# Creating an Explainable Intrusion Detection System Using Self Organizing
Maps

Jesse Ables1, Thomas Kirby1, William Anderson1,
Sudip Mittal1, Shahram Rahimi1, Ioana Banicescu1, and Maria Seale2 1
Department of Computer Science & Engineering
Mississippi State University, Mississippi, USA,
(email: {jha92, tmk169<EMAIL_ADDRESS>{mittal, rahimi,
<EMAIL_ADDRESS>
2 U.S Army Engineer Research and Development Center
Vicksburg, Mississippi, USA, (email<EMAIL_ADDRESS>
###### Abstract

Modern Artificial Intelligence (AI) enabled Intrusion Detection Systems (IDS)
are complex black boxes. This means that a security analyst will have little
to no explanation or clarification on why an IDS model made a particular
prediction. A potential solution to this problem is to research and develop
Explainable Intrusion Detection Systems (X-IDS) based on current capabilities
in Explainable Artificial Intelligence (XAI). In this paper, we create a Self
Organizing Maps (SOMs) based X-IDS system that is capable of producing
explanatory visualizations. We leverage SOM’s explainability to create both
global and local explanations. An analyst can use global explanations to get a
general idea of how a particular IDS model computes predictions. Local
explanations are generated for individual datapoints to explain why a certain
prediction value was computed. Furthermore, our SOM based X-IDS was evaluated
on both explanation generation and traditional accuracy tests using the NSL-
KDD and the CIC-IDS-2017 datasets.

##  I Introduction

The use of Artificial Intelligence (AI) in cyber-defense solutions,
particularly Intrusion Detection Systems (IDS), has been gaining traction to
protect against a wide range of cyber attacks. While these AI models have high
detection rates, high false positive and false negative rates can dissuade a
security analyst from using an AI enabled IDS [1]. These IDS built using AI
and deep learning methods are black boxes, meaning a security analyst will
have little to no explanations and clarifications on why a model made a
particular prediction. With the rise in cyber attacks on critical
infrastructure, government organizations, and business networks, there is a
pressing need for an explainable, automated detection system that can provide
real-time aid to an analyst.

Intrusion Detection Systems are generally utilized as part of a larger
cybersecurity defense effort at an organization generally located in a Cyber-
Security Operations Center (CSoC). These systems monitor networks and automate
attack detection by comparing network activity to the signature of known
attacks or by detecting behavior that is anomalous to benign network patterns
[2]. Through these methods, a security analyst can use an IDS to detect
improper use, unauthorized access, or the abuse of a network. Analysts can
then create mitigating strategies to minimize damages and costs of the
malicious behavior. The usefulness and cost effectiveness of IDS have
therefore been the subject of much research [3, 4].

Previous work in AI enabled IDS has generally focused on improving detection
rates while limiting false positives and false negatives. These techniques
have been effective at achieving high detection rate, but have failed to
provide explanations for their computed predictions. Without the ability to
understand how a model reached a decision and which features were relevant to
the decision computation, a security analyst will give less credence to these
AI enabled IDS. Opaque Deep Learning methods in particular, can be considered
as black boxes providing no explanations and feature relevance information,
severely limiting adoption in real world cyber-defense scenarios [5].

A potential solution to this problem is to research and develop Explainable
Intrusion Detection Systems (X-IDS) based on current capabilities in
Explainable Artificial Intelligence (XAI) [6]. The guidelines proposed by the
Defense Advanced Research Projects Agency (DARPA) indicate that to be
explainable, an AI should explain the reasoning for its decisions,
characterize its strengths and weaknesses, and convey a sense of its future
behavior [7]. An X-IDS that is transparent in its behavior and decision making
process, will empower a security analyst to make better informed actions,
understand the feature composition of a prediction, help CSoCs defend from
known attacks, and quickly understand zero-day attacks. To address this need,
we create an X-IDS using Self Organizing Maps (SOMs).

Data collected from modern networks contain potentially hundreds of different
features about the traffic flow, operating systems, network protocols, and
other metadata. SOMs work by representing this high dimensional data on a
2-dimensional plane. This also includes maintaining the topographical
relationship of the data by grouping similar data [8]. Through this
dimensional reduction and various other SOM visualization techniques, a
security analyst can view both global and local explanations about a potential
attack rather than an opaque prediction generated by a black box model.

As the need for explainable cyber-defense systems increases and to address the
lack of XAI research in the field of IDS, the main objective of this paper is
to demonstrate the explainability of the SOM based X-IDS rather than creating
the most accurate system. Higher accuracy systems can be developed by using
complex derivative architectures. However, further research is necessary to
make them explainable. Our goal in this paper is to increase trust in IDS and
help CSoCs defend from attack through the use of explainable insights. As a
secondary focus, we also provide the accuracy scores of our SOM based X-IDS
system trained on the NSL-KDD and CIC-IDS-2017 datasets.

Major contributions presented in this paper are -

  * •

A SOM based X-IDS, built using DARPA’s proposed guidelines for an explainable
system. This system is able to produce robust, explanatory visualizations of
the SOM model and create accurate IDS predictions.

  * •

A Local and Global explainability analysis using the SOM explainable
architecture. The explanation module creates a collection of explainable
visualizations that can be used by a security analyst to understand
predictions.

  * •

A performative analysis using NSL-KDD and CIC-IDS-2017. The SOM based model is
able to achieve accuracies as high as 91% on NSL-KDD and 80% on CIC-IDS-2017
datasets.

The rest of the paper is outlined as follows - In Section II, we discuss some
related work on IDS, XAI, and X-IDS. Section III briefly describes the SOM
algorithm and how it can be used to achieve explainability. Section IV,
outlines our SOM based X-IDS with its architecture presented in Figure 1.
Section V lists our experimental results. Finally, the conclusion and future
work has been presented in Section VI.

##  II Related Work

In this section, we present some related work on Intrusion Detection Systems
(IDS), Explainable Artificial Intelligence (XAI), and Explainable Intrusion
Detection Systems (X-IDS).

###  II-A Intrusion Detection Systems (IDS)

An intrusion refers to an action that obtains unauthorized access to a network
or system [9]. Intrusions can be characterized by a violation of
Confidentiality, Integrity, or Availability (CIA). An IDS consists of tools,
methods, and resources that help a CSoC protect an organization [10, 11].

IDS can be classified as either a host-based IDS or network-based IDS. Host-
based IDS are placed on a host system and monitor host activity, incoming and
outgoing network traffic [12]. Network-based IDS are built to survey and
protect a network of hosts from intrusion [13]. In addition, IDS can also be
categorized into operation-based classes, such as signature, anomaly, and
hybrid. Signature-based IDS operate by preventing known attacks from accessing
a network. The IDS compares incoming network traffic to a database of known
attack signatures. Notably, this method has difficulty in preventing zero-day
attacks [14]. Anomaly-based IDS look for patterns in incoming traffic to
recognize potential threats and leverage complex AI models [15, 16]. A
significant drawback of this approach is the the tendency for such systems to
categorize legitimate, unseen behavior as anomalous. Hybrid-based IDS
incorporate the design philosophy of both signature-based and intrusion-based
IDS to improve the detection rate while minimizing false positives [17, 18].

Current AI enabled anomaly-based IDS can be further divided into black box and
white box models. White box models are considered easy to understand by an
expert. This allows the expert to analyze the decision process and understand
how the model renders its decision. This ”semi-transparent” property allows
white box models to be deployed in decision sensitive domains, where auditing
the decision process is a requirement. White box models may use regression-
based approaches [19], decision trees [20], and SOMs [21]. Black box models,
on the other hand, have an opaque decision process. This opaqueness property
makes establishing the relationship between inputs and the decision difficult,
if not outright impossible. Black box models comprise nearly all the AI
enabled state-of-the-art approaches for IDS, as the focus is traditionally on
model performance, not explainability. Examples of black box models are
Isolation Forest [22], One-Class SVM [23], and Neural Networks [24].

###  II-B Explainable Artificial Intelligence (XAI)

As previously stated, state-of-the-art approaches for IDS, as well as machine
learning as a whole, focus on model performance through the lens of model
accuracy. This focus on model accuracy has driven the development further away
from modeling approaches that are transparent or have methods of
explainability. In turn, this creates a separation between model inference and
understanding model inference, which gives the inability to confirm model
fairness, privacy, reliability, causality, and ultimately trust.

The notion of XAI dates back to the 1970s. Moore et al. [25] surveyed works
from the 1970s to the 1980s, detailing early methods of explanations. Some
early explanations consisted of canned text and code translations, such as the
1974 explainer MYCIN [26]. We can find a more current definition of XAI by
DARPA [7]. They define XAI as systems that are able to explain their reasoning
to a human user, characterize their strengths and weaknesses, and convey a
sense of their future behavior. In turn, the system offers some form of
justification for its action, leading to more trust and understanding of the
system. The explanations from an XAI system help the user not only in using
and maintaining the AI model, but also helping users complete tasks in
parallel with the AI system. Tasks can include doctors making medical
decisions [26, 27, 28], credit score decisions [29], detecting counterfeit
banknotes [30] or CSoC operators defending a network [7, 31].

###  II-C Explainable Intrusion Detection Systems (X-IDS)

Explainable Intrusion Detection Systems (X-IDS) are still an emerging sub-
genre in the field. The need for explainability in IDS is becoming
increasingly necessary both to warrant further application in decision
sensitive domains, as well as to supplement and empower existing knowledge
techniques (e.g. data mining, rule-based development) that black boxes
obfuscate. The users need to be confident in the predictions or
recommendations computed by an IDS. Understandable explanations allow users to
perform their tasks correctly. The stakeholders of an IDS (e.g. CSoC
operators, developers, and investors) are individuals who will be dependent on
the performance of the system. CSoC operators will be performing defensive
actions based on prediction and explanation results. Developers can use
explanations to fortify the model in areas where it is weak. Investors may
need explanations to help them in making budgeting decisions for their
company.

The current literature consists of many different black box and white box
models being used alongside explanation techniques. Common explainer modules
for black box models are Local Interpretable Model-agnostic Explanations
(LIME) [32], SHapley Additive exPlanations (SHAP) [33], and Layer-wise
Relevance Propagation (LRP) [34]. Modern techniques for explaining black box
models consist of creating surrogate models that generate explanations either
locally or globally. Other methods involve propagating predictions backwards
in a Neural Network or decomposing a gradient. More novel approaches have also
experimented with making datasets explainable [35] or making GUIs for
explainable systems [36].

##  III Explainable Self Organizing Maps

In this section, we briefly describe the theoretical and the practical aspects
of SOMs and how they can be utilized to detect intrusions and generate
explanations.

###  III-A Self Organizing Maps (SOMs)

Self Organizing Maps (SOMs), sometimes referred to as Kohonen Maps [8, 37],
Kohonen Self Organizing Maps [38], or Kohonen Networks [39], are a class of
unsupervised machine learning algorithms. SOMs are comprised of a network of
individual units, each of which has a feature vector of the same size as the
dimension of training data. Some implementations also include an (x,y)
coordinate to allow unit movement in a two-dimensional (2D) space. This 2D
space is typically represented as a square or a hexagonal grid, to more easily
visualize the represented space.

Training a SOM model, outlined in Algorithm 1, utilizes the following steps:
First, a random training sample is picked. Then, the Best Matching Unit (BMU)
is calculated by finding the smallest euclidean distance from the training
sample to a SOM unit. After the BMU is found, it and its neighbors are updated
using the formula $w_{i}=w_{i}-\lambda*(w_{i}-i_{i})$, where $w$ is the set of
BMU weights and $i$ is the set of feature values. $\lambda$ is the learning
rate function that considers the current training iteration and distance from
the BMU. Lastly, the learning rate, neighborhood radius, and current iteration
numbers are updated. The function $\lambda$ works in a way that it decreases
during the course of the training process.

Algorithm 1 SOM Algorithm

0: n, m, T

0: W

1: Allocate n * m element array W

2: for each node in W do

3: Allocate N element array with random values [0,1]

4: end for

5: while $t<T$ do

6: Pick a training sample

7: Find Best Matching Unit using Euclidean Distance

8: Update BMU elements: $w_{i}=w_{i}-\lambda*(w_{i}-i_{i})$

9: Update BMU Neighbors

10: Update Learning Rate and Radius

11: $t+=1$

12: end while

13: return $W$

SOMs have some unique advantages that come with their application. The first
is algorithmic simplicity. As shown in Algorithm 1, the brevity of the
algorithm helps to maintain the desired properties of algorithmic
decomposability and tractability. Additionally, due to its unsupervised
nature, SOMs can work on a variety of datasets and applications (e.g. data
mining and discovery), not just prediction [40]. By design, SOMs convert high-
dimensional data into a lower dimensional representation. This representation
can be topologically clustered and explained through visualizations [41]. One
challenge that comes with the application of SOMs is the selection of the size
parameter, as the size does not dynamically adjust and there is no best size
heuristic [42]. Finally, another challenge with SOMs is their scalability,
both in their time complexity, $O(N^{2})$, and space complexity. More methods,
such as those in [43], are needed to address these challenges.

###  III-B SOMs and Intrusion Detection

In the past, SOMs have been used to create many IDS. These studies focused on
building accurate IDS and did not discuss explainability. Among these
approaches, SOMs were used to create both host-based [44] and network-based
[45, 41, 46] IDS. The majority of these methods simply trained a SOM based IDS
and illustrated mappings between datapoints and the associated BMU. The
approaches in [47, 46] use multiple SOMs in conjunction with one another to
create a more effective IDS. Only one approach [45] discussed the false
positive rate and accuracy of a SOM-based IDS. Their method for prediction
involved assigning a label to BMUs based on the training dataset. Using this
approach meant that not all SOM units were assigned a label. The authors
utilized Gaussian Mixture Modeling (GMM) to make predictions when a testing
sample was similar to an unlabeled unit.

Figure 1: Architecture for an Explainable Intrusion Detection System (X-IDS)
utilizing Self Organizing Maps (SOMs), based on DARPA’s recommended
architecture for Explainable Artificial Intelligence (XAI) systems [7].

###  III-C SOMs and Explainability

Once trained, SOMs are able to illustrate mappings between datapoints and the
associated BMU. As this is generally a 2D representation of the feature space,
it can be visually understood by the user. This advantageous SOM property
makes them explainable. SOM’s explainablity can be divided into Global and
Local explanations.

Global explanations are used to give a general idea of how a particular model
computes predictions. The U-Matrix (See Section IV-C), is a commonly used
technique [48]. This additive metric works by summing the distance to each of
a unit’s neighbors. A group of low scores represents clusters in the map,
while a group of high scores signifies sparseness. The Starburst U-Matrix is
an updated variation of the U-Matrix. This updated version helps visualize
cluster sizes and locations on the map. Other clustering representations, like
K-means clustering, can also aid in visualization. For more fine-grained data,
feature heat-maps can be created to visualize SOM feature values and their
importance. These techniques provide global explanations.

Local interpretations of data are a more recent development for explaining
SOMs. These explanations are generated for individual sample datapoints and
are used to explain why a certain prediction value was computed. This allows
the user to understand the decision process of the SOM model. The primary use
of this method is to explain and visualize feature importance. When making a
prediction, a datapoint’s features are scored based on how impactful they are
to the computed prediction. Wickramasinghe et al. [49] developed an
explainable SOM for Cyber-Physical Systems. Their system created both local
and global explanations by data-mining a SOM model. The mined information was
used to create visualizations including histograms, T-distributed Stochastic
Neighbor Embedding (t-SNE), heat maps, U-Matrix, component planes, and U-Map.
This variety of visualizations allow the SOM to be explainable not only to
domain experts, but also non-domain experts.

##  IV X-IDS Architecture

An X-IDS’s main goal is to help stakeholders protect their networks and
understand various relevant events. The system should act as both a guard and
adviser for network security. When an IDS discovers an intrusion, the user
should be notified to prevent a possible attack. Explanations generated by the
X-IDS should assist CSoC operators in their mission to protect their
organization. To help achieve this goal, we propose the proof of concept SOM
based X-IDS architecture in Figure IV. The proposed architecture is based on
DARPA’s recommended architecture for XAI systems [7]. Components of the
framework can be changed to suit users’ needs. The architecture is abstract
enough that methods other than SOMs can be interchanged to create different
X-IDS. The architecture consists of three stages: pre modeling, modeling, and
post modeling explainability. In the first phase, the model preprocesses raw
network data captured into high quality datasets, and selects parameters for
the SOM model. Next, the model is trained during the modeling phase. Metrics
are recorded to determine the newly trained model’s quality. Lastly, in the
post modelling phase, the SOM is data-mined to generate explanatory
visualizations that allow users to understand how predictions are generated.
In the next subsections, we describe each of these phases in detail.

###  IV-A Datasets and Pre Modeling Phase

In this work, NSL-KDD [50] and CIC-IDS-2017 [51] were used to test the
explainability and effectiveness of our architecture. NSL-KDD was chosen
because of its wide use in the literature. It allows our method to be compared
to other existing IDS. CIC-IDS-2017 includes more modern attacks and is useful
for testing an unbalanced dataset. The datasets are passed through a
preprocessing module that normalizes the data. Additionally, the architecture
uses Bayesian Probability of Significance [52] to select features. Any feature
significance value over a designer selected threshold is included in the
preprocessed dataset. The resulting high quality dataset is used during the
modelling phase.

###  IV-B Modeling Phase

The modeling phase begins by training the SOM model using the high quality
dataset generated during the pre modeling phase. For this paper, we use the
POPSOM implementation [53]. Training parameters include total training
iterations, learning rate, and SOM size. At the end of the training session,
the model will be tested to produce topographical error, quantization error,
F1-score, precision, recall, and a confusion matrix. The confusion matrix can
be used to determine both the false positive and false negative rate for the
model. The quality metrics are used to determine if a model has been
sufficiently trained to generate explanations.

#### Quality Metrics

There have been various metrics and measures proposed to evaluate the quality
of a trained SOM. These include quantization error, topographic accuracy,
embedding accuracy, and convergence index. Quantization error was used by
Kohenen [54], and measures the average distance between nodes and the data
points. To measure how much the features of the input space have been
preserved in low dimensional output space, a topographic error is used. The
topographic error is measured by evaluating how often the BMU and second BMU
are next to each other [42],[55]. Map embedding accuracy is similar to
quantization error and it measures how similar the distribution of the input
data is with respect to that of the SOM units [56]. In order to measure both
topographic preservation and distribution similarity between the input and SOM
units, the convergence index was proposed to be a measure that linearly
combines map embedding accuracy and topographic accuracy [57]. Prediction
accuracy metrics are also important to include in an IDS architecture. These
metrics include F1-score, false positive rate, and false negative rate. These
measurements allow the architecture to be compared to other existing IDS.

0pt

(a) NSL-KDD Local Anomaly Explanation

0pt

(b) NSL-KDD Global Feature Significance

0pt

(c) CIC-IDS-2017 Local Normal Explanation

0pt

(d) CIC-IDS-2017 Global Feature Significance

Figure 2: These figures show the local and global feature explanations for
both the NSL-KDD and CIC-IDS datasets. (a) The local explainability of a
prediction is defined by the distance between feature value and BMU. More
important features have a lower score than less important features. This
figure shows the feature importance for an anomalous sample from the NSL-KDD
testing set. (b) Global feature significance is calculated using Bayesian
Probability of Significance [52]. Higher values are considered more important
than lower values.

###  IV-C Post Modeling Explainability

Once the modeling phase has been completed and quality metrics have ensured
that the model is a good representation of the data, the model can be used to
perform a variety of explainability and visualization tasks. The model itself
is a list of SOM units and the weights associated with these units.
Visualization tasks include creating local and global explanations, a
U-Matrix, and feature heatmaps.

####  IV-C1 Local and Global Explanations

Global and local interpretability can be achieved by examining important
features of the trained SOM, and utilizing this information to generate an
explanation for a specific data instance classification or cluster
classification [58]. Global significance for NSL-KDD is shown in Figure 2(b)
with higher values denoting that a feature has a higher probability of being
important. Higher variance features increase the probability that a model will
capture the dataset’s structure [52]. Through this graph, an analyst can
understand which features are important to the overall SOM structure, allowing
them to examine predictions at a local level based on globally important
features.

Figure 2(a) shows the local explanations for a prediction, where each feature
on the y-axis has a value representing distance from its respective BMU value
(See Section III). In this example, we can see the features with the largest
impact on a prediction: duration, dst bytes, and src bytes. These features
were the closest to the BMU, and they played a large role in computing the
predicted value. Seeing the specific features that influence predictions
provides insight about samples labeled as malicious or benign and can further
help operators determine the reason of incorrect predictions. These features
can also be further investigated with feature value heat maps.

####  IV-C2 Unified Distance Matrix (U-Matrix)

The U-Matrix is a visualization of the distances between neighboring SOM
units. With distances shown as a color gradient, units far apart will create
dark boundaries while areas with similar units will be lighter. This can
visually represent the natural clusters of input data. To enhance the standard
U-Matrix, the starburst model uses connected component lines of nodes overlaid
on the matrix to better represent clusters [59]. For a labeled data set, the
user is able to visualize each BMU along with the associated label. Figure
3(a) shows clear clusters with boundaries separating malicious (1) and benign
(0) behavior. Using this information a security analyst can investigate more
visualizations and feature importance values to gain an understanding about
why certain malicious network activities are being grouped together.

####  IV-C3 Feature Value Heat Map

Heat maps show general trends that a feature has on the entire SOM model. SOM
feature values are represented from 0 to 1, and the heat maps denote this with
darker and lighter values, respectively. An example feature value heat map can
be found in Figure 3(c). In this example, the ‘dst bytes’ features has a
cluster of higher values in the bottom-left corner, while the rest of the SOM
consists of lower values. Users can use this information to form conclusions
about the model. Feature value maps are more powerful when multiple are viewed
at a time. In addition, the U-Matrix or K-means clustering charts can then be
referenced to make general decisions about the model. The heat maps work well
as a fine-grained global explanation that helps users to understand the
overall model.

##  V Experimental Results and Evaluation

Our SOM based X-IDS was evaluated on both explanation generation and
traditional accuracy tests. Experiments were run using the aforementioned
datasets (See Section IV-A), which was used to train two 18x18 SOMs. The
training process was completed in 1000 iterations over the dataset. After 1000
iterations, there was no significant improvement in evaluation metrics. In
fact, while training on the CIC-IDS-2017 dataset, the SOM model performance
began to degrade as a result of over-fitting.

(a) NSL-KDD Starburst U-Matrix

(b) NSL-KDD K-means Clustering Map

(c) Dst byte Feature Map

0pt

(d) CIC-IDS-2017 Starburst U-Matrix

0pt

(e) Flow bytes/s Feature Map

Figure 3: (a)(d)The Starburst U-Matrix shows both the most common label for
each node and the clusters the SOM has learned. Darker areas represent units
that are close Euclidean Distance-wise. Notably, we can see a clear divide
between classes on the NSL-KDD dataset as represented in the figure. (b)(e)
K-means clustering can be used as a simplified view of where labels appear on
the SOM. In this model’s iteration, anomalous traffic is mostly grouped on the
bottom of the SOM.(c) The feature value heatmap displays the value of a
specific feature on each unit in the SOM. Lighter values represent units with
values closer to 1, while darker values show values closer to 0. The ‘dst
byte’ example shows that the bottom ‘anomalous’ cluster values higher values.

###  V-A Model Explainability

The results for the NSL-KDD dataset can be found in Figures 2(a) and 2(b). The
local explanation example shows that the most important features for its
prediction were ‘Duration’, ‘Destination (dst) bytes’, and ‘Source (src)
bytes’. The remaining features, ‘Service (srv) count’, ‘Count’, and
‘Destination (dst) host count’ are considered less significant because of
their distance from the BMU. Two of the important features coincide with the
Global Feature Significance graph. This trend continues when testing on many
different test samples. The most important global features are frequently at
the forefront for local significance. Similarly to NSL-KDD, CIC-IDS-2017
follows this trend. Many of the top, globally selected features also play a
more important role in the local predictions.

The next set of explainability techniques has been data-mined from the trained
SOM. Figures 3(a) and 3(d) show the generated Starburst U-Matrix for NSL-KDD
and CIC-IDS-2017, respectively. The SOM algorithm was able to separate benign
clusters from malicious clusters in the map created from NSL-KDD dataset. The
bottom-left corner is primarily malicious samples, while the top-right corner
contains mostly benign samples. Additionally, the clusters marked by the
starbursts’ origins mostly represent one label. On the other hand, the CIC-
IDS-2017 map has not separated the labels sufficiently. Most of the labels
present in the figure are benign (0) with very few malicious labels (1). CIC-
IDS-2017 is an unbalanced dataset, with about 70% of samples being benign and
30% of samples as malicious. This class imbalance causes the SOM to be trained
on more benign samples than malicious.

For a simplified label separation, users can visualize a K-means clustering
interpretation in Figure 3(b). This figure helps to explain which clusters the
benign and malicious traffic are grouped in. The NSL-KDD K-means graph is
similar to the computed U-matrix. However, the CIC-IDS-2017 K-means cluster
graph was unable to form accurate clusters. As mentioned above, there were few
units that were labeled malicious (1), and the K-means clustering algorithm
chosen was unable to create a meaningful separation.

Lastly, the feature value heatmaps are generated for each feature of the
dataset. The examples chosen were the most significant features for each
dataset: ‘destination (dst) bytes’ and ‘flow bytes/s’. On their own, they can
be used to see general training trends for each feature. In Figures 3(c) and
3(e), we can see that each of these features have higher values in the bottom-
left units and lower values elsewhere. Users will be able to build a mental
model of the SOM when visualized in conjunction with the features maps. For
example, ‘destination (dst) byte’, ‘duration’, and ‘source (src) byte’ all
have higher values in the malicious section of the map. One may conclude that
when these values are all close to one, the sample is more than likely
malicious.

Dataset |  F1 |  Precision |  Recall |  FPR |  FNR
---|---|---|---|---|---
NSL-KDD | 91.0% | 91.0% | 91.4% | 9.4% | 8.0%
CIC-IDS-2017 | 80.0% | 77.4% | 81.8% | 22.5% | 4.5%
TABLE I: Accuracy Metrics for NSL-KDD and CIC-IDS-2017

###  V-B Accuracy

When creating an IDS, accuracy is an important metric to consider. Table I
shows the accuracy metrics obtained for both the NSL-KDD and CIC-IDS-2017
datasets. The accuracy of the NSL-KDD evaluation can be attributed to the
separation of benign and malicious traffic, as mentioned above. The accuracy
of CIC-IDS-2017, however, is much lower. The U-matrix shows that not many
units are labeled as malicious. Interestingly, only 14% of the units are
labeled as malicious, which means that 77.4% of malicious samples are similar
to that small subset of units.

The results from the explainability and accuracy experiments show that it is
possible to create explainable and relatively accurate SOM based X-IDS. The
visualization techniques used can give users an understanding of the model and
can empower security analysts to make their own predictions, similar to the
model. A 91% F1-score can be attributed to the clear separation the model
makes between malicious and benign samples. We believe that this can be
further improved with more complex SOM algorithms.

##  VI Conclusion and Future Work

In this paper, we created a proof of concept SOM based X-IDS implementation.
The implementation was able to produce robust, explainable figures describing
the SOM model. Explainability was demonstrated using various forms of
visualization including feature significance, U-matrices, and feature
heatmaps. Through these, users are able to create their own conclusions about
how the model works and makes predictions. Additionally, accuracy was tested
using the NSL-KDD and CIC-IDS-2017 datasets. The SOM implementation was able
to achieve accuracies of 91% and 80%, respectively. Potential future works
will include analysing the explainability and accuracy of Growing SOMs or
Growing Hierarchical SOMs. These studies will aim to increase the accuracy of
SOMs while simultaneously decreasing false positives and false negatives. In
addition, explanations can be improved by surveying security analysts to
discover the most useful visualizations and feedback. We will continue to use
and improve our architecture to create the state-of-the art in X-IDS.

##  VII Acknowledgment

This work by Mississippi State University was financially supported by the
U.S. Department of Defense (DoD) High Performance Computing Modernization
Program, through the US Army Engineering Research and Develop Center (ERDC)
(#W912HZ-21-C0058). The views and conclusions contained herein are those of
the authors and should not be interpreted as necessarily representing the
official policies or endorsements, either expressed or implied, of the U.S.
Army ERDC or the U.S. DoD.

## References

  * [1] Alaa Marshan.  Artificial intelligence: Explainability, ethical issues and bias.  Annals of Robotics and Automation, pages 034–037, 08 2021.
  * [2] Raytheon.  Cyber security operations center (csoc), 2017.
  * [3] Mustapha Belouch, Salah El Hadaj, and Mohamed Idhammad.  Performance evaluation of intrusion detection based on machine learning using apache spark.  Procedia Computer Science, 127:1–6, 2018.
  * [4] Shelly Xiaonan Wu and Wolfgang Banzhaf.  The use of computational intelligence in intrusion detection systems: A review.  Applied soft computing, 10(1):1–35, 2010.
  * [5] Zachary C Lipton.  The mythos of model interpretability: In machine learning, the concept of interpretability is both important and slippery.  Queue, 16(3):31–57, 2018.
  * [6] Subash Neupane, Jesse Ables, William Anderson, Sudip Mittal, Shahram Rahimi, Ioana Banicescu, and Maria Seale.  Explainable intrusion detection systems (x-ids): A survey of current methods, challenges, and opportunities, 2022.
  * [7] David Gunning and David Aha.  Darpa’s explainable artificial intelligence (xai) program.  AI Magazine, 40(2):44–58, 2019.
  * [8] Teuvo Kohonen.  Self-organized formation of topologically correct feature maps.  Biological cybernetics, 43(1):59–69, 1982.
  * [9] Dorothy E Denning.  An intrusion-detection model.  IEEE Transactions on software engineering, (2):222–232, 1987.
  * [10] Rebecca Gurley Bace, Peter Mell, et al.  Intrusion detection systems, 2001.
  * [11] Andrew McDole, Maanak Gupta, Mahmoud Abdelsalam, Sudip Mittal, and Mamoun Alazab.  Deep learning techniques for behavioural malware analysis in cloud iaas.  In Malware Analysis using Artificial Intelligence and Deep Learning. Springer, 2021.
  * [12] Kopelo Letou, Dhruwajita Devi, and Yumnam Jayanta.  Host-based intrusion detection and prevention system (hidps).  International Journal of Computer Applications, 69:28–33, 05 2013\.
  * [13] Biswanath Mukherjee, Todd L. Heberlein, and Karl N. Levitt.  Network intrusion detection.  IEEE Network, 8:26–41, 1994.
  * [14] Ashu Sharma and Sanjay Kumar Sahay.  Evolution and detection of polymorphic and metamorphic malwares: A survey.  arXiv preprint arXiv:1406.7061, 2014.
  * [15] Varun Chandola, Arindam Banerjee, and Vipin Kumar.  Anomaly detection: A survey.  ACM Comput. Surv., 41:15:1–15:58, 2009.
  * [16] Andrew McDole, Mahmoud Abdelsalam, Maanak Gupta, and Sudip Mittal.  Analyzing cnn based behavioural malware detection techniques on cloud iaas.  In International Conference on Cloud Computing, pages 64–79. Springer, 2020.
  * [17] Mateusz Szczepański, Michał Choraś, Marek Pawlicki, and Rafał Kozik.  Achieving explainability of intrusion detection system by hybrid oracle-explainer approach.  In 2020 International Joint Conference on Neural Networks (IJCNN), pages 1–8. IEEE, 2020.
  * [18] Guansong Pang, Choubo Ding, Chunhua Shen, and Anton van den Hengel.  Explainable deep few-shot anomaly detection with deviation networks.  arXiv preprint arXiv:2108.00462, 2021.
  * [19] Basant Subba, Santosh Biswas, and Sushanta Karmakar.  Intrusion detection systems using linear discriminant analysis and logistic regression.  In 2015 Annual IEEE India Conference (INDICON), pages 1–6. IEEE, 2015.
  * [20] Basim Mahbooba, Mohan Timilsina, Radhya Sahal, and Martin Serrano.  Explainable artificial intelligence (xai) to enhance trust management in intrusion detection systems using decision tree model.  Complexity, 2021, 2021.
  * [21] Chet Langin, Michael Wainer, and Shahram Rahimi.  Annabell island: a 3d color hexagonal som for visual intrusion detection.  Internation Journal of Computer Science and Information Security, 9(1):1–7, 2011.
  * [22] Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou.  Isolation forest.  2008 Eighth IEEE International Conference on Data Mining, pages 413–422, 2008.
  * [23] Bernhard Schölkopf, Robert C. Williamson, Alex Smola, John Shawe-Taylor, and John C. Platt.  Support vector method for novelty detection.  In NIPS, 1999.
  * [24] G.P. Zhang.  Neural networks for classification: a survey.  IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews), 30(4):451–462, 2000.
  * [25] Johanna D Moore and William R Swartout.  Explanation in expert systemss: A survey.  Technical report, University of Southern California Marina Del Rey Information Sciences Inst, 1988.
  * [26] Edward Hance Shortliffe.  Mycin: a rule-based computer program for advising physicians regarding antimicrobial therapy selection.  Technical report, Stanford Univ Calif Dept of Computer Science, 1974.
  * [27] Andreas Holzinger, Chris Biemann, Constantinos S Pattichis, and Douglas B Kell.  What do we need to build explainable ai systems for the medical domain?  arXiv preprint arXiv:1712.09923, 2017.
  * [28] Leeanne Lindsay, Sonya Coleman, Dermot Kerr, Brian Taylor, and Anne Moorhead.  Explainable artificial intelligence for falls prediction.  In International Conference on Advances in Computing and Data Sciences, pages 76–84. Springer, 2020.
  * [29] Ye Eun Chun, Se Bin Kim, Ja Yun Lee, and Ji Hwan Woo.  Study on credit rating model using explainable ai.  The Korean Data & Information Science Society, 32(2):283–295, 2021\.
  * [30] Miseon Han and Jeongtae Kim.  Joint banknote recognition and counterfeit detection using explainable artificial intelligence.  Sensors, 19(16):3607, 2019.
  * [31] DARPA.  Broad agency announcement explainable artificial intelligence (xai).  DARPA-BAA-16-53, pages 7–8, 2016.
  * [32] Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin.  ”Why should i trust you?” explaining the predictions of any classifier.  In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pages 1135–1144, 2016.
  * [33] Scott M Lundberg and Su-In Lee.  A unified approach to interpreting model predictions.  Advances in neural information processing systems, 30, 2017.
  * [34] Alexander Binder, Grégoire Montavon, Sebastian Lapuschkin, Klaus-Robert Müller, and Wojciech Samek.  Layer-wise relevance propagation for neural networks with local renormalization layers.  In International Conference on Artificial Neural Networks, pages 63–71. Springer, 2016.
  * [35] Sheikh Rabiul Islam, William Eberle, Sheikh K Ghafoor, Ambareen Siraj, and Mike Rogers.  Domain knowledge aided explainable artificial intelligence for intrusion detection and response.  arXiv preprint arXiv:1911.09853, 2019.
  * [36] Chunyuan Wu, Aijuan Qian, Xiaoju Dong, and Yanling Zhang.  Feature-oriented design of visual analytics system for interpretable deep learning based intrusion detection.  In 2020 International Symposium on Theoretical Aspects of Software Engineering (TASE), pages 73–80. IEEE, 2020.
  * [37] Erkki Oja and Samuel Kaski.  Kohonen maps.  Elsevier, 1999.
  * [38] Shyam M Guthikonda.  Kohonen self-organizing maps.  Wittenberg University, 98, 2005.
  * [39] Teuvo Kohonen and Timo Honkela.  Kohonen network.  Scholarpedia, 2(1):1568, 2007.
  * [40] Jason Ong and Syed Muhammad Raza Abidi.  Data mining using self-organizing kohonen maps: A technique for effective data clustering & visualization.  In IC-AI, 1999.
  * [41] VK Pachghare, Parag Kulkarni, and Deven M Nikam.  Intrusion detection system using self organizing maps.  In 2009 International Conference on Intelligent Agent & Multi-Agent Systems, pages 1–5. IEEE, 2009.
  * [42] Gregory Breard.  Evaluating self-organizing map quality measures as convergence criteria.  2017\.
  * [43] Yao Liu, Jun Sun, Qing Yao, Su Wang, Kai Zheng, and Yan Liu.  A scalable heterogeneous parallel som based on mpi/cuda.  In Asian Conference on Machine Learning, pages 264–279. PMLR, 2018\.
  * [44] Peter Lichodzijewski, A Nur Zincir-Heywood, and Malcolm I Heywood.  Host-based intrusion detection using self-organizing maps.  In Proceedings of the 2002 International Joint Conference on Neural Networks. IJCNN’02 (Cat. No. 02CH37290), volume 2, pages 1714–1719. IEEE, 2002.
  * [45] Emiro De la Hoz, Andrés Ortiz García, Julio Ortega Lopera, Eduardo Miguel De La Hoz Correa, and Fabio Enrique Mendoza Palechor.  Implementation of an intrusion detection system based on self organizing map.  2015\.
  * [46] Brandon Craig Rhodes, James A Mahaffey, and James D Cannady.  Multiple self-organizing maps for intrusion detection.  In Proceedings of the 23rd national information systems security conference, pages 16–19. MD Press Baltimore, 2000.
  * [47] Sahin Albayrak, Christian Scheel, Dragan Milosevic, and Achim Muller.  Combining self-organizing map algorithms for robust and scalable intrusion detection.  In International Conference on Computational Intelligence for Modelling, Control and Automation and International Conference on Intelligent Agents, Web Technologies and Internet Commerce (CIMCA-IAWTIC’06), volume 2, pages 123–130. IEEE, 2005.
  * [48] Alfred Ultsch and H. Peter Siemon.  Kohonen’s self organizing feature maps for exploratory data analysis.  In Proceedings of the International Neural Network Conference (INNC-90), Paris, France, July 9–13, 1990, volume 1, pages 305–308. Kluwer Academic Press, 1990.
  * [49] Chathurika S. Wickramasinghe, Kasun Amarasinghe, Daniel L. Marino, Craig Rieger, and Milos Manic.  Explainable unsupervised machine learning for cyber-physical systems.  IEEE Access, 9:131824–131843, 2021.
  * [50] Mahbod Tavallaee, Ebrahim Bagheri, Wei Lu, and Ali A Ghorbani.  A detailed analysis of the kdd cup 99 data set.  pages 1–6, 2009.
  * [51] Ranjit Panigrahi and Samarjeet Borah.  A detailed analysis of cicids2017 dataset for designing intrusion detection systems.  International Journal of Engineering & Technology, 7:479–482, 3 2018.
  * [52] Lutz Hamel and Chris Brown.  Bayesian probability approach to feature significance for infrared spectra of bacteria.  Applied Spectroscopy, 66:48–59, 1 2012.
  * [53] Li Yuan.  Implementation of self-organizing maps with Python.  University of Rhode Island, 2018.
  * [54] Teuvo Kohonen.  The self-organizing map.  Neurocomputing, 21:1–6, 1998.
  * [55] Jouko Lampinen and Erkki Oja.  Clustering properties of hierarchical self-organizing maps.  Journal of Mathematical Imaging and Vision, 2:261–272, 1992.
  * [56] Lutz Hamel.  Som quality measures: An efficient statistical approach.  volume 428, pages 49–59. Springer Verlag, 2016.
  * [57] Self-organizing map convergence.  Int. J. Serv. Sci. Manag. Eng. Technol., 9:61–84, 4 2018.
  * [58] Chathurika S Wickramasinghe, Kasun Amarasinghe, Daniel L Marino, Craig Rieger, and Milos Manic.  Explainable unsupervised machine learning for cyber-physical systems.  IEEE Access, 9:131824–131843, 2021.
  * [59] Lutz Hamel and Chris Brown.  Improved interpretability of the unified distance matrix with connected components.  7th International Conference on Data Mining (DMIN’11), 4 2012.


KEK-TH-2512

# Novel transition dynamics of topological solitons

Kentaro Nishimura  KEK Theory Center, Tsukuba 305-0801, Japan  Research and
Education Center for Natural Sciences, Keio University, 4-1-1 Hiyoshi,
Yokohama, Kanagawa 223-8521, Japan  Noriyuki Sogabe  Department of Physics,
University of Illinois, Chicago, Illinois 60607, USA  Quark Matter Research
Center, Institute of Modern Physics, Chinese Academy of Sciences, Lanzhou,
Gansu, 073000, China

###### Abstract

Continuous phase transitions can be classified into ones characterized by
local order parameters and others that need additional topological
constraints. The critical dynamics near the former transitions have been
extensively studied, but the latter is less understood. We fill this gap in
knowledge by studying the transition dynamics to a parity-breaking topological
ground state called the chiral soliton lattice in quantum chromodynamics at
finite temperature, baryon chemical potential, and an external magnetic field.
We find a slowing down of the soliton’s translational motion as the critical
magnetic field approaches while the local dissipation rate remains finite.
Therefore, the characteristic time it takes to converge to the stationary
state associated with a finite topological number strongly depends on the
initial configuration: whether it forms a solitonic structure or not.

Introduction.—The most traditional way of classifying phase transitions is by
distinguishing between the discontinuous (first-order) and continuous (second-
order) types. For the latter, a further classification has been proposed based
on topology de Gennes (1975). Standard ones are topologically trivial and can
be described by local order parameters, such as the magnetization of a
ferromagnet. However, there are also continuous transitions in which the
characteristic order parameters cannot be defined similarly but are instead
associated with topological constraints, such as the transition between a
type-II superconductor’s Meissner and mixed states, which involves a change in
the topological number of Abrikosov vortices Abrikosov (1957) (see also Ref.
SCv (1969)). Trivial transitions are characterized by scaling power laws,
while nontrivial ones have a ubiquitous logarithmic behavior either below or
above the transition point, e.g., in chiral magnets Dzyaloshinsky (1964),
cholesteric liquid crystals de Gennes and Prost (1993), etc.

Topologically trivial second-order phase transitions have been extensively
studied Hohenberg and Halperin (1977), but relatively little is known about
nontrivial transitions. One general phenomenon of trivial transitions is the
critical slowing down of hydrodynamic modes coupled with the order parameter
or itself (see Chaikin and Lubensky (1995); Hohenberg and Krekhov (2015)),
such as the vanishing diffusion coefficients of a binary fluid near the
liquid-gas critical point. Is any singular dynamical behavior exhibited by
topological objects, including domain walls and vortices, near the transition?

This letter presents the first study of the dynamical process involved in
reaching the chiral soliton lattice (CSL), a parity-breaking topological
ground state observed in various condensed matter systems Dzyaloshinsky
(1964); de Gennes and Prost (1993) and in quantum chromodynamics (QCD) under
an external magnetic field Brauner and Yamamoto (2017); Son and Stephanov
(2008); Eto  _et al._ (2013); Brauner and Kadam (2017); Brauner  _et al._
(2021); Brauner and Kolešová (2023), rotation Huang  _et al._ (2018);
Nishimura and Yamamoto (2020); Eto  _et al._ (2022), time-periodic circularly
polarized laser Yamada and Yamamoto (2021), and in QCD-like theories Brauner
_et al._ (2019a, b). Our focus is on QCD at finite temperature $T$ and finite
baryon chemical potential $\mu_{\rm B}$ under an external magnetic field
${\bm{B}}$, which is expected to be realized in magnetars and future heavy-ion
collisions exploring the high-$\mu_{\rm B}$ region of the QCD phase diagram.
We find that the soliton’s translational motion slows down as the transition
point approaches, while the local relaxation rate from an initial
configuration without the solitonic structure remains finite in the same
parameter region. Therefore, the time required to reach the ground state
associated with the topological number strongly depends on the initial
configuration, whether it forms a soliton or not. Our findings suggest a novel
class of second-order transition dynamics characterized by topological
solitons.

Setup.—We consider an effective theory of two-flavor QCD at low-$T$ and
low-$\mu_{\rm B}$ under a small ${\bm{B}}$ such that CSL appears as the ground
state Brauner and Yamamoto (2017); Brauner  _et al._ (2021). Our theory takes
into account low-energy degrees of freedom, such as the Nambu-Goldstone modes
and conserved charge densities that respect the chiral symmetry, i.e., the
neutral pion $\phi$ with $\bar{q}q\sim{\rm e}^{2{\rm i}\phi t^{3}}$ and the
axial isospin charge density $\rho=\bar{q}\gamma^{0}\gamma^{5}t^{3}q$, where
$q$ is the quark field, and $t^{a}$ is the ${\rm SU}(2)$ generator with ${\rm
tr}(t^{a}t^{b})=\delta^{ab}/2$. Near the transition between the QCD vacuum and
the CSL state, we can discard the charged pions $\pi^{\pm}$ with an additional
mass due to ${\bm{B}}\neq 0$ and the other conserved charge densities (see
Ref. Brauner and Yamamoto (2017) for interesting phenomena among $\pi^{\pm}$).
However, to describe the dynamics near the transition to the nuclear matter at
$\mu_{\rm B}$ comparable with the nuclear mass, we may need to include the
energy and momentum densities (see Ref. Son (2000)). We set $e=1$.

Formulation.—The Hamiltonian density of the system,
$\mathcal{H}=\mathcal{H}_{\phi}+\mathcal{H}_{\rho}$ consists of the pion and
charge sectors:

$\displaystyle\mathcal{H}_{\phi}$
$\displaystyle=\frac{f_{\pi}^{2}}{2}({\bm{\nabla}}\phi)^{2}-f_{\pi}^{2}m_{\pi}^{2}\cos\phi-\frac{\mu_{\rm
B}}{4\pi^{2}}{\bm{B}}\cdot{\bm{\nabla}}\phi\,,$ (1a)
$\displaystyle\mathcal{H}_{\rho}$ $\displaystyle=\frac{1}{2\chi}\rho^{2}\,.$
(1b)

Here, the pion decay constant $f_{\pi}$ characterizes the stiffness of the
chiral order, $m_{\pi}$ is the pion screening mass, and $\chi$ is the axial
isospin charge susceptibility. The first two terms on $\mathcal{H}_{\phi}$ are
the kinetic and mass terms, which can be derived based on the chiral symmetry
and its explicit breaking by a small quark mass; the third one is a
topological term due to the anomalous coupling of the neutral pion and
${\bm{B}}$ in the presence of $\mu_{\rm B}$ Son and Stephanov (2008); Son and
Zhitnitsky (2004). The transition we are interested in occurs through the
competition between the kinetic and topological terms, which disfavor and
favor inhomogeneity, respectively.

We employ the Poisson bracket method to derive the hydrodynamic equations that
follow from the system’s symmetries (for general construction, see Refs
Chaikin and Lubensky (1995); Dzyaloshinskii and Volovick (1980))

$\displaystyle\partial_{t}\phi({\bm{x}})$ $\displaystyle=\int{\rm
d}{\bm{y}}\left[\phi({\bm{x}}),\rho({\bm{y}})\right]\frac{\delta
H}{\delta\rho({\bm{y}})}-\kappa\frac{\delta H}{\delta\phi({\bm{x}})}\,,$ (2a)
$\displaystyle\partial_{t}\rho({\bm{x}})$ $\displaystyle=\int{\rm
d}{\bm{y}}\left[\rho({\bm{x}}),\phi({\bm{y}})\right]\frac{\delta
H}{\delta\phi({\bm{y}})}+\lambda{\bm{\nabla}}^{2}\frac{\delta
H}{\delta\rho({\bm{x}})}\,,$ (2b)

where $H=\int{\rm d}{\bm{x}}\,\mathcal{H}$, $\kappa$ and $\lambda$ are
relaxation rate and axial isospin conductivity. In each of (2), the first and
the second terms describe the macroscopic hamiltonian dynamics and the thermal
dissipation, which preserves and breaks the time-reversal symmetry,
respectively. We posturate a Poisson bracket such that $\phi$ and $\rho$ are
canonical conjugates,
$\left[\phi({\bm{x}}),\rho({\bm{y}})\right]=\delta({\bm{x}}-{\bm{y}})$,
consistent with the ${\rm U}(1)_{t^{3}}$ symmetry Son (2001); Weinberg (1996):
$\mathcal{L}=\mathcal{L}(\partial_{t}\phi+\mu_{\rm A},{\bm{\nabla}}\phi)$,
hence $\rho\equiv\delta\mathcal{L}/\delta\mu_{\rm
A}=\delta\mathcal{L}/\delta(\partial_{t}\phi)$. The coefficients of the
functional derivative in the dissipative terms are determined by a derivative
expansion. The leading contribution of (2b) is
$\mathcal{O}({\bm{\nabla}}^{2})$ due to the axial-isospin conservation. For
simplicity, we neglect noise terms and the anisotropy in the conductivity.

By performing functional derivatives, we arrive at the following expression:

$\displaystyle\partial_{t}\phi$
$\displaystyle=\frac{\rho}{\chi}+f_{\pi}^{2}\kappa\left(-m_{\pi}^{2}\sin\phi+{\bm{\nabla}}^{2}\phi\right)\,,$
(3a) $\displaystyle\partial_{t}\rho$
$\displaystyle=f_{\pi}^{2}{\bm{\nabla}}^{2}\phi-
m_{\pi}^{2}f_{\pi}^{2}\sin\phi+\frac{\lambda}{\chi}{\bm{\nabla}}^{2}\rho\,,$
(3b)

which represents a nonlinear and dissipative extension of previous studies Son
(2000); Son and Stephanov (2002). It is worth noting that both features are
crucial for the system to converge to the correct stationary state in the
presence of an infinite potential of the form $\propto\cos\phi$ rather than a
mass term $\propto\phi^{2}$.

We set ${\bm{B}}=B{\bm{e}}_{z}$ and use unites of $m_{\pi}^{-1}$ and
$M_{\pi}^{-1}$ for space and time coordinates, respectively. Here,
$M_{\pi}=m_{\pi}c$ represents the pion pole mass, where
$c^{2}=f_{\pi}^{2}/\chi$ denotes the pion velocity in the chiral limit Son and
Stephanov (2002). Note that the system is homogeneous in the $xy$ plane as
$\partial_{x,y}$ only enters the first term of $\mathcal{H}_{\phi}$. By
eliminating $\rho$ and neglecting $\mathcal{O}(\partial_{z}^{4})$ from the
original equations (3), we obtain the main equation of this letter:

$\displaystyle\square\phi+\sin\phi+\gamma\partial_{t}\sin\phi-\alpha\partial_{z}^{2}\partial_{t}\phi-\beta\partial_{z}^{2}\sin\phi=0\,,$
(4)

where $\square\equiv\partial_{t}^{2}-\partial_{z}^{2}$,
$\gamma=m_{\pi}f_{\pi}^{2}\kappa/c$, $\alpha=\gamma+m_{\pi}\lambda/(c\chi)$,
and $\beta=\kappa\lambda m_{\pi}^{2}$.

Chiral soliton lattice and dissipation.—The stationary solution of the time-
evolution equation (4), $\bar{\phi}(z)$ contains the spatial profile of the
CSL given by

$\displaystyle\partial_{z}^{2}\bar{\phi}=\sin\bar{\phi}-\beta\partial_{z}^{2}\sin\bar{\phi}\,.$
(5)

Let us first examine the dissipationless limit, $\beta=0$ (see Brauner and
Yamamoto (2017) for details). This equation has the same mathematical form as
the simple pendulum, and we can solve it analytically using Jacobi’s elliptic
functions:

$\displaystyle\bar{\phi}(z,k)=2\textrm{am}\left(\frac{z}{k},k\right)+\pi\,,$
(6)

where $k\,(0\leq k\leq 1)$ is the elliptic modulus, a free parameter at this
stage. Note that this solution (6) has periodic minima at
$\bar{\phi}((2m+1)kK(k),k)=2\pi m$ with $m$ being an integer and the periodic
length is given by $\ell=2kK(k)$. Here, $K(k)$ and $E(k)$ (for later purposes)
are the complete elliptic functions of the first and second kinds,
respectively.

We now determine the optimal $k$ for given $B$ with fixed $\mu_{\rm B}$ by
minimizing the total energy in $z$ direction per unit area in the $xy$ plane,
$\int_{0}^{l}{\rm d}z\mathcal{H}_{\phi=\bar{\phi}}/l$ with the solution (6).
After a straightforward calculation, we find the minimization condition
reduces to $E(k)/k=B/B_{\rm CSL}$ with $B_{\textrm{CSL}}=16\pi
m_{\pi}f_{\pi}^{2}/\mu_{\rm B}$. The solution $k(B)$ exists if and if only
$E(k)/k\geq 1$ and the equality holds in the critical magnetic field, $B_{\rm
CSL}$, which separates the QCD vacuum $(B<B_{\rm CSL})$ and the CSL $(B>B_{\rm
CSL})$. By substituting $k=k(B)$ into $\ell$, we numerically determine the
$B$-dependence of the periodic length, $\ell(B)$.

Near $B_{\rm CSL}$ from above, an asymptotic form of the complete elliptic
functions ($k^{\prime}=\sqrt{1-k^{2}}$) can be used Whittaker and Watson
(1996):

$\displaystyle K(k)$
$\displaystyle\simeq\log\frac{4}{k^{\prime}}+\frac{{k^{\prime}}^{2}}{4}\left(\log\frac{4}{k^{\prime}}-1\right)\,,$
(7a) $\displaystyle E(k)$ $\displaystyle\simeq
1+\frac{{k^{\prime}}^{2}}{2}\left(\log\frac{4}{k^{\prime}}-\frac{1}{2}\right)\,.$
(7b)

The energy minimization condition reduces to $k\simeq B_{\rm CSL}/B$ and thus
$l(B)\simeq-\log(\Delta B/B)$ with $\Delta B\equiv B-B_{\rm CSL}$. The leading
logarithmic behavior can be also derived from the balance between the
repulsion energy of the kinks separated by $l$ Perring and Skyrme (1962) (see
also Ref. Manton and Sutcliffe (2004)) and the energy gain from the
topological term measured from $B=B_{\rm CSL}$:

$\displaystyle{\rm e}^{-lm_{\pi}}\sim\frac{\mu_{\rm B}\Delta
B}{4\pi^{2}}\int_{0}^{l}{\rm d}z\partial_{z}\phi=\frac{\mu_{\rm B}\Delta
B}{2\pi}\,,$ (8)

where we have restored the unit length $m_{\pi}^{-1}$. The bulk quantities
reflects the logarithmic behavior of $l(B)$, e.g., the baryon number per unit
area in the $xy$ plane,

$\displaystyle(N_{\rm B})_{\rm tot}=\frac{N_{\rm
B}}{l}\sim-\frac{1}{\log(\Delta B/B)}\,,$ (9)

where $N_{\rm B}=-\int_{0}^{l}{\rm
d}z\partial\mathcal{H}_{\phi=\bar{\phi}}/(\partial\mu_{\rm B})=B/(2\pi)$ is
the baryon number per unit CSL Brauner and Yamamoto (2017); Son and Stephanov
(2008). By integrating $\partial\mathcal{H}_{\phi=\bar{\phi}}/(\partial B)$
instead of $\partial\mathcal{H}_{\phi=\bar{\phi}}/(\partial\mu_{\rm B})$, the
same behavior of the magnetization can be checked.

Now let us consider the dissipative case $\beta\neq 0$, applied to the
stationary solution (5). Figure 1 shows the $\beta$ dependence of a unit CSL
configuration with the boundary condition, $\bar{\phi}(0)=0$ and
$\bar{\phi}(l)=2\pi$ for an arbitrary $B>B_{\rm CSL}$. Interestingly,
nonlinear effects arise in the dissipation of the CSL,
$\propto\partial_{z}^{2}\sin\bar{\phi}\neq\partial_{z}^{2}\bar{\phi}$. If one
neglects the nonlinearity from the right-hand sides of the dynamical equation
(4), $\sin\phi\approx\phi$, which leads to a different convergence of the pion
field. It is worth noting that for the convergence to occur, $\beta$ must be
less than 1, otherwise, the solution becomes unstable at $\beta\geq 1$.

Figure 1: A unit CSL configuration with different $\beta$.

Dynamics.—We numerically study the dynamical relaxation processes towards the
stationary state discussed so far by solving Eq. (4). We consider a finite
length in the $z$-direction ($0\leq z\leq L$) and vary $B$ such that
$l(B)=L/n$ discontinuously com , where $n=1,2,...$ corresponds to the number
of kinks in the system. We discuss a possible problem in the infinite system
later. We impose each of the initial-boundary conditions:

(I) $\displaystyle\quad\phi(0,z)=0\,,\quad\phi(t,L)=2n\pi\theta(t-t_{0})\,,$
(10a) (II) $\displaystyle\quad\phi(0,z)=2n\pi z/L\,,\quad\phi(t,L)=2n\pi\,,$
(10b)

which have a common ground state at $t\rightarrow\infty$. Note that minimizing
the total energy determines $n$ at fixed $L$ and $B$. Case (I) describes a
quench from the vacuum to the CSL state at $t=t_{0}$, while case (II)
describes the relaxation process starting with an inhomogeneous configuration
that is not the ground state. Throughout the dynamical simulations below, we
set the parameters $(\alpha,\,\beta,\,\Gamma)=(2.2,\,0.4,\,0.2)$.

Figure 2 shows a typical time evolution for each of the initial-boundary
conditions (10) with two values of $B=l^{-1}(L/n)$ $(n=1,2)$ for $L=8.0$,
which is sufficiently larger than the typical size of the soliton ($\sim 1.0$
in the unit of $m_{\pi}^{-1}$) so that we can neglect boundary effects. The
yellow curves correspond to case (I), where the solitonic object (for each
$n=1$ and $n=2$) is initially created at the edge $z=L$ and moves rigidly to
the ground state position as time progresses. The green curves correspond to
case (II), where the initial uniform configuration of $\partial_{z}\phi$
approaches the stationary configuration locally. As the time intervals are
different orders of magnitudes, case (I) at $B\simeq B_{\rm CSL}$ (top left)
takes significantly longer compared to the others: case (I) relatively far
from $B_{\rm CSL}$ (top right) and case (II) for any $B$ (bottoms).

Figure 2:  Time evolution of $\partial_{z}\phi$ for different combinations of
initial-boundary conditions (I) or (II) and external magnetic field, $B\approx
1.01\,B_{\rm CSL}$ or $B\approx 1.33\,B_{\rm CSL}$. The black dashed curves
represent the stationary-state solution (5), corresponding to Fig. 1 at
$\beta=0.4$. The plotted data is limited to a time where the deviation from
the stationary solution becomes less than $1\%$ of the initial deviation.

Relaxation rate.—To quantify soliton’s slow motion in Fig. 2, we define the
displacement from the stationary state $\bar{\phi}(z)$ given by Eq. (5):
$\Delta\Phi(t)\equiv\int_{0}^{L}{\rm
d}z\left|\phi(t,z)-\bar{\phi}(z)\right|/Ln\pi$, where the normalization is
chosen so that $\Delta\Phi(0)=1$. We obtain the characteristic time $\tau$
such that the deviation decays “expositionary,” $\Delta\Phi(\tau)={\rm
e}^{-1}$, and evaluate how fast the system approaches the stationary state
using the characteristic rate $\tau^{-1}$. Figure 3 shows the dependence of
this rate on the magnetic field for each initial-boundary condition (10) and
different system size $L$. For case (I), the rate tends to $0$ as $B/B_{\rm
CSL}\rightarrow 1$, whereas it remains finite for case (II). The first two
circles ($L=8$) for each yellow and green plot correspond to the demonstration
in Fig. 2, for $B=1.01\,B_{\rm CSL}$ and $B=1.33\,B_{\rm CSL}$, respectively.
Note that the behavior as a function of $B/B_{\rm CSL}$ is independent of $L$,
although it will generally break down in a large $B$ region, where the spatial
separation of the soliton is insufficient, $l(B)\sim 1$.

Figure 3:  Dependence of the characteristic rate $\tau^{-1}$ on the magnetic
field for each initial-boundary condition, (I) and (II), represented in yellow
and green curves, respectively. The symbols (circle, triangle, and square)
represent different system sizes, $L=8,9$, and $10$, respectively. As the
magnetic field increases, the number of kinks in the system ($n=1,2,3$)
increases, leading to a faster (yellow) and slower (green) approach to the
stationary state.

Discussion.—As depicted in Fig. 3 (see also Fig. 2 for a demonstration), we
observe a slowing down of the translational motion of the soliton as the
external magnetic field $B$ approaches the transition value $B_{\rm CSL}$.
Interestingly, the local relaxation rate from an initial configuration without
a solitonic structure remains finite as $B\rightarrow B_{\rm CSL}$. This is
due to the singularity at $B=B_{\rm CSL}$ characterized by the divergence of
the CSL separation length, $l(B)\rightarrow\infty$, which only affects the
solitonic motion. Specifically, the yellow plots reach exactly zero at
$B=B_{\rm CSL}$, consistent with the fact that the kink remains stationary in
the exact infinite system, where the translational invariance is restored. We
attribute the finite relaxation process to the excited state dynamics of the
soliton, whose typical frequency $\omega\simeq m_{\pi}$ remains gapped even at
$B=B_{\rm CSL}$ Sutherland (1973); Whittaker and Watson (1996); Landau and
Lifshitz (2013) (see also Ref. ichiro Kishine and Ovchinnikov (2015) for the
review).

We can extend this analysis to an infinite system perturbed locally by a
single CSL unit. We assume the initial deformation does not affect the other
configurations, which are kept as ground states. This assumption is justified
near $B_{\rm CSL}$ since $l(B)$ is large and the nearest neighbors are
sufficiently separated. We can consider similar initial configurations as we
discussed previously (see Eq. (10) with $n=1$) and vary $B$ continuously. The
characteristic time to reach a stationary state will have a magnetic field
dependence similar to that shown in Fig. 3, where cases (I) and (II)
correspond to the dynamics resulting from an initial dislocation and
deformation of the kink, respectively. It would be interesting to test these
predictions, for instance, in chiral magnets Togawa  _et al._ (2012).

Conclusion.—In this letter, we have presented a dissipative hydrodynamic
framework with a small quark mass for QCD at finite temperature, baryon
chemical potential, and the external magnetic field. Our effective theory
incorporates a topological ground state, known as the CSL state, due to the
axial anomaly (see Eq. (3)). We expect our findings to be relevant to future
heavy-ion collision experiments at large baryon density and dynamical
phenomena in dense neutron stars.

Our numerical simulations reveal a slowing down of the soliton’s translational
motion near the critical magnetic field, while the local relaxation keeps
finite in the same region (see Figs. 2 and 3). We argue that this dynamical
feature is not specific to the CSL but can be a general characteristic of the
second-order transition that involves changing a topological number. This
feature contrasts with the standard trivial second-order phase transitions,
where both collective motions and local dissipation show simultaneous critical
slowing down due to the large correlation length of the order parameter.

###### Acknowledgements.

N. S. thanks Misha Stephanov, Ho-Ung Yee, and Maneesha Sushama Pradeep for the
useful discussion and Yuya Tanizaki, Igor Shovkovy, and Haruki Watanabe for
fruitful comments and questions. We thank Yoshimasa Hidaka for the comments
and questions on the manuscript. K. N. is supported by JSPS KAKENHI, Grant-in-
Aid for Scientific Research No. (B) 21H01084. N. S. acknowledges the support
from the Strategic Priority Research Program of Chinese Academy of Sciences,
Grant No. XDB34000000. This work is supported by the U.S. Department of
Energy, Office of Science, Office of Nuclear Physics grant DE-FG0201ER41195.

## References

  * de Gennes (1975) P. G. de Gennes, “Phase transition and turbulence: An introduction,” in  _Fluctuations, Instabilities, and Phase Transitions_, edited by T. Riste (Springer US, Boston, MA, 1975) pp. 1–18.
  * Abrikosov (1957) A. A. Abrikosov, Soviet Physics-JETP 5, 1174 (1957).
  * SCv (1969) _“Superconductivity,” Volume 2, Edited by R. D. Parks, Marcel Dekker, Inc.,_ (CRC press, 1969) pp. 817–923.
  * Dzyaloshinsky (1964) I. E. Dzyaloshinsky, JETP 19, 960–971 (1964).
  * de Gennes and Prost (1993) P. de Gennes and J. Prost,  _The Physics of Liquid Crystals_, International series of monographs on physics (Clarendon Press, 1993).
  * Hohenberg and Halperin (1977) P. C. Hohenberg and B. I. Halperin, Rev. Mod. Phys. 49, 435 (1977).
  * Chaikin and Lubensky (1995) P. M. Chaikin and T. C. Lubensky,  _Principles of Condensed Matter Physics_ (Cambridge University Press, 1995).
  * Hohenberg and Krekhov (2015) P. Hohenberg and A. Krekhov, Physics Reports 572, 1 (2015), an introduction to the Ginzburg–Landau theory of phase transitions and nonequilibrium patterns.
  * Brauner and Yamamoto (2017) T. Brauner and N. Yamamoto, JHEP 04, 132 (2017), arXiv:1609.05213 [hep-ph] .
  * Son and Stephanov (2008) D. T. Son and M. A. Stephanov, Phys. Rev. D 77, 014021 (2008), arXiv:0710.1084 [hep-ph] .
  * Eto  _et al._ (2013) M. Eto, K. Hashimoto, and T. Hatsuda, Phys. Rev. D 88, 081701(R) (2013), arXiv:1209.4814 [hep-ph] .
  * Brauner and Kadam (2017) T. Brauner and S. Kadam, JHEP 03, 015 (2017), arXiv:1701.06793 [hep-ph] .
  * Brauner  _et al._ (2021) T. Brauner, H. Kolešová, and N. Yamamoto, Phys. Lett. B 823, 136767 (2021), arXiv:2108.10044 [hep-ph] .
  * Brauner and Kolešová (2023) T. Brauner and H. Kolešová, (2023), arXiv:2302.06902 [hep-ph] .
  * Huang  _et al._ (2018) X.-G. Huang, K. Nishimura, and N. Yamamoto, JHEP 02, 069 (2018), arXiv:1711.02190 [hep-ph] .
  * Nishimura and Yamamoto (2020) K. Nishimura and N. Yamamoto, JHEP 07, 196 (2020), arXiv:2003.13945 [hep-ph] .
  * Eto  _et al._ (2022) M. Eto, K. Nishimura, and M. Nitta, JHEP 08, 305 (2022), arXiv:2112.01381 [hep-ph] .
  * Yamada and Yamamoto (2021) A. Yamada and N. Yamamoto, Phys. Rev. D 104, 054041 (2021), arXiv:2107.07074 [hep-ph] .
  * Brauner  _et al._ (2019a) T. Brauner, G. Filios, and H. Kolešová, JHEP 12, 029 (2019a), arXiv:1905.11409 [hep-ph] .
  * Brauner  _et al._ (2019b) T. Brauner, G. Filios, and H. Kolešová, Phys. Rev. Lett. 123, 012001 (2019b), arXiv:1902.07522 [hep-ph] .
  * Son (2000) D. T. Son, Phys. Rev. Lett. 84, 3771 (2000), arXiv:hep-ph/9912267 .
  * Son and Zhitnitsky (2004) D. T. Son and A. R. Zhitnitsky, Phys. Rev. D 70, 074018 (2004), arXiv:hep-ph/0405216 .
  * Dzyaloshinskii and Volovick (1980) I. Dzyaloshinskii and G. Volovick, Annals of Physics 125, 67 (1980).
  * Son (2001) D. T. Son, Int. J. Mod. Phys. A 16S1C, 1284 (2001), arXiv:hep-ph/0011246 .
  * Weinberg (1996) S. Weinberg,  _The Quantum Theory of Fields_, Vol. 2 (Cambridge University Press, 1996).
  * Son and Stephanov (2002) D. T. Son and M. A. Stephanov, Phys. Rev. D 66, 076011 (2002), arXiv:hep-ph/0204226 .
  * Whittaker and Watson (1996) E. T. Whittaker and G. N. Watson,  _A Course of Modern Analysis_, 4th ed., Cambridge Mathematical Library (Cambridge University Press, 1996).
  * Perring and Skyrme (1962) J. Perring and T. Skyrme, Nuclear Physics 31, 550 (1962).
  * Manton and Sutcliffe (2004) N. S. Manton and P. Sutcliffe,  _Topological solitons_, Cambridge Monographs on Mathematical Physics (Cambridge University Press, 2004).
  * (30) We limit ourselves to studying the discontinuous $B$, sufficient to understand the qualitative behavior. Continuous $B$ can also be studied similarly, as shown in Ref. ichiro Kishine and Ovchinnikov (2015).
  * Sutherland (1973) B. Sutherland, Physical Review A 8, 2514 (1973).
  * Landau and Lifshitz (2013) L. D. Landau and E. M. Lifshitz,  _Quantum mechanics: non-relativistic theory_ , Vol. 3 (Elsevier, 2013).
  * ichiro Kishine and Ovchinnikov (2015) J. ichiro Kishine and A. Ovchinnikov (Academic Press, 2015) pp. 1–130.
  * Togawa  _et al._ (2012) Y. Togawa, T. Koyama, K. Takayanagi, S. Mori, Y. Kousaka, J. Akimitsu, S. Nishihara, K. Inoue, A. S. Ovchinnikov, and J. Kishine, Phys. Rev. Lett. 108, 107202 (2012).