# Data Augmentation for Opcode Sequence Based Malware Detection

Niall McLaughlin  Jesus Martinez del Rincon

###### Abstract

In this paper we study data augmentation for opcode sequence based Android
malware detection. Data augmentation has been successfully used in many areas
of deep-learning to significantly improve model performance. Typically, data
augmentation simulates realistic variations in data to increase the apparent
diversity of the training-set. However, for opcode-based malware analysis it
is not immediately clear how to apply data augmentation. Hence we first study
the use of fixed transformations, then progress to adaptive methods. We
propose a novel data augmentation method – Self-Embedding Language Model
Augmentation – that uses a malware detection network’s own opcode embedding
layer to measure opcode similarity for adaptive augmentation. To the best of
our knowledge this is the first paper to carry out a systematic study of
different augmentation methods for opcode sequence based Android malware
classification.

##  1 Introduction

Data augmentation is used to improve the generalisation of machine-learning
models by artificially increasing the diversity of the training data [1]. Data
augmentation is needed because we often have limited training data, which does
not encompass the full diversity of in-the-wild data. Using augmentation we
can expose the network to a larger variety of data than is present in our
limited training set. The use of augmentation has gained increasing importance
due to deep-learning which often requires large amounts of training data. The
disadvantage of data augmentation is that the augmented samples may be highly
correlated with the existing training data, so this approach is necessarily
limited in the performance boost it can provide. When applying data
augmentation, the variability of samples in the original training set is
artificially increased by modifying each training example using one or more
transformation operations. The transformation operations are usually designed
to mimic natural variations in the data. For instance, in image classification
we may want an object detector to recognise a cat whether it is seen from the
left or right, or rotated slightly. Hence, mirroring and/or small rotations
are commonly used for vision tasks. The goal is to make the model invariant to
these transformations, thus improving its robustness to similar real world
variations. However not all augmentations correspond to real-world variations
e.g. Mixup [2]. Nevertheless, such methods have been shown empirically to
improve generalisation. For familiar types of data such as images, video, and
audio, intuition can often provide guidance on the design of novel
augmentation schemes. However, for more abstract data, such as opcode
sequences, designing augmentation methods is more challenging. In this paper,
we study data augmentation applied to opcode-sequence based malware
classifiers [3, 4]. However, our methods are general, meaning they could be
applied to sequences of raw bytes e.g., Malconv [5], or 2D malware images [6].
The contributions of this work are:

  1. (i).

We perform a systematic study of data augmentation methods applied to opcode-
sequence based malware detection.

  2. (ii).

We introduce a novel adaptive data augmentation technique, Self-Embedding
Language Model Augmentation, shown in Fig. 1. This method uses the network’s
own opcode embedding layer to measure opcode similarity to apply adaptive data
augmentation during training.

Figure 1: Top: Proposed Self-Embedding Augmentation for opcode-sequence based
malware classifiers. The network’s own opcode embedding matrix is used to
generate realistically augmented versions of opcode sequences. Augmentation
parameters are updated online during network training to generate better
augmentations. Bottom: A basic augmentation approach that uses fixed
parameters.

##  2 Related Work

Opcode based malware detection has been extensively studied. Some of the early
approaches were based on short n-grams [7, 8, 9] using classical machine
learning algorithms. However they required extensive pre-processing and
feature selection. Recently, deep-learning architectures designed for image
classification have been applied [10, 6], where the opcode sequences is
transformed into an image for classification by existing image classification
network architectures. Following from this, efficient sequence processing
architectures originally proposed for natural language processing (NLP) [11]
e.g., 1D CNNs, were used. By processing sequences using local filters, the
inefficiency of recursive models such as LSTMs [12] is avoided. To the best of
our knowledge, data augmentation has not been applied with such methods to
date. This is likely due to the difficulty of designing an appropriate
augmentation scheme for computer code.

Opcode-sequence based malware detection shares commonalities with NLP. Data
augmentation methods in NLP include: synonym replacement, random word
insertion, random word swap and random word deletion. While these techniques
may give some benefit [13] they tend to work best on smaller datasets. In the
masking technique words are replaced with a special ’blank’ word [14]. This
can be seen as a form of regularisation that works by adding noise to the
input. A related method, replaces words using synonyms from a thesaurus [11]
to create semantically similar but different sentences. Building on the idea
of substituting semantically similar words, a word embedding model such as
GloVe [15] can be used to measure word similarity. This allows replacement of
words with semantically close neighbours based on their word embeddings [16].
The NLP techniques above are not easy to apply to opcode sequences as naive
substitution of opcodes may break program functionality. There are also no
widely available pre-trained embeddings for opcode sequences. In the field of
malware classification we are aware of only one other related work, which
applies additive noise to 3-channel encoded binary file images [17] for
augmentation.

##  3 Method

###  3.1 Opcode Sequence Malware Classification

The opcode sequence of a given program can be recovered either via disassembly
or by dynamic analysis. In this work we focus on static analysis by
disassembly, although our methods are general enough to be applied to dynamic
analysis. We use a CNN based malware classifier [3]. The complete network
consists of an opcode embedding layer, a single convolutional layer, a max
pooling layer, a linear classification layer, outputting the probability a
sample is malicious. This style of architecture is often referred to as
_Malconv_ and has been successfully validated [3, 4, 18].

###  3.2 Data Augmentation of Opcode Sequences

We use the term data augmentation to describe the technique where the raw
inputs to a network are modified during training. The inputs are usually
modified to reflect variations the network should be invariant to during
testing [1]. In a sense, data augmentation artificially increases the size of
the training-set and is commonly applied to improve the network’s
generalisation performance by showing it a greater variety of examples than
those present in the training-set.

Data augmentation can be applied either offline or online [1, 19]. In online
augmentation every training example is randomly modified in a different way at
every training epoch, thus increasing the variety of training data. Offline
augmentation is typically applied when the augmentation is too computationally
costly to be used during the network’s training loop [19]. For text/sequence
based inputs, such as opcodes sequences, the computational costs of online
augmentation are negligible, therefore in this work we always use online
augmentation.

Typically, the strength of augmentation must be carefully selected so that the
network converges and generalises well on real data. There are several ways in
which the ’strength’ of data augmentation can be varied. Firstly, the ratio of
augmented data to un-augmented data presented to the network during training
can be varied. We use the parameter $\beta$ to describe the probability the
network will be presented with an augmented sample at any given epoch. Varying
$\beta$ varies the weighting of the learned features between augmented and un-
agumented data.

Secondly, we can directly vary the strength of the augmentation methods
themselves. This parameter will depend on the specifics of each augmentation
technique. For example, we can vary the percentage of opcodes randomly
replaced with zeros (See Section 3.3). We use parameter $\alpha$ to denote the
strength of the augmentation.

Finally, we can vary whether to use data augmentation during training only, or
whether to use test-time augmentation [20]. In test-time augmentation,
multiple augmented samples are passed through the network at inference time
and the final prediction based on aggregating the multiple predictions. Test-
time augmentation can improve performance in some cases [21, 20]. In this work
we only use data augmentation during training, which simplifies our analysis.
Our reported performance figures therefore represent a lower bound and may be
further improved by the use of test-time augmentation.

###  3.3 Basic Opcode Sequence Augmentation Methods

We will now introduce several basic methods of opcode sequence based data
augmentation. These methods do not adapt to the context of a particular
sequence, and are based on either heuristic principles, or existing approaches
that have successfully been applied to text-based data augmentation in NLP
[13, 14, 16].

##### Input Dropout

A random fraction of opcodes in each program are replaced with zeros. Opcodes
for replacement are selected uniformly at random from the whole opcode
sequence. This can be seen as a form of dropout [22] applied directly to the
input. It is similar to methods that add noise to the input sequence to
improve generalisation [14]. The strength of augmentation can be varied by
varying the hyperparameter, $\alpha$, which specifies the fraction of opcodes
to randomly replace.

Note that in the case of opcode sequences, this operation is not the same as
replacing opcodes with the nop (no operation) instruction. We reserve as a
special ‘blank’ character used only for augmentation with zeros. This ’blank’
character does not appear anywhere in the original opcode sequences, so it has
no semantic significance in terms of the programmatic code, and instead simply
represents missing information.

##### Random Replacement

A fraction of opcodes selected uniformly at random is replaced with different
opcodes selected uniformly at random from the instruction set. The
hyperparameter $\alpha$ specifies the fraction of opcodes to randomly replace,
hence it represents the augmentation strength. This augmentation method
increase the noise present in the opcode sequence and may force the network to
learn to ignore outlier opcodes in the opcode sequence or to ignore short
unrealistic opcode sequences.

##### Similar Instructions

A fraction of opcodes in each program are randomly replaced with an
instruction selected from a hand-designed list of semantically similar
instructions. Opcodes to be replaced are selected uniformly at random from the
opcode sequence.

For every instruction in the instruction-set, a list of similar instructions
was created using the names of instructions in the Android virtual machine
instruction-set. For instance, instructions such as move, move/from-16,
move-16 etc. can be regarded as semantically similar. For each instruction, a
table of similar instructions was created based on the instruction prefixes
e.g.: move, const, goto, cmp, if, get, put, cast etc. Instructions without
obvious semantic neighbours are augmented using the random replacement method.
This augmentation technique is intended to create novel, but semantically
similar, malware samples to ensure better generalisation of the classifier.
The hyperparameter $\alpha$ specifies the fraction of opcodes in a given
program to replace, hence it varies the augmentation strength.

##### Correlated Input Dropout

One possible issue with the above data augmentation methods such as input
dropout, random replacement and similar instructions, is they produce
uncorrelated variations in the input sequence. This is because opcodes to be
replaced are selected uniformly at random. This method of augmentation may not
create enough variation to pose a challenge to the classifier, and therefore
may not significantly improve performance. To increase the strength and
difficulty of the augmentation we instead examine the use of correlated
augmentations.

Rather than replacing individual opcodes uniformly at random we instead
examine correlated opcode replacement. We select one or more instructions from
the instruction-set, then replacing all instances of these instructions in the
opcode sequence with the special reserved ’blank’ character. For example, if
we select the move instruction, all instances of the move instruction in the
opcode-sequence would be replaced with ’blank’. The same process can be
repeated for additional instructions to increase augmentation strength.

This form of augmentation has a significant effect on the program semantics
and may force the network to learn more robust features, as it cannot rely on
any particular instruction in isolation to perform classification. It must
instead learn more robust opcode patterns. This method differs from Input
Dropout as it forces the network to learn with significant amounts of
correlated noise. The parameter $\alpha$ controls the number of the
instructions to replace as a faction of the total size of the processor’s
instruction-set, hence varies augmentation strength.

###  3.4 Adaptive Opcode Sequence Augmentation Methods

In this section we introduce several adaptive augmentation methods. These
methods use knowledge of the semantic similarity of opcodes to augment samples
in a way that may be more realistic than the basic basic augmentation methods
introduced in Section 3.3.

####  3.4.1 Language model

First introduced for natural language processing, language models learn the
semantic relationships between words in natural language text. A language
model can be used to measure the semantic similarity of different words.
Language models can be trained to predict a missing character/word in a
sequence of text conditioned on the neighbouring characters/words.
Alternatively,they can be trained to predict the next character/word in a
sentence based on the preceding words [23]. We adapt this idea for opcode
sequence based malware analysis. Given a large number of opcode sequences, we
train an off-the-shelf language model to predict a missing opcode given its
neighbouring opcodes. The resulting model captures the semantic similarity of
different opcodes. We use the Continuous Bag of Words (CBOW) word2vec
algorithm [24] as our language model. Given a word2vec model trained on many
opcode sequences, its embedding matrix contains information on the semantic
similarity of different opcodes [16]. Opcodes with similar embedding vectors
tend to be semantically similar. We can then perform augmentation by replacing
random opcodes in a given sequence with their semantic equivalents.

Concretely, word2vec model is trained offline using all the opcode sequences
in the training-set. After training, we extract the word2vec opcode embedding
matrix. For every opcode we create a ranked list of its most similar opcodes,
based on the Euclidean distance between embedding vectors. For every opcode we
record its top-10 most similar opcodes. To perform augmentation of a given
input sequence, opcodes are selected uniformly at random from the sequence.
Each opcode is then replaced with an opcode randomly selected from that
opcode’s top-10 list of semantically similar neighbours. The hyperparameter
$\alpha$ specifies the fraction of opcodes in the original sequence to
replace.

####  3.4.2 Self-Embedding Language Model

As part of training a _Malconv_ like CNN to perform malware detection we are
also learning an opcode embedding matrix, as described in Section 3.1. The
opcode embedding matrix learns the semantic relationships between opcodes. We
note that the opcode embeddings learned for malware classification may be
different from those learned by a language model. Malware detection and
language modelling are fundamentally different tasks and may require the
network to extract different information from the opcode sequence, hence each
opcodes may have different semantics in each task.

We therefore hypothesise that the embedding matrix from a network trained on
malware classification may be more useful for generating realistically
augmented inputs for training a malware classifier. This poses a chicken-and-
egg problem where we require a trained malware classifier in order to train a
new one. We resolve this problem by using the embedding matrix from the
network currently being trained. We use this embedding matrix to measure the
semantic similarity of opcodes and hence generate realistically augmented
training samples. As the network trains, the embedding matrix used to generate
augmented samples is updated, hence the augmented samples become more
realistic and challenging as training progresses. To allow the network time to
adapt to the increasingly challenging augmented samples we use a lagging
version of the embedding matrix, updated once per training epoch.

At the start of every training epoch, a copy of the malware detection
network’s opcode embedding matrix is made. Given this opcode embedding matrix,
for every opcode a list of semantically similar opcodes is constructed based
on the Euclidean distance between embedding vectors. For every opcode, the
top-10 most semantically similar opcodes i.e., those with smallest Euclidean
distances, are recorded to produce an opcode similarity table. To perform
augmentation of a given opcode sequence during training, a fraction of the
sequence’s opcodes are selected uniformly at random for replacement. The
hyperparameter $\alpha$ specifies the fraction of opcodes to randomly replace.
Each selected opcode is then replaced with a opcodes, selected uniformly at
random, from the original opcodes lists of semantically similar neighbours.
The complete augmentation process is illustrated in Fig. 1.

We note that when training first begins, the embedding matrix is randomly
initialised, so there is no semantic information yet encoded in its weights.
Hence this method essentially performs random opcode replacement during early
training epochs, and gradually begins to incorporate semantic information as
training progresses. This simulates a curriculum based approach and means that
the strength of the augmentation gradually increases during training.

##  4 Experiments

To test the effectiveness of our augmentation algorithms we performed
experiments using several different malware datasets and with different
network hyper-parameters. For all experiments we use the 1D CNN network design
from [3], which is similar to that of [5]. The following hyper-parameters were
used: Embedding Layer: $8$ dimensions, Convolutional filters: $64$, of length
$8$, Max-Pooling layer, followed by a single linear layer with a $1$
dimensional output. Binary cross entropy loss was used. Adam optimiser [25]
with batch size $48$, and learning rate of 1e-3 for $120$ epochs. During
training and testing opcode sequences were truncated to $128,000$ opcodes due
to GPU memory limitations. For all experiments, all code and hyper-parameters
remained constant across datasets and models, with only the data augmentation
method varying. Results are reported using f1-score.

Two datasets were used for the experiments: The Small Dataset, which consists
of malware from the Android Malware Genome project. This dataset contains 2123
applications - 863 benign and 1260 malware samples from 49 malware families.
The Large Dataset was provided by McAfee Labs (Intel Security) and consists of
malware from the vendor’s internal dataset. This dataset contains roughly
10,000 malware and a further 10,000 clean applications collected from the
Google Play Store. Both datasets are therefore quite evenly balanced in terms
of malware and clean programs.

Both datasets were thoroughly checked and cleaned to ensure no duplicate
programs that contaminated the test/training splits. For experimentation
purposes, each dataset was split into 5 non-overlapping folds and cross
validation was preformed during evaluation. In effect, during each round of
cross validation, 80% of the dataset was used for training and 20% for
testing. For each experiment we report the average performance across the 5
cross-validation folds in terms of f1-score.

In our experiments we vary the $\alpha$ parameter, which controls the
augmentation strength, and report how this affects the classification
f1-score. For all experiments we hold the parameter $\beta$, which controls
the probability of applying augmentation to a given sample, constant at
$\beta=0.5$ i.e., half the samples presented during training are augmented and
half are unchanged. While it would be be possible to vary both parameters for
all experiments, we did not explore this possibility due to the excessive
computational costs.

For the language model augmentation method we use the Gensim implementation
[26] of word2vec [24]. We use the default parameters i.e., a continuous bag-
of-words (CBOW) model trained using negative sampling. We use word2vec
embedding vectors of dimensionality $8$ in order to match the embedding vector
size of the malware detector network. The context window size is $5$ and the
model was trained for $5$ epochs. For each experiment the word2vec model was
pre-trained offline using the same training data as the main malware
classifier. The embedding matrix was then extracted and used to build an
opcode similarity table for generating augmentations.

###  4.1 Baseline Performance

Baseline performance of the 1D CNN opcode-based malware detector network, with
no data augmentation, was measured on both the Small and Large datasets. The
average f1-score from 5-fold CV was recorded for each dataset. For all
remaining experiments, all network hyper-parameters, training and testing
settings and code, except that related to data augmentation, remained
identical. Baseline results are shown in Table I.

###  4.2 Basic Augmentation Methods

We compare the basic augmentation schemes with baseline no augmentation
results. The basic augmentation methods make predefined changes to the opcode
sequence without regard to context. They include: ’Input Dropout’, ’Random
Replacement’, ’Similar Instructions’ and ’Correlated Input Dropout’ (See
Section 3.3). The augmentation strength, $\alpha$, was systematically varied.
Note that the $\alpha$ parameter controls different aspects of the strength of
each augmentation method, so we cannot directly compare $\alpha$ values across
different augmentation methods.

The results of these experiments are shown in Table I. Across both datasets,
several augmentation methods produce consistent improvements over the baseline
for a range of $\alpha$ values. In particular, Input Dropout consistently
performs well with peak performance occurring at $\alpha=0.2$ on both
datasets. Several other methods, Random Replacement and Similar Instructions,
outperform Input Dropout on the Small Dataset. However this performance boost
is not repeated on the Large Dataset. Correlated Input Dropout performs
similarly across both datasets, although its overall performance is slightly
worse than Input Dropout in terms of relative improvement compared to the
baseline across both datasets. The results overall suggest that these basic
augmentation methods have the potential help to improve malware classification
performance.

###  4.3 Language Model Augmentation

This approach generates augmented opcode sequences while aiming to preserve
functionality and semantics. The gensim [26] implementation of CBOW word2vec
[24] with 8-dimensional opcode embedding vectors was used to calculate opcode
similarity. The language model was trained offline and its embedding matrix
extracted to calculate opcode similarities.

The results of the experiments are shown in Table I. Performance on the Small
Dataset is comparable with the Self-Embedding (SE) Language Model (see Section
4.4) method however performance on the larger dataset is similar to the basic
augmentation methods. We hypothesise that the relatively poor performance on
the Large Dataset, compared to the SE Language model, may be caused by the
fact that this language model is trained on a different task from malware
analysis i.e., the language model is trained to predict an opcode from its
context. The relationships between opcodes learned by the language model may
be different those that are important for malware classification. However the
overall performance of this method is better than or competitive with any of
the other augmentation methods. Improving its performance may therefore
present an avenue for future research.

###  4.4 Self-Embedding Language Model Augmentation

In Self-Embedding language model augmentation, the semantic similarity between
opcodes for data augmentation is measured using the constantly updated
embedding matrix from the malware classifier currently being trained. In these
experiments the network’s embedding matrix was sampled at the beginning of
every epoch. Hence the table of opcode similarity is updated one per epoch.

We compare performance against the baseline system with no augmentation, and
against all the other augmentation methods. Results are reported in Table I.
For both the Large and Small datasets we can see that augmentation by self-
embedding language model has a positive effect on classification performance.
Across both datasets the effectiveness of augmentation varies as the $\alpha$
value is varied. In both cases maximum performance occurs when $\alpha$ is
around 0.2. Performance drops off at both higher and lower $\alpha$ values.
Compared to the other augmentation methods we can see that this method has the
highest performance across both datasets. When the optimal $\alpha$ value is
selected, the f1-score increases by almost $1\%$ which is the largest
improvement seen across all the augmentation methods. We can also see that
this method consistently outperforms the baseline, showing that the value of
the $\alpha$ parameter is not critical. We propose this method should be used
whenever training opcode-sequence based malware classifiers that make use of
an embedding matrix.

###  4.5 Augmentation Performance in Context

In this section we provide context for the performance gains achievable using
data augmentation. Another way to improve the network’s performance is to
increase its size until just before over-fitting occurs. This comes at the
cost of increased training and inference time, however it provides an upper-
bound for the potential performance of the model architecture on the dataset.
We therefore compare the performance of a constant sized network trained using
data augmentation, with that of increasingly larger networks trained without
data augmentation.

On the Large Dataset We train networks with between 32 and 256 convolutional
filters without using data augmentation. We compare these networks against a
64 convolutional filter network trained using all proposed methods of data
augmentation with their optimal hyperparameters. The results are shown in Fig.
2. We do two types of comparison: firstly, comparing classification
performance as model size is varied, and secondly, comparing classification
performance versus training and inference time.

Fig. 2 (a) shows that for models trained without data augmentation it is
necessary to significantly increase the parameter count to increase
performance. In contrast, by using data augmentation a networks with 64
convolutional filters can approach or exceeds the performance of a network
with 128 filters but no augmentation. The self-embedding language model
augmentation method even allows the smaller network to slightly exceed the
performance of the 128 filters network trained without augmentation.

Fig. 2 (b) shows that increasing network size significantly increases both
training and inference time. However for a constant network size data
augmentation causes little change in training or inference time. Augmentation
enables the performance the 64 convolutional filter network to slightly exceed
the performance of the larger 128 filter network trained without augmentation.
In addition, the smaller network achieves this with much lower training and
inference time.

These experiments show that our proposed augmentation methods can
significantly improve malware classification performance, without altering the
memory or computation time needed. They allow a smaller network trained using
augmentation to exceed the performance of a network with no augmentation.

(a) Comparing parameter count, and classification performance with/without
data augmentation. Orange line - Networks with 32, 64, 128 and 256
convolutional filters trained without data augmentation. Blue Points -
Networks with 64 convolutional filters trained using data augmentation. Data
augmentation enables higher performance with smaller models (Results shown for
the Large Dataset).

(b) A 64 conv. filter network trained using data augmentation compared to
networks with 32, 64, 128 and 256 conv. filters trained without data
augmentation. Inference and training time and f1-score per-example are shown.
Data augmentation enables a smaller model to perform as well as a larger model
with the added benefit of lower training and inference time. (Results shown
for the Large Dataset).

Figure 2: Data augmentation performance in context.

###  4.6 Combinations of Augmentations

Figure 3: Combinations of data augmentation methods on the Large Dataset. Each
line shows the % difference in malware classification f1-score from the
baseline i.e., the network trained without data augmentation. Results are
shown over a range of augmentation strengths ($\alpha$).

In this section we study the performance of combinations of augmentation
methods. Using different augmentation methods together introduces more
variability into the training data, which may improve generalisation. Note
that we did not modify the augmentation methods to prevent interference or
provide knowledge of previous augmentations applied. As above, a network with
64 convolutional filters was trained using various combined augmentations. In
Fig. 3 we report results over a range of augmentation strengths. Note that due
to the computational costs of these experiments, only a small number of
combinations were tried. We selected combinations of augmentations based on
those that performed well individually. These experiments were performed on
the Large Dataset.

Fig 3 shows that the combination of Self-Embedding Language Model and Input
Dropout performed best out of the combinations tried. However this combination
does not quite outperform the self-embedding language model used alone. We
also find that when combinations of methods are used, the optimal augmentation
strength is lower. Further research is needed to find the optimal combination
of augmentation methods that complement each other.

##  5 Conclusion

In this paper we present a study of data augmentation techniques applied to
opcode sequence based malware classification. Of the basic augmentation
methods, the simplest method, Input Dropout, gives a consistent performance
boost across both datasets. However, the adaptive method, Self Embedding
Language Model, can give a larger improvement in performance compared to the
basic methods. It reduced the error rate by 18% on the small dataset and 12%
on the large dataset. Overall our work shows the potential of data
augmentation for opcode sequence based malware classification. However, that
further study will be required to develop more realistic augmentations and to
understand the combination of basic augmentations needed to give a consistent
performance improvement.

Method | Input Dropout | Random | Similar | Correlated | Lang. Model | Self-Embed
---|---|---|---|---|---|---
Dataset | Small | Large | Small | Large | Small | Large | Small | Large | Small | Large | Small | Large
Baseline | 0.94939 | 0.94363 | 0.94939 | 0.94363 | 0.94939 | 0.94363 | 0.94939 | 0.94363 | 0.94939 | 0.94363 | 0.94939 | 0.94363
$\alpha$ 0.05 | 0.94877 | 0.94537 | 0.95688 | 0.94780 | 0.95549 | 0.94721 | 0.95188 | 0.94794 | 0.95835 | 0.94866 | 0.9502 | 0.94666
$\alpha$ 0.1 | 0.95176 | 0.94689 | 0.94979 | 0.94595 | 0.95145 | 0.94721 | 0.9529 | 0.94799 | 0.94990 | 0.94829 | 0.95118 | 0.94926
$\alpha$ 0.2 | 0.95539 | 0.94918 | 0.95374 | 0.94647 | 0.95063 | 0.94604 | 0.95406 | 0.94860 | 0.94129 | 0.94731 | 0.95881 | 0.95061
$\alpha$ 0.3 | 0.94994 | 0.94739 | 0.94049 | 0.94286 | 0.94306 | 0.94350 | 0.95220 | 0.94650 | 0.94346 | 0.94434 | 0.9576 | 0.94873
$\alpha$ 0.4 | 0.94697 | 0.94681 | 0.94155 | 0.93952 | 0.94784 | 0.94353 | 0.95100 | 0.94353 | 0.93547 | 0.94085 | 0.95032 | 0.94775
$\alpha$ 0.5 | 0.94487 | 0.94274 | 0.93640 | 0.93551 | 0.94018 | 0.94045 | 0.94854 | 0.94241 | 0.93510 | 0.93908 | 0.95267 | 0.94827
Max | 0.95539 | 0.94918 | 0.95688 | 0.94780 | 0.95549 | 0.94721 | 0.95406 | 0.94860 | 0.95835 | 0.94866 | 0.95881 | 0.95061
Delta | 0.00600 | 0.00555 | 0.00749 | 0.00417 | 0.00610 | 0.00358 | 0.00467 | 0.00497 | 0.00896 | 0.00503 | 0.00942 | 0.00698
TABLE I: Comparison of all augmentation methods as the augmentation strength
($\alpha$) is varied between 0.05 and 0.5. Results are reported as average
f1-score from 5-fold cross-validation across Large and Small Datasets. Entries
in bold text denote improved performance compared to the baseline. Max - The
maximum absolute f1-score. Delta - The maximum absolute improvement over all
$\alpha$ values, compared to the baseline.

## References

  * [1] C. Shorten and T. M. Khoshgoftaar, “A survey on image data augmentation for deep learning,” _Journal of Big Data_ , vol. 6, no. 1, pp. 1–48, 2019.
  * [2] H. Zhang, M. Cisse, Y. N. Dauphin, and D. Lopez-Paz, “mixup: Beyond empirical risk minimization,” _arXiv preprint arXiv:1710.09412_ , 2017.
  * [3] N. McLaughlin, J. Martinez del Rincon, B. Kang, S. Yerima, P. Miller, S. Sezer, Y. Safaei, E. Trickel, Z. Zhao, A. Doupé _et al._ , “Deep android malware detection,” in _CODASPY_ , 2017, pp. 301–308.
  * [4] S. Millar, N. McLaughlin, J. Martinez del Rincon, P. Miller, and Z. Zhao, “Dandroid: A multi-view discriminative adversarial network for obfuscated android malware detection,” in _CODASPY_ , 2020, pp. 353–364.
  * [5] E. Raff, J. Barker, J. Sylvester, R. Brandon, B. Catanzaro, and C. K. Nicholas, “Malware detection by eating a whole exe,” in _Workshops at the Thirty-Second AAAI Conference on Artificial Intelligence_ , 2018.
  * [6] R. Kumar, Z. Xiaosong, R. U. Khan, I. Ahad, and J. Kumar, “Malicious code detection based on image processing using deep learning,” in _Proceedings of the 2018 International Conference on Computing and Artificial Intelligence_ , 2018, pp. 81–85.
  * [7] G. Canfora, F. Mercaldo, and C. A. Visaggio, “Mobile malware detection using op-code frequency histograms,” in _2015 12th International Joint Conference on e-Business and Telecommunications (ICETE)_ , vol. 4. IEEE, 2015, pp. 27–38.
  * [8] B. Kang, B. Kang, J. Kim, and E. G. Im, “Android malware classification method: Dalvik bytecode frequency analysis,” in _Proceedings of the 2013 research in adaptive and convergent systems_ , 2013, pp. 349–350.
  * [9] Q. Jerome, K. Allix, R. State, and T. Engel, “Using opcode-sequences to detect malicious android applications,” in _ICC_. IEEE, 2014, pp. 914–919.
  * [10] R. U. Khan, X. Zhang, and R. Kumar, “Analysis of resnet and googlenet models for malware detection,” _Journal of Computer Virology and Hacking Techniques_ , vol. 15, no. 1, pp. 29–37, 2019.
  * [11] X. Zhang, J. Zhao, and Y. LeCun, “Character-level convolutional networks for text classification,” in _Advances in Neural Information Processing Systems_ , 2015, pp. 649–657.
  * [12] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” _Neural computation_ , vol. 9, no. 8, pp. 1735–1780, 1997.
  * [13] J. Wei and K. Zou, “EDA: Easy data augmentation techniques for boosting performance on text classification tasks,” in _(EMNLP-IJCNLP)_. Association for Computational Linguistics, 2019\.
  * [14] Z. Xie, S. I. Wang, J. Li, D. Lévy, A. Nie, D. Jurafsky, and A. Y. Ng, “Data noising as smoothing in neural network language models,” in _ICLR_. OpenReview.net, 2017. [Online]. Available: https://openreview.net/forum?id=H1VyHY9gg
  * [15] J. Pennington, R. Socher, and C. D. Manning, “Glove: Global vectors for word representation,” in _Empirical Methods in Natural Language Processing (EMNLP)_ , 2014, pp. 1532–1543.
  * [16] X. Jiao, Y. Yin, L. Shang, X. Jiang, X. Chen, L. Li, F. Wang, and Q. Liu, “Tinybert: Distilling bert for natural language understanding,” in _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: Findings_ , 2020, pp. 4163–4174.
  * [17] F. O. Catak, J. Ahmed, K. Sahinbas, and Z. H. Khand, “Data augmentation based malware detection using convolutional neural networks,” _PeerJ Computer Science_ , vol. 7, p. e346, 2021.
  * [18] S. Millar, N. McLaughlin, J. M. del Rincon, and P. Miller, “Multi-view deep learning for zero-day android malware detection,” _Journal of Information Security and Applications_ , vol. 58, p. 102718, 2021.
  * [19] T. Chilimbi, Y. Suzue, J. Apacible, and K. Kalyanaraman, “Project adam: Building an efficient and scalable deep learning training system,” in _11th $\\{$USENIX$\\}$ Symposium on Operating Systems Design and Implementation ($\\{$OSDI$\\}$ 14)_, 2014, pp. 571–582.
  * [20] D. Shanmugam, D. Blalock, G. Balakrishnan, and J. Guttag, “When and why test-time augmentation works,” _arXiv preprint arXiv:2011.11156_ , 2020.
  * [21] A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” _Advances in neural information processing systems_ , vol. 25, pp. 1097–1105, 2012.
  * [22] N. Srivastava, G. Hinton, A. Krizhevsky, I. Sutskever, and R. Salakhutdinov, “Dropout: a simple way to prevent neural networks from overfitting,” _The journal of machine learning research_ , vol. 15, no. 1, pp. 1929–1958, 2014.
  * [23] Y. Bengio, “Neural net language models,” _Scholarpedia_ , vol. 3, no. 1, p. 3881, 2008, revision #140963.
  * [24] T. Mikolov, K. Chen, G. Corrado, and J. Dean, “Efficient estimation of word representations in vector space,” _arXiv preprint arXiv:1301.3781_ , 2013\.
  * [25] D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” _arXiv preprint arXiv:1412.6980_ , 2014.
  * [26] R. Řehůřek and P. Sojka, “Software Framework for Topic Modelling with Large Corpora,” in _Proceedings of the LREC 2010 Workshop on New Challenges for NLP Frameworks_. ELRA, 2010, pp. 45–50.


# The active muon shield in the SHiP experiment

A. Akmete43, A. Alexandrov12, A. Anokhina35, S. Aoki16, E. Atkin34, N.
Azorskiy25, J.J. Back49, A. Bagulya28, A. Baranov36, G.J. Barker49, A. Bay41,
V. Bayliss46, G. Bencivenni13, A.Y. Berdnikov33, Y.A. Berdnikov33, M.
Bertani13, C. Betancourt42, I. Bezshyiko42, O. Bezshyyko50, D. Bick7, S.
Bieschke7, A. Blanco24, J. Boehm46, M. Bogomilov1, K. Bondarenko50, W.M.
Bonivento11, A. Boyarsky50, R. Brenner38, D. Breton4, R. Brundler42, M.
Bruschi10, V. Büscher8, A. Buonaura12,d, S. Buontempo12, S. Cadeddu11, A.
Calcaterra13, M. Campanelli48, J. Chauveau5, A. Chepurnov35, M. Chernyavsky28,
K.-Y. Choi21, A. Chumakov2, P. Ciambrone13, G.M. Dallavalle10, N.
D’Ambrosio12,14, G. D’Appollonio11,c, G. De Lellis12,d, A. De Roeck39, M. De
Serio9,a, L. Dedenko35, A. Di Crescenzo12,d, N. Di Marco14, C. Dib2, H.
Dijkstra39, V. Dmitrenko34, D. Domenici13, S. Donskov31, A. Dubreuil40, J.
Ebert7, T. Enik25, A. Etenko29, F. Fabbri10, L. Fabbri10,b, O. Fedin32, G.
Fedorova35, G. Felici13, M. Ferro-Luzzi39, R.A. Fini9, P. Fonte24, C.
Franco24, T. Fukuda17, G. Galati12,d, G. Gavrilov31, S. Gerlach6, L. Golinka-
Bezshyyko50, D. Golubkov26, A. Golutvin47, D. Gorbunov27, S. Gorbunov28, V.
Gorkavenko50, Y. Gornushkin25, M. Gorshenkov30, V. Grachev34, E. Graverini42,
V. Grichine28, A. M. Guler43, Yu. Guz31, C. Hagner7, H. Hakobyan2, E. van
Herwijnen39, A. Hollnagel7, B. Hosseini11, M. Hushchyn36, G. Iaselli9,a, A.
Iuliano12,d, R. Jacobsson39, M. Jonker39, I. Kadenko50, C. Kamiscioglu44, M.
Kamiscioglu43, M. Khabibullin27, G. Khaustov31, A. Khotyantsev27, S.H. Kim20,
V. Kim32,33, Y.G. Kim22, N. Kitagawa17, J.-W. Ko23, K. Kodama15, A.
Kolesnikov25, D.I. Kolev1, V. Kolosov31, M. Komatsu17, N. Konovalova28, M.A.
Korkmaz43, I. Korol6, I. Korol’ko26, A. Korzenev40, S. Kovalenko2, I.
Krasilnikova30, K. Krivova34, Y. Kudenko27,34, V. Kurochka27, E. Kuznetsova32,
H.M. Lacker6, A. Lai11, G. Lanfranchi13, O. Lantwin47, A. Lauria12,d, H.
Lebbolo5, K.Y. Lee20, J.-M. Lévy5, L. Lopes24, V. Lyubovitskij2, J. Maalmi4,
A. Magnan47, V. Maleev32, A. Malinin29, A. Mefodev27, P. Mermod40, S.
Mikado18, Yu. Mikhaylov31, D.A. Milstead37, O. Mineev27, A. Montanari10, M.C.
Montesi12,d, K. Morishima17, S. Movchan25, N. Naganawa17, M. Nakamura17, T.
Nakano17, A. Novikov34, B. Obinyakov29, S. Ogawa19, N. Okateva28, P.H. Owen42,
A. Paoloni13, B.D. Park20, L. Paparella9, A. Pastore9,a, M. Patel47, D.
Pereyma26, D. Petrenko34, K. Petridis45, D. Podgrudkov35, V. Poliakov31, N.
Polukhina28,34, M. Prokudin26, A. Prota12,d, A. Rademakers39, F. Ratnikov36,
T. Rawlings46, M. Razeti11, F. Redi47, S. Ricciardi46, T. Roganova35, A.
Rogozhnikov36, H. Rokujo17, G. Rosa12, T. Rovelli10,b, O. Ruchayskiy3, T.
Ruf39, V. Samoylenko31, A. Saputi13, O. Sato17, E.S. Savchenko30, W. Schmidt-
Parzefall7, N. Serra42, A. Shakin30, M. Shaposhnikov41, P. Shatalov26, T.
Shchedrina28, L. Shchutska50, V. Shevchenko29, H. Shibuya19, A. Shustov34,
S.B. Silverstein37, S. Simone9,a, M. Skorokhvatov34,29, S. Smirnov34, J.Y.
Sohn20, A. Sokolenko50, N. Starkov28, B. Storaci42, P. Strolin12,d, S.
Takahashi16, I. Timiryasov41, V. Tioukov12, N. Tosi10, D. Treille39, R.
Tsenov1,25, S. Ulin34, A. Ustyuzhanin36, Z. Uteshev34, G. Vankova-Kirilova1,
F. Vannucci5, P. Venkova1, S. Vilchinski50, M. Villa10,b, K. Vlasik34, A.
Volkov28, R. Voronkov28, R. Wanke8, J.-K. Woo23, M. Wurm8, S. Xella3, D.
Yilmaz44, A.U. Yilmazer44, C.S. Yoon20, Yu. Zaytsev26 1Faculty of Physics,
Sofia University, Sofia, Bulgaria
2Universidad Técnica Federico Santa María and Centro Científico Tecnológico de
Valparaíso, Valparaíso, Chile
3Niels Bohr Institute, University of Copenhagen, Copenhagen, Denmark
4LAL, Université Paris-Sud 11, CNRS/IN2P3, Orsay, France
5LPNHE, Université Pierre et Marie Curie, Université Paris Diderot,
CNRS/IN2P3, Paris, France
6Humboldt-Universität zu Berlin, Berlin, Germany
7Universität Hamburg, Hamburg, Germany
8Johannes Gütenberg Universität Mainz, Mainz, Germany
9Sezione INFN di Bari, Bari, Italy
10Sezione INFN di Bologna, Bologna, Italy
11Sezione INFN di Cagliari, Cagliari, Italy
12Sezione INFN di Napoli, Napoli, Italy
13Laboratori Nazionali dell’INFN di Frascati, Frascati, Italy
14Laboratori Nazionali dell’INFN di Gran Sasso, L’Aquila, Italy
15Aichi University of Education, Kariya, Japan
16Kobe University, Kobe, Japan
17Nagoya University, Nagoya, Japan
18College of Industrial Technology, Nihon University, Narashino, Japan
19Toho University, Funabashi, Chiba, Japan
20Gyeongsang National University, Jinju, Korea
21Chonnam National University e, Gwangju, Korea
22Gwangju National University of Education e, Gwangju, Korea
23Jeju National University e, Jeju, Korea
24LIP, Universidade de Coimbra, Coimbra, Portugal
25Joint Institute of Nuclear Research (JINR), Dubna, Russia
26Institute of Theoretical and Experimental Physics (ITEP) NRC ’Kurchatov
Institute’, Moscow, Russia
27Institute for Nuclear Research of the Russian Academy of Sciences (INR RAS),
Moscow, Russia
28P.N. Lebedev Physical Institute (LPI), Moscow, Russia
29National Research Centre ’Kurchatov Institute’, Moscow, Russia
30National University of Science and Technology "MISiS" f, Moscow, Russia
31Institute for High Energy Physics (IHEP) NRC ’Kurchatov Institute’,
Protvino, Russia
32Petersburg Nuclear Physics Institute (PNPI) NRC ’Kurchatov Institute’,
Gatchina, Russia
33St. Petersburg Polytechnic University (SPbPU) g, St. Petersburg, Russia
34National Research Nuclear University (MEPhI), Moscow, Russia
35Skobeltsyn Institute of Nuclear Physics of Moscow State University (SINP
MSU), Moscow, Russia
36Yandex School of Data Analysis, Moscow, Russia
37Stockholm University, Stockholm, Sweden
38Uppsala University, Uppsala, Sweden
39European Organization for Nuclear Research (CERN), Geneva, Switzerland
40University of Geneva, Geneva, Switzerland
41École Polytechnique Fédérale de Lausanne (EPFL), Lausanne, Switzerland
42Physik-Institut, Universität Zürich, Zürich, Switzerland
43Middle East Technical University (METU), Ankara, Turkey
44Ankara University, Ankara, Turkey
45H.H. Wills Physics Laboratory, University of Bristol, Bristol, United
Kingdom
46STFC Rutherford Appleton Laboratory, Didcot, United Kingdom
47Imperial College London, London, United Kingdom
48University College London, London, United Kingdom
49University of Warwick, Warwick, United Kingdom
50Taras Shevchenko National University of Kyiv, Kyiv, Ukraine
aUniversità di Bari, Bari, Italy
bUniversità di Bologna, Bologna, Italy
cUniversità di Cagliari, Cagliari, Italy
dUniversità di Napoli “Federico II”, Napoli, Italy
eAssociated to Gyeongsang National University, Jinju, Korea
fAssociated to P.N. Lebedev Physical Institute (LPI), Moscow, Russia
gAssociated to Petersburg Nuclear Physics Institute (PNPI), Gatchina, Russia

###### Abstract

The SHiP experiment is designed to search for very weakly interacting
particles beyond the Standard Model which are produced in a 400 GeV/c proton
beam dump at the CERN SPS. An essential task for the experiment is to keep the
Standard Model background level to less than 0.1 event after $2\times 10^{20}$
protons on target. In the beam dump, around $10^{11}$ muons will be produced
per second. The muon rate in the spectrometer has to be reduced by at least
four orders of magnitude to avoid muon-induced combinatorial background. A
novel active muon shield is used to magnetically deflect the muons out of the
acceptance of the spectrometer. This paper describes the basic principle of
such a shield, its optimization and its performance.

##  1 Introduction

The SHiP experiment [1] is a new general purpose fixed target facility
proposed at the CERN SPS accelerator to search for new physics in the largely
unexplored domain of very weakly interacting particles with masses below
$\mathcal{O}(10)~{}\mathrm{GeV/c^{2}}$ and c$\tau$ of kilometers [2]. The
facility is designed to maximize the production of charm and beauty mesons,
while providing the cleanest possible environment. The 400 GeV/c proton beam
extracted from the SPS will be dumped into a molybdenum-tungsten target, with
the aim of accumulating $2\times 10^{20}$ protons on target (POT) during five
years of operation. The charm production at SHiP exceeds that of any existing
or presently planned facility.

For radiation protection, a 5 m thick iron shield is placed behind the target
to absorb hadrons. The SPS will deliver $4\times 10^{13}$ POT during a one
second long spill, which produces on the order of $10^{11}$ muons/s mainly
from the decay of $\pi$, $\rm{K}$, $\rho$, $\omega$ and charmed mesons. These
muons would give rise to a serious background for many hidden particle
searches, and hence their flux has to be reduced by at least four orders of
magnitude. The SHiP experiment will use of a series of magnets to deflect the
muons out of the acceptance of the spectrometer. Any hidden sector particle
originating from charm or beauty meson decay will be produced with a
significant transverse momentum with respect to the beam axis111In the SHiP
coordinate system the z-axis is along the beam line and the y-axis is pointing
upward.. In order to maximize acceptance, the detector therefore should be
placed as close as possible to the target, and hence the muon shield should be
as short as possible. Behind the muon shield a dedicated detector will probe a
variety of models with long lived exotic particles with masses below
$\mathcal{O}(10)~{}\rm{GeV/c^{2}}$. The detector is designed to fully
reconstruct the exclusive decays of hidden sector particles and to reject the
background down to below 0.1 events in the sample of $2\times 10^{20}$ POT.

The detector is based on a 50 m long decay volume, housing a $5\times 10~{}\rm
m^{2}$ spectrometer magnet which is sandwiched between tracker stations. To
suppress the background from neutrinos interacting in the fiducial volume, the
decay volume is maintained under a vacuum since at atmospheric pressure $\sim
10^{5}$ neutrino interactions are expected for $2\times 10^{20}$ POT. The
spectrometer is designed to accurately reconstruct the decaying particle’s
decay vertex, its mass and its impact parameter. Behind the last tracking
station, a dedicated timing detector with resolution less than 100 ps measures
the coincidence of the decay products, which allows the rejection of
combinatorial backgrounds. The timing detector is followed by a set of
calorimeters and by muon chambers to provide identification of electrons,
photons, muons and charged hadrons. The decay volume is surrounded by
background taggers to detect the products of neutrino and muon inelastic
scattering in the surrounding structures, which may produce long lived
Standard Model $\rm{V}^{0}$ particles, such as $\rm{K}_{\rm{L}}$, that have a
similar decay topology to the expected signals.

The experimental facility is also ideally suited for studying interactions of
the least known tau neutrinos [3]. It will therefore host in between the muon
shield and the decay volume an emulsion target with a maximum acceptable
charged particle flux of $10^{3}$/mm2 for an exposure based on the emulsion
cloud concept developed in OPERA [4] and a muon spectrometer.

In the simulation, fixed target collisions of protons are generated by PYTHIA8
[5], neutrino interactions by GENIE [6] and inelastic muon interactions by
PYTHIA6 [7]. The heavy flavor production in cascade interactions is also taken
into account [8]. The SHiP detector response is simulated in the GEANT4 [9]
framework. All the simulation is performed within the FairRoot [10] framework.

While muons can easily be deflected out of the acceptance of the spectrometer
by a magnetic field, the problem is the large spread in the phase space of
muons, as shown in figure 1, with the consequence that the return field of the
magnets tend to bend muons back towards the spectrometer. The DONUT [3]
experiment employed a combination of magnetic and passive shielding to clear
muons from their emulsion target, which was located 36 m downstream of the
target. SHiP will accumulate three orders of magnitude more protons on target,
and hence requires a much larger reduction in muon flux for both the emulsion
and the hidden sector particles search. To achieve this SHiP will employ the
novel magnetic shielding concept described in this paper.

The basic magnetic configuration that addresses these issues is presented in
the next section. Section 3 describes the optimization procedure with a
simplified Monte Carlo tool to obtain a layout which reduces the muon flux
sufficiently for a minimum size of the system. The optimization is checked by
implementing the obtained layout in the GEANT4-based SHiP software package,
and its performance is presented in section 4. The last section discusses
possible improvements and gives an outlook for obtaining the final design of
the SHiP muon shield.

Figure 1: Transverse momentum versus momentum distribution of muons, as
generated by Pythia [5, 7].

##  2 The basic principle of magnet based muon shielding

The principle of the magnet based shielding is shown in 2-D in figure 2. The
first part of the shield should be long enough, i.e. providing sufficient
$\int Bdl$, to separate both muon polarities to either side of the z-axis. For
a 350 GeV/c muon, taking into account the $p_{T}$ distribution at its
production point, this requires a $\sim 18$ m long magnet with a field222When
using a high permeability material such as Grain Oriented steel a 1.8 T flux
density could be obtained while the coils would dissipate low enough power so
that they could be cooled with air [11]. in the iron of 1.8 T.

Lower momentum muons, which traverse the return field of this magnet, will be
bent back in the direction of the spectrometer as is shown in figure 2 for a
50 GeV/c muon. To shield the spectrometer from these muons, an additional
magnet is added with opposite polarity field close to the z-axis, and hence
the lower momentum muons will be swept out again. At the start of this second
magnet, the two field polarities should be as close in x as possible . A
magnet design study [11] shows that an air gap as small as 2 cm between the
two field polarities can be used without distorting the 1.8 T field in the
iron.

Figure 2: Cross section at y=0 shows the principle of magnetic shielding. The
magnetic field is along the y-axis, and its polarity is indicated by the
blue/green color of the iron poles of the magnets. The trajectories of a 350
GeV/c muon and 50 GeV/c muon are shown with a full and dashed line,
respectively.

##  3 Simulations and optimization

To test the basic principle of the muon shielding concept described in section
2 and optimize its layout, a fast program was written which traces the muons
through the magnets. Each magnet is described by the following seven
parameters: length and, at either end, widths, heights, and air-gap widths
between field and return field. Muons are traced through a setup with a step
size of 5 cm, and only the following physics processes are taken into account:
bending in a 1.8 T magnetic field, specific energy loss ($dE/dx$) and Gaussian
smeared multiple Coulomb scattering.

The aim is to design the shortest possible shield which allows no muons to
reach the spectrometer, while at the same time being affordable and hence
using as little iron as possible. These requirements are combined into a
single penalty function which is then minimized. The penalty function is given
by

$\frac{W\times(1+\Sigma\chi_{\mu^{+}})}{A}$ (3.1)

where:

  * •

All muons are assigned a positive charge, and the magnetic fields are oriented
to bend the muons towards positive x at the last tracking station. The
transverse (x,y) position of muons is obtained at the last tracking station,
which has a sensitive area of $5\times 10\rm~{}m^{2}$, by tracing their
trajectory 64 m downstream of the shield. Their position at the last tracking
station is converted to a smooth function to allow the optimization to sense
that it moves all $\mu^{+}$ out of the acceptance of the last tracking
station. Hence, with $|y|<5$ m, their x-position is converted into
$\chi_{\mu^{+}}=\sqrt{(5.6-(x+3.))/5.6}$ for $-3<x<2.6$ m, else
$\chi_{\mu^{+}}=0$;

  * •

$A=1.-L/100$: Approximately the relative acceptance of a new long lived
particle in a benchmark scenario, where $L$ is the length of the shield in m;

  * •

$W$: Weight of the shield in tonnes of iron;

  * •

The sum is taken over all muons.

The optimization uses Minuit [12] to minimize penalty function (3.1) by
varying the size of the magnets. Only muons with $p(\mu)>1$ GeV/c at the last
tracking station are considered as background muons, since only larger
momentum tracks will be used in the searches. Magnet transverse sizes are only
allowed to vary by quanta of 1 cm. Magnet length sizes are only allowed to
vary by quanta of 10 cm. To assure that a muon which traverses the same
geometry returns the same contribution to the penalty function the tracing of
each muon is always started with a random number seeded by its momentum. For
simplicity, the optimization is made with seven magnets. Future work will try
to vary the number of magnets. The first two magnets after the beam dump are
also required for radiation protection and their lengths are fixed to 1.4 and
3.4 m respectively, their gaps are fixed to 2 cm and they have the same height
at either end of each magnet.

Muons have been generated with Pythia [5, 7], corresponding to $\sim 10^{10}$
POT, and the Minuit SIMPLEX function varies 41 parameters to minimize the
penalty function. After convergence, none of the muons traverse the last
tracking station for a total shield length of 34 m. Its layout and performance
is presented in the next section.

##  4 Active muon shield performance

The SHiP experiment simulations are performed in the software package FairShip
[1]. FairShip is mostly a collection of libraries and scripts based on the
FairRoot framework [10], which is fully based on the ROOT software framework
[13]. In the framework, users can construct their detectors, and perform
simulation and analysis without any code dependence on a specific Monte Carlo
simulation software. FairRoot uses the ROOT geometry package TGeo to build,
browse, track and visualize a detector geometry. The muon shield can be made
of two different magnet types, that are depicted in figure 3. When there is
enough air-gap between the iron yokes with the opposite field direction to
place a coil a magnet of type a) in figure 3 is used. If the optimization
requires an air-gap which is too small to accommodate a coil, a magnet of type
b) in figure 3, which has place for coils at the top and bottom, is used.

Figure 3:  A view in the x-y plane of the two magnet configurations. In
configuration a) the air-gap is large enough anywhere along y to place a coil.
Configuration b) has an air-gap close to 2 cm at y=0, and hence the program
will create large enough air-gaps at the top and bottom of the magnet to
accommodate the coils.

In addition, the following boundary conditions are imposed to assure a
realistic implementation of the magnets:

  * •

For every cross section in the xy-plane, the width of the iron is large enough
everywhere to sustain the same magnetic flux;

  * •

Minimum air-gap between opposite field directions is 2 cm;

  * •

Minimum air-gap for accommodating coils in the plane perpendicular to the beam
direction is 20 cm;

  * •

Minimum air-gap between magnets along the beam direction is 10 cm;

  * •

Mitred joints between volumes with horizontal and vertical fields are imposed
to lower their magnetic reluctance [11].

The geometry optimization results in a shield layout shown in figure 4,
weighing 1845 tonnes, which does not include the supports.

Figure 4: Geometric view of the optimized muon shield, showing at the top, the
z-y plane view, and at the bottom, the z-x plane view. SHiP defines the origin
of the coordinate system to be in the center of the decay vessel. Color
shading is used to enhance the contrast between different magnetic field
orientations.

To test the background with the prototype shielding in FairShip, only target,
muon shield, tracking stations and spectrometer magnet were included in the
simulation. The last tracking station is located 64 m downstream of the last
shielding magnet.

The simulation is first run with all the material of the shield in place, but
with the magnetic field switched off. This results in $\sim 3.1\times 10^{9}$
muons which traverse the last tracking station during one SPS spill of
$4\times 10^{13}$ POT. Switching on the magnetic field reduces this rate to
$\sim 3.0\times 10^{5}$ muons/s, of which $\sim 6.5\times 10^{4}$ have momenta
larger than 3 GeV/c. These muon rates are sufficiently low to cause
insignificant background levels in the experiment.

Examining the muons which do reach the last tracking station reveals that they
are mainly due to two effects which are not included in the optimization
procedure, namely catastrophic energy loss [14] and very large scattering
angles.

##  5 Discussion and outlook

A magnetic deflecting system for muons is presented, which provides the
required rate reduction of muons for the SHiP experiment and fulfills the
emulsion requirements described in the introduction. The design is optimized
to reduce muon background in the spectrometer for the shortest possible shield
and the lowest iron usage. The optimized geometry of the shield is 34 m long
and its weigth is 1845 tonnes not including its supports. As coming from
FairShip simulation, given that the muons which do traverse the system are due
to physics processes which have not been included in the optimization program,
the shield will be further optimized using all physics processes as
implemented in GEANT4 [9]. This will increase the required CPU time by several
orders of magnitude. In addition, it is found that a large flux of electrons
and photons is produced by the muons traversing the magnets. Their momentum is
typically below a GeV/c, and hence they do not constitute a source of
background directly. However, the SHiP decay vessel is surrounded by detectors
to tag any charged particle entering the vessel. Moreover, the emulsion target
upstream is also sensitive to low energy electrons that may spoil its
reconstruction capability. Hence, the flux of these particles has to also be
controlled to ensure an effective use of these surround taggers. A future
optimization will include the flux of electrons and photons through the
taggers and emulsion detectors in the penalty function.

## References

  * [1] The SHiP Collaboration, A facility to Search for Hidden Particles (SHIP) at the CERN SPS, April 2015, arXiv:1504.04956v1.
  * [2] S. Alekhin et. al, A facility to Search for Hidden Particles at the CERN SPS: the SHiP physics case, _Rept. Prog. Phys._ , 79, 124-201 (2016).
  * [3] The DONUT Collaboration, Observation of Tau Neutrino Interactions, _Phys.Lett._ , B504, 218-224 (2001).
K. Kodama et al., Final tau-neutrino results from the DONuT experiment _Phys.
Rev. D_ 78, 052002 (2008).

  * [4] R. Acquafredda et al., The OPERA experiment in the CERN to Gran Sasso neutrino beam, _$JINST~{}4$_ , P04018, (2009). doi: 10.1088/1748-0221/4/04/P04018.
  * [5] T. Sjöstrand, S. Mrenna, and P. Skands, , A brief introduction to PYTHIA 8.1, _Comput.Phys.Commun._ , 178, 852-867, 2008, doi:10.1016/j.cpc.2008.01.036.
  * [6] C. Andreopoulos, A. Bell, D. Bhattacharya, F. Cavanna, J. Dobson, et al., The GENIE Neutrino Monte Carlo Generator, _Nucl.Instrum.Meth._ , A614, 87-104, 2010, doi:10.1016/j.nima.2009.12.009.
  * [7] T. Sjöstrand, S. Mrenna, and P. Skands, , PYTHIA 6.4 physics and manual, _JHEP_ ,05, 026, 2006, doi:10.1088/1126-6708/2006/05/026.
  * [8] H. Dijkstra, T. Ruf, Heavy Flavour Cascade Production in a Beam Dump, SHiP-NOTE-2015-009 (2015).
  * [9] S. Agostinelli, et al. , GEANT4: A Simulation toolkit, _Nucl.Instrum.Meth._ , A506, 250-303, 2003, doi:10.1016/S0168-9002(03)01368-8.
  * [10] M. Al-Turany, D. Bertini, R. Karabowicz, D. Kresan, P. Malzacher, et al., The FairRoot framework, _J.Phys.Conf.Ser._ , 396, 022001, 2012, doi:10.1088/1742-9596/396/2/022001.
  * [11] V. Bayliss, M. Courthold, T. Rawlings, Active Muon Shield - Preliminary Design Report, CERN-SHiP-NOTE-2015-003 (2015).
  * [12] F. James, MINUIT Function Minimization and Error Analysis: Reference Manual Version 94.1, CERN Program Library Long Writeup D506 (1998).
  * [13] Rene Brun and Fons Rademakers, ROOT - An Object Oriented Data Analysis Framework, Proceedings AIHENP’96 Workshop, Lausanne, Sep. 1996, _Nucl. Inst. and Meth. in Phys. Res._ , A 389 (1997) 81-86.
  * [14] K. Bachas et al., Studies of catastrophic muon energy losses in ATLAS H8 combined Testbeam data, _Nuclear Physics B (Proc. Suppl.)_ 177-178 (2008) 320-321.