-
based is a blend of lookups and rules for pattern matching that is hand-coded
by an area expert. These rules use the contextual information of the entity to
decide if candidate entities are substantial or not. Machine learning based
NER approaches utilize an assortment of models, for example, Maximum Entropy
Models [24], Hidden Markov Models (HMMs) [25], CRFs [26], Perceptrons [27],
Support Vector Machines (SVMs) [28], or neural networks [2]. The best NER
approaches incorporate those dependent on CRFs. CRFs address the NER issue
utilizing an arrangement labeling model. In this model, the label of an entity
is demonstrated as reliant on the labels of the previous and following
entities in a predefined window.

As deep neural networks address many short comes of classical statistical
technique such as feature engineering, they are considered as a potential
alternative [29]. As feature are learned automatically by the neural network,
they decline the measure of human endeavors required in various applications.
Significant enhancements in accuracy in neural network feature with respect to
hand-engineered features are shown by empirical outcomes over a wide
arrangement of domains. Recurrent Neural Networks (RNNs) property of having
long time memory as they process input with variable length results in
outstanding accomplishment with several NLP tasks [30]. In [31], LSTM property
to permit the learning between arbitrary long-distance dependencies enhances
its performance over RNN.

In [32], LSTM-CRF technique was applied to the issue of NER in the Cyber
Security domain utilizing the corpus made accessible by Joshi et al. [15].
Given an annotated corpus of a decent size, it was observed that this
technique outflanks the state of the art methods given an annotated corpus of
a decent size.

##  3 Background

###  3.1 Convolutional Neural Network (CNN)

CNN is very famous network as it uses less learnable parameters. This network
consists of three types of layers which are convolution layers, pooling
layers, and fully connected layers. In the convolution layer of this neural
network, convolution operation is performed using several filters which slide
through the input and learns the features of the input data. The pooling layer
is utilized to decrease the size of the previous layer. Min pooling, max
pooling, and average pooling are the different types of pooling layers
available. The network is connected with a dense layer at the end so that the
features can be mapped to the classification.

###  3.2  Recurrent Neural Network (RNN)

RNN is a very important deep learning architecture which can handle sequential
information whereas feedforward neural networks fail at doing this. That’s why
RNN is utilized for applications related to sequential data, for example,
speech data as it can learn multi-variation like PoS tagging [33] using the
hidden units present in the recurrent cells. The issue of exploding or
vanishing gradients is the main problem with RNN.

###  3.3  Long Short-Term Memory (LSTM)

LSTM was introduced to solve the problem of vanishing gradient in RNN. It
selectively remembers the patterns for a long duration of time. The error that
will be backpropagated through layers is preserved which is a big help to
LSTM. Because of the three gates in LSTM, it has the ability to handle long
term as well as short term information whereas RNN can handle only short term
data. The cell takes decisions about when to allow read, write, etc.
operations as well as what to store and erase.

###  3.4 Gated Recurrent Unit (GRU)

GRU is an extended version of standard RNN and are also considered as a minor
variation from LSTM. An LSTM without an output gate is basically called as
GRU. It has update gate and reset gate which chooses what data should be
passed through them. LSTM can easily perform unbounded counting, so in this
way, it is stronger than GRU. That’s why the LSTM is able to learn simple
languages whereas GRU fails at this.

###  3.5 Bidirectional architectures

To understand the context better and resolve ambiguities in the text,
bidirectional recurrent structures are utilized which learns the information
from the previous and future time stamps. The two types of connections are one
going forward in time and the other going backward in time. These connections
help in learning the previous and future representations respectively. The
module in this bidirectional recurrent structure could be an RNN, LSTM or GRU.

##  4 Description of the Data set

Auto-labeled Cyber Security domain text corpus provided by Bridges et al. [1]
comprising of around 40 entity types was used in this work. All the corpora is
stored in a single JSON file and high-level JSON element are used to represent
each corpus. Each word in these corpora is auto-annotated with an entity type.
The files were additionally changed over into CoNLL2000 format in order to
feed the data into the model. Every word was annotated in a separate line and
separation between the three corpora were removed. When the preprocessing is
completed, each line in the data set consists of a word as well as its entity
type. The data set was divided into three subsets that is training,
validation, and testing consisting of 70%, 10%, and 20% data respectively.

##  5 Proposed Architecture

The proposed architecture for Cyber Security named entity recognition is shown
in Figure 1. The architecture has three different sections, namely input,
feature generation, and output. In the input layer, the text data is converted
into numerical features using Keras embedding. These numerical features are
high dimensional in nature so they are passed into a bidirectional GRU layer.
Bidirectional GRU layer refines the vectors and feeds them to a CNN layer. CNN
network generates more optimal features and feeds it to a CRF layer for
enhanced learning. This final layer uses the Viterbi algorithm to generate the
most possible tag for the input word.

Figure 1: Proposed Architecture.

##  6 Experiments, Results, and Observations

TensorFlow111https://www.tensorflow.org/ with Keras222https://keras.io/ were
used to implement all the deep learning architectures. All the models are
trained on GPU enabled TensorFlow. Various statistical measures are utilized
in order to evaluate the performance of the proposed classical machine
learning and deep learning models.

Initially, to identify the optimal architecture for auto-labeled Cyber
Security domain text corpus we proposed an architecture which has been
explained in Section 5 and we compared the performance of the proposed method
with the architectures already published. Various deep learning architectures
were implemented and their performance was compared with Bidirectional
GRU+CNN-CRF. Bidirectional GRU+CNN-CRF outperformed all other architectures.
LSTM is computationally expensive whereas GRU is computationally inexpensive
which can lead to the same performance in some cases and some cases the
performance of the GRU is better than LSTM.

The training dataset was used to train the models and these trained models
were tested using the testing data set. LSTM, RNN, GRU, Bidirectional GRU
contains 128 hidden units. Embedding dimension of 128, learning rate of 0.005,
and Stochastic Gradient Descent (SGD) learning method are used in all the
experiments. The models were compared in terms of precision, recall, and
f1-score and the detailed results are reported in Table 1. The performance
metrics in terms of precision, recall, and f1-score shows that Bidirectional
GRU+CNN-CRF outperformed all other architectures.

Table 1: Average weighted performance metrics for all entity types.

Model | Precision | Recall | F1-score
---|---|---|---
LSTM-CRF [9] | 85.3 | 94.1 | 89.5
CRF [9] | 82.4 | 83.3 | 82.8
CNN-CRF | 83.1 | 93.9 | 88.2
RNN-CRF | 83.5 | 85.6 | 84.5
GRU-CRF | 86.5 | 95.7 | 90.9
Bidirectional GRU-CRF | 88.7 | 95.4 | 91.9
Bidirectional GRU+CNN-CRF | 90.8 | 96.2 | 93.4

##  7 Conclusion and Future work

This work evaluates the efficacy of various deep learning frameworks along
with CRF model for NER Cyber Security text data and Bidirectional GRU+CNN-CRF
model performed better than other deep learning architecture. The best part
about the proposed architecture is that it does not require any feature
engineering. This work can be extended for Relation Extraction (RE). RE
basically attempts to find occurrences of relations among entities. Product
vulnerability description can be better understood by using RE. For instance,
RE can be used to identify and differentiate the product that is being
attacked and the product that is meant to attack by using the information
extracted from the product vulnerability description.

## Acknowledgment

This research was supported in part by Paramount Computer Systems and Lakhshya
Cyber Security Labs. We are grateful to NVIDIA India, for the GPU hardware
support to research grant. We are also grateful to Computational Engineering
and Networking (CEN) department for encouraging the research.

## References

  * [1] R. A. Bridges, C. L. Jones, M. D. Iannacone, K. M. Testa, and J. R. Goodall, ”Automatic labeling for entity extraction in cyber security,” arXiv preprint arXiv:1308.4941, 2013.
  * [2] R. Collobert, J. Weston, L. Bottou, M. Karlen, K. Kavukcuoglu, and P. Kuksa, ”Natural language processing (almost) from scratch,” Journal of Machine Learning Research, vol. 12, pp. 2493-2537, 2011.
  * [3] Vinayakumar, R., Soman, K. P., & Poornachandran, P. (2018). Detecting malicious domain names using deep learning approaches at scale. Journal of Intelligent & Fuzzy Systems, 34(3), 1355-1367.
  * [4] Vinayakumar, R., Soman, K. P., & Poornachandran, P. (2018). Evaluating deep learning approaches to characterize and classify malicious URL’s. Journal of Intelligent & Fuzzy Systems, 34(3), 1333-1343.
  * [5] Vinayakumar, R., Alazab, M., Jolfaei, A., Soman, K. P., & Poornachandran, P. (2019, May). Ransomware triage using deep learning: twitter as a case study. In 2019 Cybersecurity and Cyberforensics Conference (CCC) (pp. 67-73). IEEE.
  * [6] Vinayakumar, R., Soman, K. P., Poornachandran, P., & Akarsh, S. (2019). Application of Deep Learning Architectures for Cyber Security. In Cybersecurity and Secure Information Systems (pp. 125-160). Springer, Cham.
  * [7] T. Mikolov, I. Sutskever, K. Chen, G. S. Corrado, and J. Dean, ”Distributed representations of words and phrases and their compositionality,” in Advances in neural information processing systems, pp. 3111-3119, 2013.
  * [8] G. Lample, M. Ballesteros, S. Subramanian, K. Kawakami,and C. Dyer, ”Neural architectures for named entity recognition,” arXiv preprint arXiv:1603.01360, 2016.
  * [9] Gasmi, Houssem, Abdelaziz Bouras, and Jannik Laval. ”LSTM Recurrent Neural Networks for Cybersecurity Named Entity Recognition.” ICSEA 2018 (2018): 11.
  * [10] S. More, M. Matthews, A. Joshi, and T. Finin, “A knowledge-based approach to intrusion detection modeling,” in Security and Privacy Workshops (SPW), 2012 IEEE Symposium on Semantic Computing and Security. IEEE, 2012, pp. 75–81.
  * [11] T. Reuters, “OpenCalais,” 2009.
  * [12] V. Mulwad, W. Li, A. Joshi, T. Finin, and K. Viswanathan, “Extracting information about security vulnerabilities from web text,” in Proceedings of the 2011 IEEE/WIC/ACM International Conferences on Web Intelligence and Intelligent Agent Technology - Volume 03, ser. WI-IAT ’11. Washington, DC, USA: IEEE Computer Society, 2011, pp. 257–260. [Online]. Available: http://dx.doi.org/10.1109/WI-IAT.2011.26
  * [13] J. R. Finkel, T. Grenager, and C. Manning, “Incorporating non-local information into information extraction systems by Gibbs sampling,” in Proceedings of the 43rd Annual Meeting on Association for Computational Linguistics,ser. ACL ’05. Stroudsburg, PA,USA: Association for Computational Linguistics,2005, pp. 363–370. [Online]. Available: http://dx.doi.org/10.3115/1219840.1219885
  * [14] E. F. Tjong Kim Sang and F. De Meulder,“Introduction to the CoNLL-2003 shared task: Language-independent named entity recognition,” in Proceedings of the Seventh Conference on Natural Language Learning at HLT-NAACL 2003- Volume 4. Association for Computational Linguistics, 2003, pp. 142–147.
  * [15] A. Joshi, R. Lal, T. Finin, and A. Joshi, “Extracting cybersecurity related linked data from text,” in Proceedings of the 7th IEEE International Conference on Semantic Computing. IEEE Computer Society Press, 2013.
  * [16] G. Rizzo and R. Troncy, “NERD: A framework for unifying named entity recognition and disambiguation extraction tools,” in Proceedings of the Demonstrations at the 13th Conference of the European Chapter of the Association for Computational Linguistics. Association for Computational Linguistics, 2012, pp. 73–76.
  * [17] R. Huang and E. Riloff, “Bootstrapped training of event extraction classifiers,” in Proceedings of the 13th Conference of the European Chapter of the Association for Computational Linguistics. Association for Computational Linguistics, 2012, pp. 286–295.
  * [18] N. McNeil, R. A. Bridges, M. D. Iannacone, B. Czejdo, N. Perez, and J. R. Goodall, “PACE: Pattern accurate computationally efficient bootstrapping for timely discovery of cyber-security concepts,” in Machine Learning and Applications (ICMLA), 2013 11th International Conference on. IEEE, 2013.
  * [19] J. Geng and J. Yang, “Auto bib: Automatic extraction of bibliographic information on the web,” in Proceedings of the International Database Engineering and Applications Symposium, ser.IDEAS ’04. Washington, DC, USA: IEEE Computer Society, 2004, pp. 193–204. [Online]. Available: http://dx.doi.org/10.1109/IDEAS. 2004.14
  * [20] Bridges, Robert A., et al. ”Automatic labeling for entity extraction in cyber security.” arXiv preprint arXiv:1308.4941(2013).
  * [21] Jones, Corinne L., et al. ”Towards a relation extraction framework for cyber-security concepts.” Proceedings of the 10th Annual Cyber and Information Security Research Conference. ACM, 2015.
  * [22] P. Cimiano, S. Handschuh, and S. Staab, ”Towards the self annotating web,” in Proceedings of the 13th international conference on World Wide Web, pp. 462-471, 2004.
  * [23] P. Pantel and M. Pennacchiotti, ”Automatically Harvesting and Ontologizing Semantic Relations,” in Proceedings of the 2008 Conference on Ontology Learning and Population: Bridging the Gap Between Text and Knowledge, Amsterdam, The Netherlands, The Netherlands, pp. 171-195, 2008.
  * [24] H. L. Chieu and H. T. Ng, ”Named entity recognition: a maximum entropy approach using global information,” in Proceedings of the 19th international conference on Computational linguistics-Volume 1, pp. 190-196, 2002.
  * [25] A. McCallum, D. Freitag, and F. C. N. Pereira, ”Maximum Entropy Markov Models for Information Extraction and Segmentation.,” in Icml, pp. 591-598, 2000.
  * [26] A. McCallum and W. Li, ”Early results for named entity recognition with conditional random fields, feature induction and web-enhanced lexicons,” in Proceedings of the seventh conference on Natural language learning at HLT-NAACL 2003-Volume 4, pp. 188-191, 2003.
  * [27] X. Carreras, L. Màrquez, and L. Padró, ”Learning a perceptron-based named entity chunker via online recognition feedback” in Proceedings of the seventh conference on Natural language learning at HLT-NAACL 2003-Volume 4, pp. 156-159, 2003.
  * [28] H. Isozaki and H. Kazawa, ”Efficient support vector classifiers for named entity recognition,” in Proceedings of the 19th international conference on Computational linguistics-Volume 1, pp. 1-7, 2002.
  * [29] Y. Goldberg, ”A Primer on Neural Network Models for Natural Language Processing.,” J. Artif. Intell. Res.(JAIR), vol. 57, pp. 345-420, 2016.
  * [30] A. Graves, A. Mohamed, and G. Hinton, ”Speech recognition with deep recurrent neural networks,” in Acoustics, speech and signal processing (icassp), ieee international conference on, pp. 6645-6649, 2013.
  * [31] F. A. Gers, J. A. Schmidhuber and F. A. Cummins, ”Learning to Forget: Continual Prediction with LSTM,”, Neural Compution, vol. 12, pp. 2451-2471, 10 2000.
  * [32] Hochreiter, S., & Schmidhuber, J. (1997). Long short-term memory. Neural computation, 9(8), 1735-1780.
  * [33] Collobert, R., Weston, J., Bottou, L., Karlen, M., Kavukcuoglu, K., & Kuksa, P. (2011). Natural language processing (almost) from scratch. Journal of machine learning research, 12(Aug), 2493-2537.
  * [34] Vinayakumar, R., Alazab, M., Srinivasan, S., Pham, Q. V., Padannayil, S. K., & Simran, K. (2020). A Visualized Botnet Detection System based Deep Learning for the Internet of Things Networks of Smart Cities. IEEE Transactions on Industry Applications.
  * [35] Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., & Venkatraman, S. (2019). Robust intelligent malware detection using deep learning. IEEE Access, 7, 46717-46738.
  * [36] Vinayakumar, R., & Soman, K. P. (2020). Siamese neural network architecture for homoglyph attacks detection. ICT Express, 6(1), 16-19.


††thanks: Email address

# Direct observations of rising oil droplets deformed by hydrocarbonoclastic
bacteria

Vincent Hickla Hima Hrithik Pamub Gabriel Juarezb<EMAIL_ADDRESS>aDepartment of Physics, University of Illinois at Urbana-Champaign, Urbana,
Illinois 61801, USA  bDepartment of Mechanical Science and Engineering,
University of Illinois at Urbana-Champaign, Urbana, Illinois 61801, USA

###### Abstract

In marine environments, microscopic droplets of spilled oil can be transported
over tens or hundreds kilometers in the water column. As this oil is
biodegraded, growing bacteria on the droplets’ surface can deform the oil-
water interface to generate complex shapes and significantly enlarge droplets.
A complete understanding of the fate and transport of spilled oil requires
bridging the present gap between these length scales and determining how
microscale processes affect large-scale transport of oil. Here, we describe
experimental results describing rising oil droplets in a purpose-built
hydrodynamic treadmill which rotates to keep droplets stationary in the lab
frame for continuous, direct observation. Droplets of radii $10-100$ µm are
colonized and deformed by bacteria over several days before their rising
speeds through the water column are measured. Rising speeds of deformed
droplets are significantly slower as a result of bio-aggregate formation at
the droplet surface compared to those of droplets of weathered or unweathered
oil without bacteria. Additionally, we discover bio-aggregate particles of oil
and bacterial biofilms which sink through the water column. The composition of
these particles is quantified using fluorescence microscopy. These results
have important implications for the study of oil transport following a spill,
as colonization by bacteria can cause oil droplets to remain in the water
column for months or years longer than otherwise expected. An improved
understanding of the physical transformations of oil droplets during
biodegradation shows promise for significantly improving models of oil spills.
Additionally, the formation of sinking particles of oil and bacteria presents
a new vector for hydrocarbon sedimentation and potential marine oil snow
formation.

Keywords: biodegradation, oil-degrading bacteria, oil droplets, hydrodynamic
treadmill, hydrocarbon transport, oil spills.

Synopsis: Microscopic processes affect the transport of oil droplets over long
distances. This study uses novel experimental protocols to show how bacterial
deformations reduce droplet rising speeds and cause oil sedimentation.

##  I Introduction

Understanding the transport of crude oil through marine environments is
crucial for the study of the long-term effects of anthropogenic oil spills and
of natural marine oil seeps. Oil spills in particular can cause catastrophic
damage to marine ecosystems, and oil spill response techniques can only be
effective if the complex physics which underlie the motion of oil through the
water column are considered. An important challenge is to accurately predict
the transport of microscopic, immiscible droplets of oil which can be
suspended at depth for months after a spill Camilli  _et al._ (2010); Passow
and Overton (2021). These droplets, which typically range from $\leq 1$ µm to
hundreds of µm in radius Li  _et al._ (2015), can form plumes which contain as
much as 70% of the oil spilled in events such as the Deepwater Horizon (DWH)
disaster Ryerson  _et al._ (2012); Passow and Overton (2021). In situ
observations and simulations of oil spills have shown that these droplets can
be transported over hundreds of kilometers North  _et al._ (2015); French-
McCay  _et al._ (2019). To fully describe the fate of these droplets, one must
bridge the gap between microscale processes underlying the evolution of the
droplets themselves and macroscale processes determining their long-term
transport.

As oil is transported through the water column, marine bacteria attach to the
surface of droplets and can degrade some components of the oil. Some estimates
suggest that, following the DWH disaster, 30% of the spilled oil may have been
biodegraded by marine organisms, especially bacteria Passow and Hetland
(2016). Accordingly, the ultimate fate of spilled oil cannot be accurately
assessed without considering the effects of biodegradation on droplet
transport.

Existing models of oil biodegradation and transport typically make a number of
simplifying assumptions regarding droplet evolution. For example,
biodegradation is taken to involve a simple shrinkage of oil droplets over
time. Some authors also explicitly assume that oil droplets remain spherical,
and any biofilm formation on their surface is neglected Vilcáez  _et al._
(2013); North  _et al._ (2015). Additionally, it is commonly assumed that
droplet buoyancy remains constant and the rate of degradation is the same for
all droplets North  _et al._ (2015). In reality, droplet degradation rates
depend on droplet size not only because of different area-to-volume ratios,
but also because encounters between cells and droplets can be a rate-limiting
step Fernandez  _et al._ (2022). Accurate predictions of sub-surface oil
transport require an improved and more detailed understanding of
biodegradation mechanics Vilcáez  _et al._ (2013); North  _et al._ (2013);
Daly  _et al._ (2016); Socolofsky  _et al._ (2019).

Recent work has shown that the growth of bacteria confined to the surface of
oil droplets can cause deformations of the interface Hickl and Juarez (2022a).
As cells continue to grow, an aggregate of biofilm and oil forms around
droplets, enlarging them by as much as a factor of 2 Omarova  _et al._ (2019);
Hickl and Juarez (2022b). This observation contradicts the prevailing notion
that droplets must shrink as they are degraded. Understanding how droplet
deformations affect the transport of oil is crucial for determining its
eventual fate. By pinning disks of oil between two surfaces, it has been shown
that interfacial biofilms increase the drag on oil droplets White  _et al._
(2020). However, the magnitude of this change, or its dependence on droplet
size and morphology remain unknown. Additionally, other effects such as
changes in buoyancy have yet to be described. To our knowledge, there are no
experimental observations of how droplets colonized and deformed by oil-
degrading bacteria are transported vertically through a water column.

The vertical transport of hydrocarbons is a crucial ecological process which
can affect the global climate by reducing atmospheric $\text{CO}_{2}$ via
sedimentation in the ocean Kiørboe (2001). Following oil spills, most of the
oil either rises to form surface slicks or becomes entrenched in deep-sea
plumes. In both cases, marine snow particles can cause hydrocarbons to sink
and become sedimented on the ocean floor. Estimates have suggested that as
much as 14% of oil spilled in the Deepwater Horizon Disaster may have sunk to
the seafloor, largely as a result of marine snow formation Daly  _et al._
(2016); Valentine  _et al._ (2014). A variety of mechanisms for the formation
of marine snow in the context of oil spills have been described Brakstad  _et
al._ (2018); Ross  _et al._ (2021), but most emphasize the importance of
phytoplankton which interact with oil and other organisms to form particles
$>0.5$ mm in size Gregson  _et al._ (2021). Less attention has been paid to
smaller sinking particles which may include spilled oil. In particular, while
bacteria are known to attach to existing marine snow Kiørboe (2001); Słomka
_et al._ (2020), it is unclear to what extent their growth can itself lead to
the formation of sinking, hydrocarbon-rich particles. Recent observations of
biofilm formation on both oil films Omarova  _et al._ (2019) and droplets
Abbasi  _et al._ (2018); Hickl and Juarez (2022a), suggest that oil dispersion
caused by bacterial colonization may be important to consider.

Here, we present experimental results from direct observations of the vertical
transport of oil droplets colonized and deformed by bacteria. Inspired by
recent advances in the study of swimming microorganisms Krishnamurthy  _et
al._ (2020), we construct a “hydrodynamic treadmill,” which allows for the
stationary observation of droplets (in the lab frame), while maintaining
continuous motion through a water column. Using this method, precise
measurements of oil rising and sinking speeds are achieved in vitro. Oil
droplets colonized by bacteria are deformed significantly, which can lead to
the formation of aggregates of oil and biofilm with complex morphologies.
Droplets deformed by bacteria rise significantly slower than droplets of both
unweathered and weathered oil as a result of changes in both drag and
buoyancy. As a result of oil dispersion by bacterial colonization, bio-
aggregates of oil and biofilm sink through the water column. The composition
of these aggregates varies widely, with crude oil comprising between $0.05\%$
and $7.8\%$ of the volume. These results challenge several key assumptions in
the literature on the transport of suspended oil subject to biodegradation.
The sinking of aggregates of oil and bacteria represents a new pathway through
which microscopic, hydrocarbon-rich particles can sediment in the ocean.

##  II Experimental methods

To visualize rising oil droplets, we constructed a rotating annular fluid
chamber which acts as a hydrodynamic treadmill for the droplets. The chamber
was constructed using aluminum rings (3 mm thick) sandwiched between laser cut
sheets of acrylic (1.5 mm thick). The inner aluminum ring had an inner radius
of 15 mm and an outer radius of 45 mm. The outer ring had an inner radius of
65 mm and an outer radius of 80 mm. The four pieces were screwed together and
sealed using silicone rubber sheets (1 mm thick) and epoxy. Thus, the fluid
chamber was a ring of width 20 mm, with a radius of 55 mm at the center, and a
thickness of 4 mm. The chamber was mounted on a 8 mm steel shaft (Phidgets)
using a universal mounting hub (Pololu).

The chamber was rotated by a DC motor (McMaster-Carr) via a custom-built
gearbox with laser-cut acrylic gears to reduce the speed of rotation and
provide finer control over the angular velocity. The speed of the motor could
be set manually using a power controller, or programmatically using a motor
driver carrier (Pololu VNH5019) and an Arduino microcontroller. The angular
speed of the chamber could be controlled with a resolution of less than
$5\times 10^{-4}$ rad/s. An optical encoder (Phidgets IHC3808) was used to
measure the precise angular velocity of the chamber during experiments. These
components were mounted onto an optical breadboard using optical posts, rotary
bearings, and various custom 3D printed and laser cut parts.

Images were taken at $2.3\times$ magnification using a Ximea SCMOS camera and
a zoom lens, mounted on a tripod and focused on the 3 o’clock position of the
annular fluid chamber. Each droplet is recorded for 10 s at 20 fps. Images are
calibrated in each experiment using a ruler placed in the field of view. The
resolution is $2.37$ µm/pixel.

Figure 1: Hydrodynamic treadmill. (A) Render of our setup assembly, showing
the fluid chamber, custom gearbox, camera, and optical encoder mounted on an
optical breadboard. (B) Frontal view of annular fluid chamber with inner and
outer radii $R_{i}$ and $R_{o}$, with camera fixed on the 3 o’clock position.
(C) Sample image of deformed oil droplets (red circles) in tracer particle
suspension in the fluid chamber.

The bacterial strain used in this study was _A. borkumensis_ (ATCC 700651), a
rod-shaped, non-motile, alkane-degrading marine bacterium. Bacteria were grown
by incubating cells in 5 mL of culture medium for $24$ hours at $30\
^{\circ}$C in an orbital shaker at $180$ rpm. The culture medium consisted of
37.4 g/L of 2216 marine broth (BD Difco) and 10 g/L of sodium pyruvate. The
average doubling time was measured to be 1.6 hours using a Biowave CO8000 cell
density meter.

In each experiment $0.5$ mL of MC525 crude oil was added to a culture tube
containing culture medium inoculated with bacteria, forming a thin oil film on
the water surface. MC252 is a light sweet crude oil having a density of
$0.850$ g/mL, an interfacial tension of $20$ mN/m, and a viscosity of $3.9$
mPa s at $32\ ^{\circ}$C Daling  _et al._ (2014). This oil is autofluorescent
throughout the visible spectrum. The tube containing cell culture and oil was
then incubated for $3-5$ days at $30\ ^{\circ}$C in an orbital shaker at $180$
rpm. The agitation produced a polydispersion that includes oil droplets with
radii $10$ µm $<R<100$ µm to which bacteria can attach, grow, and induce
deformations.

There were two control protocols: one with weathered and one with unweathered
oil. For weathered oil, the sample preparation was identical to that described
above, except no cells were added to the culture medium. This protocol enables
us to control for any evaporation or dissolution of oil that occurs while
bacteria grow. For unweathered oil, a polydispersion of oil in DI water is
produced via gentle agitation in a test tube, without any incubation. This
protocol is used to confirm that the experimental setup and measurement
protocol is working as intended, since the density and expected rising speeds
of the unweathered oil are known.

In all three protocols (deformed oil, unweathered oil, and weathered oil), the
polydispersion of oil in water was injected into the rotating fluid chamber.
To accurately measure the rising speeds of droplets relative to the
surrounding fluid, polystyrene tracer particles with a $16.6$ µm diameter were
added to the fluid at a concentration of $8\times 10^{3}$ particles/mL. In
videos of droplets suspended in the rotating chamber, the fluid speed $v_{f}$
was determined with a custom PTV MATLAB algorithm used to determine the
velocity of the tracer particles surrounding each droplet. The velocity of the
droplets relative to the camera $v_{oc}$ was similarly determined. The
velocity of the droplets relative to the surrounding fluid is then given by
$v_{of}=v_{oc}-v_{f}$.

##  III Results

Figure 2: Droplet formation and morphology. (A) Schematic of the protocol for
polydispersion of oil droplets into a cell suspension. Bacteria are incubated
for several days in a liquid culture with a film of oil at the surface.
Constant agitation disperses oil into the fluid, where droplets are colonized
and deformed. (B) Droplet size distribution for experiments with and without
bacteria. (C) Deformed oil droplets with positive buoyancy. Phase contrast
(left) and fluorescence (right) microscopy images show oil droplets buckled
and tubulated by bacteria. (D) Aggregates of oil and biomass with negative
buoyancy. Phase contrast images (left) show full size of sinking object.
Fluorescent images (right) show that only a fraction of the aggregate is crude
oil. Scale bar is the same for (C) and (D).

Droplets suspended in a cell suspension become colonized and deformed by
bacteria. Suspended droplets are formed by continuously agitating tubes
containing a cell culture with a thin layer of oil, as shown in Fig. 2A. Then,
bacteria attach to and grow at the droplet surface, and eventually overcome
surface tension to deform droplets. After several days, a small amount of the
oil-in-water dispersion is taken out of the tube and placed between a
microscope slide and cover slip separated by 1 mm spacers. Phase contrast and
fluorescence microscopy are then used to visualize the suspended oil particles
along with any attached bacteria and biofilm. Nearly all droplets appear
buckled, with many having tube-like protrusions at their surface, as shown in
Fig. 2C-D. The radii of all droplets from experiments in the hydrodynamic
treadmill (including controls) are shown in Fig. 2B. For deformed droplets,
the equivalent radius is given by $R_{eq}=\sqrt{A_{c}/\pi}$, where $A_{c}$ is
the cross-sectional area of the droplet in the imaging plane. The mean droplet
size measured in the treadmill was $\bar{R}=36\pm 2$ µm.

The composition and morphology of oil particles determine their buoyancy. Once
injected onto the microscope slide, some aggregates of oil and biofilm rise to
the cover slip, while others sink and remain on the glass slide. Since the oil
is autofluorescent, fluorescence microscopy was used to determine how the oil
was distributed within particles with both positive and negative buoyancy.
Rising particles appear to be buckled droplets that consist primarily of oil,
with some bacteria and biofilm at the interface, as shown in Fig. 2C. On the
other hand, sinking particles consist primarily of bacteria and biofilm, which
have smaller oil particles suspended within them, as shown in Fig. 2D.

The hydrodynamic treadmill gives accurate measurements of the rising speeds of
uncolonized and unweathered oil droplets. In control experiments, a
polydispersion of oil in water is injected into the rotating chamber. For
microscopic droplets, the Reynold’s number $Re=\rho_{w}v_{T}R/\mu<<1$, meaning
viscous forced dominate over inertial ones. Here, $v_{T}$ is the terminal
speed, and $\mu$ and $\rho_{w}$ are the viscosity and mass density of water,
respectively. Therefore, the expected terminal rising speed of a droplet is
calculated by setting the sum of the weight, buoyant force, and Stokes’ drag
equal to zero. For spherical droplets, this gives

$v_{T}=\frac{2}{9}\frac{g}{\mu}(\rho_{o}-\rho_{w})R^{2}$ (1)

where $g$ is the acceleration due to gravity, and $\rho_{o}$ is the density of
the oil. All droplets analyzed in the treadmill had Reynolds numbers $Re<0.1$.
Since the density of unweathered oil is known, this speed can readily be
calculated for droplets of unweathered oil, shown in Fig. 3 (solid line).
Experimental measurements of rising speeds of unweathered droplets are in very
good agreement with this prediction, shown in Fig. 3 (grey points). This
result validates our method for measuring vertical speeds of microscopic
objects in a water column.

Droplets of weathered oil rise more slowly than droplets of unweathered oil.
These droplets are produced by maintaining a polydispersion of oil droplets in
culture medium on an orbital shaker for 5 days. During this time, volatile
components of the crude oil can evaporate, while soluble components are
dissolved in the surrounding fluid. Since these components tend to be lighter
Daling  _et al._ (2014), this weathering process is expected to increase the
density of the oil droplets. As expected, droplets of weathered oil rise more
slowly in the hydrodynamic treadmill, shown in Fig. 3 (blue points). Using
these speeds, we estimate the density of weathered oil to be $0.899\pm 0.013$
g/mL, which is significantly higher than the density of unweathered oil,
$0.850$ g/mL.

Figure 3: Measurements of droplet rising speeds from hydrodynamic treadmill.
(Black line) The expected rising speeds for unweathered droplets with no
bacteria as determined from Eq. 1. (Grey and Blue points) Experimentally
measured rising speeds of unweathered and weathered oil droplets,
respectively, that are not colonized or deformed by bacteria. (Red points)
experimentally measured rising speeds of deformed droplets that are visibly
non-spherical as a result of cell attachment and growth. Error bars represent
variation in speed from PTV measurements.

Oil droplets deformed by bacteria rise significantly more slowly than both
unweathered and weathered droplets of oil. Droplets are deformed by
maintaining a polydispersion of oil in culture medium with bacteria for $3-5$
days. As bacteria grow on the droplet surface, they form a monolayer which
produces active stresses that can overcome surface tension to deform the oil-
water interface. Droplets than are visibly deformed when observed in the
hydrodynamic treadmill all have smaller rising speeds than droplets that are
only weathered without bacteria, shown in Fig. 3 (red points). The mean ratio
of the rising speed of deformed droplets to the theoretical rising speed
obtained from Eq. 1 was $v_{D}/v_{T}(R)=0.46\pm 0.19$, with values ranging
from $0.05$ to $0.69$. Here, $R$ is the radius of deformed droplets measured
directly in the hydrodynamic treadmill. The variation in speeds is much larger
than in control experiments, which is due to the complex and varied
morphologies of different droplets, as shown in Fig. 2C.

Bio-aggregates of oil and bacteria that do not rise in water were also
observed using the hydrodynamic treadmill. By reversing the direction of the
rotation of the fluid chamber, continuous observation of sinking particles was
possible. Additionally, some particle were nearly stationary, meaning they
were neutrally buoyant. Both sinking and neutrally buoyant particles have
highly complex, non-spherical morphologies. As a result, precisely measuring
their size was not possible in the hydrodynamic treadmill, as only a 2D cross-
section could be observed. For sinking particles, the measured speeds ranged
from approximately $10$ µm/s to $140$ µm/s.

To quantify the composition of sinking particles of oil and bacteria, an oil-
in-water dispersion was created by letting bacteria colonize oil in a test
tube under constant agitation over 5 days, as described above. Then, the
agitation was stopped, and the test tube was kept stationary for $1$ h,
allowing negatively buoyant particles to sink, and positively buoyant
particles to rise to the surface. The fluid at the bottom of the tube was
carefully decanted to prevent further mixing, and a sample was placed between
a microscope slide and a cover slip separated by 1 mm spacers. After an
additional $0.5$ h of waiting, particles that had settled onto the glass slide
were imaged using brightfield and fluorescence microscopy. Brightfield
microscopy showed the entire particles, including oil and bacteria, while
fluorescence microscopy was used to determine the exact distribution of crude
oil, as shown in Fig. 4A.

Figure 4: Composition of sinking particles of oil and bacteria. (A) Composite
image of a sinking particle with approximate radius of $159$ µm, taken using
brightfield (grayscale) and fluorescence microscopy (green false color,
showing crude oil) at $10\times$ magnification. (Inset) The calibration curve
of fluorescence intensity as a function of oil depth used to estimate the
volume of oil in such particles. (B) Log-log plot of estimated oil volume in
sinking particles of different volumes. Error bars represent uncertainty in
the quantity of oil based on the calibration curve.

The volume of oil in bio-aggregates was measured using fluorescence
microscopy. First, stationary droplets of crude oil were formed on a glass
slide in DI water without bacteria. The intensity of the fluorescent emission
at the center of each droplet was measured, with the focus set to the midplane
of the droplets. Plotting this intensity as a function of droplet diameter
shows how the depth of oil along the optical axis (the direction perpendicular
to the focal plane) determines the intensity of the fluorescent emission. For
droplets up to a diameter of about $20$ µm, the intensity depends linearly on
the oil depth, as shown in Fig. 4A (inset). This method yields a calibration
curve relating the depth of the oil $h_{o}$ at a point to the fluorescence
intensity $I_{F}$:

$I_{F}=mh_{o}+b\text{ for }h_{o}<20$ (2)

where $m$ and $b$ are fitting parameters.

Sinking particles consist mostly of bacteria and their extracellular polymeric
substances (EPS), and contain only a small amount of oil. In sinking particles
of bio-aggregate, oil is dispersed into many (non-spherical) microdroplets
with radii $R<10$ µm, as shown in Fig. 4A. Therefore, the quantity of oil at
each pixel of size $\delta x$ can be calculated by:

$V_{\text{oil}}(x,y)=\frac{I_{F}(x,y)-b}{m}\delta x^{2}$ (3)

where $(x,y)$ are coordinate in the image plane. Then, to calculate the total
volume of oil in a bio-aggregate particle, the volume of oil is summed over
all pixels in the region $P$ where the particle is located:

$V_{\text{oil}}=\sum_{\\{x,y\\}\in
P}\max\left(\frac{I_{F}(x,y)-b}{m},0\right)\delta x^{2}$ (4)

The $\max$ function serves to ensure that the calculated oil volume at each
pixel is non-negative.

Fitting suggests a power law relationship of $V_{\text{oil}}\propto
V_{\text{total}}^{0.8}$, as shown in Fig. 4B, meaning the proportion of oil
tends to decrease slightly with particle size. The mean percentage of oil
across all particles with negative buoyancy is $2.3\pm 0.2\%$, with values
ranging from $0.05\%$ to $7.8\%$, meaning most of the particle volume is
composed of cells and biofilm. The low minimum value of the proportion is
consistent with our observation that some sinking particles appear not to
contain any oil, suggesting the biofilm formed at the oil-water interface can
break apart.

##  IV Discussion

Direct observation of rising oil droplets deformed by oil-degrading bacteria
in the hydrodynamic treadmill revealed that these droplets rise significantly
slower through the water column than either unweathered or weathered droplets
without bacteria. Additionally, sinking particles of oil and bacterial bio-
aggregates were discovered. Here, we perform further analysis to rigorously
quantify the effect of bacterial colonization on droplet rising speeds.
Additionally, we will make quantitative estimates of the composition of
sinking particles and their effect on vertical transport of oil. When
measuring particle sizes in the hydrodynamic treadmill, it was not possible to
distinguish between oil and bio-aggregates around droplets. In previous work
using microfluidics, it was shown that bio-aggregate formation causes droplets
to increase in size by some $\Delta R$ Hickl and Juarez (2022a). The value of
$\Delta R$ varied significantly between droplets, making it difficult to
accurately estimate the initial radius of deformed droplets in the
hydrodynamic treadmill.

Here, previous measurements of $\Delta R$ are used in conjunction with rising
speeds measured in the hydrodynamic treadmill to estimate the initial radius
$R_{0}$ of deformed droplets in the treadmill. Deformed droplets observed in
the treadmill were sorted by how much slower their observed rising speed
$v_{D}$ was compared to the expected speed $v_{T}(R)$ calculated from Eq. 1,
where $R=R_{0}+\Delta R$ is the total radius. It is assumed that for the
droplet with the largest value of $v_{D}/v_{T}(R)$, the relative size of the
bio-aggregate is near its minimum measured value of $\Delta R/R_{0}=0.08$.
Conversely, it is assumed that for the deformed droplet with the smallest
value of $v_{D}/v_{T}(R)$, the relative size of the bio-aggregate is at its
maximum value of $\Delta R/R_{0}=1.56$. By extrapolating to the rest of the
droplets, the initial radius $R_{0}$ of each droplet in the hydrodynamic
treadmill can be estimated (see Supplemental Information for more details).
Then, the relative rising speeds of deformed droplets were calculated to be
$v_{D}/v_{T}(R_{0})=0.72\pm 0.15$, on average, with values ranging from $0.30$
to $0.86$. As expected, the rising speeds of small droplets tend to change the
most, since the relative increase in size $\Delta R/R_{0}$ is inversely
correlated with the initial radius $R_{0}$ Hickl and Juarez (2022a).

Figure 5: Change in rising time due to droplet deformation from cell growth.
(Blue points) The estimated increase in the rising time through the water
column from a depth of 1000 m as a result of droplet deformation from
bacterial colonization. For reference, horizontal lines indicate 1 week, 1
month, and 1 year. Droplet radii are estimated from previous results
describing bio-aggregate emergence due to interfacial cell growth. The dashed
line represents best power-law fit to the data: $\Delta T\propto
R_{0}^{-2.8}$.

Based on these calculations, the effect of droplet deformations by interfacial
cell growth on the long range transport of spilled oil can be estimated. The
time it takes for droplets of weathered oil without bacteria to rise to the
ocean surface from a typical deep-sea spill at 1000 m is calculated using the
terminal speed from Eq. 1. Values of this expected rising time for the initial
droplet size range estimated from our experiments, $10\leq R_{0}\leq 60$ µm,
range from 2 weeks for $60$ µm droplets to about a year for $10$ µm droplets.
The change in the rising time $\Delta T$ resulting from bacterial colonization
and deformation can then be estimated for the experimentally observed
droplets, as shown in Fig. 5 (blue points). For the largest droplets with
$R\gtrsim 50$ µm, the change in rising time is several days, a significant
increase to the time this oil remains in the water column. For the smallest
droplets with $R\approx 10$ µm, the rising time can change dramatically,
increasing by 1-2 years. The changes in rising time $\Delta T$ appear to
depend on initial droplet radius following a power law $\Delta T\propto
R_{0}^{\alpha}$, with $\alpha=-2.8\pm 0.3$, as shown in Fig. 5 (dashed line).

These calculations suggest that the additional time that droplets remain in
the water column is sensitive to the amount of bio-aggregate formed at the
droplet surface. It is important to consider the change in droplet size due to
bacterial colonization when estimating the change in rising times (see
Supplemental Information for further discussion). In reality, droplets in this
size range became suspended in a deep-sea plume at around 1200 m for months
following the DWH spill Camilli  _et al._ (2010); Hazen  _et al._ (2010). It
is possible that colonization by bacteria contributed to the persistence of
these droplets at depth. Alternatively, the emergence of a bio-aggregate which
decreases the buoyancy of the droplets could cause them to sink from the
plume, contributing to the known phenomenon of oil sedimentation Daly  _et
al._ (2016). More work is needed to investigate the transport of droplets
under different flow conditions that mimic the environment of deep-sea plumes.

While the rising particles observed in the above experiments were droplets
colonized and deformed by cells, sinking particles had more complex
morphologies. They were large pieces of bio-aggregate in which small
quantities of oil were embedded. There are two primary mechanisms by which
such aggregates could be formed in the setup described in Fig. 2. First, if a
large bio-aggregate forms around the droplet, it is possible that parts of it
can break off because of the agitation of the dispersion. Second, a bio-
aggregate could also form on the thin film of oil which remains on the culture
medium as the dispersion is formed. Pieces of this aggregate could then also
break off and be dispersed into the fluid. The formation of a biofilm on the
underside of an oil film has previously been observed Omarova  _et al._
(2019). The distinction between these two formation mechanisms of sinking bio-
aggregates are important, as they describe how bacterial colonization can lead
to downward transport of oil both from a deep-sea plume of droplets and from
an oil slick at the ocean surface.

The total quantity of oil transported downwards by sinking particles of bio-
aggregate is very small. By using fluorescence microscopy to measure the
volume of oil in many sinking particles, the density of oil in the fluid from
which samples were taken is estimated to be between 1.6 and 8.1 ppm. The
volume of oil initially used in these experiments was $100$ µL, and the total
sample volume for sinking particles was $2$ mL. Therefore, only between
$3.2\times 10^{-3}$ % and $1.6\times 10^{-2}$ % of the oil became sedimented
as a result of bio-aggregate formation. This particular result is likely very
sensitive to the initial conditions of our experiment, particularly the amount
of agitation when creating the dispersion, and the thickness of the oil slick
in the tube, shown in Fig. 2A. Future work should consider using parameters
realistic for real oil spill scenarios, potentially including the use of
chemical dispersants, to more accurately assess the potential for oil
sedimentation by bacterial growth.

The speeds of sinking particles measured in the treadmill, along with particle
compositions measured using microscopy, can be used to estimate the mass
density of biofilms of A. borkumensis. Consider the slowest sinking particles
(or neutrally buoyant particles), which have a density of $1.0$ g/mL. The
proportion of oil in these particles is likely close to the maximum value
observed for sinking bio-aggregates, $7.8\%$ by volume. Since the density of
the oil ($0.899$ g/mL) is known, the density of the remaining volume, composed
of bacteria and EPS, must be at least $1.009$ g/mL. On the other hand,
consider the fastest sinking particle observed in the hydrodynamic treadmill,
with a terminal speed of $142$ µm/s. Supposing this particle had an average
oil proportion, $2.3\%$, Eq. 1 can be used to calculate that the density of
the remaining constituents of the particle must be $1.037$ g/mL. Thus, the
density of the cells and EPS which make up most of the bio-aggregates is only
slightly larger than that of water. This result is in agreement with other
studies which have reported slowly sinking millimeter-sized particles
consisting largely of exopolymers Bochdansky  _et al._ (2016). These
parameters could be crucial for the creation of more accurate models of oil
transport during bacterial colonization.

The experimental setup described here is a major step forward in the study of
the transport of spilled oil. A major challenge in marine microbiology is the
design of experimental techniques to investigate how microscale interactions
affect macroscopic ecological processes Taute (2020). Microorganisms as small
as hundreds of micrometers in size have been shown to swim over distances of
tens of meters Blasco (1978), making direct long-term observations of
individual organisms in vitro impossible. Very recently, vertical tracking
microscopy techniques have been developed to study the swimming of individual
plankton Krishnamurthy  _et al._ (2020). Here, a similar hydrodynamic
treadmill was used for the continuous direct observation of suspended oil
droplets deformed by bacteria. The rotation of the fluid chamber allows
particles of interest to be maintained in place relative to the imaging
apparatus while effectively being transported indefinitely through a water
column. Then, direct observation allowed for the precise characterization of
how the physical forces acting on droplets in marine environments are affected
by microbial growth at the interface.

The importance of the transport of living matter in marine environments
extends far beyond the subject of oil spills. Bacteria are key components of
marine food webs, and the transport of hydrocarbons is crucial for the carbon
cycle that regulates oceanic life DeVries (2022); Moran  _et al._ (2022). The
formation of aggregates of organic and inorganic materials, especially in the
form of marine snow, is an important process that allows for nutrients to be
transported into lower layers of the ocean Kiørboe (2001). The formation of
marine snow begins when particles with sizes on the order of nanometers or
micrometers encounter dead or dying phytoplankton, protists, or animals. Other
studies have focused on the ability of bacteria to encounter and attach to
existing sinking particles Datta  _et al._ (2016); Nguyen  _et al._ (2022).
Our results show that the reverse is possible as well: bacteria can form bio-
aggregates by themselves, even when no other organisms or large particles are
present in the water column. Other organisms can then attach to these
aggregates, further promoting sedimentation of particulate organic matter. The
experimental techniques described here can be adapted to further study the
interactions between oil droplets and other marine organisms, and could
significantly improve our understanding of the formation and transport of
marine oil snow.

##  V Acknowledgments

This material is based on work supported by the Oil Spill Recovery Institute
under Contract No. 20-10-06.

## References

  * Camilli  _et al._ (2010) R. Camilli, C. M. Reddy, D. R. Yoerger, B. A. Van Mooy, M. V. Jakuba, J. C. Kinsey, C. P. McIntyre, S. P. Sylva, and J. V. Maloney, Science 330, 201 (2010).
  * Passow and Overton (2021) U. Passow and E. B. Overton, Annual Review of Marine Science 13 (2021), 10.1146/annurev-marine-032320-095153.
  * Li  _et al._ (2015) Z. Li, A. Bird, J. Payne, N. Vinhateiro, Y. Kim, C. Davis, and N. Loomis,  _Technical Reports for Deepwater Horizon Water Column Injury Assessment: Oil Particle Data from the Deepwater Horizon Oil Spill_, Tech. Rep. (RPS ASA, 2015).
  * Ryerson  _et al._ (2012) T. B. Ryerson, R. Camilli, J. D. Kessler, E. B. Kujawinski, C. M. Reddy, D. L. Valentine, E. Atlas, D. R. Blake, J. De Gouw, S. Meinardi, D. D. Parrish, J. Peischl, J. S. Seewald, and C. Warneke, Proceedings of the National Academy of Sciences of the United States of America 109, 20246 (2012).
  * North  _et al._ (2015) E. W. North, E. E. Adams, A. E. Thessen, Z. Schlag, R. He, S. A. Socolofsky, S. M. Masutani, and S. D. Peckham, Environmental Research Letters 10 (2015), 10.1088/1748-9326/10/2/024016.
  * French-McCay  _et al._ (2019) D. French-McCay, D. Crowley, and L. McStay, Marine Pollution Bulletin 146, 779 (2019).
  * Passow and Hetland (2016) U. Passow and R. Hetland, Oceanography 29, 88 (2016).
  * Vilcáez  _et al._ (2013) J. Vilcáez, L. Li, and S. S. Hubbard, Geochemical Transactions 14 (2013), 10.1186/1467-4866-14-4.
  * Fernandez  _et al._ (2022) V. I. Fernandez, R. Stocker, and G. Juarez, Scientific Reports 2022 12:1 12, 1 (2022).
  * North  _et al._ (2013) E. W. North, E. E. Adams, Z. Schlag, C. R. Sherwood, R. He, K. H. Hyun, and S. A. Socolofsky, in  _Monitoring and Modeling the Deepwater Horizon Oil Spill: A Record Breaking Enterprise_ (wiley, 2013) pp. 217–226.
  * Daly  _et al._ (2016) K. L. Daly, U. Passow, J. Chanton, and D. Hollander, Anthropocene 13, 18 (2016).
  * Socolofsky  _et al._ (2019) S. A. Socolofsky, J. Gros, E. North, M. C. Boufadel, T. F. Parkerton, and E. E. Adams, Marine Pollution Bulletin 143, 204 (2019).
  * Hickl and Juarez (2022a) V. Hickl and G. Juarez, Marine Pollution Bulletin 178, 113645 (2022a).
  * Omarova  _et al._ (2019) M. Omarova, L. T. Swientoniewski, I. K. Mkam Tsengam, D. A. Blake, V. John, A. McCormick, G. D. Bothun, S. R. Raghavan, and A. Bose, ACS Sustainable Chemistry & Engineering , acssuschemeng.9b01923 (2019).
  * Hickl and Juarez (2022b) V. Hickl and G. Juarez, Soft Matter 18, 7217 (2022b).
  * White  _et al._ (2020) A. R. White, M. Jalali, M. C. Boufadel, and J. Sheng, Scientific Reports 2020 10:1 10, 1 (2020).
  * Kiørboe (2001) T. Kiørboe, Scientia Marina 65, 57 (2001).
  * Valentine  _et al._ (2014) D. L. Valentine, G. B. Fisher, S. C. Bagby, R. K. Nelson, C. M. Reddy, S. P. Sylva, and M. A. Wood, Proceedings of the National Academy of Sciences of the United States of America 111, 15906 (2014).
  * Brakstad  _et al._ (2018) O. G. Brakstad, A. Lewis, and C. J. Beegle-Krause, Marine Pollution Bulletin 135, 346 (2018).
  * Ross  _et al._ (2021) J. Ross, D. Hollander, S. Saupe, A. B. Burd, S. Gilbert, and A. Quigg, Marine Pollution Bulletin 165, 112025 (2021).
  * Gregson  _et al._ (2021) B. H. Gregson, B. A. McKew, R. D. Holland, T. J. Nedwed, R. C. Prince, and T. J. McGenity, Frontiers in Marine Science 8, 11 (2021).
  * Słomka  _et al._ (2020) J. Słomka, U. Alcolombri, E. Secchi, R. Stocker, and V. I. Fernandez, New Journal of Physics 22, 043016 (2020), arXiv:1908.08376 .
  * Abbasi  _et al._ (2018) A. Abbasi, G. D. Bothun, and A. Bose, Langmuir 34, 5352 (2018).
  * Krishnamurthy  _et al._ (2020) D. Krishnamurthy, H. Li, F. Benoit du Rey, P. Cambournac, A. G. Larson, E. Li, and M. Prakash, Nature Methods 17, 1040 (2020).
  * Daling  _et al._ (2014) P. S. Daling, F. Leirvik, I. K. Almås, P. J. Brandvik, B. H. Hansen, A. Lewis, and M. Reed, Marine Pollution Bulletin 87, 300 (2014).
  * Hazen  _et al._ (2010) T. C. Hazen, E. A. Dubinsky, T. Z. DeSantis, G. L. Andersen, Y. M. Piceno, N. Singh, J. K. Jansson, A. Probst, S. E. Borglin, J. L. Fortney, W. T. Stringfellow, M. Bill, M. E. Conrad, L. M. Tom, K. L. Chavarria, T. R. Alusi, R. Lamendella, D. C. Joyner, C. Spier, J. Baelum, M. Auer, M. L. Zemla, R. Chakraborty, E. L. Sonnenthal, P. D’haeseleer, H.-Y. N. Holman, S. Osman, Z. Lu, J. D. Van Nostrand, Y. Deng, J. Zhou, and O. U. Mason, Science (New York, N.Y.) 330, 204 (2010).
  * Bochdansky  _et al._ (2016) A. B. Bochdansky, M. A. Clouse, and G. J. Herndl, Scientific Reports 2016 6:1 6, 1 (2016).
  * Taute (2020) K. M. Taute, Nature Methods 2020 17:10 17, 965 (2020).
  * Blasco (1978) D. Blasco, Marine Biology 1978 46:1 46, 41 (1978).
  * DeVries (2022) T. DeVries, Annual Review of Environment and Resources 47, 317 (2022).
  * Moran  _et al._ (2022) M. A. Moran, E. B. Kujawinski, W. F. Schroer, S. A. Amin, N. R. Bates, E. M. Bertrand, R. Braakman, C. T. Brown, M. W. Covert, S. C. Doney, S. T. Dyhrman, A. S. Edison, A. M. Eren, N. M. Levine, L. Li, A. C. Ross, M. A. Saito, A. E. Santoro, D. Segrè, A. Shade, M. B. Sullivan, and A. Vardi, Nature Microbiology 2022 7:4 7, 508 (2022).
  * Datta  _et al._ (2016) M. S. Datta, E. Sliwerska, J. Gore, M. F. Polz, and O. X. Cordero, Nature Communications 2016 7:1 7, 1 (2016).
  * Nguyen  _et al._ (2022) T. T. Nguyen, E. J. Zakem, A. Ebrahimi, J. Schwartzman, T. Caglar, K. Amarnath, U. Alcolombri, F. J. Peaudecerf, T. Hwa, R. Stocker, O. X. Cordero, and N. M. Levine, Nature Communications 2022 13:1 13, 1 (2022).