B)\cup(E_{2}\cup C)$, is the union of all elements of rank $3$ and all
elements of rank $2$. Moreover, it follows from Proposition 6.5 that if
$\alpha,\delta$ either both have rank $3$ or both have rank $2$, then
$\alpha\mathop{\mathscr{R}^{*}}\delta$, and hence
$\alpha\mathop{\mathscr{D}^{*}}\delta$. We show that there is an element
$\beta\in B$ of rank $3$ and $\gamma\in C$ of rank $2$ such that
$\beta\mathop{\mathscr{L}^{*}}\gamma$, which will complete the description of
$\mathop{\mathscr{D}^{*}}$.

We recall from Example 2.15 that for

$\displaystyle t=\begin{pmatrix}1&2&3&4&i_{\geq 5}\\\
1&3&2&1&i\end{pmatrix},\quad u=\begin{pmatrix}1&2&3&4&i_{\geq 5}\\\
1&1&1&4&4\end{pmatrix},\quad f=\begin{pmatrix}1&2&3&4&i_{\geq 5}\\\
1&1&1&1&1\end{pmatrix},$

we have $\beta:=\phi_{t,f}\in B$ and $\gamma:=\phi_{u,f}\in C$, so that
$\beta$ and $\gamma$ have the same type. We show that
$\mathrm{Fix}(t,f)=\mathrm{Fix}(u,f)$, so that
$\beta\mathop{\mathscr{L}^{*}}\gamma$ by Proposition 6.9.

Since $f=c_{1}$ we see that that
$\mathrm{Fix}(t,f)=\\{g\in\mathcal{S}_{n}:gt=tg\mbox{ and }1g=1\\}$. If
$g\in\mathrm{Fix}(t,f)$ we therefore have $1=1g=4tg=4gt$ and hence (since $g$
is a permutation and $1g=1$) $4g=4$. For all $i\geq 5$ we have $ig=itg=igt$,
that is, $ig$ is fixed by $t$ from which it follows that $ig\geq 5$ for all
$i\geq 5$. Finally we have $2g=3gt$ and $3g=2gt$. Thus

$\mathrm{Fix}(t,f)=\\{g,(2\,3)g:g\in\mathcal{S}_{n},ig=i\mbox{ for }1\leq
i\leq 4\\}.$

Similarly $\mathrm{Fix}(u,f)=\\{g\in\mathcal{S}_{n}:gu=ug\mbox{ and }1g=1\\}$.
If $g\in\mathrm{Fix}(u,f)$ we therefore have $1=1g=1gu=2gu=3gu$ and hence
(since $g$ is a permutation and $1g=1$) we must have $\\{2g,3g\\}=\\{2,3\\}$.
Thus for all $i\geq 4$ we have that $ig\geq 4$. Moreover, since $u$ fixes $4g$
we must have $4g=4$ since $4$ is the only value distinct from $1$ that is
fixed by $u$. It is then easy to see that

$\mathrm{Fix}(u,f)=\\{g,(2\,3)g:g\in\mathcal{S}_{n},ig=i\mbox{ for }1\leq
i\leq 4\\}=\mathrm{Fix}(t,f).$

We now look at the $\mathop{\mathscr{J}^{*}}$ relation.

We know that $\mathop{\mathscr{D}^{*}}\subseteq\mathop{\mathscr{J}^{*}}$.
Clearly for any $\beta\in E_{1}$ we have
$E_{1}=\mathcal{E}_{n}\beta\mathcal{E}_{n}$ is saturated by
$\mathop{\mathscr{D}^{*}}$. It only remains to show that for some
$\alpha\in\mathcal{E}_{n}\setminus(\mathcal{G}_{n}\cup E_{1})$ we have that
$\mathcal{E}_{n}\alpha\mathcal{E}_{n}$ is saturated by
$\mathop{\mathscr{D}^{*}}$. Taking any $\alpha\in E_{3}$ and calling upon
Propositions 6.5 and 6.9 yields the result. ∎

Finally, the $\mathop{\widetilde{\mathscr{D}}}$ and
$\mathop{\widetilde{\mathscr{J}}}$-relations are only composed of two classes:
the minimal ideal $E_{1}$ and its complement $\mathcal{E}_{n}\setminus E_{1}$.

######  Proposition 6.13.

The $\mathop{\widetilde{\mathscr{D}}}$-classes of $\mathcal{E}_{n}$ are
$\mathcal{E}_{n}\setminus E_{1}$ and $E_{1}$ and further,
$\mathop{\widetilde{\mathscr{J}}}=\mathop{\widetilde{\mathscr{D}}}$.

###### Proof.

Propositions 6.5 and 6.6 immediately give us that there are two
$\mathop{\widetilde{\mathscr{D}}}$-classes, namely $\mathcal{E}_{n}\setminus
E_{1}$ and $E_{1}$. Since $E_{1}$ is an ideal, it is a
$\mathop{\widetilde{\mathscr{J}}}$-class. The result follows. ∎

##  7\. The structure of $\mathrm{End}(\mathcal{T}_{n})$ for $n\leq 4$

In order to have clean statements with uniform proofs, in the previous
sections we focussed on the case where $n\geq 5$. To complete the picture, in
this section we describe the structure of $\mathcal{E}_{n}$ in the cases where
$n\leq 4$. We note that the decomposition in terms of rank and type given in
Lemma 2.9 can also be used to describe the structure of $\mathcal{E}_{n}$ in
these small cases, however, some of the sets turn out to be empty. Indeed,
$\mathcal{E}_{1}=\mathcal{G}_{1}=\\{\varepsilon\\}$ is a trivial group, and
$\mathcal{E}_{2}$ decomposes as a disjoint union
$\mathcal{E}_{2}=\mathcal{G}_{2}\cup E_{2}(2)\cup E_{1}(2)$ where
$\mathcal{G}_{2}=\\{\varepsilon,\psi_{(1\,2)}\\}$ is the automorphism group,
whilst $E_{2}(2)=\\{\phi_{\mathrm{id},c_{1}},\phi_{\mathrm{id},c_{2}}\\}$ and
$E_{1}(2)=\\{\phi_{\mathrm{id},\mathrm{id}},\phi_{c_{1},c_{1}},\phi_{c_{2},c_{2}}\\}$
are the idempotents of rank $2$ and $1$ respectively. We note in particular
that these two semigroups (consisting of group elements and idempotents only)
are regular. For $n=3$, the endomorphism monoid $\mathcal{E}_{3}$ decomposes
as a disjoint union $\mathcal{E}_{3}=\mathcal{G}_{3}\cup E_{3}(3)\cup
E_{2}(3)\cup C(3)\cup E_{1}(3)$. The elements of $C(3)$ are not regular (note
that the reasoning given in the proof of Proposition 3.5 also applies here).
For the case $n=4$, recall that the endomorphism monoid
$\mathcal{E}_{4}=\mathrm{End}(\mathcal{T}_{4})$ was described in Lemma 2.9 as
$\mathcal{E}_{4}=\mathcal{G}_{4}\cup D(4)\cup E_{3}(4)\cup B(4)\cup
E_{2}(4)\cup C(4)\cup E_{1}(4)$ where each set is non-empty and $D(4)$
contains idempotents of rank $7$, namely the elements in the set
$E_{7}(4)=\left\\{\sigma^{g}\colon g\in\mathcal{K}\right\\}$.

In spite of these differences, certain properties turn out to be common to all
endomorphism monoids $\mathcal{E}_{n}$. Since their proofs are often akin to
those presented in Sections 3–6 and these results could be obtained by direct
enumeration using a computer program such as GAP, we will only highlight the
main points that differ or require attention. A detailed version of these
proofs can be found in the thesis of the second author [9].

######  Proposition 7.1.

Let $n$ be a natural number. In the endomorphism monoid $\mathcal{E}_{n}$, the
following statements hold:

  1. (1)

the set of all idempotents is a band, and forms a rank-ordered chain of right
zero semigroups;

  2. (2)

the set of idempotents of rank $1$ is the minimal ideal of $\mathcal{E}_{n}$;

  3. (3)

$\mathop{\mathscr{H}}=\mathop{\mathscr{L}}\subseteq\mathop{\mathscr{R}}=\mathop{\mathscr{D}}=\mathop{\mathscr{J}}$;

  4. (4)

$\mathop{\mathscr{R}^{*}}=\mathop{\widetilde{\mathscr{R}}}$ and the classes
are the sets of elements with the same rank.

###### Proof.

These facts have already been explicitly proven for $n\geq 5$ in the previous
sections, and it is straightforward to check that the details go through in
just the same way for all $n\neq 4$. Indeed, for all $n\neq 4$, statements (1)
and (2) follow in exactly the same way as in the proof of Proposition 3.4,
whilst it is readily verified that the characterisation of the
$\mathop{\mathscr{L}}$ and $\mathop{\mathscr{R}}$ relations given in Section 5
($\alpha\mathop{\mathscr{L}}\beta$ if and only if $\alpha=\beta$ or
$\alpha,\beta\in\mathcal{G}_{n}$; and $\alpha\mathop{\mathscr{R}}\beta$ if and
only if $\alpha,\beta\in E_{k}$ for some $k$ or
$\alpha,\beta\in\mathcal{G}_{n}$ or
$\alpha\mathcal{G}_{n}=\beta\mathcal{G}_{n}$) also hold in these cases, from
which statement (3) follows (since
$\mathop{\mathscr{L}}\subseteq\mathop{\mathscr{R}}$). Part (4) is trivial in
the case where $n=1,2$ (since these semigroups are regular) and can be proved
in an entirely similar manner in the case $n=3$, using the fact that there is
an idempotent of each type.

The case $n=4$ is a little different, since there are extra endomorphisms to
consider. We use extensively the multiplication of elements described in
Corollary 2.6 and Lemma 2.7.

For parts (1) and (2): It is clear from the multiplication in Corollary 2.6
that $E_{1}(4)<E_{2}(4)<E_{3}(4)<\\{\varepsilon\\}$ is a chain of right-zero
semigroups. That $E_{1}(4)$ is the minimal ideal can be seen by consideration
of ranks. Notice that if $\alpha=\sigma^{g}\in E_{7}(4)$, then
$p_{g}=\mathrm{id}$ and $\alpha\sigma^{h}=\sigma^{h}$, which means that
elements of $E_{7}(4)$ are left identities for elements of $D(4)$, and hence
in particular that $E_{7}(4)$ is also a right-zero semigroup. To complete the
proof it suffices to verify that $E_{7}(4)E_{k}(4)\subseteq E_{k}(4)$ and
$E_{k}(4)E_{7}(4)\subseteq E_{k}(4)$ for all $k\leq 3$, which follows
immediately from Lemma 2.7.

For part (3): It is clear from the multiplication in Corollary 2.6 and Lemma
2.7 that $D(4)$ and $\mathcal{E}_{4}\setminus D(4)$ are subsemigroups of
$\mathcal{E}_{4}$. Elements of $D(4)$ cannot be in the same
$\mathop{\mathscr{L}}$\- or $\mathop{\mathscr{R}}$-class as elements of
$\mathcal{E}_{4}\setminus D(4)$ since they do not have the same rank.
Moreover, from the multiplication one finds that two elements of
$\mathcal{E}_{4}\setminus D(4)$ will be $\mathop{\mathscr{L}}$ (respectively,
$\mathop{\mathscr{R}}$) related in $\mathcal{E}_{4}$ if and only if they are
$\mathop{\mathscr{L}}$ (respectively, $\mathop{\mathscr{R}}$) related in
$\mathcal{E}_{4}\setminus D(4)$, and one can describe the classes here in a
similar manner to the case $n\neq 4$. Thus it suffices to describe how $D(4)$
splits into $\mathop{\mathscr{L}}$ and $\mathop{\mathscr{R}}$ classes. Since
$\mathrm{im\,}\sigma^{g}=\left\\{t^{g}\colon
t\in\mathcal{S}_{4},4t=4\right\\}\cup\left\\{c_{4g}\right\\}$, it follows that
$\mathrm{im\,}\sigma^{g}=\mathrm{im\,}\sigma^{h}$ if and only if $4g=4h$. Thus
$\alpha\mathop{\mathscr{L}}\beta$ if and only if $\alpha=\beta$ or
$\alpha,\beta\in\mathcal{G}_{4}$ or $\alpha=\sigma^{g}$, $\beta=\sigma^{h}$
both lie in $D(4)$ with $4g=4h$. Also, for all $g,h\in\mathcal{S}_{4}$ we have
that $p_{g}^{-1}h,p_{h}^{-1}g\in\mathcal{S}_{4}$ with
$\sigma^{g}\sigma^{p_{g}^{-1}h}=\sigma^{h}$ and
$\sigma^{h}\sigma^{p_{h}^{-1}g}=\sigma^{g}$ which shows that $D(4)$ is an
$\mathop{\mathscr{R}}$-class. This yields that
$\alpha\mathop{\mathscr{R}}\beta$ if and only if $\alpha,\beta\in E_{k}(4)$
for some $1\leq k\leq 3$ or $\alpha,\beta\in\mathcal{G}_{4}$ or
$\alpha,\beta\in D(4)$ or $\alpha\mathcal{G}_{4}=\beta\mathcal{G}_{4}$. Since
$\mathop{\mathscr{L}}\subseteq\mathop{\mathscr{R}}$ we obtain the result.

For part (4): From the multiplication in Lemma 2.7 we see that elements of
$E_{7}(4)$ are left identities of $\mathcal{E}_{4}\setminus\mathcal{G}_{4}$,
but they are not left identities for elements of $\mathcal{G}_{4}$. Likewise,
elements of $E_{3}(4)$ are left identities of
$\mathcal{E}_{4}\setminus\left(\mathcal{G}_{4}\cup D(4)\right)$, but they are
not left identities for elements of $\mathcal{G}_{4}\cup D(4)$. It follows
from this that $D(4)$ is an $\mathop{\widetilde{\mathscr{R}}}$-class, and
(since
$\mathop{\mathscr{R}}\subseteq\mathop{\mathscr{R}^{*}}\subseteq\mathop{\widetilde{\mathscr{R}}}$)
an $\mathop{\mathscr{R}^{*}}$-class. For the remaining elements, similar
reasoning to that used in the proofs of Lemma 6.1 and Proposition 6.5 applies
to show that the remaining classes follow the same pattern as before. ∎

We recall from the discussion above that $\mathcal{E}_{3}$ is not regular, and
so it makes sense to consider the extended Green’s relations.

######  Proposition 7.2.

In $\mathcal{E}_{3}$ the following statements hold:

  1. (1)

$\mathop{\mathscr{L}^{*}}\subseteq\mathop{\mathscr{R}^{*}}=\mathop{\mathscr{D}^{*}}=\mathop{\mathscr{J}^{*}}=\mathop{\widetilde{\mathscr{R}}}$
and the $\mathop{\mathscr{R}^{*}}$-classes are $\mathcal{G}_{3}$, $E_{3}(3)$,
$E_{2}(3)\cup C(3)$ and $E_{1}(3)$ (i.e. elements of the same rank);

  2. (2)

$\alpha\mathop{\widetilde{\mathscr{L}}}\beta$ if and only if $\alpha=\beta$ or
$\alpha,\beta\in\mathcal{G}_{3}\cup C(3)$;

  3. (3)

$\alpha\mathop{\mathscr{L}^{*}}\beta$ if and only if
$\alpha,\beta\in\mathcal{G}_{3}$ or $\alpha^{2}=\alpha=\beta=\beta^{2}$ or
$\alpha=\phi_{t,e},\beta=\phi_{u,f}$ both lie in $C(3)$ with
$\mathrm{Fix}(t,e)=\mathrm{Fix}(u,f)$;

  4. (4)

the $\mathop{\widetilde{\mathscr{D}}}$-classes are $\mathcal{G}_{3}\cup
E_{2}(3)\cup C(3)$, $E_{3}(3)$ and $E_{1}(3)$;

  5. (5)

the $\mathop{\widetilde{\mathscr{J}}}$-classes are $\mathcal{E}_{3}\setminus
E_{1}(3)$ and $E_{1}(3)$.

###### Proof.

Since $\mathcal{E}_{3}$ contains an idempotent of each type as defined in
Section 2.3, almost all of the arguments given in Section 6 to go through
verbatim. The only two notable differences concern the relations
$\mathop{\mathscr{D}^{*}}$ and $\mathop{\widetilde{\mathscr{D}}}$. Indeed for
$\mathop{\mathscr{D}^{*}}$ the proof of Proposition 6.12 utilises an element
of $B(n)$ to deduce that certain elements are
$\mathop{\mathscr{D}^{*}}$-related, but since $B(3)=\emptyset$, this argument
is not valid for $n=3$. The result however follows directly from the
observation that $\mathop{\mathscr{L}^{*}}\subseteq\mathop{\mathscr{R}^{*}}$
so that $\mathop{\mathscr{D}^{*}}=\mathop{\mathscr{R}^{*}}$, while the proof
that $\mathop{\mathscr{D}^{*}}=\mathop{\mathscr{J}^{*}}$ is just as before. In
a similar manner in the case of $\mathop{\widetilde{\mathscr{D}}}$, the proof
of Proposition 6.13 relies on the fact that elements of $A(n)$, $B(n)$ and
$C(n)$ are $\mathop{\widetilde{\mathscr{L}}}$-related in order to show that
elements of $E_{2}(n)$, $E_{3}(n)$ and $\mathcal{G}_{n}$ are
$\mathop{\widetilde{\mathscr{D}}}$-related. Since $A(3)=B(3)=\emptyset$ this
argument does not hold for $n=3$. However, it is easy to see that elements of
$E_{3}(3)$ form a single $\mathop{\widetilde{\mathscr{D}}}$-class, while
elements of $\mathcal{G}_{3}$ and $E_{2}(3)$ are
$\mathop{\widetilde{\mathscr{L}}\\!\circ\\!\widetilde{\mathscr{R}}}$-related.
Thus the classes of $\mathop{\widetilde{\mathscr{D}}}$ are as given in the
statement. Finally
$\mathop{\widetilde{\mathscr{D}}}\subseteq\mathop{\widetilde{\mathscr{J}}}$,
and since classes of $\mathop{\widetilde{\mathscr{J}}}$ are ideals saturated
by $\mathop{\widetilde{\mathscr{L}}}$ and $\mathop{\widetilde{\mathscr{R}}}$,
it follows that the only two classes are $E_{1}(3)$ and
$\mathcal{E}_{3}\setminus E_{1}(3)$. ∎

Likewise, $\mathcal{E}_{4}$ is not regular, and the extended Green’s relations
can be described as follows:

######  Proposition 7.3.

In the endomorphism monoid $\mathcal{E}_{4}$, the following statements hold:

  1. (1)

$\alpha\mathop{\mathscr{L}}\beta$ if and only if $\alpha=\beta$ or
$\alpha,\beta\in\mathcal{G}_{4}$ or $\alpha=\sigma^{g}$, $\beta=\sigma^{h}$
both lie in $D(4)$ with $4g=4h$;

  2. (2)

$\alpha\mathop{\mathscr{R}}\beta$ if and only if $\alpha,\beta\in E_{k}(4)$
for some $1\leq k\leq 3$ or $\alpha,\beta\in\mathcal{G}_{4}$ or
$\alpha,\beta\in D(4)$ or $\alpha\mathcal{G}_{4}=\beta\mathcal{G}_{4}$;

  3. (3)

$\alpha\mathop{\widetilde{\mathscr{L}}}\beta$ if and only if $\alpha=\beta$ or
$\alpha,\beta\in\mathcal{G}_{4}\cup B(4)\cup C(4)$ or $\alpha=\sigma^{g}$,
$\beta=\sigma^{h}$ both lie in $D(4)$ with $4g=4h$;

  4. (4)

$\alpha\mathop{\mathscr{L}^{*}}\beta$ if and only if
$\alpha,\beta\in\mathcal{G}_{4}$ or $\alpha^{2}=\alpha=\beta=\beta^{2}$ or
$\alpha=\sigma^{g}$, $\beta=\sigma^{h}$ both lie in $D(4)$ with $4g=4h$ or
$\alpha=\phi_{t,e},\beta=\phi_{u,f}$ both lie in $B(4)\cup C(4)$ with
$\mathrm{Fix}(t,e)=\mathrm{Fix}(u,f)$;

  5. (5)

$\mathop{\mathscr{D}^{*}}=\mathop{\mathscr{J}^{*}}$ and the
$\mathop{\mathscr{D}^{*}}$-classes are $\mathcal{G}_{4},D(4),E_{3}(4)\cup
B(4)\cup E_{2}(4)\cup C(4)$ and $E_{1}(4)$;

  6. (6)

the $\mathop{\widetilde{\mathscr{D}}}$-classes are $D(4)$, $E_{1}(4)$ and
$\mathcal{E}_{4}\setminus\left(D(4)\cup E_{1}(4)\right)$;

  7. (7)

the $\mathop{\widetilde{\mathscr{J}}}$-classes are $\mathcal{E}_{4}\setminus
E_{1}(4)$ and $E_{1}(4)$.

###### Proof.

The proof of parts (1) and (2) is contained in that of Proposition 7.1. For
parts (3) and (4): Much of the proof from the previous section regarding
$\mathop{\widetilde{\mathscr{L}}}$ applies here, with the additional note that
if $\alpha\in B(4)\cup C(4)$ and $\eta\in E_{7}(4)$, then $\alpha\eta\in
E_{1}(4)$ so that the only right identity for elements in $B(4)\cup C(4)$ is
$\varepsilon$. Now if $\alpha=\sigma^{g}\in D(4)$ and $\eta=\sigma^{f}\in
E_{7}(4)$ are such that $\alpha\eta=\alpha$, it follows that $4g=4f$. Thus
$\sigma^{g}\mathop{\widetilde{\mathscr{L}}}\sigma^{h}$ forces $4g=4h$ and thus
$\sigma^{g}\mathop{\mathscr{L}}\sigma^{h}$. This shows that for
$\alpha,\beta\in D(4)$ we have $\alpha\mathop{\mathscr{L}}\beta$ if and only
if $\alpha\mathop{\widetilde{\mathscr{L}}}\beta$ if and only if
$\alpha\mathop{\mathscr{L}^{*}}\beta$ (since
$\mathop{\mathscr{L}}\subseteq\mathop{\mathscr{L}^{*}}\subseteq\mathop{\widetilde{\mathscr{L}}}$,
and the description of $\mathop{\mathscr{L}}$ has been given in the proof of
Proposition 7.1). The proof that the remaining classes are as stated follows
the reasoning of Proposition 6.9, noting that this is unaffected by the
presence of elements in $D(4)$ and the absence of elements in $A(4)$. Indeed
the presence of elements in $D(4)$ could only separate classes listed in
Proposition 6.9, but these are either already $\mathop{\mathscr{L}}$-classes,
or they are classes in $B(4)\cup C(4)$. However, it is easy to see that if for
some $\gamma\in D(4)$, $\delta\in\mathcal{E}_{n}$ and $\alpha\in B(4)\cup
C(4)$ one has $\alpha\gamma=\alpha\delta$ then $\beta\gamma=\beta\delta$ for
all $\beta\in B(4)\cup C(4)$. For part (5): The proof of
$\mathop{\mathscr{D}^{*}}$ and $\mathop{\mathscr{J}^{*}}$ is exactly the same
as in Proposition 6.12 by considering the restrictions of elements $t,u$ and
$f$ to the set $\left\\{1,2,3,4\right\\}$, that is, by using the elements

$\displaystyle t=\begin{pmatrix}1&2&3&4\\\ 1&3&2&1\end{pmatrix},\quad
u=\begin{pmatrix}1&2&3&4\\\ 1&1&1&4\end{pmatrix},\quad\text{and}\quad
f=\begin{pmatrix}1&2&3&4\\\ 1&1&1&1\end{pmatrix},$

since we then have that $\phi_{t,f}\in B(4)$ and $\phi_{u,f}\in C(4)$ are
$\mathop{\mathscr{L}^{*}}$-related.

For parts (6) and (7): We have that $D(4)$ is a
$\mathop{\widetilde{\mathscr{D}}}$-class on its own since it is a single
$\mathop{\widetilde{\mathscr{R}}}$-class as well as the union of the
$\mathop{\widetilde{\mathscr{L}}}$-classes of its elements, and the other
classes as given in the statement follow from the proof of Proposition 6.13.
However, since
$\mathop{\widetilde{\mathscr{D}}}\subseteq\mathop{\widetilde{\mathscr{J}}}$
and the principal ideal generated by elements of $D(4)$ is not
$\sim$-saturated, this forces elements of $\mathcal{E}_{4}\setminus E_{1}(4)$
to form a single $\mathop{\widetilde{\mathscr{J}}}$-class as required. ∎

##  8\. Related problems

As mentioned in the Introduction, this article is an opener in the discussion
of the structure of endomorphism monoids of full transformation semigroups of
various natural kinds. We present here a number of questions and possible
further directions worthy of investigation.

### Minimal presentations and counting problems

The presentation constructed in Section 4 uses a minimal generating set, whose
size has a nice combinatorial interpretation in terms of directed coloured
graphs of certain types. Using the machinery of generating functions, it seems
possible that one could give (recurrence) formulae for $r_{3}(n)$ (the number
of orbits of rank $3$) and $r_{2}(n)$ (the number of essential orbits of rank
$2$), and hence give a formula for the size $m(n)$ of a minimal generating set
of $\mathcal{E}_{n}$. A natural question in this regard is how $m(n)$ grows
asymptotically, in particular as compared with the size of the endomorphism
monoid $\mathcal{E}_{n}$ itself. We note that some similar counting problems
(concerning solutions to the system of equations $X^{2}=X$, $Y^{2}=Y$, $XY=YX$
in $\mathcal{T}_{n}$) have been considered in [13].

Whilst our generating set is minimal, we make no claim, however, as to the
minimality of our _presentation_. Indeed, the number of relations of the form
(R2) and (R3) and the length of the words involved in these relation is
dependent upon the chosen presentation $\langle X_{\Pi}:R_{\Pi}\rangle$ of the
symmetric group $\mathcal{S}_{n}$. Specifically, it is dependent upon
$F_{\Pi}(n)$, that is, the smallest number such that any element of
$\mathcal{S}_{n}$ has a representation as a word of length at most
$F_{\Pi}(n)$ in the generators $X_{\Pi}$.

### Other questions concerning presentations

We have considered a presentation for the monoid $\mathcal{E}_{n}$, based on a
minimal set of generators. If we allowed ourselves to chose a generator from
each orbit, then our relations would naturally simplify. Previous articles
have considered presentations for the singular part of $\mathcal{T}_{n}$ [2,
4]. We could equally well consider (now semigroup) generators and
presentations for $\mathcal{E}_{n}\setminus\mathcal{G}_{n}$.

### Other semigroups of transformations

We have focussed on $\mathcal{E}_{n}=\mathrm{End}(\mathcal{T}_{n})$ as
$\mathcal{T}_{n}$ is perhaps the most natural semigroup of _finite_
transformations.The automorphisms and endomorphisms of $\mathcal{PT}_{n}$ and
$\mathcal{I}_{n}$ have already been described by different authors (see [8,
Chap. 7]), where $\mathcal{PT}_{n}$ and $\mathcal{I}_{n}$ are, respectively,
the semigroups of partial (partial one-one) maps of a finite set, under
composition of (partial) maps. What can be said of the structure of
$\mathrm{End}(\mathcal{PT}_{n})$, $\mathrm{End}(\mathcal{I}_{n})$ or
$\mathrm{End}(\mathcal{S}_{n})$?

Moving away from transformation semigroups, one could consider related
semigroups, such as Brauer monoids and partition monoids (see, for example,
[3]), where here the endomorphisms have been determined [18].

We have started with an unordered set $\\{1,\ldots,n\\}$ and defined
$\mathcal{T}_{n}$ to be all maps from this set to itself. There are ordered
analogues of $\mathcal{T}_{n}$ obtained by considering order preserving maps
of $\\{1,\ldots,n\\}$. The study of their endomorphisms has begun in [15, 16],
and it would be interesting to develop these ideas further to describe the
structure of the endomorphism monoids.

In another direction, one can drop the constraint of finiteness. Specifically,
what of the endomorphism monoid of the full transformation monoid (and related
semigroups) on an _infinite_ set, such as $\mathbb{N}$?

### Semigroup vs. monoid endomophisms

For any monoid $S$ we may consider the monoid of monoid endomorphisms (that
is, semigroup endomorphisms also fixing the identity) or the monoid of
semigroup endomorphisms. Here we have considered the latter for
$\mathcal{T}_{n}$, but it would also be possible to adapt our results to
consider the former.

### Endomorphisms of endomorphism monoids of other algebras

We may regard regard $\mathcal{T}_{n}$ as the monoid of endomorphisms of an
algebra with no operations. This is a degenerate case of a free algebra. One
could consider endomorphisms of other endomorphism monoids of free algebra,
perhaps starting with their automorphisms. A useful reference here is [1].

### Iteration

The structure of $\mathcal{T}_{n}$ is quite rich: it forms a chain of
$\mathcal{D}=\mathop{\mathscr{J}}$-classes, which are non-trivial, and it has
elements of every rank. It is, of course, the semigroup of endomorphisms of an
algebra with no operations. By contrast, the structure of $\mathcal{E}_{n}$ is
rather thin - for example, $\mathop{\mathscr{L}}$ is trivial outside of the
group of units. Will this make the structure of
$\mathrm{End}(\mathcal{E}_{n})$ richer? In general, what can one say about the
sequence of monoids

$\mathcal{T}_{n},\;\mathrm{End}(\mathcal{T}_{n}),\;\mathrm{End}(\mathrm{End}(\mathcal{T}_{n})),\ldots?$

## References

  * [1] J. Araújo, J. Konieczny, Automorphisms of endomorphism monoids of $1$-simple free algebras. Comm. Algebra 37, 83–-94 (2009).
  * [2] J. East, A presentation for the singular part of the full transformation semigroup. Semigroup Forum 81, 357– 379 (2010).
  * [3] J. East, Generators and relations for partition monoids and algebras. Journal of Algebra 339, 1–26 (2011).
  * [4] J. East, Defining relations for idempotent generators in finite full transformation semigroups. Semigroup Forum 86, 451–485 (2013).
  * [5] A. El Qallali, Structure theory for abundant and related semigroups. PhD Thesis, University of York, (1980).
  * [6] J. Fountain, Right PP monoids with central idempotents. Semigroup Forum 13, 229–237 (1977).
  * [7] J. Fountain, Abundant Semigroups. Proc. London Math. Soc. 44, 103–129 (1982).
  * [8] O. Ganyushkin and V. Mazorchuk. Classical finite transformation semigroups: an introduction (Vol. 9), Springer Science & Business Media (2008).
  * [9] A. Grau, Aspects of endomorphism monoids of certain algebras, PhD Thesis, University of York (2023).
  * [10] C. Hollings, From right PP monoids to restriction semigroups: a survey. Eur. J. Pure Appl. Math., 21–57 (2009).
  * [11] J. M. Howie, Fundamentals of Semigroup Theory. Oxford University Press (1995).
  * [12] M. Kilp, Commutative monoids all of whose principal ideals are projective. Semigroup Forum 6, 334–339 (1973).
  * [13] C. Krattenthaler, T. W. Müller, Equations in finite semigroups: explicit enumeration and asymptotics of solution numbers, Journal of Combinatorial Theory, Series A 105, 291–334 (2004).
  * [14] M. V. Lawson, Semigroups and ordered categories I, The reduced case. Journal of Algebra 141, 422–462 (1991).
  * [15] D. Li, V. H. Fernandes, Endomorphisms of semigroups of oriented transformations. Semigroup Forum 106, no.1, 184–210 (2023).
  * [16] D. Li, V. H. Fernandes, Endomorphisms of semigroups of monotone transformations. Journal of Algebra and Its Applications, to appear.
  * [17] D. B. McAlister, One-to-one partial right translations of a right cancellative semigroup. J. Algebra 43, 231–251 (1976)
  * [18] V. Mazorchuk, Endomorphisms of $\mathfrak{B}_{n},\,P\mathfrak{B}_{n}$, and $\mathfrak{C}_{n}$, Comm. Algebra 30, 3489–3513 (2002).
  * [19] F. Pastijn, A representation of a semigroup by a semigroup of matrices over a group with zero, Semigroup Forum 10, 238–249 (1975).
  * [20] J.-E. Pin. Varieties of formal languages. Vol. 184. London: North Oxford Academic, (1986).
  * [21] B. Schein and B. Teclezghi, Endomorphisms of finite full transformation semigroups. Proceedings of the American Mathematical Society 126, 2579–2587 (1998).
  * [22] B. Steinberg, Representation theory of finite monoids, Springer (2016).


# Search for an axion-like particle in $J/\psi$ radiative decays

M. Ablikim1, M. N. Achasov13,b, P. Adlarson73, R. Aliberti34, A.
Amoroso72A,72C, M. R. An38, Q. An69,56, Y. Bai55, O. Bakina35, R. Baldini
Ferroli28A, I. Balossino29A, Y. Ban45,g, V. Batozskaya1,43, D. Becker34, K.
Begzsuren31, N. Berger34, M. Bertani28A, D. Bettoni29A, F. Bianchi72A,72C, E.
Bianco72A,72C, J. Bloms66, A. Bortone72A,72C, I. Boyko35, R. A. Briere5, A.
Brueggemann66, H. Cai74, X. Cai1,56, A. Calcaterra28A, G. F. Cao1,61, N.
Cao1,61, S. A. Cetin60A, J. F. Chang1,56, T. T. Chang75, W. L. Chang1,61, G.
R. Che42, G. Chelkov35,a, C. Chen42, Chao Chen53, G. Chen1, H. S. Chen1,61, M.
L. Chen1,56,61, S. J. Chen41, S. M. Chen59, T. Chen1,61, X. R. Chen30,61, X.
T. Chen1,61, Y. B. Chen1,56, Y. Q. Chen33, Z. J. Chen25,h, W. S. Cheng72C, S.
K. Choi10A, X. Chu42, G. Cibinetto29A, S. C. Coen4, F. Cossio72C, J. J. Cui48,
H. L. Dai1,56, J. P. Dai77, A. Dbeyssi19, R. E. de Boer4, D. Dedovich35, Z. Y.
Deng1, A. Denig34, I. Denysenko35, M. Destefanis72A,72C, F. De Mori72A,72C, Y.
Ding39, Y. Ding33, J. Dong1,56, L. Y. Dong1,61, M. Y. Dong1,56,61, X. Dong74,
S. X. Du79, Z. H. Duan41, P. Egorov35,a, Y. L. Fan74, J. Fang1,56, S. S.
Fang1,61, W. X. Fang1, Y. Fang1, R. Farinelli29A, L. Fava72B,72C, F.
Feldbauer4, G. Felici28A, C. Q. Feng69,56, J. H. Feng57, K Fischer67, M.
Fritsch4, C. Fritzsch66, C. D. Fu1, Y. W. Fu1, H. Gao61, Y. N. Gao45,g, Yang
Gao69,56, S. Garbolino72C, I. Garzia29A,29B, P. T. Ge74, Z. W. Ge41, C.
Geng57, E. M. Gersabeck65, A Gilman67, K. Goetzen14, L. Gong39, W. X.
Gong1,56, W. Gradl34, M. Greco72A,72C, M. H. Gu1,56, Y. T. Gu16, C. Y
Guan1,61, Z. L. Guan22, A. Q. Guo30,61, L. B. Guo40, R. P. Guo47, Y. P.
Guo12,f, A. Guskov35,a, X. T. H.1,61, W. Y. Han38, X. Q. Hao20, F. A.
Harris63, K. K. He53, K. L. He1,61, F. H. Heinsius4, C. H. Heinz34, Y. K.
Heng1,56,61, C. Herold58, T. Holtmann4, P. C. Hong12,f, G. Y. Hou1,61, Y. R.
Hou61, Z. L. Hou1, H. M. Hu1,61, J. F. Hu54,i, T. Hu1,56,61, Y. Hu1, G. S.
Huang69,56, K. X. Huang57, L. Q. Huang30,61, X. T. Huang48, Y. P. Huang1, T.
Hussain71, N Hüsken27,34, W. Imoehl27, M. Irshad69,56, J. Jackson27, S.
Jaeger4, S. Janchiv31, J. H. Jeong10A, Q. Ji1, Q. P. Ji20, X. B. Ji1,61, X. L.
Ji1,56, Y. Y. Ji48, Z. K. Jia69,56, P. C. Jiang45,g, S. S. Jiang38, T. J.
Jiang17, X. S. Jiang1,56,61, Y. Jiang61, J. B. Jiao48, Z. Jiao23, S. Jin41, Y.
Jin64, M. Q. Jing1,61, T. Johansson73, X. K.1, S. Kabana32, N. Kalantar-
Nayestanaki62, X. L. Kang9, X. S. Kang39, R. Kappert62, M. Kavatsyuk62, B. C.
Ke79, A. Khoukaz66, R. Kiuchi1, R. Kliemt14, L. Koch36, O. B. Kolcu60A, B.
Kopf4, M. Kuessner4, A. Kupsc43,73, W. Kühn36, J. J. Lane65, J. S. Lange36, P.
Larin19, A. Lavania26, L. Lavezzi72A,72C, T. T. Lei69,k, Z. H. Lei69,56, H.
Leithoff34, M. Lellmann34, T. Lenz34, C. Li46, C. Li42, C. H. Li38, Cheng
Li69,56, D. M. Li79, F. Li1,56, G. Li1, H. Li69,56, H. B. Li1,61, H. J. Li20,
H. N. Li54,i, Hui Li42, J. R. Li59, J. S. Li57, J. W. Li48, Ke Li1, L. J
Li1,61, L. K. Li1, Lei Li3, M. H. Li42, P. R. Li37,j,k, S. X. Li12, S. Y.
Li59, T. Li48, W. D. Li1,61, W. G. Li1, X. H. Li69,56, X. L. Li48, Xiaoyu
Li1,61, Y. G. Li45,g, Z. J. Li57, Z. X. Li16, Z. Y. Li57, C. Liang41, H.
Liang33, H. Liang1,61, H. Liang69,56, Y. F. Liang52, Y. T. Liang30,61, G. R.
Liao15, L. Z. Liao48, J. Libby26, A. Limphirat58, D. X. Lin30,61, T. Lin1, B.
X. Liu74, B. J. Liu1, C. Liu33, C. X. Liu1, D. Liu19,69, F. H. Liu51, Fang
Liu1, Feng Liu6, G. M. Liu54,i, H. Liu37,j,k, H. B. Liu16, H. M. Liu1,61,
Huanhuan Liu1, Huihui Liu21, J. B. Liu69,56, J. L. Liu70, J. Y. Liu1,61, K.
Liu1, K. Y. Liu39, Ke Liu22, L. Liu69,56, L. C. Liu42, Lu Liu42, M. H.
Liu12,f, P. L. Liu1, Q. Liu61, S. B. Liu69,56, T. Liu12,f, W. K. Liu42, W. M.
Liu69,56, X. Liu37,j,k, Y. Liu37,j,k, Y. B. Liu42, Z. A. Liu1,56,61, Z. Q.
Liu48, X. C. Lou1,56,61, F. X. Lu57, H. J. Lu23, J. G. Lu1,56, X. L. Lu1, Y.
Lu7, Y. P. Lu1,56, Z. H. Lu1,61, C. L. Luo40, M. X. Luo78, T. Luo12,f, X. L.
Luo1,56, X. R. Lyu61, Y. F. Lyu42, F. C. Ma39, H. L. Ma1, J. L. Ma1,61, L. L.
Ma48, M. M. Ma1,61, Q. M. Ma1, R. Q. Ma1,61, R. T. Ma61, X. Y. Ma1,56, Y.
Ma45,g, F. E. Maas19, M. Maggiora72A,72C, S. Maldaner4, S. Malde67, A.
Mangoni28B, Y. J. Mao45,g, Z. P. Mao1, S. Marcello72A,72C, Z. X. Meng64, J. G.
Messchendorp14,62, G. Mezzadri29A, H. Miao1,61, T. J. Min41, R. E. Mitchell27,
X. H. Mo1,56,61, N. Yu. Muchnoi13,b, Y. Nefedov35, F. Nerling19,d, I. B.
Nikolaev13,b, Z. Ning1,56, S. Nisar11,l, Y. Niu 48, S. L. Olsen61, Q.
Ouyang1,56,61, S. Pacetti28B,28C, X. Pan53, Y. Pan55, A. Pathak33, Y. P.
Pei69,56, M. Pelizaeus4, H. P. Peng69,56, K. Peters14,d, J. L. Ping40, R. G.
Ping1,61, S. Plura34, S. Pogodin35, V. Prasad32, F. Z. Qi1, H. Qi69,56, H. R.
Qi59, M. Qi41, T. Y. Qi12,f, S. Qian1,56, W. B. Qian61, C. F. Qiao61, J. J.
Qin70, L. Q. Qin15, X. P. Qin12,f, X. S. Qin48, Z. H. Qin1,56, J. F. Qiu1, S.
Q. Qu59, C. F. Redmer34, K. J. Ren38, A. Rivetti72C, V. Rodin62, M. Rolo72C,
G. Rong1,61, Ch. Rosner19, S. N. Ruan42, A. Sarantsev35,c, Y. Schelhaas34, K.
Schoenning73, M. Scodeggio29A,29B, K. Y. Shan12,f, W. Shan24, X. Y. Shan69,56,
J. F. Shangguan53, L. G. Shao1,61, M. Shao69,56, C. P. Shen12,f, H. F.
Shen1,61, W. H. Shen61, X. Y. Shen1,61, B. A. Shi61, H. C. Shi69,56, J. Y.
Shi1, Q. Q. Shi53, R. S. Shi1,61, X. Shi1,56, J. J. Song20, T. Z. Song57, W.
M. Song33,1, Y. X. Song45,g, S. Sosio72A,72C, S. Spataro72A,72C, F. Stieler34,
Y. J. Su61, G. B. Sun74, G. X. Sun1, H. Sun61, H. K. Sun1, J. F. Sun20, K.
Sun59, L. Sun74, S. S. Sun1,61, T. Sun1,61, W. Y. Sun33, Y. Sun9, Y. J.
Sun69,56, Y. Z. Sun1, Z. T. Sun48, Y. X. Tan69,56, C. J. Tang52, G. Y. Tang1,
J. Tang57, Y. A. Tang74, L. Y Tao70, Q. T. Tao25,h, M. Tat67, J. X. Teng69,56,
V. Thoren73, W. H. Tian57, W. H. Tian50, Y. Tian30,61, Z. F. Tian74, I.
Uman60B, B. Wang69,56, B. Wang1, B. L. Wang61, C. W. Wang41, D. Y. Wang45,g,
F. Wang70, H. J. Wang37,j,k, H. P. Wang1,61, K. Wang1,56, L. L. Wang1, M.
Wang48, Meng Wang1,61, S. Wang12,f, T. Wang12,f, T. J. Wang42, W. Wang70, W.
Wang57, W. H. Wang74, W. P. Wang69,56, X. Wang45,g, X. F. Wang37,j,k, X. J.
Wang38, X. L. Wang12,f, Y. Wang59, Y. D. Wang44, Y. F. Wang1,56,61, Y. H.
Wang46, Y. N. Wang44, Y. Q. Wang1, Yaqian Wang18,1, Yi Wang59, Z. Wang1,56, Z.
L. Wang70, Z. Y. Wang1,61, Ziyi Wang61, D. Wei68, D. H. Wei15, F. Weidner66,
S. P. Wen1, C. W. Wenzel4, U. Wiedner4, G. Wilkinson67, M. Wolke73, L.
Wollenberg4, C. Wu38, J. F. Wu1,61, L. H. Wu1, L. J. Wu1,61, X. Wu12,f, X. H.
Wu33, Y. Wu69, Y. J Wu30, Z. Wu1,56, L. Xia69,56, X. M. Xian38, T. Xiang45,g,
D. Xiao37,j,k, G. Y. Xiao41, H. Xiao12,f, S. Y. Xiao1, Y. L. Xiao12,f, Z. J.
Xiao40, C. Xie41, X. H. Xie45,g, Y. Xie48, Y. G. Xie1,56, Y. H. Xie6, Z. P.
Xie69,56, T. Y. Xing1,61, C. F. Xu1,61, C. J. Xu57, G. F. Xu1, H. Y. Xu64, Q.
J. Xu17, X. P. Xu53, Y. C. Xu76, Z. P. Xu41, F. Yan12,f, L. Yan12,f, W. B.
Yan69,56, W. C. Yan79, X. Q Yan1, H. J. Yang49,e, H. L. Yang33, H. X. Yang1,
Tao Yang1, Y. Yang12,f, Y. F. Yang42, Y. X. Yang1,61, Yifan Yang1,61, M.
Ye1,56, M. H. Ye8, J. H. Yin1, Z. Y. You57, B. X. Yu1,56,61, C. X. Yu42, G.
Yu1,61, T. Yu70, X. D. Yu45,g, C. Z. Yuan1,61, L. Yuan2, S. C. Yuan1, X. Q.
Yuan1, Y. Yuan1,61, Z. Y. Yuan57, C. X. Yue38, A. A. Zafar71, F. R. Zeng48, X.
Zeng12,f, Y. Zeng25,h, X. Y. Zhai33, Y. H. Zhan57, A. Q. Zhang1,61, B. L.
Zhang1,61, B. X. Zhang1, D. H. Zhang42, G. Y. Zhang20, H. Zhang69, H. H.
Zhang33, H. H. Zhang57, H. Q. Zhang1,56,61, H. Y. Zhang1,56, J. J. Zhang50, J.
L. Zhang75, J. Q. Zhang40, J. W. Zhang1,56,61, J. X. Zhang37,j,k, J. Y.
Zhang1, J. Z. Zhang1,61, Jiawei Zhang1,61, L. M. Zhang59, L. Q. Zhang57, Lei
Zhang41, P. Zhang1, Q. Y. Zhang38,79, Shuihan Zhang1,61, Shulei Zhang25,h, X.
D. Zhang44, X. M. Zhang1, X. Y. Zhang53, X. Y. Zhang48, Y. Zhang67, Y. T.
Zhang79, Y. H. Zhang1,56, Yan Zhang69,56, Yao Zhang1, Z. H. Zhang1, Z. L.
Zhang33, Z. Y. Zhang42, Z. Y. Zhang74, G. Zhao1, J. Zhao38, J. Y. Zhao1,61, J.
Z. Zhao1,56, Lei Zhao69,56, Ling Zhao1, M. G. Zhao42, S. J. Zhao79, Y. B.
Zhao1,56, Y. X. Zhao30,61, Z. G. Zhao69,56, A. Zhemchugov35,a, B. Zheng70, J.
P. Zheng1,56, W. J. Zheng1,61, Y. H. Zheng61, B. Zhong40, X. Zhong57, H.
Zhou48, L. P. Zhou1,61, X. Zhou74, X. K. Zhou61, X. R. Zhou69,56, X. Y.
Zhou38, Y. Z. Zhou12,f, J. Zhu42, K. Zhu1, K. J. Zhu1,56,61, L. Zhu33, L. X.
Zhu61, S. H. Zhu68, S. Q. Zhu41, T. J. Zhu12,f, W. J. Zhu12,f, Y. C. Zhu69,56,
Z. A. Zhu1,61, J. H. Zou1, J. Zu69,56
(BESIII Collaboration)
1 Institute of High Energy Physics, Beijing 100049, People’s Republic of China
2 Beihang University, Beijing 100191, People’s Republic of China
3 Beijing Institute of Petrochemical Technology, Beijing 102617, People’s
Republic of China
4 Bochum Ruhr-University, D-44780 Bochum, Germany
5 Carnegie Mellon University, Pittsburgh, Pennsylvania 15213, USA
6 Central China Normal University, Wuhan 430079, People’s Republic of China
7 Central South University, Changsha 410083, People’s Republic of China
8 China Center of Advanced Science and Technology, Beijing 100190, People’s
Republic of China
9 China University of Geosciences, Wuhan 430074, People’s Republic of China
10 Chung-Ang University, Seoul, 06974, Republic of Korea
11 COMSATS University Islamabad, Lahore Campus, Defence Road, Off Raiwind
Road, 54000 Lahore, Pakistan
12 Fudan University, Shanghai 200433, People’s Republic of China
13 G.I. Budker Institute of Nuclear Physics SB RAS (BINP), Novosibirsk 630090,
Russia
14 GSI Helmholtzcentre for Heavy Ion Research GmbH, D-64291 Darmstadt, Germany
15 Guangxi Normal University, Guilin 541004, People’s Republic of China
16 Guangxi University, Nanning 530004, People’s Republic of China
17 Hangzhou Normal University, Hangzhou 310036, People’s Republic of China
18 Hebei University, Baoding 071002, People’s Republic of China
19 Helmholtz Institute Mainz, Staudinger Weg 18, D-55099 Mainz, Germany
20 Henan Normal University, Xinxiang 453007, People’s Republic of China
21 Henan University of Science and Technology, Luoyang 471003, People’s
Republic of China
22 Henan University of Technology, Zhengzhou 450001, People’s Republic of
China
23 Huangshan College, Huangshan 245000, People’s Republic of China
24 Hunan Normal University, Changsha 410081, People’s Republic of China
25 Hunan University, Changsha 410082, People’s Republic of China
26 Indian Institute of Technology Madras, Chennai 600036, India
27 Indiana University, Bloomington, Indiana 47405, USA
28 INFN Laboratori Nazionali di Frascati , (A)INFN Laboratori Nazionali di
Frascati, I-00044, Frascati, Italy; (B)INFN Sezione di Perugia, I-06100,
Perugia, Italy; (C)University of Perugia, I-06100, Perugia, Italy
29 INFN Sezione di Ferrara, (A)INFN Sezione di Ferrara, I-44122, Ferrara,
Italy; (B)University of Ferrara, I-44122, Ferrara, Italy
30 Institute of Modern Physics, Lanzhou 730000, People’s Republic of China
31 Institute of Physics and Technology, Peace Avenue 54B, Ulaanbaatar 13330,
Mongolia
32 Instituto de Alta Investigación, Universidad de Tarapacá, Casilla 7D,
Arica, Chile
33 Jilin University, Changchun 130012, People’s Republic of China
34 Johannes Gutenberg University of Mainz, Johann-Joachim-Becher-Weg 45,
D-55099 Mainz, Germany
35 Joint Institute for Nuclear Research, 141980 Dubna, Moscow region, Russia
36 Justus-Liebig-Universitaet Giessen, II. Physikalisches Institut, Heinrich-
Buff-Ring 16, D-35392 Giessen, Germany
37 Lanzhou University, Lanzhou 730000, People’s Republic of China
38 Liaoning Normal University, Dalian 116029, People’s Republic of China
39 Liaoning University, Shenyang 110036, People’s Republic of China
40 Nanjing Normal University, Nanjing 210023, People’s Republic of China
41 Nanjing University, Nanjing 210093, People’s Republic of China
42 Nankai University, Tianjin 300071, People’s Republic of China
43 National Centre for Nuclear Research, Warsaw 02-093, Poland
44 North China Electric Power University, Beijing 102206, People’s Republic of
China
45 Peking University, Beijing 100871, People’s Republic of China
46 Qufu Normal University, Qufu 273165, People’s Republic of China
47 Shandong Normal University, Jinan 250014, People’s Republic of China
48 Shandong University, Jinan 250100, People’s Republic of China
49 Shanghai Jiao Tong University, Shanghai 200240, People’s Republic of China
50 Shanxi Normal University, Linfen 041004, People’s Republic of China
51 Shanxi University, Taiyuan 030006, People’s Republic of China
52 Sichuan University, Chengdu 610064, People’s Republic of China
53 Soochow University, Suzhou 215006, People’s Republic of China
54 South China Normal University, Guangzhou 510006, People’s Republic of China
55 Southeast University, Nanjing 211100, People’s Republic of China
56 State Key Laboratory of Particle Detection and Electronics, Beijing 100049,
Hefei 230026, People’s Republic of China
57 Sun Yat-Sen University, Guangzhou 510275, People’s Republic of China
58 Suranaree University of Technology, University Avenue 111, Nakhon
Ratchasima 30000, Thailand
59 Tsinghua University, Beijing 100084, People’s Republic of China
60 Turkish Accelerator Center Particle Factory Group, (A)Istinye University,
34010, Istanbul, Turkey; (B)Near East University, Nicosia, North Cyprus,
99138, Mersin 10, Turkey
61 University of Chinese Academy of Sciences, Beijing 100049, People’s
Republic of China
62 University of Groningen, NL-9747 AA Groningen, The Netherlands
63 University of Hawaii, Honolulu, Hawaii 96822, USA
64 University of Jinan, Jinan 250022, People’s Republic of China
65 University of Manchester, Oxford Road, Manchester, M13 9PL, United Kingdom
66 University of Muenster, Wilhelm-Klemm-Strasse 9, 48149 Muenster, Germany
67 University of Oxford, Keble Road, Oxford OX13RH, United Kingdom
68 University of Science and Technology Liaoning, Anshan 114051, People’s
Republic of China
69 University of Science and Technology of China, Hefei 230026, People’s
Republic of China
70 University of South China, Hengyang 421001, People’s Republic of China
71 University of the Punjab, Lahore-54590, Pakistan
72 University of Turin and INFN, (A)University of Turin, I-10125, Turin,
Italy; (B)University of Eastern Piedmont, I-15121, Alessandria, Italy;
(C)INFN, I-10125, Turin, Italy
73 Uppsala University, Box 516, SE-75120 Uppsala, Sweden
74 Wuhan University, Wuhan 430072, People’s Republic of China
75 Xinyang Normal University, Xinyang 464000, People’s Republic of China
76 Yantai University, Yantai 264005, People’s Republic of China
77 Yunnan University, Kunming 650500, People’s Republic of China
78 Zhejiang University, Hangzhou 310027, People’s Republic of China
79 Zhengzhou University, Zhengzhou 450001, People’s Republic of China
a Also at the Moscow Institute of Physics and Technology, Moscow 141700,
Russia
b Also at the Novosibirsk State University, Novosibirsk, 630090, Russia
c Also at the NRC ”Kurchatov Institute”, PNPI, 188300, Gatchina, Russia
d Also at Goethe University Frankfurt, 60323 Frankfurt am Main, Germany
e Also at Key Laboratory for Particle Physics, Astrophysics and Cosmology,
Ministry of Education; Shanghai Key Laboratory for Particle Physics and
Cosmology; Institute of Nuclear and Particle Physics, Shanghai 200240,
People’s Republic of China
f Also at Key Laboratory of Nuclear Physics and Ion-beam Application (MOE) and
Institute of Modern Physics, Fudan University, Shanghai 200443, People’s
Republic of China
g Also at State Key Laboratory of Nuclear Physics and Technology, Peking
University, Beijing 100871, People’s Republic of China
h Also at School of Physics and Electronics, Hunan University, Changsha
410082, China
i Also at Guangdong Provincial Key Laboratory of Nuclear Science, Institute of
Quantum Matter, South China Normal University, Guangzhou 510006, China
j Also at Frontiers Science Center for Rare Isotopes, Lanzhou University,
Lanzhou 730000, People’s Republic of China
k Also at Lanzhou Center for Theoretical Physics, Lanzhou University, Lanzhou
730000, People’s Republic of China
l Also at the Department of Mathematical Sciences, IBA, Karachi , Pakistan

(August 30, 2024)

###### Abstract

We search for an axion-like particle (ALP) $a$ through the process
$\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$, $J/\psi\rightarrow\gamma a$,
$a\rightarrow\gamma\gamma$ in a data sample with $(2708.1\pm 14.5)\times
10^{6}$ $\psi(3686)$ events collected by the BESIII detector. No significant
ALP signal is observed over the expected background, and the upper limits on
the branching fraction of the decay $J/\psi\rightarrow\gamma a$ and the ALP-
photon coupling constant $g_{a\gamma\gamma}$ are set at the 95% confidence
level in the mass range of $0.165\leq m_{a}\leq 2.84\,\mbox{GeV}/c^{2}$. The
limits on $\mathcal{B}(J/\psi\rightarrow\gamma a)$ range from $8.3\times
10^{-8}$ to $1.8\times 10^{-6}$ over the search region, and the constraints on
the ALP-photon coupling are the most stringent to date for $0.165\leq
m_{a}\leq 1.468\,\mbox{GeV}/c^{2}$.

###### keywords:

BESIII , Axion-like particle , Pseudo-Goldstone boson

††journal: Physics Letters B

##  1 Introduction

Axion-like particles (ALPs) are pseudo-Goldstone bosons arising from some
spontaneously broken global symmetry, addressing the strong _CP_ [1, 2, 3, 4]
or hierarchy problems [5]. ALPs could appear in theories beyond the Standard
Model (SM), such as string theory [6] and extended Higgs models [7]. ALPs
could also provide a portal connecting SM particles to the dark sectors [8],
and in certain situations, they are proposed as cold dark matter candidates
[9]. In the most common scenarios, the ALP $a$ predominantly couples to
photons with a coupling constant $g_{a\gamma\gamma}$. As a generalization of
QCD axions, ALPs have arbitrary masses and couplings which are bounded by
experiments. In the sub-$\mbox{MeV}/c^{2}$ mass range, the bounds on
$g_{a\gamma\gamma}$ are provided by laser experiments, solar photon
instruments, as well as cosmological and astrophysical observations [10, 11].
In the $\mbox{MeV}/c^{2}$ to $\mbox{GeV}/c^{2}$ mass region, constraints on
the coupling constant mainly come from beam-dump experiments [12, 13, 14] and
high-energy collider experiments by searching for final states with photons.
Long-lived ALPs have been searched for in $J/\psi$ and $\Upsilon$ radiative
decays [15, 16] and through $e^{+}e^{-}\rightarrow\gamma+\text{invisible}$
processes [17]. The limits for short-lived ALPs decaying to two photons are
obtained from $e^{+}e^{-}\rightarrow\gamma\gamma$ [18],
$e^{+}e^{-}\rightarrow\gamma\gamma\gamma$ [19, 20] via ALP-strahlung
production, and the light-by-light scattering process
$\gamma\gamma\rightarrow\gamma\gamma$ [21, 22], as well as $pp$ collisions
[23, 24, 25]. There is a striking gap in the limits on the ALP-photon coupling
in the ALP mass range from $100\,\mbox{MeV}/c^{2}$ to roughly
$10\,\mbox{GeV}/c^{2}$, leaving the large area $10^{-3}\lesssim
g_{a\gamma\gamma}\lesssim 10^{-5}\,\mbox{GeV}^{-1}$ still uncovered where
electron-positron colliders can play a unique role [26].

We search for ALPs decaying into two photons at BESIII in $J/\psi$ radiative
decays via $J/\psi\rightarrow\gamma a$, $a\rightarrow\gamma\gamma$ in the mass
range of $0.165\leq m_{a}\leq 2.84\,\mbox{GeV}/c^{2}$. In this Letter we
ignore the ALP coupling to c-quarks and assume the branching fraction of $a$
decaying to photons is 100%, with a decay width
$\Gamma_{a}=g_{a\gamma\gamma}^{2}m_{a}^{3}/64\pi$. The experimental signature
of the ALP decaying into two photons depends on the correlation between its
mass and coupling. Except for the mass region below $0.1\,\mbox{GeV}/c^{2}$,
the ALP has a negligible lifetime and decay width, and the opening angle
between the decay photons is large enough to be resolved in the detector. The
mass intervals of $0.10<m_{a}<0.165\,\mbox{GeV}/c^{2}$,
$0.46<m_{a}<0.60\,\mbox{GeV}/c^{2}$ and $0.90<m_{a}<1.01\,\mbox{GeV}/c^{2}$
are excluded from the search due to the peaking backgrounds from the decays of
$\pi^{0}$, $\eta$ and $\eta^{\prime}$ mesons, respectively. In order to avoid
pollution from non-resonant ALP production $e^{+}e^{-}\rightarrow\gamma a$ and
in order to probe resonant ALP production $J/\psi\rightarrow\gamma a$ in a
model-independent way [27], the decay
$\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$ is exploited to isolate the
$J/\psi$ sample.

##  2 Detector, data sets and Monte Carlo simulation

The BESIII detector [28] records symmetric $e^{+}e^{-}$ collisions provided by
the BEPCII storage ring [29], which operates in the center-of-mass energy
range from 2.00 to 4.95 GeV, with a peak luminosity of $1\times 10^{33}$
cm-2s-1 achieved at $\sqrt{s}$ = 3.77 GeV. BESIII has collected large data
samples in this energy region [30]. The cylindrical core of the BESIII
detector covers 93% of the full solid angle and consists of a helium-based
multilayer drift chamber (MDC), a plastic scintillator time-of-flight system
(TOF), and a CsI(Tl) electromagnetic calorimeter (EMC), which are all enclosed
in a superconducting solenoidal magnet providing a 1.0 T magnetic field. The
solenoid is supported by an octagonal flux-return yoke with resistive plate
counter muon identification modules interleaved with steel. The charged-
particle momentum resolution at $1\leavevmode\nobreak\ {\rm GeV}/c$ is
$0.5\%$, and the ${\rm d}E/{\rm d}x$ resolution is $6\%$ for electrons from
Bhabha scattering. The EMC measures photon energies with a resolution of
$2.5\%$ ($5\%$) at $1$ GeV in the barrel (end-cap) region. The time resolution
in the TOF barrel region is 68 ps, while that in the end-cap region is 110 ps.
The end-cap TOF system was upgraded in 2015 using multigap resistive plate
chamber technology, providing a time resolution of 60 ps [31].

We perform the search using the $\psi(3686)$ data samples collected by the
BESIII detector during three data-taking periods: 2009, 2012, and 2021. The
numbers of $\psi(3686)$ events are determined by counting inclusive hadronic
events whose branching fraction is known rather precisely [32, 33]. There are
$(107.0\pm 0.8)\times 10^{6}$ $\psi(3686)$ events collected in 2009,
$(341.1\pm 2.9)\times 10^{6}$ events collected in 2012 and $(2.26\pm
0.01)\times 10^{9}$ events collected in 2021, for a total of $(2708.1\pm
14.5)\times 10^{6}$ $\psi(3686)$ events. In this analysis, the $J/\psi$ sample
originates from the decay $\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$. The
analysis strategy is to first tag $J/\psi$ events by selecting two oppositely
charged pions, and then to search for the signal candidate events with three
additional photons originating from the tagged $J/\psi$ sample. A semi-blind
procedure is performed to avoid possible bias, where approximately 10% of the
full data set is used to optimize the event selection and validate the fit
approach. The final result is then obtained with the full data set only after
the analysis strategy is fixed.

Simulated data samples produced with a geant4-based [34] Monte Carlo (MC)
package, which includes the geometric description of the BESIII detector and
the detector response, are used to determine detection efficiencies and to
estimate backgrounds. The simulation models the beam-energy spread and
initial-state radiation in $e^{+}e^{-}$ annihilations with the generator kkmc
[35]. An inclusive MC sample with approximately the same number of
$\psi(3686)$ decays as in data is used to check for potential backgrounds. The
inclusive MC sample includes the production of the $\psi(3686)$ resonance, the
initial-state radiation production of the $J/\psi$, and the continuum
processes incorporated in kkmc [35]. All particle decays are modeled with
evtgen [36] using branching fractions either taken from the Particle Data
Group (PDG) [37], when available, or otherwise estimated with lundcharm [38].
Final-state radiation from charged final-state particles is incorporated using
the photos package [39]. To simulate the signal decays, the decay
$\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$ is modeled according to the
partial wave analysis results of $\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$
[40]; a $P$-wave model [36] is used for the subsequent decay
$J/\psi\rightarrow\gamma a$ and a phase-space model is used for the
$a\rightarrow\gamma\gamma$ decay. The signal events are simulated individually
for different mass hypotheses of ALP $m_{a}$ in the range of $0.165\leq
m_{a}\leq 2.84\,\mbox{GeV}/c^{2}$ with a step size of $5\,\mbox{MeV}/c^{2}$,
which is smaller than the signal resolution. Study of the inclusive MC sample
with a generic event type analysis tool, TopoAna [41], indicates that the
dominant backgrounds are from $\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$ with
subsequent decays of $J/\psi\rightarrow\gamma\pi^{0}$, $\gamma\eta$ and
$\gamma\eta^{\prime}$. These backgrounds are each generated exclusively with
the angular distribution of $1+\cos^{2}\theta_{\gamma}$ [36], where
$\theta_{\gamma}$ is the angle of the radiative photon relative to the
positron beam direction in the $J/\psi$ rest frame. Some potential backgrounds
of the form $\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$ with $J/\psi$ decaying
into purely neutral particles in the final states are generated exclusively
with different generators: $J/\psi\rightarrow\gamma\eta_{c}$ with the angular
distribution of $1+\cos^{2}\theta_{\gamma}$ [36],
$J/\psi\rightarrow\gamma\pi^{0}\pi^{0}$ according to the partial wave analysis
results of $J/\psi\rightarrow\gamma\pi^{0}\pi^{0}$ [42] with the assumption of
isospin symmetry, as well as $J/\psi\rightarrow\gamma\gamma\gamma$ with a
phase-space distribution. Each background MC sample is weighted to match the
integrated luminosity of the data set.

##  3 Event selection

Signal candidates are required to have two oppositely charged tracks and at
least three photon candidates. Charged tracks detected in the MDC are required
to be within a polar angle ($\theta$) range of $|\rm{cos\theta}|<0.93$, where
$\theta$ is defined with respect to the $z$-axis, which is the symmetry axis
of the MDC. For each charged track, the momentum must be less than
$0.45\,\mbox{GeV}/c$ and the distance of closest approach to the interaction
point (IP) along the $z$-axis $|V_{z}|$ must be less than 10 cm, and in the
transverse plane $|V_{xy}|$ less than 1 cm. Both charged tracks are assumed to
be pion candidates, and the recoil mass in the center-of-mass system
$M(\pi^{+}\pi^{-})_{\rm recoil}$ must be in the range of [3.080, 3.114]
$\,\mbox{GeV}/c^{2}$.

Photon candidates are identified using showers in the EMC. The deposited
energy of each shower must be more than 25 MeV in the barrel region
($|\\!\cos\theta|<0.80$) and more than 50 MeV in the end-cap region
($0.86<|\\!\cos\theta|<0.92$). To exclude showers that originate from charged
tracks, the angle subtended by the EMC shower and the position of the closest
charged track at the EMC must be greater than 10 degrees as measured from the
IP. To suppress electronic noise and showers unrelated to the event, the
difference between the EMC time and the event start time is required to be
within [0, 700] ns. Events satisfying the above requirements are retained for
further analysis.

The $\pi^{+}$ and $\pi^{-}$ tracks are constrained to a common vertex to
determine the event interaction point, and a four-constraint (4C) kinematic
fit to the initial four-momentum of the $\psi(3686)$ is applied for each
$\pi^{+}\pi^{-}\gamma\gamma\gamma$ combination. The combination with the
smallest fit $\chi_{\rm 4C}^{2}$ is retained, with the requirement of
$\chi_{\rm 4C}^{2}<40$. If there are 5 or more photons in a single event, to
suppress the background from $J/\psi\rightarrow\gamma\pi^{0}\pi^{0}$, we loop
over all $\pi^{+}\pi^{-}5\gamma$ combinations and choose the one with the
minimum $\chi^{2}_{\rm 4C}(5\gamma)$ and require $\chi^{2}_{\rm
4C}<\chi^{2}_{\rm 4C}(5\gamma)$. For the remaining photons, the sum of their
energy deposition in the EMC $E_{\rm other}$ is required to be less than
$0.1\,\mbox{GeV}$. The requirements of $\chi_{\rm 4C}^{2}$ and $E_{\rm other}$
are optimized according to the Punzi significance [43] defined as
$\epsilon/(1.5+\sqrt{B})$, where $\epsilon$ denotes the signal efficiency
obtained from signal MC samples and $B$ is the number of background events
obtained from background MC samples.

##  4 ALP signal search

The two-photon invariant mass $M_{\gamma\gamma}$ distribution of the events
surviving the above selection is shown in Fig. 1, in which the MC simulation
is seen to be consistent with the data. There are three entries per event from
all possible combinations of the three selected photons. According to studies
of MC simulation, the background is dominated by peaking contributions from
$J/\psi\rightarrow\gamma\pi^{0}$, $\gamma\eta$ and $\gamma\eta^{\prime}$
decays. There is a small contribution from residual
$J/\psi\rightarrow\gamma\pi^{0}\pi^{0}$ background with two soft photons that
peaks around the $\pi^{0}$ mass region in the $M_{\gamma\gamma}$ distribution.
There is also contamination from $J/\psi\rightarrow\gamma f_{2}(1270)$ decays,
followed by the decay $f_{2}(1270)\rightarrow\pi^{0}\pi^{0}$. However, since
the $f_{2}(1270)$ state has a large width and the contribution is relatively
small, this contribution can be treated as non-peaking background and is well
described by a polynomial function when extracting the signal yields.

A series of one-dimensional unbinned extended maximum-likelihood fits are
performed to the $M_{\gamma\gamma}$ distribution to determine the signal
yields with different ALP mass hypotheses in the mass range of $0.165\leq
m_{a}\leq 2.84\,\mbox{GeV}/c^{2}$. The search step is $3\,\mbox{MeV}/c^{2}$
for $0.165\leq m_{a}<1.20\,\mbox{GeV}/c^{2}$ and $4\,\mbox{MeV}/c^{2}$ for
other mass regions, with 674 different ALP mass points in total excluding the
regions close to the $\pi^{0}$, $\eta$ and $\eta^{\prime}$ masses. For a
specific fit, the likelihood function is a combination of signal, non-peaking
background, and peaking components of the $\pi^{0}$, $\eta$ and
$\eta^{\prime}$ mesons. Different $M_{\gamma\gamma}$ fit intervals are used
for various $m_{a}$ hypotheses in order to handle the non-peaking and peaking
backgrounds properly, which are listed in Table 1 in detail.

\begin{overpic}[width=227.62204pt]{diphoton_mass.pdf} \end{overpic} FIG. 1: The diphoton invariant-mass distributions for data and the MC-simulated backgrounds, which are normalized to the integrated luminosity of the data. TABLE 1: The $M_{\gamma\gamma}$ fit intervals for various $m_{a}$ points. $m_{a}$ points ($\mbox{GeV}/c^{2}$) |  $M_{\gamma\gamma}$ fit intervals ($\mbox{GeV}/c^{2}$)
---|---
0.165 - 0.35 | 0.06 - 0.45
0.35 - 0.75 | 0.25 - 0.85
0.75 - 1.20 | 0.65 - 1.30
1.20 - 2.84 | ($m_{a}-0.2$) - ($m_{a}+0.2$)

For a single fit, the signal probability density function (PDF) is constructed
from a peaking component from the ALP decay, and a combinatorial contribution
from the other two combinations of photons. The peaking component is
parameterized by the sum of two Crystal Ball (CB) [44] functions with
opposite-side tails and they are required to have the same mean, resolution,
and relative weight. These values and the detection efficiency are determined
by fitting the signal MC samples. The resolution ranges from
$6\,\mbox{MeV}/c^{2}$ near $m_{a}=0.165\,\mbox{GeV}/c^{2}$ to
$11\,\mbox{MeV}/c^{2}$ near $m_{a}=2.2\,\mbox{GeV}/c^{2}$, and it decreases
back to $7\,\mbox{MeV}/c^{2}$ near $m_{a}=2.84\,\mbox{GeV}/c^{2}$ when
approaching the mass of the $J/\psi$ meson. The detection efficiency ranges
from 30% to 35%. The combinatorial component of the signal is described by a
smoothed kernel density estimation PDF [45] obtained from the signal MC sample
with the mass hypothesis $m_{a}$ closest to the fitted assumption. The ratio
between the combinatorial part and the peaking component of the signal are
computed within the corresponding fit interval. For any search point, the
parameters of the CB functions, the ratio of the combinatorial part and the
efficiency are interpolated between the mass points by a fit with a polynomial
function. The peaking background components at the $\pi^{0}$, $\eta$ and
$\eta^{\prime}$ masses are described by the sum of two CB functions using
parameters determined from data. A fifth-order Chebyshev polynomial function
is used to describe the $M_{\gamma\gamma}$ distribution of the non-peaking
background for $0.75\leq m_{a}<1.20\,\mbox{GeV}/c^{2}$ and a third-order
Chebyshev polynomial function is used for the remaining mass regions. When
performing the fit, the shapes of the signal and the peaking background PDFs
are fixed, while the non-peaking background PDF shape and the yields of
signal, peaking and non-peaking background events are free parameters in the
fit. The $M_{\gamma\gamma}$ distributions for selected $m_{a}$ points and the
fit results are shown in Fig. 2.

The branching fractions of
$J/\psi\rightarrow\gamma(\pi^{0},\eta,\eta^{\prime})\rightarrow\gamma\gamma\gamma$
are measured to validate the signal extraction procedure. The peaks are
treated as signals, and the fitting procedure described above is applied to
extract the number of peak events. After accounting for the contribution of
peaking backgrounds, the results are found to be compatible with the published
BESIII measurement [46] within uncertainties.

##  5 Systematic uncertainties

The systematic uncertainties are divided into two parts, which are additive
and multiplicative in nature. The additive systematic uncertainty arises from
the uncertainties in the signal parameterization and background modeling. The
multiplicative systematic uncertainty includes contributions coming from MDC
tracking, photon reconstruction, and selection criteria, which are related to
the signal efficiency.

The uncertainty due to signal and peaking background shapes is considered by
performing the same fitting procedure with different combinations of the
nominal and alternative signal and peaking background shapes. The alternative
signal shape is obtained from the signal MC sample with the mass hypothesis
$m_{a}$ closest to the search point, and the alternative peaking background
shape is modeled with the sum of a CB and a Gaussian functions. The non-
peaking background is described by polynomials, and the potential bias
(spurious signal) due to the choice of functional form is obtained as the
signal yield extracted from a signal-plus-background fit to the background-
only $M_{\gamma\gamma}$ distribution [47]. The spurious signal is required to
be less than 30% of the expected statistical uncertainty in the signal yield
when selecting the background modeling function. A fifth-order Chebyshev
polynomial function is chosen for $0.75\leq m_{a}<1.20\,\mbox{GeV}/c^{2}$ and
a third-order Chebyshev polynomial function is chosen for the remaining mass
regions. The maximum of the absolute value of the fitted signal yield over the
search ranges constitutes the spurious-signal systematic uncertainty, which is
the dominant source of systematic uncertainty in the analysis: 8.09 for
$0.165\leq m_{a}<0.35\,\mbox{GeV}/c^{2}$, 1.41 for $0.35\leq
m_{a}<0.75\,\mbox{GeV}/c^{2}$, 17.95 for $0.75\leq
m_{a}<1.20\,\mbox{GeV}/c^{2}$ and 39.93 for $1.20\leq m_{a}\leq
2.84\,\mbox{GeV}/c^{2}$. For each mass value $m_{a}$, the spurious-signal
uncertainty is incorporated in the overall likelihood assuming a Gaussian
distribution, and the minimum significance value and the maximum upper limit
are recorded among the different fit scenarios.

\begin{overpic}[width=227.62204pt]{fit_ALP_0327.pdf}
\put(20.0,58.0){\small{(a)}} \end{overpic}
\begin{overpic}[width=227.62204pt]{fit_ALP_2208.pdf}
\put(20.0,58.0){\small{(b)}} \end{overpic} FIG. 2: The $M_{\gamma\gamma}$
distribution for (a) $m_{a}=0.327\,\mbox{GeV}/c^{2}$ and (b)
$m_{a}=2.208\,\mbox{GeV}/c^{2}$ with fit results overlaid. The black dots with
error bars are data, and the contribution of the non-peaking background is
represented by a blue dashed curve. The green shaded region and the red solid
curve represent the signal PDF and the total PDF, respectively. The inset of
the figure (a) displays an enlargement of the $M_{\gamma\gamma}$ region
between 0.25 and $0.4\,\mbox{GeV}/c^{2}$. The largest local significance is
2.6$\sigma$ at the $m_{a}=2.208\,\mbox{GeV}/c^{2}$ point.

The multiplicative systematic uncertainties are listed in Table 2. The
tracking efficiency of charged pions is investigated using control samples of
$J/\psi\rightarrow p\bar{p}\pi^{+}\pi^{-}$ decays [48]. The difference in
tracking efficiencies between data and MC simulation is found to be 1.0% per
track, which is taken as the uncertainty from the tracking efficiency. The
photon detection efficiency is studied with a clean sample of
$J/\psi\rightarrow\rho^{0}\pi^{0}$ decays [49]. The difference in detection
efficiencies between data and the MC simulation is 1.0% per photon. The
systematic uncertainty due to $M(\pi^{+}\pi^{-})_{\rm recoil}$ is determined
to be 0.3% according to the study of
$\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$, $J/\psi\rightarrow
e^{+}e^{-}\mu^{+}\mu^{-}$ decays. The systematic uncertainties associated with
the 4C kinematic fit, $E_{\rm other}$ and $N_{\rm trk}$ (number of charged
tracks) requirements are studied with the control sample of
$\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$, $J/\psi\rightarrow\gamma\eta$
decays and are determined to be 1.8%, 1.4% and 0.1%, respectively. The
uncertainty from the branching fraction of
$\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$ decays is taken from the PDG [37],
and the systematic uncertainty due to the number of $\psi(3686)$ events is
determined to be 0.6% by studying inclusive hadronic decays [32, 33]. The
multiplicative systematic uncertainty is included in the overall likelihood as
a Gaussian nuisance parameter with a width equal to the uncertainty.

TABLE 2: The multiplicative systematic uncertainties. The total systematic uncertainty is obtained by adding all individual uncertainties in quadrature, assuming all sources to be independent. Source | Uncertainty (%)
---|---
MDC tracking | 2.0
Photon reconstruction | 3.0
$M(\pi^{+}\pi^{-})_{\rm recoil}$ requirement | 0.3
4C kinematic fit | 1.8
$E_{\rm other}$ requirement | 1.4
$N_{\rm trk}$ requirement | 0.1
$\mathcal{B}(\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi)$ | 0.9
Number of $\psi(3686)$ | 0.6
Total | 4.4

##  6 Result

For each $m_{a}$ point, the local significance is determined by
$\mathcal{S}=\mathrm{sign}(N_{\mathrm{sig}})\cdot\sqrt{2\ln(\mathcal{L}_{\mathrm{max}}/\mathcal{L}_{0})}$,
where $\mathcal{L}_{\mathrm{max}}$ and $\mathcal{L}_{0}$ are the likelihood
values with and without the signal hypothesis included in the fit,
respectively. The fitted signal yields $N_{\rm sig}$ and the corresponding
significances are shown in Fig. 3. The largest local significance of
$2.6\sigma$ is observed near $m_{a}=2.208\,\mbox{GeV}/c^{2}$, consistent with
the null hypothesis. The fit results for $m_{a}=2.208\,\mbox{GeV}/c^{2}$ is
shown in Fig. 2(b).

Since no significant ALP signal is observed, we compute the 95% confidence
level (CL) upper limits on $\mathcal{B}(J/\psi\rightarrow\gamma a)$ as a
function of $m_{a}$ using a one-sided frequentist profile-likelihood method
[50]. Then the branching fraction limit is converted to the ALP-photon
coupling limit using [27]

$g_{a\gamma\gamma}=\sqrt{\frac{\mathcal{B}(J/\psi\rightarrow\gamma
a)}{\mathcal{B}(J/\psi\rightarrow
e^{+}e^{-})}(1-\frac{m_{a}^{2}}{m_{J/\psi}^{2}})^{-3}\frac{32\pi\alpha_{\mathrm{em}}}{m_{J/\psi}^{2}}},$
(1)

where $\mathcal{B}(J/\psi\rightarrow e^{+}e^{-})=(5.971\pm 0.032)\%$ is the
world average value from the PDG [37] and $\alpha_{\mathrm{em}}$ is the
electromagnetic coupling. An additional 0.5% uncertainty arising from the
knowledge of $\mathcal{B}(J/\psi\rightarrow e^{+}e^{-})$ is included when
converting $\mathcal{B}(J/\psi\rightarrow\gamma a)$ to $g_{a\gamma\gamma}$.

\begin{overpic}[width=227.62204pt]{fit_yield_significance.pdf} \end{overpic}
FIG. 3: The distribution of the signal yields $N_{\rm sig}$ (upper plot) and
the local significance $\mathcal{S}$ (lower plot) obtained from the maximum-
likelihood fits as a function of $m_{a}$. The vertical gray bands indicate the
excluded regions close to the $\pi^{0}$, $\eta$, and $\eta^{\prime}$ masses.

The expected and observed upper limits at the 95% CL on
$\mathcal{B}(J/\psi\rightarrow\gamma a)$ are shown in Fig. 4. The observed
limits range from $8.3\times 10^{-8}$ to $1.8\times 10^{-6}$ in the ALP mass
region of $0.165\leq m_{a}\leq 2.84\,\mbox{GeV}/c^{2}$. The exclusion limits
in the ALP-photon coupling $g_{a\gamma\gamma}$ versus ALP mass $m_{a}$ plane
obtained from this analysis are shown in Fig. 5, together with the constraints
of other experiments. Our limits exclude the region in the ALP-photon coupling
range $g_{a\gamma\gamma}>3\times 10^{-4}\,\mbox{GeV}^{-1}$ for an ALP mass
$m_{a}$ around $0.25\,\mbox{GeV}/c^{2}$, with an improvement by a factor of
2-3 over the previous Belle II measurement [20]. In addition, the constraints
on the ALP-photon coupling are the most stringent to date for $0.165\leq
m_{a}\leq 1.468\,\mbox{GeV}/c^{2}$.

##  7 Summary

Based on a data sample with $(2708.1\pm 14.5)\times 10^{6}$ $\psi(3686)$
events collected by the BESIII detector, we search for ALPs decaying into two
photons produced in $J/\psi$ radiative decays using the
$\psi(3686)\rightarrow\pi^{+}\pi^{-}J/\psi$ process. No significant ALP signal
is observed and we set the 95% CL upper limits on the branching fraction of
the decay $J/\psi\rightarrow\gamma a$ and the ALP-photon coupling
$g_{a\gamma\gamma}$. The observed limits on
$\mathcal{B}(J/\psi\rightarrow\gamma a)$ range from $8.3\times 10^{-8}$ to
$1.8\times 10^{-6}$ in the ALP mass region of $0.165\leq m_{a}\leq
2.84\,\mbox{GeV}/c^{2}$ and the exclusion limits on the ALP-photon coupling
are the most stringent to date for $0.165\leq m_{a}\leq
1.468\,\mbox{GeV}/c^{2}$.

\begin{overpic}[width=227.62204pt]{expected_observed_BF_UL.pdf} \end{overpic}
FIG. 4: Expected and observed upper limits at the 95% CL on
$\mathcal{B}(J/\psi\rightarrow\gamma a)$. The black curve is for data, the
black dashed curve represents the expected values and the green (yellow) band
represents the $\pm 1\sigma$ ($\pm 2\sigma$) region.
\begin{overpic}[width=227.62204pt]{ALP_photon_coupling.pdf} \end{overpic} FIG.
5: Exclusion limits at the 95% CL in the ALP-photon coupling
$g_{a\gamma\gamma}$ versus ALP mass $m_{a}$ plane obtained from this analysis.
The constraints from _BABAR_ [17], OPAL [18], Belle II [20], CMS [21], ATLAS
[22], PrimEx [12], and beam-dump experiments [13, 14] are also shown. All
measurements assume a 100% ALP decay branching fraction into photons.

## Acknowledgement

The BESIII collaboration thanks the staff of BEPCII and the IHEP computing
center for their strong support. We thank Jia Liu for the useful suggestions.
This work is supported in part by National Key R&D Program of China under
Contracts Nos. 2020YFA0406400, 2020YFA0406300; National Natural Science
Foundation of China (NSFC) under Contracts Nos. 11635010, 11735014, 11835012,
11935015, 11935016, 11935018, 11961141012, 12022510, 12025502, 12035009,
12035013, 12061131003, 12192260, 12192261, 12192262, 12192263, 12192264,
12192265; the Chinese Academy of Sciences (CAS) Large-Scale Scientific
Facility Program; the CAS Center for Excellence in Particle Physics (CCEPP);
Joint Large-Scale Scientific Facility Funds of the NSFC and CAS under Contract
No. U1832207; CAS Key Research Program of Frontier Sciences under Contracts
Nos. QYZDJ-SSW-SLH003, QYZDJ-SSW-SLH040; 100 Talents Program of CAS; The
Institute of Nuclear and Particle Physics (INPAC) and Shanghai Key Laboratory
for Particle Physics and Cosmology; ERC under Contract No. 758462; European
Union’s Horizon 2020 research and innovation programme under Marie Sklodowska-
Curie grant agreement under Contract No. 894790; German Research Foundation
DFG under Contracts Nos. 443159800, 455635585, Collaborative Research Center
CRC 1044, FOR5327, GRK 2149; Istituto Nazionale di Fisica Nucleare, Italy;
Ministry of Development of Turkey under Contract No. DPT2006K-120470; National
Research Foundation of Korea under Contract No. NRF-2022R1A2C1092335; National
Science and Technology fund; National Science Research and Innovation Fund
(NSRF) via the Program Management Unit for Human Resources & Institutional
Development, Research and Innovation under Contract No. B16F640076; Olle
Engkvist Foundation under Contract No. 200-0605; Polish National Science
Centre under Contract No. 2019/35/O/ST2/02907; STFC (United Kingdom);
Suranaree University of Technology (SUT), Thailand Science Research and
Innovation (TSRI), and National Science Research and Innovation Fund (NSRF)
under Contract No. 160355; The Royal Society, UK under Contracts Nos.
DH140054, DH160214; The Swedish Research Council; U. S. Department of Energy
under Contract No. DE-FG02-05ER41374

## References

  * [1] R. D. Peccei and H. R. Quinn, Phys. Rev. Lett. 38, 1440 (1977).
  * [2] R. D. Peccei and H. R. Quinn, Phys. Rev. D 16, 1791 (1977).
  * [3] S. Weinberg, Phys. Rev. Lett. 40, 223 (1978).
  * [4] F. Wilczek, Phys. Rev. Lett. 40, 279 (1978).
  * [5] P. W. Graham, D. E. Kaplan and S. Rajendran, Phys. Rev. Lett. 115, 221801 (2015).
  * [6] A. Ringwald, J. Phys. Conf. Ser. 485, 012013 (2014).
  * [7] G. C. Branco et al., Phys. Rept. 516, 1 (2012).
  * [8] M. Freytsis and Z. Ligeti, Phys. Rev. D 83, 115009 (2011).
  * [9] P. Arias et al., JCAP 06, 013 (2012).
  * [10] P. W. Graham et al., Rev. Nucl. Part. Sci. 65, 485 (2015).
  * [11] D. Cadamuro and J. Redondo, JCAP 02, 032 (2012).
  * [12] D. Aloni et al., Phys. Rev. Lett. 123, 071801 (2019).
  * [13] B. Döbrich et al., JHEP 02, 018 (2016).
  * [14] D. Banerjee et al. [NA64 Collaboration], Phys. Rev. Lett. 125, 081801 (2020).
  * [15] M. Ablikim et al. [BESIII Collaboration], Phys. Rev. D 101, 112005 (2020).
  * [16] I. S. Seong et al. [Belle Collaboration], Phys. Rev. Lett. 122, 011801 (2019).
  * [17] M. J. Dolan et al., JHEP 12, 094 (2017); Erratum: [JHEP 03, 190 (2021)].
  * [18] S. Knapen et al., Phys. Rev. Lett. 118, 171801 (2017).
  * [19] M. Acciarri et al. [L3 Collaboration], Phys. Lett. B 345, 609 (1995).
  * [20] F. Abudinén et al. [Belle II Collaboration], Phys. Rev. Lett. 125, 161806 (2020).
  * [21] A. M. Sirunyan et al. [CMS Collaboration], Phys. Lett. B 797, 134826 (2019).
  * [22] G. Aad et al. [ATLAS Collaboration], JHEP 03, 243 (2021); Erratum: [JHEP 11, 050 (2021)].
  * [23] D. d’Enterria, Workshop on Feebly Interacting Particles (2021), arXiv:2102.08971.
  * [24] G. Aad et al. [ATLAS Collaboration], Phys. Rev. Lett. 113, 171801 (2014).
  * [25] G. Aad et al. [ATLAS Collaboration], Eur. Phys. J. C 76, 210 (2016).
  * [26] J. Jaeckel, M. Spannowsky, Phys. Lett. B 753, 482 (2016).
  * [27] L. Merlo et al., JHEP 06, 091 (2019).
  * [28] M. Ablikim et al. [BESIII Collaboration], Nucl. Instrum. Meth. A 614, 345 (2010).
  * [29] C. H. Yu et al., Proceedings of IPAC2016, Busan, Korea, 2016, doi:10.18429/JACoW-IPAC2016-TUYA01.
  * [30] M. Ablikim et al. [BESIII Collaboration], Chin. Phys. C 44, 040001 (2020).
  * [31] X. Li et al., Radiat. Detect. Technol. Methods 1, 13 (2017); Y. X. Guo et al., Radiat. Detect. Technol. Methods 1, 15 (2017); P. Cao et al., Nucl. Instrum. Meth. A 953, 163053 (2020).
  * [32] M. Ablikim et al. [BESIII Collaboration], Chin. Phys. C 37, 063001 (2013).
  * [33] M. Ablikim et al. [BESIII Collaboration], Chin. Phys. C 42, 023001 (2018).
  * [34] S. Agostinelli et al. [GEANT4 Collaboration], Nucl. Instrum. Meth. A 506, 250 (2003).
  * [35] S. Jadach, B. F. L. Ward and Z. Was, Phys. Rev. D 63, 113009 (2001); Comput. Phys. Commun. 130, 260 (2000).
  * [36] D. J. Lange, Nucl. Instrum. Meth. A 462, 152 (2001); R. G. Ping, Chin. Phys. C 32, 599 (2008).
  * [37] R. L. Workman et al. [Particle Data Group], Prog. Theor. Exp. Phys. 2022, 083C01 (2022).
  * [38] J. C. Chen et al., Phys. Rev. D 62, 034003 (2000); R. L. Yang, R. G. Ping and H. Chen, Chin. Phys. Lett. 31, 061301 (2014).
  * [39] E. Richter-Was, Phys. Lett. B 303, 163 (1993).
  * [40] J. Z. Bai, et al. [BES Collaboration], Phys. Rev. D 62, 032002 (2000).
  * [41] X. Y. Zhou et al., Comput. Phys. Commun. 258, 107540 (2021).
  * [42] M. Ablikim et al. [BESIII Collaboration], Phys. Rev. D 92, 052003 (2015); Erratum: [Phys. Rev. D 93, 039906 (2016)].
  * [43] G. Punzi, eConf C030908, MODT002 (2003), arXiv:physics/038063.
  * [44] J. H. Cheng et al., Nucl. Instrum. Methods Phys. Res., Sect. A 827, 165 (2016).
  * [45] K. S. Cranmer, Comput. Phys. Commun. 136, 198 (2001).
  * [46] M. Ablikim et al. [BESIII Collaboration], Phys. Rev. D 97, 072014 (2018).
  * [47] ATLAS Collaboration, Recommendations for the Modeling of Smooth Backgrounds, ATL-PHYS-PUB-2020-028, 2020.
  * [48] M. Ablikim et al. [BESIII Collaboration], Phys. Rev. D 83, 112005 (2011).
  * [49] M. Ablikim et al. [BESIII Collaboration], Phys. Rev. D 81, 052005 (2010).
  * [50] G. Cowan et al., Eur. Phys. J. C 71, 1554 (2011); [Erratum: Eur. Phys. J. C 73, 2501 (2013)].


# Minimize Web Applications vulnerabilities through the early Detection of
CRLF Injection ††thanks: Identify applicable funding agency here. If none,
delete this.

MD Asibul Hasan  Dept. of Computer Science and Engineering
Southeast University
<EMAIL_ADDRESS>Md. Mijanur Rahman  Dept. of Computer Science and
Engineering
Southeast University
<EMAIL_ADDRESS>
###### Abstract

Carriage return (CR) and line feed (LF), also known as CRLF injection is a
type of vulnerability that allows a hacker to enter special characters into a
web application, altering its operation or confusing the administrator. Log
poisoning and HTTP response splitting are two prominent harmful uses of this
technique. Additionally, CRLF injection can be used by an attacker to exploit
other vulnerabilities, such as cross-site scripting (XSS). Email injection,
also known as email header injection, is another way that can be used to
modify the behavior of emails. The Open Web Application Security Project
(OWASP) is an organization that studies vulnerabilities and ranks them based
on their level of risk. According to OWASP, CRLF vulnerabilities are among the
top 10 vulnerabilities and are a type of injection attack. However, CRLF
vulnerabilities can also lead to the discovery of other high-risk
vulnerabilities, and it fosters a better approach to mitigate CRLF
vulnerabilities in the early stage and help secure applications against known
vulnerabilities. Although there has been a significant amount of research on
other types of injection attacks, such as Structure Query Language Injection
(SQL Injection). There has been less research on CRLF vulnerabilities and how
to detect them with automated testing. There is room for further research to
be done on this subject matter in order to develop creative solutions to
problems. It will also help to reduce false positive alerts by checking the
header response of each request. Automated alerts from security systems can
provide a quicker and more accurate understanding of potential vulnerabilities
and can help to reduce false positive alerts. Despite the extensive research
on various types of vulnerabilities in web applications, CRLF vulnerabilities
have only recently been included in the research. Utilizing automated testing
as a recurring task can assist companies in receiving consistent updates about
their systems and enhance their security.

Keywords—Cyber Security, OWASP vulnerabilities, Security Detection, CRLF
Injection, Injection Attack

##  I Introduction

Cyber security is primarily concerned with the protection of anything that is
connected to the internet. This can be an application/software, network,
device, etc. There are numerous types of vulnerabilities in applications, such
as SQL injection, cross-site scripting (XSS), and local file inclusion (LFI),
while network vulnerabilities may include denial of service (DoS) attacks,
sniffing, and spoofing[3] [4]. To ensure cyber security, engineers must
prioritize confidentiality, integrity, and availability, which are the three
letters upon which the CIA triad stands. The goal of this research is to
identify a specific application vulnerability. The cyber security industry is
massive and consists primarily of two teams: one works for the company while
the other works against the company, typically the intruder. It is crucial
that everyone in the Software Development Life Cycle (SDLC) maintains the
process, but due to a lack of understanding or high value, some organizations
skip security testing. However, security testing checks whether the software
is vulnerable to cyber attacks, test the impact of malicious activities, and
determine the long-term success of the software.
The majority of researchers covered different types of vulnerability which is
also dangerous for web applications as well as other software. But there is
less research on CRLF injection vulnerability and has been one of the most
dangerous vulnerabilities in recent years. Because this vulnerability was
discovered newly that is why there is no details research about this
vulnerability so there is a scope to improve CRLF detection. Researchers have
only investigated the other types of vulnerabilities where attacks are mainly
based on HTTP attacks [1]. This research only covers web application
vulnerability which is a very big issue in developing a secure application[5].
CRLF vulnerability is not a common vulnerability like Cross site scripting or
SQL injection [5][6] but this can lead to other vulnerabilities and expose the
system to critical information.
If there is any vulnerability that discloses the company’s inside information
or exposes users’/customers’ information that will be a huge disaster for the
company. The most widespread flaw in web applications is the injection, which
includes SQL, HTML, CRLF, and other types of injection. Other flaws include
XSS, broken access control, security misconfiguration, exposed sensitive data,
inadequate attack protection, using components with known vulnerabilities,
using unprotected APIs, local file inclusion, and broken authentication and
session management [1][7]. To solve this problem, many researchers have tried
several methods but less research has been carried out in the area of CRLF
vulnerability detection or discovery, and this still remains one of the most
critical vulnerabilities. This can expose system information and hackers can
steal confidential data from applications. CRLF is not only a single
vulnerability but this can also lead to some other vulnerabilities mainly
injection type of vulnerabilities.
The majority of organization who is concerned about their security hire a
security specialist to prevent security breaches, and a security engineer to
check for vulnerabilities manually but this process takes so much time and
reduce productivity. As cyber threats evolve, security engineers are
increasingly tasked with threat modeling, penetration testing, and automation
to proactively determine the level of vulnerability. This is focused on a
critical injection of vulnerability CRLF. CRLF refers to Carriage Return and
Line Feed. It’s an injection attack that could lead to XSS attack by doing
that attacker can grab the user session and in some cases can accelerate
privilege[8] [9]. XSS attacks are a type of injection, in which malicious
scripts are injected into otherwise benign and trusted websites. XSS attacks
occur when an attacker uses a web application to send malicious code,
generally in the form of a browser side script, to a different end user
through such an online application. The code for a web browser often takes the
form of a JavaScript segment, but it can also be HTML, Flash, or any other
type of code that the browser is capable of executing. [10][11]. XSS
vulnerabilities normally allow an attacker to masquerade as a victim user, to
carry out any actions that the user is able to perform and to access any of
the user’s data[6].
There are so many researches that have been done based on web application
vulnerability as well as network vulnerability and threats. The majority of
these are dangerous attacks that can take over the full system. But though
CRLF vulnerability is a new kind of vulnerability that has not been explored
by researchers, most especially the specific vulnerability. Some software
works impeccably with CRLF vulnerability but they are paid applications. To
solve this problem with CRLF vulnerability, this research will provide insight
and a logical approach for those who want to work in this area of interest.
The first sectionof this study described its abstract. The second section
described the introduction of the study. The third section conveyed the
literature review, followed by themethodology, and finally the conclusion of
the research.

##  II Literature Review

According to our studies, there has been a fair amount of research done on
vulnerability management. Some of the research has been focused on injection-
based attacks including SQL injection, HTML injection, and also code
injection. A study on three major SQLi techniques was implemented on the
educational and financial websites of Bangladesh and executes analysis web
applications for figuring out the security condition [1]. But there was no
mention of any CRLF vulnerability. Some case studies have been conducted on
various types of vulnerabilities in some websites in Bangladesh. Additionally,
some papers have explored automated and manual penetration testing in a range
of domains. An example of the online application called Tunestore is used in a
case study to carry out security testing. It provides an example of tool- and
manually-assisted web application security testing. Testing on Tunestore is
done using Paros, WebScarab, JBroFuzz, Fortify, and Acunetix. [5].
This paper aims to eliminate CRLF vulnerability on web applications and helps
the security tester to detect the vulnerability before releasing the product.
Solving this vulnerability will also secure the application against XSS
attacks because CRLF can also lead to XSS. These are major vulnerabilities
according to OWASP.

##  III Methodology

CRLF vulnerability in web applications is a major security concern that can
have serious consequences. This vulnerability allows attackers to insert
malicious code into a web page or application, which can then be executed by
the web browser or program. This can result in the exposure of sensitive
information, the execution of arbitrary code, or the launch of a denial of
service attack.
CRLF vulnerabilities are often exploited through CRLF injection attacks, in
which malicious code is injected into a web page or application. To prevent
CRLF injection attacks, it is essential to properly validate and sanitize all
input. Any user input that will be used in a Structured Query Language (SQL)
should be properly encoded and checked for incorrect characters. It is also
critical to keep all web servers and applications up to date with the latest
security fixes.

Figure 01: How CRLF attacks occurred

As a result of this CRLF attack, more harmful attacks including XSS, page
injection, web cache poisoning, and many others are launched. Log poisoning
and HTTP response splitting are the popular use of these attacks. By adding a
line end and an extra line, the attacker adds false log file entries. This
could be done to deceive system administrators or cover up other attacks [10].
LF, CR, #, and ! are common ASCII characters used in creating server-side
attacks. By including them in the feature set, these assaults can be
detected.[2]
One way to exploit a CRLF vulnerability is to inject a CRLF character into a
web application in order to exploit a buffer overflow vulnerability. Another
way to exploit a CRLF vulnerability is to inject a CRLF character into a web
application in order to exploit an XSS vulnerability. Proposed framework to
find CRLF vulnerability:

Figure 02: Proposed Framework

In this figure, the user will give a list of website links or a single link
when running CRLF. After that, the application will check for header responses
if there is CR or LF signs based on that application and will make sure
whether it is vulnerable or not vulnerable. This framework will give fewer
false positive alerts than other applications. An extract of the complete HTTP
GET request is shown below:[1]

Figure 03: CRLF in the header

In this figure, it is a header request where CRLF means the CR and LF tag can
be found.
CR and LF are special characters (ASCII 13 and 10 respectively, also referred
to as $\backslash$r and $\backslash$n) that are used to signify the End of
Line (EOL). They’re used to note the termination of a line, however, dealt
with differently in today’s popular Operating Systems.

##  IV Result and Discussions

Our study concentrated on determining the presence and consequences of CRLF
vulnerabilities in the wild as well as investigating potential remedies and
the most effective methods for avoiding and overcoming these problems. Our
research shows that CRLF vulnerabilities affect a large number of websites and
online apps and that they are rather widespread in web applications. These
flaws might have detrimental effects, such as allowing hackers to insert
malicious code into a website or application, which could result in data
breaches, identity theft, and other security breaches. We advise using a
number of quality standards, such as input validation, sanitization, and
encoding of user input, as well as routine testing and monitoring of web
applications to discover and resolve any vulnerabilities, in order to mitigate
these issues. Overall, our research emphasizes how critical it is to handle
online security in a proactive manner, including routinely identifying and
patching possible vulnerabilities like CRLF issues. By doing this, businesses
can defend themselves against security flaws, guarantee the security of their
users, and safeguard their websites and apps.

Figure 04: Vulnerability chart

The findings of this investigation showed that a total of 40 websites were
examined using the suggested framework for locating CRLF vulnerabilities,
which are shown in Figure 4. Three out of the forty websites were determined
to be vulnerable to CRLF injection attacks, according to the data graph. For
some legal issues, it’s not possible to disclose the target website’s name or
website address.

Figure 05: Comparison chart

The findings of the research showed that 40 websites were examined for CRLF
vulnerabilities using three distinct frameworks which are depicted in Figure
5. According to the statistics in the figure, the suggested framework was able
to find more susceptible websites than Acunetix and Metasploit Pro combined.

##  V Conclusion

This study’s objective was to better our knowledge about CRLF vulnerabilities
in web applications. This study examined the characteristics and potential
repercussions of CRLF vulnerabilities as well as techniques for spotting and
reducing these dangers. The suggested framework was more effective than the
already available tools and had fewer false positives. Our research has shown
the significance of taking CRLF vulnerabilities into account during the
software development lifecycle and highlighted how they could affect the
security of online applications. By offering practical knowledge that may
assist people and organizations in defending against the continuously changing
threats in the digital world, this study has also contributed to the larger
area of cyber security.

## References

  * [1] Hassan, M.M., Bhuyian, T., Sohel, M.K., Sharif, M.H. and Biswas, S., 2018. SAISAN: An automated Local File Inclusion vulnerability detection model. International Journal of Engineering & Technology, 7(2-3), p.4.
  * [2] Agarwal, V., Hubballi, N., Chitrakar, A.S. and Franke, K., 2019, December. Identifying Anomalous HTTP Traffic with Association Rule Mining. In 2019 IEEE International Conference on Advanced Networks and Telecommunications Systems (ANTS) (pp. 1-6). IEEE.
  * [3] Suroto, S., 2017. A review of defense against slow HTTP attack. JOIV: International Journal on Informatics Visualization, 1(4), pp.127-134.
  * [4] Kshirsagar, D. and Kumar, S., 2016, August. HTTP flood attack detection using ontology. In Proceedings of the International Conference on Advances in Information Communication Technology & Computing (pp. 1-4).
  * [5] Dukes, L., Yuan, X. and Akowuah, F., 2013, April. A case study on web application security testing with tools and manual testing. In 2013 Proceedings of IEEE Southeastcon (pp. 1-6). IEEE.
  * [6] Mohammadi, M., Chu, B. and Lipford, H.R., 2017, July. Detecting cross-site scripting vulnerabilities through automated unit testing. In 2017 IEEE International Conference on Software Quality, Reliability and Security (QRS) (pp. 364-373). IEEE.
  * [7] Buja, G., Abd Jalil, K.B., Ali, F.B.H.M. and Rahman, T.F.A., 2014, April. Detection model for SQL injection attack: An approach for preventing a web application from the SQL injection attack. In 2014 IEEE Symposium on Computer Applications and Industrial Electronics (ISCAIE) (pp. 60-64). IEEE.
  * [8] Ami, P.V. and Malav, S.C., 2013. Top five dangerous security risks over web application. International Journal of Emerging Trends & Technology in Computer Science, 2(1), pp.41-43.
  * [9] Al-Khurafi, O.B. and Al-Ahmad, M.A., 2015, December. Survey of web application vulnerability attacks. In 2015 4th International Conference on Advanced Computer Science Applications and Technologies (ACSAT) (pp. 154-158). IEEE.
  * [10] Gupta, S. and Gupta, B.B., 2015, May. PHP-sensor: a prototype method to discover workflow violation and XSS vulnerabilities in PHP web applications. In Proceedings of the 12th ACM international conference on computing frontiers (pp. 1-8).
  * [11] Shar, L.K. and Tan, H.B.K., 2012. Automated removal of cross site scripting vulnerabilities in web applications. Information and Software Technology, 54(5), pp.467-478.