# Estimation of CP violating EDMs from known mechanisms in the SM ††thanks:
This work was supported by SERI-FCS award # 2015.0594, Sigma Xi grants
G2017100190747806 and G2019100190747806, and DOE grant DE-SC0014448. We would
like to thank Y. Stadnik, N. Yamanaka, and K. S. Kirch for useful discussions.

Laboratory for Nuclear Science, Massachusetts Institute of Technology
77 Mass. Ave., Bldg 26-540, Cambridge, MA 02139
E-mail  Jeff A. Winger
Department of Physics and Astronomy, Mississippi State University
PO Box 5167, Mississippi State, MS 39752
E-mail<EMAIL_ADDRESS>
###### Abstract:

New sources of CP violation, beyond the known sources in the standard model
(SM), are required to explain the baryon asymmetry of the universe.
Measurement of a non-zero permanent electric dipole moment (EDM) in
fundamental particles, such as in an electron or a neutron, or in nuclei or
atoms, can help us gain a handle on the sources of CP violation, both in the
SM and beyond. Multiple mechanisms within the SM can generate CP violating
EDMs, _viz._ through the CKM matrix in the weak sector or through the QCD
$\bar{\theta}$ parameter in the strong sector. We will estimate the maximum
possible EDMs of leptons, certain baryons, select atoms and molecules in the
(CKM$\bigoplus\bar{\theta}$) framework, assuming that the EDM wholly
originates from either of the two SM mechanisms, independently. These
estimates have been presented in light of the current experimental upper
limits on the EDMs, in the following systems - leptons: $e^{-}$, $\mu^{-}$,
$\tau^{-}$, $\nu_{e}^{0}$, $\nu^{0}_{\mu}$, $\nu^{0}_{\tau}$, baryons:
$n^{0}$, $p^{+}$, $\Lambda^{0}$, $\Sigma^{0}$, $\Xi^{0}$, $\Lambda^{+}_{c}$,
$\Xi^{+}_{c}$, atoms: 85Rb, 133Cs, 210Fr, 205Tl, 199Hg, 129Xe, 225Ra, 223Rn,
and molecules: HfF+, PbO, YbF, ThO, RaF, TlF. EDMs in different systems
constrain CP-violating interactions differently _i.e._ the same measured
constraint on the EDM in two different systems may not actually be equally
constraining on CP violating parameters. Finally, we emphasize the need to
measure a non-zero EDM in multiple systems before understanding the origins of
these CP-violating EDMs.

##  1 Introduction

A non-zero electric dipole moment (EDM) in sub-atomic particles indicates
violation of parity (P) and time reversal (T) symmetries. The standard model
(SM) conserves the joint symmetry of charge inversion, parity, and time
reversal (CPT) [1], and consequently a non-zero EDM is CP violating. CP
violation is a required condition for baryogenesis in the early universe [2].
The amount of CP violation is thus an important measurable.

CP violation is a key ingredient of weak interactions, and in the quark sector
of the SM it is encoded in the Cabbibo-Kobayashi-Maskawa (CKM) quark
oscillation matrix [3, 4]. Note that since the mass differences of charged
leptons is large, the oscillation between charged leptons is suppressed, but
there is also CP violation encoded into the Pontecorvo-Maki-Nakagawa-Sakata
(PMNS) matrix which describes the neutrino oscillations [5, 6], but we do not
consider the contributions from the PMNS matrix in this paper. The amount of
CP violation arising from the CKM matrix in the SM in insufficient to explain
the observed baryon asymmetry of the universe [7]. CP violation could also be
introduced into the strong sector of the SM, through the Quantum
Chromodynamics (QCD)-$\bar{\theta}$ [8], but no CP violation has been observed
in strong or electromagnetic interaction mediated processes.

In reality, the EDM of a system may arise from many sources: (i) the intrinsic
EDM of the fundamental particles for leptons and quarks, $d_{i}$, (ii) CP
violating pion-nucleon or nucleon-nucleon (both long range $\pi$NN-isoscalar,
$\bar{g}^{(0)}_{\pi}$, isovector, $\bar{g}^{(1)}_{\pi}$, isotensor,
$\bar{g}^{(2)}_{\pi}$, and short range hadronic interactions,
$\bar{d}^{(SR)}_{h}$), and (iii) CP violating electron-nuclear (both scalar,
$C_{S}$, and tensor, $C_{T}$) interactions. In a low energy paradigm, the EDM
of a species, $d$, maybe written as [9, 10, 11]:

$d=\sum_{i}\kappa_{d_{i}}d_{i}+\sum_{h\in\\{n,p\\}}\kappa_{\bar{d}^{(SR)}_{h}}\bar{d}^{(SR)}_{h}+\sum_{j\in\\{0,1,2\\}}\kappa_{\bar{g}^{(j)}_{\pi}}\bar{g}^{(j)}_{\pi}+\kappa_{C_{S}}C_{S}+\kappa_{C_{T}}C_{T},$
(1)

where $i\in\\{u,d,s,c,t,b,e,\mu,\tau,\nu_{e},\nu_{\mu},\nu_{\tau}\\}$, and
$\kappa_{k}$ are coefficients showing the sensitivity of the EDM to the
particular species _w.r.t._ the corresponding source. Measurement of a
statistically significant EDM in multiple species helps us better understand
the sources of CP violation. In this paper we will focus on reviewing and
estimating the EDMs generated by a single source, coming from either of two
mechanisms in the SM, CKM or QCD-$\bar{\theta}$, and place them in light of
the current experimental constraints. We have only considered systems where
experimental constraints already exist or have been planned. Furthermore, we
have neglected the sign of the EDM. In the following sections we will describe
the process for estimation of EDMs in subatomic particles, in atoms, as well
as in molecules. Finally, we have concluded with a short note discussing the
short comings of these estimates. A detailed review of the various effects
contributing to the EDMs of these systems may be found in Refs. [9, 10, 11].

##  2 EDM of sub-atomic particles

###  ${\bm{e}^{-}}$:

Diagrams that contribute to the EDM of charged leptons have four-loops [12].
This suppresses the SM-CKM mechanism generated electron EDM to
$d^{\text{\tiny{(SM-CKM)}}}_{e}\sim 10^{-44}~{}$e$\cdot$cm [12]. Ref. [13] has
shown that electrons may also acquire an EDM through the SM-$\bar{\theta}$ of
about $d^{\text{\tiny{(SM-$\bar{\theta}$)}}}_{e}\sim 8.6\times
10^{-38}~{}$e$\cdot$cm. Using the polar molecule ThO, the ACME collaboration
has set an experimental constraint of $d^{\text{\tiny{(90\%
C.L.)}}}_{e}<1.1\times 10^{-29}~{}$e$\cdot$cm [14].

###  $\bm{\mu}^{-}(\bm{\tau}^{-})$:

The mechanisms that generate an EDM in muons (tau leptons) are identical to
those in electrons. The EDM of charged leptons acquired through the two SM
mechanisms scales with the inverse ratio of the masses [13]. Thus, we can
scale up the SM-CKM and the SM-$\bar{\theta}$ EDMs of the electron by a factor
of $m_{\mu^{-}(\tau^{-})}/m_{e}$ to obtain the theoretical SM expectation for
the muon (tau lepton) EDM. The experimental constraint for the muon (tau
lepton) EDM, $d^{\text{\tiny{(90\% C.L.)}}}_{\mu^{-}(\tau^{-})}<0.16(38)\times
10^{-18}~{}$e$\cdot$cm, comes directly from the muon $g\mathchar 45\relax 2$
experiment [15] (comes from the Belle collaboration, using $e^{-}e^{+}$
collisions [16]). More recently, Ref. [17] has updated the limit to
$d^{\text{\tiny{(90\% C.L.)}}}_{\tau^{-}}<2.6\times 10^{-18}~{}$e$\cdot$cm
using the above method.

###  ${\bm{\nu}^{0}}$:

The theoretical expectations for EDMs of neutrinos is as of yet unavailable.
All the experimental constraints for neutrino EDMs come from indirect
measurements involving $e\bar{e}$ collisions. The constraints of
$d^{\text{\tiny{(90\% C.L.)}}}_{\nu_{e}^{0}}<2\times 10^{-21}~{}$e$\cdot$cm
and $d^{\text{\tiny{(90\% C.L.)}}}_{\nu^{0}_{\mu}}<2\times
10^{-21}~{}$e$\cdot$cm have been reported in Refs. [18, 19]. Refs. [20, 21,
22] have reported a constraint of $d^{\text{\tiny{(90\%
C.L.)}}}_{\nu_{\tau}}<4.35\times 10^{-17}~{}$e$\cdot$cm.

### n0, p+:

Diagrams that generate an EDM in baryons are simpler $\pi NN$ diagrams with
just one-loop [23], and consequently we can expect larger baryonic SM EDMs
when compared to charged leptons. The neutron’s SM-CKM EDM has been estimated
to be around $d^{\text{\tiny{(SM-CKM)}}}_{n}\sim 2\times
10^{-32}~{}$e$\cdot$cm [23]. The QCD-$\bar{\theta}$ parameter, in fact, is
directly proportional to the neutron EDM value [24]:
$d_{n}\sim\bar{\theta}\cdot(6\times 10^{-17})~{}\text{e$\cdot$cm},$ (2)
$\bar{\theta}^{\text{\tiny{(90\% C.L.)}}}<3\times 10^{-10}.$ (3) Therefore,
the maximum allowed contribution of the QCD-$\bar{\theta}$ parameter is
constrained by the experimental upper limit on the neutron EDM,
$d^{\text{\tiny{(90\% C.L.)}}}_{n}<1.8\times 10^{-26}~{}$e$\cdot$cm [25],
which implies the constraint in Eq. 3, making the maximum allowed value of
$d^{\text{\tiny{(SM-$\bar{\theta}$)}}}_{n}$ the same as well. Therefore, we do
not need any physics beyond the standard model (BSM) effects to generate a
neutron EDM. Any neutron EDM measured above the SM-CKM value would just be
attributable to the QCD-$\bar{\theta}$ parameter. However, QCD-$\bar{\theta}$
could be close to zero, in which case the neutron could have an EDM wholly
generated by SM-CKM, or in addition to possible BSM sources. If the neutron
EDM was solely responsible for the 199Hg EDM, then the constraint extracted
from the measurement of the 199Hg EDM is in fact better than the direct
neutron EDM measurement using ultra-cold neutrons,
$d^{\text{\tiny{${}^{199}$Hg, (90\% C.L.)}}}_{n}<1.3\times
10^{-26}~{}$e$\cdot$cm [26]. However, we have adopted the direct measurement
limit.

In $\pi NN$ diagrams (_eg._ $p^{+}(n^{0})\rightarrow n^{0}(p^{+})\pi^{+(-)}$),
one can easily interchange the proton with the neutron (and vice versa). This
indicates that the SM-CKM contribution to the proton EDM is similar to that of
the neutron EDM. Similarly, we will limit the contribution of
QCD-$\bar{\theta}$ to the proton EDM, with the value of SM-$\bar{\theta}$ EDM
obtained from the neutron. If the proton EDM was solely responsible for the
199Hg EDM, then the constraint extracted from the measurement of the 199Hg EDM
is $d^{\text{\tiny{(90\% C.L.)}}}_{p}<1.7\times 10^{-25}~{}$e$\cdot$cm [26].
Similar to the muon $g-2$ storage ring measurement which gave rise to a
constraint on the muon EDM, there are plans to directly measure the proton EDM
using a storage ring [27].

###
$\bm{\Lambda}^{0},\bm{\Sigma}^{0},\bm{\Xi}^{0},\bm{\Lambda}^{+}_{c},\bm{\Xi}^{+}_{c}$:

The rest masses of the strange and charmed baryons, which we have considered,
are within a factor of $2-3$ of each other, unlike the orders of magnitude
variation of masses in charged leptons, so we neglect any mass effects here.
Ref. [28] estimates that $d^{\text{\tiny{(SM-CKM)}}}_{\Lambda^{0}}\sim
d^{\text{\tiny{(SM-CKM)}}}_{n}/2$, and Ref. [29] shows the ratio between EDMs
of the $\Lambda^{0},~{}\Sigma^{0},\text{and}~{}\Xi^{0}$ baryons;
$\\{d^{\text{\tiny{(SM-CKM)}}}_{\Lambda^{0}}:d^{\text{\tiny{(SM-
CKM)}}}_{\Sigma^{0}}:d^{\text{\tiny{(SM-CKM)}}}_{\Xi^{0}}\\}=\\{3:-1:4\\}$.
Baryon EDM generating $\pi NN$ diagrams involve conversion of
$\\{u,s,b\\}\leftrightarrow\\{d,c,t\\}$. The SM-CKM EDM for neutrons and
protons are comparable, since their quark content involves exchanging a $u$
quark with a $d$ quark. Similarly, we obtain
$\\{\Lambda_{c}^{+},\Xi_{c}^{+}\\}$ baryons by exchanging the $s$ quark of
$\\{\Lambda^{0},\Xi^{0}\\}$ with a $c$ quark, respectively. Consequently, we
estimated the SM-CKM EDMs of the two charmed baryons as $d^{\text{\tiny{(SM-
CKM)}}}_{\Lambda^{0}}\sim d^{\text{\tiny{(SM-CKM)}}}_{\Lambda_{c}^{+}}$ and
$d^{\text{\tiny{(SM-CKM)}}}_{\Xi^{0}}\sim d^{\text{\tiny{(SM-
CKM)}}}_{\Xi_{c}^{+}}$. Refs. [30, 31], give the EDM arising from the
QCD-$\bar{\theta}$ parameter for these baryons. But, coupled with the
constraint upon $\bar{\theta}$ from the neutron EDM, the constraint on the
SM-$\bar{\theta}$ EDM portion for these baryons is weaker than that for the
neutron. Therefore, we will constrain the SM-$\bar{\theta}$ EDM for these
baryons with the same constraint we used for the neutron or proton. For the
strange and charmed baryons, the EDM of only one has been measured:
$d^{\text{\tiny{(90\% C.L.)}}}_{\Lambda^{0}}<9.1\times 10^{-17}~{}$e$\cdot$cm
[32] using data from $p^{+}X$ collisions in a fixed target experiment.

|  | $|d^{\text{\tiny{(SM-CKM)}}}|<$ | $|d^{\text{\tiny{(SM-$\bar{\theta}$)}}}|<$ | $|d^{\text{\tiny{(90\% C.L.)}}}|<$ | Ref.
---|---|---|---|---|---
Charged leptons: | $e^{-}$ | $10^{-44}$ | $8.6\times 10^{-38}$ | $1.1\times 10^{-29}$ | [14]
| $\mu^{-}$ | $2.1\times 10^{-42}$ | $1.8\times 10^{-35}$ | $1.6\times 10^{-19}$ | [15]
| $\tau^{-}$ | $3.6\times 10^{-41}$ | $3.1\times 10^{-34}$ | $2.6\times 10^{-18}$ | [17]
Neutrinos: | $\nu_{e}^{0}$ | $-$ | $-$ | $2\times 10^{-21}$ | [18]
| $\nu^{0}_{\mu}$ | $-$ | $-$ | $2\times 10^{-21}$ | [18]
| $\nu^{0}_{\tau}$ | $-$ | $-$ | $4.4\times 10^{-17}$ | [21, 22]
Light baryons: | $n^{0}_{(udd)}$ | $2\times 10^{-32}$ | $1.8\times 10^{-26}$ | $1.8\times 10^{-26}$ | [25]
| $p^{+}_{(uud)}$ | $2\times 10^{-32}$ | $1.8\times 10^{-26}$ | $1.7\times 10^{-25}$ | [26]
Strange & charmed baryons: | $\Lambda^{0}_{(uds)}$ | $1\times 10^{-32}$ | $1.8\times 10^{-26}$ | $9.1\times 10^{-17}$ | [32]
| $\Sigma^{0}_{(uss)}$ | $3.3\times 10^{-33}$ | $1.8\times 10^{-26}$ | $-$ |
| $\Xi^{0}_{(uss)}$ | $1.3\times 10^{-32}$ | $1.8\times 10^{-26}$ | $-$ |
| $\Lambda^{+}_{c(udc)}$ | $1\times 10^{-32}$ | $1.8\times 10^{-26}$ | $-$ |
| $\Xi^{+}_{c(usc)}$ | $1.3\times 10^{-32}$ | $1.8\times 10^{-26}$ | $-$ |
Table 1: Table showing the reach of SM-CKM and SM-$\bar{\theta}$ contributions
to the species’ EDM. The numbers are in the units of e$\cdot$cm.

##  3 EDM of Atoms

Atoms may acquire a permanent EDM owing to the EDM of the nucleus, electrons,
or from the CP-violating interactions between the electrons and the nucleus
(or other electrons). Ideally, the electron cloud shields any nuclear EDM
effectively suppressing the contribution of the nuclear EDM to the atomic EDM
[33]. Schiff shielding is not perfect in cases where [34]: (i) the electrons
are relativistic [35], especially in high-$Z$ paramagnetic atoms with a single
unpaired electron like in the alkali atoms 85Rb, 133Cs and 210Fr, but also in
205Tl, and/or (ii) the nucleus has quadrupole and octupole deformations, like
in diamagnetic atoms of 225Ra and 223Rn, and possibly also in 199Hg and 129Xe,
and/or (iii) there exists dominant CP-violating interactions between
constituents of the atoms. The semi-leptonic scalar [14] and tensor [26] e-N
interaction parameters have already been constrained, respectively:
$\vspace{-8mm}C^{\text{\tiny{(90\% C.L.)}}}_{S}<7.2\times 10^{-10},$ (4)
$\vspace{-8mm}C^{\text{\tiny{(90\% C.L.)}}}_{T}<1.3\times 10^{-10},$ (5) where
the paramagnetic atoms (and polar molecules) are sensitive to the $C_{S}$
parameter and the diamagnetic atoms (and molecules) are sensitive to the
$C_{T}$ parameter.

###  85Rb, 133Cs, 210Fr, 205Tl:

An enhanced electron EDM along with the semi-leptonic scalar e-N interactions
are responsible for the atomic EDM in these paramagnetic atoms:
$d_{\text{\tiny{Atom}}}\sim(\partial d_{\text{\tiny{Atom}}}/\partial
d_{e})d_{e}+(\partial d_{\text{\tiny{Atom}}}/\partial C_{S})C_{S}$. In order
to estimate the SM-CKM EDM for these atoms, the SM-CKM EDM of the electron and
the constraint upon $C_{S}$, in Eq. 4, have been scaled up by their respective
factors in Table 2, and added together. For paramagnetic atoms, additional
contributions to $C_{S}$ enter through $\bar{\theta}$ [39], and after
combining with the constraint upon $\bar{\theta}$ in Eq. 3 yields:

$C_{S}(\bar{\theta})\sim 0.03\bar{\theta}\implies C_{S}(\bar{\theta})<9\times
10^{-12}.$ (6)

The SM-$\bar{\theta}$ EDM values were obtained by scaling up the
SM-$\bar{\theta}$ EDM of the electron and constraint on $C_{S}(\bar{\theta})$
above with their respective scaling factors in Table 2, and added together.

Atom | —$\partial d_{\text{\tiny{Atom}}}/\partial d_{e}$— | —$\partial d_{\text{\tiny{Atom}}}/\partial C_{S}$—
---|---|---
89Rb |  $~{}~{}25.7$ [36] |  $~{}~{}1.2$ [36]
210Fr |  $903.~{}~{}$ [37] |  $~{}~{}5.0$ [10]
133Cs |  $123.~{}~{}$ [36] |  $~{}~{}7.1$ [11]
205Tl |  $573.~{}~{}$ [38] |  $70.~{}~{}$ [11]
Table 2: Sensitivity to atomic EDM _w.r.t._ the e- EDM [9] and semi-leptonic
e-N interaction parameter, $C_{S}$ ($\times 10^{-19}~{}\text{e.cm}$), in the
paramagnetic atoms.

###  199Hg:

This nucleus may posses an intrinsic CP-violating nuclear Schiff moment which
leads to a nuclear EDM [33]. A non-zero nuclear Schiff moment can give rise to
an amplified EDM in an atom depending on the electron configuration and its
CP-violating interactions with the nuclear Schiff moment [39]. 199Hg and 129Xe
are particularly interesting diamagnetic atoms whose atomic EDM is thought to
have contributions from the EDMs of the nucleons, electrons, and most
importantly from a non-zero nuclear Schiff moment. The atomic EDM of 199Hg [9]
and its nuclear Schiff moment [40] can be decomposed to contributions from
neutrons, protons, and electrons as:
$\vspace{-7mm}d_{\text{${}^{199}$Hg}}=\rho_{p}\cdot d_{p}+\rho_{n}\cdot
d_{n}+\kappa_{S}\cdot S+\mathcal{O}(d_{e}),$ (7)
$\vspace{-7mm}S_{\text{${}^{199}$Hg}}=\left(0.20~{}\text{fm}^{2}\right)d_{p}+\left(1.895~{}\text{fm}^{2}\right)d_{n},$
(8) where $\kappa_{S}=-2.4\times 10^{-4}~{}\text{fm}^{2}$ [26],
$\rho_{p}=(-0.56\times 10^{-4})$ [9], and $\rho_{n}=(-5.3\times 10^{-4})$ [9].
Given that the electron SM-CKM EDM and its allowed SM-$\bar{\theta}$ EDM are
about 12 orders of magnitude lower than that of the proton or neutron, we can
safely neglect the contribution of the $d_{e}$ to the atomic EDM of 199Hg.
Using the SM-CKM EDM and SM-$\bar{\theta}$ EDM values for the neutron and
proton, we can write the theoretical expectations for the nuclear Schiff
moment of 199Hg as: $|S^{\text{\tiny{(SM-
CKM)}}}_{\text{\tiny{${}^{199}$Hg}}}|\sim 4.2\times 10^{-19}~{}$e$\cdot$fm3
and
$|S^{\text{\tiny{(SM-$\bar{\theta}$)}}}_{\text{\tiny{${}^{199}$Hg}}}|<6.3\times
10^{-13}~{}$e$\cdot$fm3. Along with the Schiff moment values calculated here,
and the values of SM-CKM EDM and SM-$\bar{\theta}$ EDM associated with $d_{p}$
and $d_{n}$, we arrived at $\\{|d^{\mathcal{T}\text{\tiny{(SM-
CKM)}}}_{\text{\tiny{${}^{199}$Hg}}}|,|d^{\mathcal{T}\text{\tiny{(SM-$\bar{\theta}$)}}}_{\text{\tiny{${}^{199}$Hg}}}|\\}=\\{2.2\times
10^{-35},6.2\times 10^{-30}\\}~{}\text{e}\cdot\text{cm}$.

The dependence of SM-CKM EDM for 199Hg on $C_{T}$ is: $\partial
d_{\text{\tiny{${}^{199}$Hg}}}/\partial C_{T}=3\times 10^{-20}$ [10], and
combining this with the constraint in Eq. 5 essentially yields the
experimental limit. Similarly, the dependence on $C_{S}$: $\partial
d_{\text{\tiny{${}^{199}$Hg}}}/\partial C_{S}=-5.9\times 10^{-22}$ [10],
combined with the constraint in Eq. 4 gives $4.3\times
10^{-31}~{}\text{e}\cdot\text{cm}$, while combining the above dependence
_w.r.t._ $C_{S}$ with Eq. 6, yields $5.3\times
10^{-33}~{}\text{e}\cdot\text{cm}$. On the other hand, $C_{S}(\bar{\theta})$
in Eq. 6 combined with the $\partial d_{\text{\tiny{${}^{199}$Hg}}}/\partial
C_{S}$ coefficient gives $5.3\times 10^{-33}~{}$e$\cdot$cm, so we shall
neglect this and retain the SM-$\bar{\theta}$ previously obtained through the
Schiff moment. In the case of 199Hg, any statistically significant EDM can be
explained within the SM CKM through $C_{S}$ or $C_{T}$ parameters or the
SM-$\bar{\theta}$ framework through the QCD-$\bar{\theta}$.

In this estimation, we’ve used $\kappa_{S}=-2.4\times 10^{-4}~{}\text{fm}^{2}$
from Ref. [26], but if we were to use $\kappa_{S}=+2.8\times
10^{-4}~{}\text{fm}^{2}$ from Ref. [9], we’d obtain: $\\{d^{\text{\tiny{(SM-
CKM)}}}_{\text{\tiny{${}^{199}$Hg}}}\sim
0,~{}d^{\text{\tiny{(SM-$\bar{\theta}$)}}}_{\text{\tiny{${}^{199}$Hg}}}<6\times
10^{-32}\\}~{}$e$\cdot$cm. It is important to note that the SM EDM of 199Hg
could be zero. This implies that the constraint on $\bar{\theta}$ obtained
from 199Hg is much more stringent than the value we extracted using neutron
EDM ($\theta^{n}_{s}<5\times 10^{-5}$). But due to the model dependence of the
extraction of the constraint on QCD-$\bar{\theta}$ from 199Hg EDM, we will
continue to rely on the value of QCD-$\bar{\theta}$ obtained from neutron EDM.

###  129Xe:

Scaling the values of $\\{|d^{\mathcal{T}\text{\tiny{(SM-
CKM)}}}_{\text{\tiny{${}^{199}$Hg}}}|,|d^{\mathcal{T}\text{\tiny{(SM-$\bar{\theta}$)}}}_{\text{\tiny{${}^{199}$Hg}}}|\\}$
by the $\mathcal{T}$-factor indicated in Table 4 yields,
$\\{|d^{\mathcal{T}\text{\tiny{(SM-
CKM)}}}_{\text{\tiny{${}^{129}$Xe}}}|,|d^{\mathcal{T}\text{\tiny{(SM-$\bar{\theta}$)}}}_{\text{\tiny{${}^{129}$Xe}}}|\\}=\\{3.0\times
10^{-36},8.4\times 10^{-31}\\}~{}\text{e}\cdot\text{cm}$. By combining the
limits in Eqs. 4 and 5, with $\partial d_{\text{\tiny{${}^{129}$Xe}}}/\partial
C_{S}=-4.4\times 10^{-23}$ [10] and $\partial
d_{\text{\tiny{${}^{129}$Xe}}}/\partial C_{T}$ from Table 4, yields $3.2\times
10^{-32}~{}\text{e}\cdot\text{cm}$ and $7.8\times
10^{-31}~{}\text{e}\cdot\text{cm}$, respectively, clearly both larger than
$d^{\mathcal{T}\text{\tiny{(SM-CKM)}}}_{\text{\tiny{${}^{129}$Xe}}}$. Like in
the case of 199Hg we will retain the value of
$d^{\mathcal{T}\text{\tiny{(SM-$\bar{\theta}$)}}}_{\text{\tiny{${}^{129}$Xe}}}$.

###  225Ra, 223Rn:

Higher electric and magnetic moments are not fully shielded by the Schiff
screening. In such cases, not only is the nuclear Schiff moment contribution
enhanced by the electron cloud, but there are additional enhancement factors
contributing to the nuclear Schiff moment itself due to the octupole and
quadrupole deformations of the nucleus [41, 44]. Contributions from individual
nucleons, or electrons here is negligible. Scaling up
$\\{|d^{\mathcal{T}\text{\tiny{(SM-
CKM)}}}_{\text{\tiny{${}^{199}$Hg}}}|,|d^{\mathcal{T}\text{\tiny{(SM-$\bar{\theta}$)}}}_{\text{\tiny{${}^{199}$Hg}}}|\\}$
using the factors in Table 4 gives the Schiff moment contributions:
$\\{|d^{\mathcal{T}\text{\tiny{(SM-
CKM)}}}_{\text{\tiny{${}^{225}$Ra(${}^{223}$Rn)}}}|,|d^{\mathcal{T}\text{\tiny{(SM-$\bar{\theta}$)}}}_{\text{\tiny{${}^{225}$Ra(${}^{223}$Rn)}}}|\\}=\\{1.6(0.63)\times
10^{-32},4.5(1.8)\times 10^{-27}\\}~{}\text{e}\cdot\text{cm}$. Neglecting the
contributions of $C_{S}$ (and any propagation of $C_{S}$ via the
QCD-$\bar{\theta}$) like in the case of 129Xe, and combining the $\partial
d_{\text{Atom}}/\partial C_{T}$ coefficients in Table 4 with the constraint in
Eq. 5 gives $\\{d^{\mathcal{T}\text{\tiny{(SM-
CKM)}}}_{\text{\tiny{${}^{225}$Ra(${}^{223}$Rn)}}}|=6.9(0.65)\times
10^{-30}~{}\text{e}\cdot\text{cm}$.

|  | $|d^{\text{\tiny{(SM-CKM)}}}|<$ | $|d^{\text{\tiny{(SM-$\bar{\theta}$)}}}|<$ | $|d^{\text{\tiny{(90\% C.L.)}}}|<$ | Ref.
---|---|---|---|---|---
Paramagnetic atoms: |  85Rb | $8.6\times 10^{-29}$ | $1.1\times 10^{-30}$ | $1\times 10^{-18}$ | [45]
|  133Cs | $5.1\times 10^{-28}$ | $6.4\times 10^{-30}$ | $1.1\times 10^{-23}$ | [46]
|  205Tl | $5.0\times 10^{-27}$ | $6.3\times 10^{-29}$ | $1.5\times 10^{-24}$ | [47]
|  210Fr | $3.6\times 10^{-28}$ | $4.5\times 10^{-30}$ | $-$ |
Diamagnetic atoms: |  199Hg | $6.2\times 10^{-30}$ | $6.2\times 10^{-30}$ | $6.2\times 10^{-30}$ | [26]
|  129Xe | $7.8\times 10^{-31}$ | $8.4\times 10^{-31}$ | $1.3\times 10^{-27}$ | [48]
Diamagnetic atoms with |  225Ra | $6.9\times 10^{-30}$ | $4.5\times 10^{-27}$ | $1.2\times 10^{-23}$ | [49]
nuclear octupole deformation: |  223Rn | $6.5\times 10^{-31}$ | $1.8\times 10^{-27}$ | $-$ |
Table 3: Table showing the expected SM-CKM and SM-$\bar{\theta}$ contributions to the species’ atomic EDM, for $\\{C_{S},C_{T}\\}\neq 0$. The numbers are in the units of e$\cdot$cm.  Atom | $\kappa^{\text{(Atom)}}_{S}/\kappa^{{}^{199}Hg}_{S}$ | $d^{\mathcal{T}}_{\text{(Atom)}}/d^{\mathcal{T}}_{{}^{199}Hg}$ | —$\partial d_{\text{\tiny{Atom}}}/\partial C_{T}$—
---|---|---|---
129Xe |  $1/7.4$ [41] | $1$ |  $0.6$ [11]
225Ra |  $3.~{}~{}$[41] |  $240~{}$ [42] |  $5.3$ [11]
223Rn |  $~{}1.2$ [41] |  $240~{}$ [43] |  $0.5$ [10]
Table 4: By columns, enhancement factors _w.r.t._ that in 199Hg (i) nuclear
Schiff moment to the atomic EDM, and (ii) nuclear quadrupole and octupole
deformation to the nuclear Schiff moment; dependence of atomic EDM on (iii)
semi-leptonic tensor e-N interaction ($\times 10^{-20}~{}$e$\cdot$cm).

##  4 EDM of Molecules

All the experiments discussed so far, searching for EDMs in sub-atomic
particles and atoms, applied an electric field, $E$ on the order of
$\sim$kV/cm, to induce (Stark) energy level splitting owing to a possible non-
zero EDM. Electric fields are subject to the break-down potential of vacuum.
If large potentials are applied to two electrodes separated by a distance,
then electrons begin to flow between the electrodes, limiting the effective
potential difference at electric fields of about $E\sim 30~{}k$V/cm. Recent,
electric fields, as high as $E\sim 112~{}k$V/cm, have been achieved using
niobium electrodes [50]. Polar molecules contain charged atoms, which have
large intra-molecular electric fields, $E_{\text{Mol.}}$, on the order of
GV/cm. The EDM sensitivity achievable is directly proportional to the electric
field we can apply. Experiments searching for EDMs in molecules use this
intra-molecular electric field as a key to achieve higher EDM sensitivities
compared to atomic EDM experiments.

### PbO, ThO, HfF+, YbF:

In a polar molecule, the valence electrons of the atom feel the large intra-
molecular electric field. Each of these polar molecules have a particular
associated molecular electric field and the experiments measuring their EDM
used an additional applied electric field, so their sensitivity to the
electron EDM varies. In order to compare these molecular EDMs, we normalized
the molecular EDM measured with the ratio of molecular electric field to the
applied electric field, listed in Table 5. The corresponding SM-CKM EDMs and
SM-$\bar{\theta}$ EDMs are obtained using: $d^{\text{\tiny{\\{(SM-
CKM),(SM-$\bar{\theta}$)\\}}}}_{\text{\tiny{Mol.}}}\sim[d^{\text{\tiny{\\{(SM-
CKM),(SM-$\bar{\theta}$)\\}}}}_{e}+(\partial d_{\text{\tiny{Mol.}}}/\partial
C_{S})\\{C^{\text{\tiny{(90\%
C.L.)}}}_{S},C_{S}(\bar{\theta})\\}]\times(E_{\text{Mol.}}/E)$.

Mol. |  $E_{\text{Mol.}}$ (GV/cm) |  $|d^{\text{\tiny{(90\% C.L.)}}}_{e}|<$ (e$\cdot$cm) |  $E$ (V/cm) | —$\partial d_{\text{\tiny{Mol.}}}/\partial C_{S}$—
---|---|---|---|---
HfF+ |  $23~{}~{}~{}$ [51] | $1.3\times 10^{-28}$ |  ${\bf 24}$ [52, 53] |  $~{}~{}~{}~{}8.9$ [11]
PbO |  $25~{}~{}~{}$ [54, 55] | $1.7\times 10^{-26}$ |  $\\{{\bf 100},125\\}$ [56] |  $\sim 4.2$ [57]
YbF |  $14.5$ [58] | $1.1\times 10^{-27}$ |  ${\bf 10k}~{}~{}~{}~{}~{}~{}$ [59] |  $~{}~{}~{}~{}8.6$ [11]
ThO |  $78~{}~{}~{}$ [60, 61] | $1.1\times 10^{-29}$ |  $\\{{\bf 80},140\\}$ [14] |  $~{}~{}13.~{}~{}$ [11]
Table 5: Relevant intra-molecular electric field, $E_{\text{Mol.}}$, measured
e-EDM, the external electric field, $E$, applied in the experiment, and the
CP-odd semi-leptonic interaction parameter, $C_{S}$ ($10^{-21}$e$\cdot$cm).

###  225RaF:

The relevant molecular electric field felt by the radium nuclei in the 225RaF
molecule is $E_{\text{\tiny{${}^{225}$RaF}}}=130~{}$MV/cm [62]. The nucleus of
225Ra is much heavier than an electron, so the electric field felt by the
nucleus of 225Ra in its rest frame is much less than that in the polar
molecules discussed above, where the same field is felt by the electron in its
rest frame. The radium EDM experiment plans to apply an electric field of
$E=300~{}$kV/cm [50] using niobium electrodes. The SM-CKM and
SM-$\bar{\theta}$ contributions to the EDM of 225RaF were obtained by scaling
up SM-CKM EDM and SM-$\bar{\theta}$ EDM values associated with atomic 225Ra
with the ratio of $(E_{\text{Mol.}}/E)$.

### TlF:

The TlF molecule is a diamagnetic system, similar to the 199Hg atom. The EDM
of TlF is $d_{TlF}\sim 81d_{e}+d_{p}/2+2.9\times 10^{-18}C_{S}+2.7\times
10^{-16}C_{T}$ [11, 63]. Clearly one could neglect the contribution of
electron or proton EDMs. Hence, the SM-CKM EDM for TlF dominantly originates
from $C_{T}$ with $|d^{\mathcal{T}\text{\tiny{(SM-
CKM)}}}_{\text{\tiny{TlF}}}|=3.5\times 10^{-26}~{}$e$\cdot$cm.
SM-$\bar{\theta}$ contributions to the EDM of TlF arising from the proton is
$9\times 10^{-27}~{}$e$\cdot$cm, while the same originating from
QCD-$\bar{\theta}$ and via the scalar semi-leptonic interaction can be
neglected.

|  $\frac{E_{\text{Mol.}}}{E}$ $\left(\times\frac{[(*)/\text{cm}]}{[(*)/\text{cm}]}\right)$ | $|d^{\text{\tiny{(SM-CKM)}}}|<$ | $|d^{\text{\tiny{(SM-$\bar{\theta}$)}}}|<$ | $|d^{\text{\tiny{(90\% C.L.)}}}|<$
---|---|---|---|---
Diamagnetic mol.: | TlF | $3.5\times 10^{-26}$ | $9\times 10^{-29}$ |  $4.8\times 10^{-23}$ [63]
Polar mol.: | HfF+ $\left(\frac{23~{}\text{GV}}{24~{}\text{V}}\right)$ | $6.1\times 10^{-21}$ | $7.7\times 10^{-23}$ |  $1.2\times 10^{-19}$ [52, 53]
| PbO $\left(\frac{25~{}\text{GV}}{100~{}\text{V}}\right)$ | $7.6\times 10^{-22}$ | $9.5\times 10^{-24}$ |  $4.3\times 10^{-18}$ [56]
| YbF $\left(\frac{14.5~{}\text{GV}}{10~{}\text{kV}}\right)$ | $9.0\times 10^{-24}$ | $1.1\times 10^{-25}$ |  $1.5\times 10^{-21}$ [59]
| ThO $\left(\frac{78~{}\text{GV}}{80~{}\text{V}}\right)$ | $1.1\times 10^{-20}$ | $1.1\times 10^{-22}$ |  $1.1\times 10^{-20}$ [14]
| RaF $\left(\frac{130~{}\text{MV}}{300~{}\text{kV}}\right)$ | $3.0\times 10^{-27}$ | $2.0\times 10^{-24}$ | $-$
Table 6: Table showing the expected SM-CKM and SM-$\bar{\theta}$ contributions
to the species’ molecular EDM, for $\\{C_{S},C_{T}\\}\neq 0$. The numbers are
in the units of e$\cdot$cm. Here, $E_{\text{Mol.}}$ denotes the intra-
molecular electric field experienced by the electron (HfF+, PbO, YbF, ThO) or
the nucleus (RaF), and $E$ denotes the applied electric field in the
experiment. Figure 1: Panel showing the measured upper limit and expected SM
theoretical values of the EDM from the SM-CKM and SM-$\bar{\theta}$
mechanisms, for various species. The measured upper limit of EDM at 90% C.L.
has been shown in red. The gray portion represents the contribution of the
QCD-$\theta_{s}$ parameter to the value of the EDM, and the purple portion
shows the contribution of the SM-CKM matrix to the value of the EDM.

##  5 Conclusion

As we go from the simplest to the more complex systems, _i.e._ leptons to
baryons to atoms to molecules, the possible mechanisms that can generate an
EDM increases. Both the SM-CKM and SM-$\bar{\theta}$ portions of the EDM of
paramagnetic atoms and polar molecules are dominated by the contributions of
scalar semi-leptonic e-N interactions, $C_{S}$, and the SM-CKM EDM of
diamagnetic atoms are dominated by the tensor semi-leptonic e-N interactions,
$C_{T}$, while SM-$\bar{\theta}$ EDM is dominated by the Schiff moment
contributions (mostly through long range $\pi$NN interactions). Furthermore,
recent studies [64, 65] have also shown that the e--SM-CKM EDM could be much
higher, using hadronic loops instead of quark 4-loops used in Ref. [12], which
may dramatically improve the estimates which depend on the e-EDM. These
estimates of SM-CKM and SM-$\bar{\theta}$ EDMs for sub-atomic particles, have
also been used in Refs. [17, 66, 67].

The constraints on $C_{S}$, $C_{T}$, and long range $\pi$NN interactions
(through QCD-$\bar{\theta}$) come from the EDM measurements with ThO, 199Hg,
and the neutron, respectively. Consequently any measurement of a statistically
significant EDM in these three species could lead to a SM measurement, since
mechanisms within the SM are sufficient to explain their EDM wholly. Note that
SM-CKM EDMs generally have a smaller reach than SM-$\bar{\theta}$ EDMs for all
the fundamental particles, but the situation is reversed in paramagnetic atoms
and polar molecules owing to constraints on QCD-$\bar{\theta}$ better
constraining the EDM that it generates, compared to $C_{S}$ or $C_{T}$ (by
$\sim 2$ and $\sim 3$ orders of magnitude, by comparing Tables 2 and 4 with
Eq. 2, respectively). On the other hand, in the case of 199Hg, the reach of
SM-CKM EDM is comparable to SM-$\bar{\theta}$ EDM, and clearly is a candidate
where the constraint on QCD-$\bar{\theta}$ and $C_{T}$ comparably generate an
EDM through the SM-$\bar{\theta}$ and SM-CKM mechanisms, respectively.

A statistically significant measurement in any one species would not help us
understand the origins of its EDM, thereby requiring measurement of an EDM in
multiple systems to parse out the contributions from various underlying
mechanism. In Figure 1, for sub-atomic particles, the white space between the
SM-$\bar{\theta}$ EDM portion of the SM theoretical estimate and the
experimental constraint could be fertile ground in which to search for physics
BSM. Given that the white space for the charged leptons is the largest (over
$\sim 8$ orders of magnitude), they may be the apt systems in which to search
for BSM effects given their low SM background. Additionally, new and improved
efforts to measure the EDM of p+, TlF, Ra, and RaF may make their status
comparable to the current status of n0, 199Hg, and ThO.

## References

  * [1] G. Lüders, Ann. Phys. 2, 1 (1957). DOI: 10.1016/0003-4916(57)90032-5.
  * [2] A. D. Sakharov, JETP Lett. 5, 24 (1967). URL: inspirehep.net/literature/51345.
  * [3] N. Cabibbo, Phys. Rev. Lett. 10, 531 (1963). DOI: 10.1103/PhysRevLett.10.531.
  * [4] M. Kobayashi and T. Maskawa, Prog. Theo. Phys. 49, 652 (1973). DOI: 10.1143/PTP.49.652.
  * [5] B. Pontecorvo, JETP Lett. 34, 247 (1958). URL: inspirehep.net/literature/42736.
  * [6] Z. Maki et al., Prog. Theo. Phys. 28, 870 (1962). DOI: 10.1143/PTP.28.870.
  * [7] A. Riotto and M. Trodden, Annu. Rev. Nucl. Part. Sci. 49, 35 (1999). DOI: 10.1146/annurev.nucl.49.1.35.
  * [8] G. ’t Hooft, Phys. Rev. Lett. 37, 8 (1976). DOI: 10.1103/PhysRevLett.37.8.
  * [9] J. Engel et al., Prog. Part. Nucl. Phys. 71, 21 (2013). DOI: 10.1016/j.ppnp.2013.03.003.
  * [10] T. Chupp and M. Ramsey-Musolf, Phys. Rev. C 91, 035502 (2015). DOI: 10.1103/PhysRevC.91.035502.
  * [11] T. E. Chupp et al., Rev. Mod. Phys. 91, 015001 (2019). DOI: 10.1103/RevModPhys.91.015001.
  * [12] M. Pospelov and A. Ritz, Phys. Rev. D 89, 056006 (2014). DOI: 10.1103/PhysRevD.89.056006.
  * [13] D. Ghosh and R. Sato, Phys. Lett. B 777, 335 (2018). DOI: 10.1016/j.physletb.2017.12.052.
  * [14] V. Andreev et al., Nature 562, 355 (2018). DOI: 10.1038/s41586-018-0599-8.
  * [15] G. W. Bennett et al., Phys. Rev. D 80, 052008 (2009). DOI: 10.1103/PhysRevD.80.052008.
  * [16] K. Inami et al., Phys. Lett. B 551, 16 (2003). DOI: 10.1016/S0370-2693(02)02984-2.
  * [17] K. Kirch and P. Schmidt-Wellenburg, EPJ Web Conf. 234, 01007 (2020). DOI: 10.1051/epjconf/202023401007.
  * [18] F. del Aguila and M. Sher, Phys. Lett. B 252, 116 (1990). DOI: 10.1016/0370-2693(90)91091-O.
  * [19] L. B. Okun’, Sov. J. Nucl. Phys. (1986). URL: inspirehep.net/record/227109.
  * [20] T. Ibrahim and P. Nath, Phys. Rev. D 81, 033007 (2010). DOI: 10.1103/PhysRevD.81.033007.
  * [21] A. Gutiérrez-Rodríguez et al., Phys. Rev. D 69, 073008 (2004). DOI: 10.1103/PhysRevD.69.073008.
  * [22] R. Escribano and E. Massó, Phys. Lett. B 395, 369 (1997). DOI: 10.1016/S0370-2693(97)00059-2.
  * [23] I. B. Khriplovich and A. R. Zhitnitsky, Phys. Lett. B 109, 490 (1982). DOI: 10.1016/0370-2693(82)91121-2.
  * [24] M. Pospelov and A. Ritz, Ann. Phys. 318, 119 (2005). DOI: 10.1016/j.aop.2005.04.002.
  * [25] C. Abel et al., Phys. Rev. Lett. 124, 081803 (2020). DOI: 10.1103/PhysRevLett.124.081803.
  * [26] B. Graner et al., Phys. Rev. Lett. 116, 161601 (2016). DOI: 10.1103/PhysRevLett.116.161601.
  * [27] V. Anastassopoulos et al., Rev. Sci. Instrum. 87, 115116 (2016). DOI: 10.1063/1.4967465.
  * [28] A. Pich and E. de Rafael, Nucl. Phys. B 367, 313 (1991). DOI: 10.1016/0550-3213(91)90019-T.
  * [29] D. Atwood and A. Soni, Phys. Lett. B 291, 293 (1992). DOI: 10.1016/0370-2693(92)91048-E.
  * [30] B. Borasoy, Phys. Rev. D 61, 114017 (2000). DOI: 10.1103/PhysRevD.61.114017.
  * [31] F.-K. Guo and U.-G. Meißner, JHEP 2012, 97 (2012). DOI: 10.1007/JHEP12(2012)097.
  * [32] L. Pondrom et al., Phys. Rev. D 23, 814 (1981). DOI: 10.1103/PhysRevD.23.814.
  * [33] L. I. Schiff, Phys. Rev. 132, 2194 (1963). DOI: 10.1103/PhysRev.132.2194.
  * [34] C.-P. Liu et al., Phys. Rev. C 76, 035503 (2007). DOI: 10.1103/PhysRevC.76.035503.
  * [35] W. Bernreuther and M. Suzuki, Rev. Mod. Phys. 63, 313 (1991). DOI: 10.1103/RevModPhys.63.313.
  * [36] H. S. Nataraj et al., Phys. Rev. Lett. 101, 033002 (2008). DOI: 10.1103/PhysRevLett.101.033002.
  * [37] T. M. R. Byrnes et al., Phys. Rev. A 59, 3082 (1999). DOI: 10.1103/PhysRevA.59.3082.
  * [38] Z. W. Liu and H. P. Kelly, Phys. Rev. A 45, 4210 (1992). DOI: 10.1103/PhysRevA.45.R4210.
  * [39] V. V. Flambaum and I. B. Khriplovich, JETP Lett. 89, 1505 (1985). URL: osti.gov/biblio/5524604.
  * [40] V. F. Dmitriev and R. A. Sen’kov, Phys. Rev. Lett. 91, 212303 (2003). DOI: 10.1103/PhysRevLett.91.212303.
  * [41] V. A. Dzuba et al., Phys. Rev. A 66, 012111 (2002). DOI: 10.1103/PhysRevA.66.012111.
  * [42] J. H. de Jesus and J. Engel, Phys. Rev. C 72, 045503 (2005). DOI: 10.1103/PhysRevC.72.045503.
  * [43] V. Spevak et al., Phys. Rev. C 56, 1357 (1997). DOI: 10.1103/PhysRevC.56.1357.
  * [44] P. Mohanmurthy et al., AIP Conf. Proc. 2249, 030046 (2020). DOI: 10.1063/5.0008560.
  * [45] E. S. Ensberg, Phys. Rev. 153, 36 (1967). DOI: 10.1103/PhysRev.153.36.
  * [46] S. A. Murthy et al., Phys. Rev. Lett. 63, 965 (1989). DOI: 10.1103/PhysRevLett.63.965.
  * [47] E. D. Commins et al., Phys. Rev. A 50, 2960 (1994). DOI: 10.1103/PhysRevA.50.2960.
  * [48] F. Allmendinger et al., Phys. Rev. A 100, 022505 (2019). DOI: 10.1103/PhysRevA.100.022505.
  * [49] M. Bishof et al., Phys. Rev. C 94, 025501 (2016). DOI: 10.1103/PhysRevC.94.025501.
  * [50] M. BastaniNejad et al., Phys. Rev. ST Accel. Beams 15, 97 (2012). DOI: 10.1103/PhysRevSTAB.15.083502.
  * [51] T. Fleig and M. K. Nayak, Phys. Rev. A 88, 032514 (2013). DOI: 10.1103/PhysRevA.88.032514.
  * [52] W. B. Cairncross et al., Phys. Rev. Lett. 119, 153001 (2017). DOI: 10.1103/PhysRevLett.119.153001.
  * [53] H. Loh et al., Science 342, 1220 (2013). DOI: 10.1126/science.1243683.
  * [54] M. G. Kozlov and D. DeMille, Phys. Rev. Lett. 89, 133001 (2002). DOI: 10.1103/PhysRevLett.89.133001.
  * [55] A. N. Petrov et al., Phys. Rev. A 72, 022505 (2005). DOI: 10.1103/PhysRevA.72.022505.
  * [56] S. Eckel et al., Phys. Rev. A 87, 052130 (2013). DOI: 10.1103/PhysRevA.87.052130.
  * [57] V. V. Flambaum et al., arXiv [hep-ph: 2004.10359] (2020).
  * [58] D. M. Kara et al., New J. Phys. 14, 103051 (2012). DOI: 10.1088/1367-2630/14/10/103051.
  * [59] J. J. Hudson et al., Nature 473, 493 (2011). DOI: 10.1038/nature10104.
  * [60] L. V. Skripnikov, J. Chem. Phys. 145, 214301 (2016). DOI: 10.1063/1.4968229.
  * [61] M. Denis and T. Fleig, J. Chem. Phys. 145, 214307 (2016). DOI: 10.1063/1.4968597.
  * [62] A. D. Kudashov et al., Phys. Rev. A 90, 052513 (2014). DOI: 10.1103/PhysRevA.90.052513.
  * [63] D. Cho et al., Phys. Rev. A 44, 2783 (1991). DOI: 10.1103/PhysRevA.44.2783.
  * [64] Y. Yamaguchi and N. Yamanaka, arXiv [hep-ph: 2006.00281] (2020).
  * [65] Y. Yamaguchi and N. Yamanaka, arXiv [hep-ph: 2003.08195] (2020).
  * [66] R. Alemany et al., arXiv [hep-Ex: 1902.00260] (2019).
  * [67] J. Beacham et al., J. Phys. G 47, 010501 (2019). DOI: 10.1088/1361-6471/ab4cd2.


Malware Classification with Word Embedding Features

Aparna Sunil Kale
Fabio Di Troia
Mark<EMAIL_ADDRESS>
Malware classification is an important and challenging problem in information security.
Modern malware classification techniques rely on machine learning models that can be
trained on features such as opcode sequences, API calls,
and byte $n$-grams, among many others. In this research, we consider opcode
features. We implement hybrid machine
learning techniques, where we engineer feature vectors by training
hidden Markov models—a technique that we refer to as HMM2Vec—and
Word2Vec embeddings on these opcode sequences. The resulting HMM2Vec
and Word2Vec embedding vectors are then used as features for classification algorithms.
Specifically, we consider support vector machine (SVM), $k$-nearest neighbor ($k$-NN),
random forest (RF), and convolutional neural network (CNN) classifiers. We conduct substantial
experiments over a variety of malware families. Our experiments extend well beyond
any previous work in this field.

§ INTRODUCTION

Malware is a software that is created with the intent to cause harm to computer data
or otherwise adversely affect computer systems <cit.>. Detecting malware can be
a challenging task, as there exist a wide variety of advanced malware that employ
various anti-detection techniques.

Some advanced types of malware include polymorphic and metamorphic code.
Such code enables attackers to easily generate vast numbers of new
malware variants that cannot be detected using standard techniques <cit.>.
According to McAfee, some 60 million new malware samples were created
in the first quarter of the year 2019 <cit.>. Malware detection—and
the closely related problem of malware classification—are inherently challenging
in such an environment.

The methods used to protect users from malware include signature-based and
behavioral-based detection techniques. Signature-based detection is
based on specific patterns found in malware samples. In contrast, behavioral-based detection
is based on actions performed by code. Signature-based techniques cannot detect
new malware variants, while behavioral-based techniques often results in a
high false-positive rate. Both of these traditional malware detection strategies
fail when confronted with advanced forms of malware <cit.>. Therefore, it is essential to
consider alternative malware detection techniques.

Modern malware research
often focuses on machine learning, which has shown better performance as compared
to traditional methods, particularly in the most challenging cases. Machine learning models
for malware classification can be trained on a wide variety of features, including API calls,
opcodes sequences, system calls, and control flow graphs, among many others <cit.>.

In this research, we extract features from several malware families.
We then train a hidden Markov model (HMM) for each malware sample.
The converged probability matrices of the HMMs
(the so-called $B$ matrices) that belong to the same malware family would be
expected to have similar characteristics. These matrices from our converged HMMs
are converted to feature vectors, in a process that we refer to as HMM2Vec.
The resulting HMM2Vec vectors are used as features
in the following classification algorithms: $k$-nearest neighbors ($k$NN),
support vector machines (SVM), random forest (RF), and convolutional neural networks (CNN);
we refer to these hybrid techniques as
HMM2Vec-$k$NN, HMM2Vec-SVM, HMM2Vec-RF, and HMM2Vec-CNN,
respectively. Similarly, we consider Word2Vec encodings in place of the HMM2Vec
embeddings, which gives rise to the corresponding hybrid models of
Word2Vec-$k$NN, Word2Vec-SVM, Word2Vec-RF, and Word2Vec-CNN.

For each of these hybrid techniques, extensive malware classification experiments
are conducted over a set of seven challenging malware families. Again,
our experiments are based on engineered features derived from opcode sequences.

The remainder of this paper is organized as follows.
In Section <ref> we provide a discussion of relevant background topics,
with a focus on the machine learning techniques employed
in this research. We also provide a selective survey of related work.
Section <ref> covers the novel
hybrid machine learning techniques that are the focus of this research. In this
section, we also provide information on the dataset that we have used.
Section <ref> gives our experimental
results and analysis. Finally,
Section <ref> summarizes our results and includes a
discussion of possible directions for future work.

§ BACKGROUND

In this section, we introduce the machine learning models used in this research.
We also provide a selective survey of relevant previous work.

§.§ Machine Learning Techniques

A wide variety of machine learning techniques are considered in this research.
We train hidden Markov models and generate Word2Vec embeddings, which are
subsequently used as features in various classification algorithms. The classification
algorithms considered are random forest, $k$-nearest neighbor, support vector machines,
and convolutional neural networks. Due to space limitations, each of these
techniques is introduced only very briefly in this section.

§.§.§ Hidden Markov Models

A hidden Markov model (HMM) is a probabilistic machine learning algorithm
that can be used for pattern matching applications in such diverse areas
as speech recognition <cit.>,
human activity detection <cit.>, and protein sequencing <cit.>.
HMMs have also proven useful for malware analysis.

A discrete HMM is defined as $\lambda=(A,B,\pi)$, where $A$ is the state transition
matrix for the underlying Markov process, $B$ contains probability distributions that
relate the hidden states to the observations, and $\pi$ is the initial state distribution.
All three of these matrices are row stochastic.

In this research, we focus on the $B$ matrix of trained HMMs. These matrices
can be viewed as representing crucial statistical properties of the observation sequences
that were used to train the HMM. Using these $B$ matrices as input to classifiers
is an advanced form of feature engineering, whereby information in the
original features is distilled into a potentially more informative form by the
trained HMM. We refer to the process of deriving these HMM-based feature
vectors as HMM2Vec. We have more to say about
generating HMM2Vec features from HMMs in Section <ref>.

§.§.§ Word2Vec

Word2Vec has recently gained considerable popularity in
natural language processing (NLP) <cit.>.
This word embedding technique is based on a shallow neural network, with the weights
of the trained model serving as embedding vectors—the trained model itself serves no
other purpose. These embedding vectors capture significant relationships
between words in the training set. Word2Vec can also
be used beyond the NLP context to model relationships between
more general features or observations.

When training a Word2Vec model, we must specify the desired
vector length, which we denote as $N$. Another key parameter
is the window length $W$, which represents the width of a sliding
window that is used to extract training samples from the data.
Algebraic properties hold for Word2Vec
embeddings; see <cit.> for further information.

In this research, we train Word2Vec models on opcode sequences.
The resulting embedding vectors are used as feature
vectors for several different classifiers. Analogous to the HMM feature vectors discussed
in the previous section, these Word2Vec embeddings serve as
engineered features that may be more informative than the raw opcode

§.§.§ Random Forest

Random forest (RF) is a class of supervised machine learning techniques.
A random forest is based on decision trees, which are one of the
simplest and most intuitive “learning” techniques available. The primary drawback to
a simple decision trees is that it tends to overfit—in effect, the decision
tree “memorizes” the training data, rather than learning from the it.
A random forest overcomes this limitation by a process known as “bagging,”
whereby a collection of decision trees are trained, each using a subset of the
available data and features <cit.>.

§.§.§ $k$-Nearest Neighbors

Perhaps the simplest learning algorithm possible is $k$-nearest neighbors ($k$NN).
In this technique,
there is no explicit training phase, and in the testing phase, a sample is
classified simply based on the nearest neighbors in the training set.
This is a lazy learning technique, in the sense that all computation
is deferred to the classification phase. The parameter $k$ specifies the number
of neighbors used for classification. Small values of $k$ tend to results
in highly irregular decision boundaries, which is a hallmark of overfitting.

§.§.§ Support Vector Machine

Support vector machines (SVM) are popular supervised learning algorithms <cit.>
that have found widespread use in malware analysis <cit.>.
A key concept behind SVMs is a separating hyperplane that
maximizes the margin, which is the minimum distance between the classes.
In addition, the so-called kernel trick introduces nonlinearity into the process, with minimal
computational overhead.

Several popular nonlinear kernels are used in SVMs.
In this research, we experiment with linear kernels and nonlinear
radial basis function (RBF) kernels.

§.§.§ Convolutional Neural Network

Neural networks are a large and diverse class of learning algorithms
that are loosely modeled on structures of the brain.
A deep neural network (DNN) is a neural network with multiple hidden
layers—such networks are state of the art for many learning problems.
Convolutional neural networks (CNN) are DNNs that are
optimized for image analysis, but have proven effective in many other
problem domains.
The architecture of a CNN consists of hidden layers, along with input and output layers.
The hidden layers of a CNN typically include convolutional layers,
pooling layers, and a fully connected output layer <cit.>.

§.§ Selective Survey of Related Work

Machine learning has been widely used in malware research.
This section introduces representative examples from the literature
that are related to the work considered in this paper.

In <cit.>, the authors consider features based on API calls.
Other research considers features such as opcodes,
system calls, control flow graphs, and byte sequences for malware detection <cit.>.

As discussed in <cit.>, features obtained via static analysis (e.g., opcode sequences)
results in more efficient and faster techniques as compared to those that rely on features that
require dynamic analysis (e.g., API calls). However, dynamic analysis often provides
a more accurate reflection of malware, and obfuscation techniques are generally
less effective for dynamic features.

The literature is replete with hybrid machine learning techniques for malware classification.
For example, in <cit.>, the author proposes a hybrid machine learning technique
that uses HMM matrices as the input to a convolutional neural network to classify malware families.
Researchers in <cit.> use SVMs to classify trained HMMs. In <cit.>,
the authors consider an ensemble model that combines predictions from
and , files together—the predictions are stacked and fed
to a neural network for classification.
In <cit.>, the authors use
Word2Vec to generate embeddings from machine instructions. Moreover, they
propose a proof of concept model to train a convolutional neural network based
on the Word2Vec embeddings.

The research in this paper builds on
the work in <cit.>.
We propose hybrid machine learning techniques
for malware classification using HMM2Vec
and Word2Vec engineered features which are derived from
opcode sequences. Four different classifiers are considered,
giving us a total of eight distinct experiments that we refer to as
HMM2Vec-$k$NN, HMM2Vec-SVM, HMM2Vec-RF, HMM2Vec-CNN,
Word2Vec-$k$NN, Word2Vec-SVM, Word2Vec-RF, and Word2Vec-CNN.
As far as the authors are aware, only one of these eight combinations,
namely, Word2Vec-CNN, has been considered in
previous work. Moreover, we experiment with a much wider array
of window sizes and vector lengths for our Word2Vec models
as compared to prior related work.
In the next section, we discuss our eight proposed
techniques in detail.

§ IMPLEMENTATION

In this section, we first give information about the dataset used in this research.
Then we discuss the various hybrid machine learning techniques that are the focus
of the experiments reported in Section <ref>.

§.§ Dataset

The raw dataset used for our experiments includes 2793 malware families
with one or more samples per family <cit.>.
Figure <ref>
lists all of the families in our dataset that have more than 300 samples.

Families in dataset with at least 300 samples

We selected seven of the families listed in Figure <ref>
that have more than 1000 samples, and randomly selected 1000
samples of each type, giving us a total of 7000 samples.
The following seven families were selected for this research.

BHO can perform a wide variety of malicious actions,
as specified by an attacker <cit.>.

CeeInject is designed to conceal itself from detection,
and hence various families use it as a shield to prevent detection.
For example, CeeInject can obfuscate a bitcoin mining client,
which might have been installed on a system without the user's
knowledge or consent <cit.>.

FakeRean pretends to scan the system, notifies the user of nonexistent issues,
and asks the user to pay to clean the system <cit.>.

OnLineGames steals login information and captures user
keystroke activity <cit.>.

Renos will claim that the system has spyware and ask for a payment to
remove the nonexistent spyware <cit.>.

Vobfus is a family that downloads other malware onto a user's computer
and makes changes to the device configuration that cannot be restored
by simply removing the downloaded malware <cit.>.

Winwebsec is a trojan that presents itself as antivirus software—it displays
misleading messages stating that the device has been
infected and attempts to persuade the user to pay a fee to free the
system of malware <cit.>.

For each sample, we train an HMM and a Word2Vec model using opcode sequences.
The raw dataset consists of  files, and hence we first extract the
mnemonic opcode sequence from each malware sample.
We use  to generate  files from which we
extract opcode sequences. For each opcode sequence
we retain the $M$ most frequent opcodes and remove all others. We
experiment with the $M$ most frequent opcodes for $M\in\{20,31,40\}$,
where “most frequent” is based on the opcode distribution over the entire dataset.
The number of hidden states in each HMM was chosen to be $N=2$,
and the number of output symbols is given by $M$.
For the Word2Vec models, we experiment with additional parameters.

Experiments involving $M\in\{20, 31,40\}$ are discussed at the start
of Section <ref>.
Based on the results of such experiments, we selected $M=31$ for
all subsequent HMM2Vec and Word2Vec experiments.
The 31 most frequent opcodes are
listed in Figure <ref>,
along with the percentage of the total that each opcode

The 31 most frequent opcodes

From the numbers in Figure <ref>,
we see that any opcode outside of the top 31 accounts for less
that 0.5% of the total opcodes. Since we are considering
statistical-based feature engineering techniques, these omitted
opcodes are highly unlikely to affect the results to any significant degree.

§.§ Hybrid Classification Techniques

In this section, we discuss the hybrid machine learning models
that are the basis for the research in this paper.
Specifically, we consider
HMM2Vec-SVM, HMM2Vec-RF, HMM2Vec-$k$NN, and HMM2Vec-CNN.
We then briefly discuss the analogous Word2Vec techniques,  namely,
Word2Vec-SVM, Word2Vec-RF, Word2Vec-$k$NN, and Word2Vec-CNN.

To train our hidden Markov models, we use
the  library <cit.>,
and we select the best HMM based on multiple random restarts.
For all remaining machine learning techniques, except for CNNs,
we used  <cit.>.
To train our CNN models, we use the Keras library <cit.>.

§.§.§ HMM Hybrid Techniques

For our HMM2Vec-SVM hybrid technique, we first train an HMM for each sample,
using the extracted opcode sequence as the training data.
Then we use an SVM to classify the samples, based on the $B$
matrices of the converged HMMs.
Each converged $B$ matrix is vectorized by simple concatenating the rows.
Since $N=2$ is the number of hidden states and $M$ is the number of
distinct opcodes in the observation sequence,
each $B$ matrix is $N\times M$. Consequently, the
resulting engineered feature vectors are all of length $NM$.
When training the SVM,
we experiment with various hyperparameters and kernel functions.

Our HMM2Vec-RF, HMM2Vec-$k$NN, and HMM2Vec-CNN techniques are
analogous to the HMM2Vec-SVM hybrid technique.
For the HMM2Vec-CNN, we use a one-dimensional CNN.
In each case, we tune the relevant parameters.

§.§.§ Word2Vec Hybrid Techniques

As mentioned above, Word2Vec is typically trained on a series of words,
which are derived from sentences in a natural language. In our research,
the sequence of opcodes from a malware executable is treated as a stream of “words.”
Analogous to our HMM2Vec experiments, we concatenate the Word2Vec
embeddings to obtain a vector of length $NM$, where $M$ is the number
of distinct opcodes in the training set and $N$ is the length of the
embedding vectors.

Once we have trained the Word2Vec models to obtain the
engineered feature vectors, the classification process for each of
Word2Vec-SVM, Word2Vec-RF, Word2Vec-CNN, and Word2Vec-$k$NN
is analogous to that for the corresponding HMM-based technique.
As with the HMM classification techniques, we tune the parameters in each case.

§ EXPERIMENTS AND RESULTS

In this section, we present the results of several hybrid machine learning experiments
for malware classification.
As discussed above, these experiments are based on opcode sequences,
with feature engineering involving HMM and Word2Vec models.
We consider four classifiers, giving us a total of eight different
experiments, which we denote as
HMM2Vec-SVM, HMM2Vec-RF, HMM2Vec-$k$NN, HMM2Vec-CNN,
Word2Vec-SVM, Word2Vec-RF, Word2Vec-$k$NN, and Word2Vec-CNN.

Before discussing our hybrid multiclass results, we first consider
binary classification experiments using different numbers of opcodes.
The purpose of these experiments is to determine the number of opcodes
to use in our subsequent multiclass experiments.

§.§ Binary Classification

In this section, we classify samples from the
Winwebsec and Fakerean malware families, both of which are examples of rogue
security software that claim to be antivirus tools. We compare the accuracies
when using the $M$ most frequent opcodes, for $M\in\{ 20, 31, 40\}$.

For each of these binary classification experiments, we generate a Word2Vec
model for each sample in both families, using a vector size of $N=2$ and window
sizes of $W\in\{1, 5, 10, 30, 100\}$. Thus, we conduct 15 distinct experiments,
each involving 2000 labeled samples. In each case, we use a 70-30
training-testing split. The results of these experiments are summarized in
Figure <ref>.

Binary classification using Word2Vec-SVM model (Winwebsec vs Fakerean)

From Figure <ref>, we see that
good results are obtained
for window size $W=5$ and 31 or 40 opcodes.
Both of these cases yield an accuracy in excess of 99%.
But, the improvement when using 40 opcodes over 31
opcodes is relatively small, and with 40 opcodes,
feature extraction and training times are greater.
Therefore, in all of the multiclass experiments
discussed in the next sections, we use 31 opcodes.

§.§ HMM2Vec Multiclass Experiments

For all of our multiclass experiments, we
consider the seven malware families that are discussed in Section <ref>,
BHO <cit.>,
Ceeinject <cit.>,
Fakerean <cit.>,
OnLineGames <cit.>,
Renos <cit.>,
Vobfus <cit.>,
Winwebsec <cit.>.
We extracted opcodes from 50 malware families
and use the 31 most frequent to train HMMs for each sample in each of the seven
families under consideration.
For all HMMs, the number of hidden states is selected to be $N=2$.
Since we are considering 31 distinct opcodes, we have $M=31$,
giving us engineered HMM2Vec feature vectors of length 62.

As mentioned above,
we train HMMs using the  library <cit.>
and we select the highest scoring model
based on multiple random restarts.
The precise number of random restarts is determined by the
length of the opcode sequence—for shorter sequences in the range
of 1000 to 5000 opcodes, we use 100 restarts; otherwise
we select the best model based on 50 random restarts.
The $B$ matrix of the highest-scoring model is then converted
to a one-dimensional vector.

To obtain the HMM2Vec features,
we convert the $B$ matrix of a trained HMM into vector form.
A subtle point that arises in this conversion process is that
the order of the hidden states in the $B$ matrix need not be consistent
across different models. Since we only have $N=2$ hidden states
in our experiments, this means that
the order of the rows of the corresponding $B$
matrices may not agree between different models. To account for this
possibility, we
determine the hidden state that has the highest probability with respect to the
opcode and we deem this to be the first half of the
HMM2Vec feature vector, with the other row of the $B$ matrix
being the second half of the vector. Since  is by far the most frequent
opcode, this will yield a consistent ordering of the hidden states.

§.§.§ HMM2Vec-SVM

Table <ref> gives the results of a grid search over
various parameters and kernel functions. As with all of our multiclass
experiments, we use a 70-30 split of the data for training and testing.
For the multiclass SVM, we use a one-versus-other technique.
From the results in Table <ref>, we see that the
RBF kernel performs poorly, while the linear kernel yields consistently strong
results. Our best results are obtained using a linear kernel with $C=100$
and $C=1000$.

HMM2Vec-SVM accuracies
$C$     $\gamma$
linear     1     N/A     0.83

linear     10     N/A     0.87

linear     100     N/A     0.88

linear     1000     N/A     0.88
RBF     1     0.001    0.13

RBF     1     0.0001      0.13

RBF     10     0.001    0.42

RBF     10     0.0001     0.13

RBF     100     0.001    0.69

RBF     100     0.0001     0.34

RBF     1000     0.001    0.83

RBF     1000     0.0001     0.70

Figure <ref> gives the
confusion matrix for our HMM2Vec-SVM experiment, based on
a linear kernel with $C=100$.
We see that BHO and Vobfus are classified with the highest
accuracies of 94.2% and 96.6%, respectively. On the other
hand, Winwebsec and Fakerean are the most challenging, with 9%
and 7% misclassification rates, respectively. We also note that
OnLineGames samples are frequently misclassified as Fakerean.

Confusion matrix for HMM2Vec-SVM with linear kernel

§.§.§ HMM2Vec-$k$NN

Recall that in $k$NN, the parameter $k$ is the number of
neighbors that are used to classify samples.
We experimented with $k$NN classifiers using our engineered HMM2Vec
features for each $k\in\{1,2,3,\ldots,50\}$. Figure <ref>
gives the resulting multiclass accuracy for these HMM2Vec-$k$NN
experiments as a function of $k$.

HMM2Vec-$k$NN accuracy as a function of $k$

From Figure <ref>, we see that as the accuracy declines
as $k$ increases. However,
small values of $k$ result in a highly irregular decision boundary,
which is a sign of overfitting. As a general rule, we should choose $k\approx\sqrt{S}$,
where $S$ is the number of training samples. For our experiment, this
gives us $k=70$, for which we obtain an accuracy of about 79%.

§.§.§ HMM2Vec-RF

There are many hyperparameters to consider when training a random forest.
Using our HMM engineered features, we performed a randomized search and
obtained the best results with the parameter in Table <ref>.

Randomized search parameters for HMM2Vec-RF

Hyperparameter     Value
$n$-estimators     1000

min samples split     2

min samples leaf     1

max features     auto

max depth     50

bootstrap    false

Using the hyperparameters in Table <ref>,
our HMM2Vec-RF classifier achieves an overall accuracy of 96%.
In Figure <ref>, we give the results of this experiment
in the form of a confusion matrix.
From this confusion matrix, we see that
BHO and Vobfus are classified with high accuracies
of 97% and 99%, respectively. The misclassifications between
OnLineGames and Fakerean are reduced, as compared to the SVM
classifier considered above, as are the misclassifications between Winwebsec
and Fakerean.

Confusion matrix for HMM2Vec-RF using grid parameters

§.§.§ HMM2Vec-CNN

Next, we consider classification based on CNNs.
There are numerous possible configurations and many hyperparameters in such models.
Due to the fact that our feature vectors are one-dimensional,
we use one-dimensional CNNs.

We split the data into 80% training, 10% validation,
and 10% testing. With this split, we have 5600 training samples,
700 validation samples, and 700 testing samples. We train each
model using the rectified linear unit (ReLU) activation function
and 200 epochs. To construct these models, we used the Keras library <cit.>.

For our first set of experiments, we train CNNs using one input layer of
dimension 200, a hidden layer with 500 neurons, and
our output layer has seven neurons, since we have seven classes.
We use a mean squared error (MSE) loss function.

Using stochastic gradient descent (SDG) as the optimizer,
we obtained an accuracy of about 50%.
Switching to the Adam  optimizer <cit.>,
we achieve a training accuracy of 97% and a testing accuracy of 92%.
Consequently, we use Adam for all further experiments.

We train a CNN with two hidden layers, one input layer,
and an output layer, with 20, 200, and seven neurons, respectively.
In this case, using categorical cross-entropy (CC) as the loss function,
we achieved a testing accuracy of 88%, but the model showed a 40% loss.

Next, we expand the hidden layer to 500 neurons
and perform a grid search to identify the best hyperparameters.
We experimented with various loss functions,
we use 200 neurons in the input layer, one hidden layer with 500 neurons,
ReLU activation functions, and an output layer with seven neurons,
followed by a softmax activation. In this setup, we achieved a testing accuracy
of 93.8% using the CC loss function. However, the training accuracy
reached 100%, which indicates overfitting.

There are several possible ways to mitigate overfitting—we employ regularization based on
a dropout layer.

Intuitively, when a neuron is dropped at a particular iteration, it forces other neurons
to become active, which reduces the tendency of some neurons
to dominate during training.
By spreading the training over more neurons, we
reduce the tendency of the model to overfit the data.

When we set the dropout rate to 0.5, we achieve a testing accuracy
of 94.2% with a training accuracy of 98%. In this case,
we have eliminating the overfitting that was observed in
our previous models.

§.§ Word2Vec Multiclass Experiments

The experiments in this section are analogous to the HMM2Vec
experiments in Section <ref>.
However, Word2Vec includes more parameters
that we can easily adjust, as compared to HMM2Vec,
and hence we experiment with these parameters.
Specifically, for our Word2Vec models, we experiment with
different window sizes $W$
and different lengths $N$ of the embedding vectors.
Since we are considering feature vectors with 31
distinct opcodes, for the $N=2$ case, we will have
Word2Vec engineered feature vectors of length 62,
which is the same size as the HMM2Vec feature vectors
considered above. However, for $N>2$, we have larger
feature vectors. Also, the window size allows us to
consider additional context in Word2Vec models,
as compared to our HMM2Vec features.

§.§.§ Word2Vec-SVM

Here, we generate feature vectors using Word2Vec,
and apply an SVM classifier. As mentioned above, Word2Vec
gives us the flexibility to choose the vector embedding
and window sizes, and hence we experiment
with these parameters.
As in all of the multiclass cases, we consider 1000 malware
samples from each of seven families.
In all cases,
we split the input data 70-30 for training and testing.
For the SVM experiments, we use a one-versus-other technique.

As with our HMM2Vec-SVM experiments, we first perform a grid search
over the parameters for linear and RBF kernels. For these experiments,
we use vectors size of $N=2$ and a window of size $W=30$.
Table <ref> summarizes the results
of these experiments. We observed that the RBF kernel
achieves the highest accuracy.

Word2Vec-SVM grid search accuracies ($N=2$ and $W=30$)

$C$     $\gamma$
linear     1     N/A     0.86

linear     10     N/A     0.85

linear     100     N/A     0.85

linear     1000     N/A     0.85
RBF     1     0.001    0.87

RBF     1     0.0001      0.70

RBF     10     0.001    0.91

RBF     10     0.0001     0.84

RBF     100     0.001    0.92

RBF     100     0.0001     0.88

RBF     1000     0.001    0.92

RBF     1000     0.0001     0.90

For our next set of Word2Vec-SVM experiments,
we consider a linear kernel.
For the Word2Vec features,
we use vector lengths $M\in\{2, 31, 100\}$
and windows of size $W\in\{1, 5, 10, 30, 100\}$,
giving us a total of 15 distinct Word2Vec-SVM experiments using linear kernels.

The results of these Word2Vec-SVM experiments are summarized in the
form of a bar graph in Figure <ref> (a).
Note that our best accuracy of 95% for the linear
kernel was achieved with input vectors of size $N=31$ and,
perhaps surprisingly, a window of size $W=1$.
These results show that the accuracies significantly improve
for embedding vector sizes $N>2$.

(a) Linear kernel

(b) RBF kernel

Word2Vec-SVM experiments

Next, we consider the RBF kernel in more detail.
Based on the results in Table <ref>,
we select $C=1000$ and $\gamma=0.001$.
We generate Word2Vec vectors of sizes $N\in\{2, 31, 100\}$ and
window sizes $W\in\{1, 5, 10, 30, 100\}$.
The results of these 15 experiments
are summarized in Figure <ref> (b).
In this case, we achieve a best accuracy of 95% with
a vector length of $N=31$ and a window size of
either $W=1$ or $W=10$.
Note that the results improve when
the vector size $N$ is increased from 2 to 31,
but the accuracy does not improve for $N=100$.

§.§.§ Word2Vec-$k$NN

For our Word2Vec-$k$NN experiments, we again consider the 15 cases
given by vector lengths $N\in\{2, 31, 100\}$ and
window sizes $W\in\{1, 5, 10, 30, 100\}$.
In each case, we consider $k\in\{1, 2, 3,\ldots, 100\}$.
We find that for all cases with vectors with sizes $N\in\{2, 31, 100\}$
and window sizes $W\in\{1, 5, 10, 30, 100\}$, we achieve about 94%  classification
accuracy. In Figure <ref> we give a line graph
for Word2Vec-$k$NN accuracy as a function of $k$.

As in our HMM2Vec-$k$NN experiments,
to avoid overfitting, we choose $k=70$,
which in this case gives us an accuracy of about 89%.

Word2Vec-$k$NN accuracy ($N=100$ and $W=1$)

§.§.§ Word2Vec-RF

In this set of experiments, we consider the same 15 combinations of
Word2Vec vector sizes and window sizes as in the previous experiments in
this section. In each case, the number of trees in the random
forest is set to 1000.
We find that the best result for Word2Vec-RF
occurs with a vector size of $N=100$ and a window size of $W=30$,
in which case we achieve an accuracy of 96.2%.
The confusion matrix for this case is given in Figure <ref>.
The worst misclassification is that Winwebsec is misclassified
as Fakerean for a mere 3% of the samples tested.

Confusion matrix for Word2Vec-RF

We also conduct experiments on the RF parameters, using a
Word2Vec vector size of $N=100$ and a window size of $W=30$.
Table <ref> lists the best parameters obtained
based on a grid search. With these parameters, we
obtain an accuracy of 93.17%.

Randomized search parameters for Word2Vec-RF

Hyperparameter     Value
$n$-estimators     1400

min samples split     2

min samples leaf     1

max features     auto

max depth     40

bootstrap    false

§.§.§ Word2Vec-CNN

Using the same parameters as in the previous Word2Vec experiments, that is,
vector lengths $N\in\{2, 31, 100\}$ and window sizes $W\in\{1, 5, 10, 30, 100\}$,
we consider the same CNN architectures as in the HMM2Vec-CNN
experiments, above.

Figure <ref> (a) and (b) give model accuracy and loss,
respectively, for an experiments with $N=31$ and $W=1$, where we
have trained for 200 epochs. In this case,
we achieve 95% testing accuracy, but validation loss increases dramatically,
which is a clear indication of overfitting.

(a) Accuracy

(b) Loss

Word2Vec-CNN overfittling

(a) Accuracy

(b) Loss

Model accuracy and loss for Word2Vec-CNN

To deal with the overfitting that is evident in Figure <ref>,
we reduce the number of epochs and we tune the learning rate.
Specifically, we reduce the number of epochs to 50, we
set the learning rate to 0.0001, and we let $\beta_1=0.9$
and $\beta_2=0.999$, as per the suggestions in <cit.>.
Figure <ref> (a) and (b) give model accuracy and loss,
respectively, for an experiment based on this selection of parameters.
In this case, we achieve 94% testing accuracy,
and the loss is reduced significantly. The loss has been reduced,
and there is no indication of overfitting in this
improved model.

Figure <ref> summarized the 15 experiments we
conducted using Word2Vec-CNN. For these experiment,
as we increase the window size, generally
we must decrease the number of epochs to keep
the model loss within acceptable bounds.

Accuracies for Word2Vec-CNN experiments

From Figure <ref>, we see that
our best accuracy achieved using a Word2Vec-CNN
architecture is 94%.
Figure <ref> gives the confusion matrix
for this best Word2Vec-CNN model. We see that the Fakerean family is
relatively often misclassified as OnLineGames or Winwebsec.
In our previous experiments, we have observed that Fakerean is
generally the most challenging family to correctly classify.

Confusion matrix for Word2Vec-CNN

§.§ Robustness Experiments

Since malware often evolves, it is
advantageous if a classification technique
is robust to change in malware samples. Therefore,
as a final set of experiments, we explore the robustness of the various models
considered in the previous sections.

For our robustness experiments, we consider binary
classification, using the Winwebsec and Fakerean families.
And, as with our previous experiments, we
only consider the 31 most frequent opcodes.
We scramble the opcode sequences by a factor of 10%, 20%, 30%, and 40%.
For example, a scrambling factor of 10% means that we select a block
that contains 10% of the opcodes in a sample and we randomly shuffle
the opcodes in this selected block.
The resulting scrambled opcode sequence is then used

to generate HMM2Vec and Word2Vec feature vectors.

igures/robust_hmm.tex     igures/robust_w2v.tex

(a) HMM2Vec     (b) Word2Vec-SVM

igures/robust_w2v_knn.tex     igures/robust_w2v_rf.tex

(c) Word2Vec-$k$NN     (d) Word2Vec-RF

2c(e) Word2Vec-CNN

Robustness for Winwebsec and Fakerean binary classification

The resulting HMM2Vec experiments are summarized in Figure <ref> (a).
For the Word2Vec experiments, we test various windows sizes $W$ in each case.
These Word2Vec
experiments are summarized in Figures <ref> (b) through (e).

In general, Figure <ref> indicates that
our opcode feature embedding techniques are not
particularly robust with respect to the shuffling experiments
that we have performed. In every case, the accuracy drops to 80% or
less with just 10% scrambling. Yet, there are some noteworthy results. For example,
we see that SVM far outperforms the other classifiers on the HMM2Vec features.
In contrast, for the Word2Vec features, small window sizes perform
best and, with respect to the classifiers,
SVM performs relatively well, although several other classifiers are competitive.
Another interesting observation
is that there is not much decline in any of the techniques after
about 10% scrambling.

§ CONCLUSION AND FUTURE WORK

In this paper, we considered engineered features for malware classification.
These engineered features were derived from opcode sequences
via a technique we refer to as HMM2Vec, and a parallel set of experiments
was conducted using
Word2Vec embeddings. We experimented with a
diverse set of seven malware families. We also used four different classifiers
with each of the two engineered feature sets,
and we conducted a significant number of experiments to tune the
various hyperparameters of the machine learning algorithms.

Figure <ref> summarizes the best accuracies for our Word2Vec
and HMM2Vec hybrid classification techniques. From Figure <ref> we see that
that HMM2Vec-RF and Word2Vec-RF attained the best results,
with 96% accuracy when classifying a balanced set of samples from seven families.
All of the hybrid machine learning techniques
based on Word2Vec embeddings performed well, while the HMM2Vec
results were more mixed. This may be due to the relatively limited
number of options considered when training
HMMs in our experiments, as compared to Word2Vec.

Best accuracies for HMM2Vec hybrid machine learning

Almost all our hybrid machine learning techniques classified
samples from BHO, Vobfus, and Renos with very high accuracy.
We observed that the Winwebsec and OnLineGames samples
were often misclassified as Fakerean. The percentage of these
misclassification was higher in HMM2Vec than Word2Vec,
and accounts for most of the difference between these classification

We also performed experiments that showed that
none of the techniques considered in this paper is particularly
robust with respect to feature scrambling.
The Word2Vec models were more consistent in these
experiments, but the best HMM2Vec models performed
as well as the best Word2Vec models.

A major advantage of Word2Vec was its faster training time. We found that
generating HMM2Vec features was

slower than generating Word2Vec features
by a factor of about 15.
This vast difference between the two
cases was primarily due to the need to train multiple HMMs (i.e., multiple random restarts)
in cases where the amount of training data is relatively small.
Word2Vec can be trained on short opcode sequences,
since a larger window size $W$ effectively inflates
the number of training samples that are available.

As future extension of this research, similar experiments could be
performed on a larger and more diverse set of malware families.
In this research, we only considered opcode sequences—analogous
experiments on other features, such as byte $n$-grams or
dynamic features such as API
calls would be interesting.

Further experiments involving the many parameters found in the various
machine learning techniques considered here would be worthwhile.
To mention just one of many such examples,
additional combinations of window sizes and feature vector
lengths could be considered in Word2Vec.
Finally, other machine learning paradigms would be worth considering
in the context of malware detection based on vector embedding features.
Examples of other machine learning approaches that could be
advantageous for this problem include adversarial networks
and reinforcement learning.