# Fermion Dark Matter and Radiative Neutrino Masses from Spontaneous Lepton
Number Breaking

Cesar Bonilla<EMAIL_ADDRESS>Physik-Department T30d, Technische
Universität München. James-Franck-Strasse, 85748 Garching, Germany.
Departamento de Física, Universidad Católica del Norte, Avenida Angamos 0610,
Casilla 1280, Antofagasta, Chile.  Leon M.G. de la Vega
<EMAIL_ADDRESS>Instituto de Física, Universidad Nacional
Autónoma de México, A.P. 20-364, Ciudad de México 01000, México.  J. M.
Lamprea<EMAIL_ADDRESS>Instituto de Física, Universidad Nacional
Autónoma de México, A.P. 20-364, Ciudad de México 01000, México.  Mesoamerican
Centre for Theoretical Physics – UNACH, ctra. Zapata km 4, 29040, Tuxtla
Gutiérrez, México Roberto A. Lineros<EMAIL_ADDRESS>Departamento de
Física, Universidad Católica del Norte, Avenida Angamos 0610, Casilla 1280,
Antofagasta, Chile.  Eduardo Peinado<EMAIL_ADDRESS>Instituto de
Física, Universidad Nacional Autónoma de México, A.P. 20-364, Ciudad de México
01000, México.

###### Abstract

In this paper, we study the viability of having a fermion Dark Matter particle
below the TeV mass scale in connection to the neutrino mass generation
mechanism. The simplest realization is achieved within the scotogenic model
where neutrino masses are generated at the 1-loop level. Hence, we consider
the case where the dark matter particle is the lightest $\mathbb{Z}_{2}$-odd
Majorana fermion running in the neutrino mass loop. We assume that lepton
number is broken dynamically due to a lepton number carrier scalar singlet
which acquires a non-zero vacuum expectation value. In the present scenario
the Dark Matter particles can annihilate via $t$\- and $s$-channels. The
latter arises from the mixing between the new scalar singlet and the Higgs
doublet. We identify three different Dark Matter mass regions below 1 TeV that
can account for the right amount of dark matter abundance in agreement with
current experimental constraints. We compute the Dark Matter-nucleon spin-
independent scattering cross-section and find that the model predicts spin-
independent cross-sections “naturally” dwelling below the current limit on
direct detection searches of Dark Matter particles reported by XENON1T.

Neutrino Mass, Dark Matter

###### pacs:

14.60.Pq, 12.60.Fr, 14.80.-j

##  I Introduction

The observed fundamental particles as well as their interactions via the
strong and electroweak forces are well described under the Standard Model (SM)
picture. However, the SM predicts massless neutrinos contradicting neutrino
oscillation experiments which indicate that at most one active neutrino can be
massless Whitehead (2016); Decowski (2016); Abe  _et al._ (2017); de Salas
_et al._ (2018); Capozzi  _et al._ (2016); Esteban  _et al._ (2019). In
addition, so far there is no experimental evidence on the exact mechanism
chosen by nature to generate neutrino masses. In this regard, the most popular
idea to circumvent this mismatch between the SM and neutrino oscillation data
is to assume that neutrinos are Majorana particles and invoke the so-called
$seesaw$ mechanism Minkowski (1977); Yanagida (1979); Mohapatra and Senjanovic
(1980); Schechter and Valle (1980, 1982); Foot  _et al._ (1989). Furthermore,
the SM does not provide a candidate to account for the dark matter (DM) relic
abundance in the Universe. The dark matter constitutes about 80% of the matter
content of the Universe and its presence is strongly supported by
observational evidence at multiple scales, through gravitational effects, its
role in structure formation and influence in the features of the Cosmic
Microwave Background (CMB). By looking at the CMB and other observables, the
Planck collaboration has put the following limit on the dark matter relic
abundance Aghanim  _et al._ (2018),

$\Omega_{c}h^{2}=0.1200\pm 0.0012\ \ \text{at}\ \ 68\%\,\text{C.L}.$ (1)

Theoretically, it is very tempting to think that the DM sector and neutrino
mass generation mechanism are linked. This connection appears naturally when
the neutrino masses are generated at the loop level Ma (2006). In such
scenarios, the smallness of the neutrino masses is due to a loop suppression
and the additional particles carry a non-trivial charge under an unbroken
symmetry which is responsible for DM stability. The simplest idea in this
regard is the so-called Scotogenic model Ma (2006), where the neutrino masses
are generated at the 1-loop level. In this model, the DM candidate happens to
be the lightest particle running inside the loop with an odd charge under a
$\mathbb{Z}_{2}$ discrete symmetry. It could be either bosonic, a CP-even
(odd) scalar, or fermionic, a heavy Majorana particle. The strong connection
between DM and neutrino mass generation has driven novel studies within this
context Hagedorn  _et al._ (2018); Blennow  _et al._ (2019) as well as new
variants Fileviez Pérez  _et al._ (2019).

Here we have considered the case where the neutrino mass is generated after
the spontaneous breaking of lepton number in the Scotogenic model Babu and Ma
(2008) leading to the existence of the Majoron, $J$, a physical Nambu-
Goldstone boson Chikashige  _et al._ (1981); Schechter and Valle (1982). As a
consequence, an invisible Higgs decay channel opens up contributing to its
total decay width Joshipura and Rindani (1992); Romao  _et al._ (1992);
Joshipura and Valle (1993); Bonilla  _et al._ (2015). On top of that, in this
model there are two DM annihilation channels when the DM is a Majorana
fermion. One is mediated by $\mathbb{Z}_{2}$-odd particles (t-channel) Kubo
_et al._ (2006) and the other one (s-channel) Babu and Ma (2008); Aranda  _et
al._ (2019) coming from the mixing between the scalar singlet and the SM model
Higgs after the spontaneous breaking of lepton number and electroweak
symmetries. The latter helps to explain DM relic abundance in the Universe for
DM masses below the TeV region.

We organized the paper as follows: we introduce the model in the next Section.
All the constraints used in our analysis are given in Section III. We describe
how the analysis is made and we present our results in Section IV. Finally, we
conclude in Section V.

##  II The model

We consider a model where a scalar singlet $\sigma$, a $SU(2)_{L}$ scalar
doublet $\eta$ with hypercharge $1/2$, and three generations of Majorana
fermions $N_{i}$ (with $i=1,2,3$) are added to Standard Model. It is assumed
that the scalar doublet $\eta=(\eta^{+},\eta^{0})^{T}$ and the Majorana
fermions have an odd charge under an unbroken discrete $\mathbb{Z}_{2}$
symmetry. This setup can be seen as an extension of the _Scotogenic_ model Ma
(2006). Hence, the lightest $\mathbb{Z}_{2}$-odd particle turns out to be a
stable DM candidate. Furthermore, we consider the case where the masses of the
heavy Majorana fermions are dynamically generated when the scalar singlet gets
a vacuum expectation value $\langle\sigma\rangle$. This requires that the
scalar singlet $\sigma$ has a non-trivial charge under lepton number and is
responsible of the neutrino mass generation after spontaneous symmetry
breaking. The particle content and charge assignments of the model are shown
in Table 1.

|  X $L_{i}$ X |  X$\ell_{R_{i}}$X |  X $\Phi$ X |  X $\eta$ X |  X $N_{i}$ X |  X $\sigma$ X
---|---|---|---|---|---|---
$SU(2)_{L}$ | $2$ | $1$ | $2$ | $2$ | $1$ | $1$
$U(1)_{Y}$ | $-1/2$ | $-1$ | $1/2$ | $1/2$ | $0$ | $0$
$U(1)_{L}$ | $-1$ | $-1$ | $0$ | $0$ | $-1$ | $2$
$\mathbb{Z}_{2}$ | $+$ | $+$ | $+$ | $-$ | $-$ | $+$
Table 1: Particle content and charge assignments of the model.

Considering the particle content and additional symmetries, the renormalizable
$\mbox{SM}\,\otimes\,U(1)_{L}\otimes\mathbb{Z}_{2}$ invariant Lagrangian for
leptons is given by:

$-\mathcal{L}_{\text{Y}}\supset
Y^{\ell}_{ij}\bar{L}_{i}\Phi\ell_{R_{j}}+Y^{\nu}_{ij}\,\bar{L}_{i}\tilde{\eta}N_{j}+\cfrac{1}{2}Y^{N}_{ij}\,\sigma\bar{N}^{c}_{i}N_{j}+\textit{h.c.},$
(2)

where $\tilde{\eta}=i\tau_{2}\eta^{*}$, $L_{i}=(\nu_{L_{i}},\ell_{L_{i}})^{T}$
with $i,j=\leavevmode\nobreak\ e,\leavevmode\nobreak\ \mu$ and $\tau$. The
scalar fields

$\displaystyle\Phi=\begin{pmatrix}\phi^{+}\\\ \phi^{0}\end{pmatrix}$ and
$\displaystyle\ \ \eta=\begin{pmatrix}\eta^{+}\\\ \eta^{0}\end{pmatrix},$ (3)

denote the usual SM Higgs doublet and the inert doublet respectively. On the
other hand, the scalar potential of the model reads

$\displaystyle V$
$\displaystyle=\mu_{1}^{2}\Phi^{\dagger}\Phi+\mu_{2}^{2}\eta^{\dagger}\eta+\mu_{3}^{2}\sigma^{*}\sigma+\lambda_{1}(\Phi^{\dagger}\Phi)^{2}+\lambda_{2}(\eta^{\dagger}\eta)^{2}+\lambda_{3}(\eta^{\dagger}\eta)(\Phi^{\dagger}\Phi)$
$\displaystyle+\lambda_{4}(\eta^{\dagger}\Phi)(\Phi^{\dagger}\eta)+\displaystyle\frac{\lambda_{5}}{2}\left[(\eta^{\dagger}\Phi)^{2}+(\Phi^{\dagger}\eta)^{2}\right]+\lambda_{6}(\sigma^{*}\sigma)^{2}$
$\displaystyle+\lambda_{7}(\sigma^{*}\sigma)(\Phi^{\dagger}\Phi)+\lambda_{8}(\sigma^{*}\sigma)(\eta^{\dagger}\eta).$

For simplicity, the dimensionless parameters $\lambda_{i}$ (with $i=1,...,8$)
in the last equation are assumed to be real. The scalar singlet $\sigma$ and
the neutral component of the doublet $\Phi$ in eq. (II) can be shifted as
follows

$\sigma=\frac{v_{\sigma}}{\sqrt{2}}+\frac{R_{1}+i\,I_{1}}{\sqrt{2}}\ \
\text{and}\ \
\phi^{0}=\frac{v_{\Phi}}{\sqrt{2}}+\frac{R_{2}+i\,I_{2}}{\sqrt{2}},$ (5)

where $v_{a}$ (with $a=\sigma,\Phi$) are the vacuum expectation values and
$v_{\Phi}=246$ GeV; $R_{j}$ and $I_{j}$ (with $j=1,2$) represent the CP-even
and CP-odd parts of the fields.

###  II.1 Mass spectrum

Computing the second derivatives of the scalar potential in eq. (II) and
evaluating them at the minimum of the potential, one gets the CP-even and CP-
odd mass matrices, $M^{2}_{R}$ and $M^{2}_{I}$ respectively. There are two CP-
odd massless fields, one of them corresponds to the longitudinal component of
the $Z$ boson and the other one is a physical Nambu-Goldstone boson resulting
from the spontaneous breaking of the $U(1)_{L}$ symmetry, the Majoron $J$
Chikashige  _et al._ (1981); Schechter and Valle (1982). Hence,

$J\equiv I_{1},\ \ G^{0}\equiv I_{2}\ .$ (6)

For the CP-even part, one can define the two mass eigenstates $h_{i}$ through
the rotation matrix $O_{R}$ as follows,

$\begin{pmatrix}h_{1}\\\\[5.69054pt]
h_{2}\end{pmatrix}=O_{R}\begin{pmatrix}R_{1}\\\\[5.69054pt]
R_{2}\end{pmatrix}\equiv\begin{pmatrix}\cos\alpha&\sin\alpha\\\\[5.69054pt]
-\sin\alpha&\cos\alpha\end{pmatrix}\ \begin{pmatrix}R_{1}\\\\[5.69054pt]
R_{2}\end{pmatrix}\,.$ (7)

The angle $\alpha$ is interpreted as the doublet-singlet mixing angle. Then,
we have that

$O_{R}\,M^{2}_{R}\,O^{T}_{R}=\text{diag}(m^{2}_{h_{1}},m^{2}_{h_{2}})\,.$ (8)

where $M_{R}^{2}$ is the squared CP-even mass matrix whose eigenvalues are
given by,

$m^{2}_{(h_{1},h_{2})}=\left(\lambda_{1}v_{\Phi}^{2}+\lambda_{6}v_{\sigma}^{2}\right)\mp\sqrt{\lambda^{2}_{7}v_{\Phi}^{2}v_{\sigma}^{2}+(\lambda_{1}v_{\Phi}^{2}-\lambda_{6}v_{\sigma}^{2})^{2}},$
(9)

where the “$-$” (“$+$”) sign corresponds to $h_{1}$ ($h_{2}$). Notice that one
of these scalar has to be associated to the SM Higgs boson with a $125.09$ GeV
mass Aad  _et al._ (2015). Furthermore, the masses of the CP-even and CP-odd
components of the inert doublet, $\eta$, turn out to be

$m^{2}_{(\eta_{R},\eta_{I})}=\mu^{2}_{2}+\frac{\lambda_{8}}{2}v_{\sigma}^{2}+\frac{\lambda_{3}+\lambda_{4}\pm\lambda_{5}}{2}v_{\Phi}^{2}.$
(10)

The mass of the charged scalar field is given by,

$m^{2}_{\eta^{\pm}}=\mu_{2}^{2}+\frac{\lambda_{3}}{2}v_{\Phi}^{2}+\frac{\lambda_{8}}{2}v_{\sigma}^{2}.$
(11)

Notice that the masses of the CP-even and CP-odd fields satisfy the relation
$\lambda_{5}v_{\Phi}^{2}=(m^{2}_{\eta_{R}}-m^{2}_{\eta_{I}})$.

As it was mentioned before, neutrino masses are generated dynamically like the
rest of the SM fermions. That is, the Majorana masses of $N_{i}$ as well as
the light neutrinos arise after the spontaneous breaking of the global
$U(1)_{L}$ symmetry. From eq. (2) follows that the mass matrix for the $N_{i}$
fields is given by

$(m_{N})_{ij}=\sqrt{2}Y^{N}_{ij}v_{\sigma}.$ (12)

The one-loop neutrino mass generation is depicted in Fig. 1.

Figure 1: One-loop Feynman diagram for neutrino mass generation.

After the electroweak symmetry breaking one gets that the light neutrino mass
matrix is given by the following expression Ma (2006); Babu and Ma (2008)

$(M_{\nu})_{ij}=\sum_{k=1}^{3}\frac{Y^{\nu}_{ik}\,Y^{\nu}_{kj}m_{N_{k}}}{32\pi^{2}}\left[\frac{m_{\eta_{R}}^{2}}{m_{\eta_{R}}^{2}-m_{N_{k}}^{2}}\log\frac{m_{\eta_{R}}^{2}}{m_{N_{k}}^{2}}-\frac{m_{\eta_{I}}^{2}}{m_{\eta_{I}}^{2}-m_{N_{k}}^{2}}\log\frac{m_{\eta_{I}}^{2}}{m_{N_{k}}^{2}}\right].$
(13)

##  III Summary of constraints

Before analysing the sensitivities of the experimental searches for WIMPs, we
first discuss the theoretical and experimental restrictions that are
implemented in our analysis.

###  III.1 Boundedness conditions

In order to ensure that the theory is perturbative the quartic couplings in
the scalar potential, eq. (II), as well as the Yukawa couplings in eq. (2) are
limited to be Lindner  _et al._ (2016),

$|\lambda_{i}|,|Y^{a}_{jk}|^{2}\leq 4\pi\ \ \text{with}\ \
i=1,...,8;\,j,k=1,2,3\ \ \text{and}\ \ a=\nu,\ell,N.$ (14)

Furthermore, the consistency requirements of the scalar potential demand that
the dimensionless parameters in eq. (II) have to fulfill the following
conditions Kadastik  _et al._ (2009),

$\displaystyle\lambda_{1},\lambda_{2},\lambda_{6}\geq 0,\ \
\lambda_{3}\geq-2\sqrt{\lambda_{1}\lambda_{2}},$ $\displaystyle
4\lambda_{1}\,\lambda_{6}\geq\lambda_{7}^{2},\ \
4\lambda_{2}\,\lambda_{6}\geq\lambda_{8}^{2}\ \ \text{and}\ \
\lambda_{3}+\lambda_{4}-|\lambda_{5}|\geq-2\sqrt{\lambda_{1}\lambda_{2}}.$
(15)

From the last relations it is guaranteed that the scalar potential is bounded
from below.

###  III.2 Searches of new physics

As we described in the previous section, there are 6 physical scalars in the
model: three CP-even $h_{i}$ ($i=1,2$) and $\eta_{R}$; two CP-odd $\eta_{I}$
and the Majoron $J$; and a charged scalar $\eta^{\pm}$. Therefore, one has to
impose the constraints on the scalar masses coming from the LEP results
Heister  _et al._ (2002) and the latest reports from the LHC on the Higgs
properties Tanabashi  _et al._ (2018). Notice that the invisible Higgs decay
channel is always present, namely the Higgs decay into Majorons $h\to JJ$,
where in our case the SM Higgs $h$ will be identified with either $h_{1}$ or
$h_{2}$. Then, this decay mode coexists with the Higgs decay into the fermion
dark matter, $N_{1}$, when it is kinematically allowed, i.e. $h\to N_{1}N_{1}$
when $m_{N_{1}}<m_{h}/2$. Therefore, we consider Tanabashi  _et al._ (2018)

$\mathcal{B}_{inv}\equiv\text{BR}(h\to\text{invisible})<0.28\ \ \text{at}\ \
95\%\ \ \text{C.L}.$ (16)

On the other hand, the LEP collaboration studies on the invisible decays of
$W^{\pm}$ and $Z^{0}$ gauge bosons Heister  _et al._ (2002) provide bounds on
the masses of the inert scalars $\eta_{R}(\eta_{I})$ and $\eta^{\pm}$. From
these searches, the following conditions must be fulfilled Lundstrom  _et al._
(2009)

$m_{\eta_{R}}+m_{\eta_{I}}>m_{Z},\ \ m_{\eta^{\pm}}>m_{Z}/2\ \ \text{and}\ \
m_{\eta^{\pm}}+m_{\eta_{(R,I)}}>m_{W}.$ (17)

The LEP reports also established disallowed mass regions for the mass
splitting given by,

$m_{\eta_{I}}-m_{\eta_{R}}>8\leavevmode\nobreak\ \text{GeV}\ \ \text{if}\ \
m_{\eta_{R}}<80\leavevmode\nobreak\ \text{GeV}\ \ \text{and}\ \
m_{\eta_{I}}<100\leavevmode\nobreak\ \text{GeV},$ (18)

and $m_{\eta^{\pm}}>80$ GeV.

Finally, it is important to mention that the oblique parameters $S$, $T$ and
$U$ are also sensitive to new physics Peskin and Takeuchi (1990, 1992). Then,
it has to be considered that values of these parameters in the model lie
within the following regions Tanabashi  _et al._ (2018).

$S=0.02\pm 0.10,\quad T=0.07\pm 0.12\quad\text{and}\quad U=0.0\pm 0.09.$ (19)

###  III.3 Dark matter searches

The abundance of DM in the Universe, given in terms of the cosmological
abundance parameter, eq. (1), provides restrictions on the parameter space of
DM models. Furthermore, there exist constraints coming from searches of DM by
experiments using (in)direct detection techniques. The direct dark matter
detection experiments have set bounds, for DM masses above 6 GeV, on the dark
matter-nucleon spin-independent scattering cross section. The most stringent
bounds are set by the XENON1T experiment, that is $\sigma_{\text{SI}}\lesssim
4.1\times 10^{-47}\text{cm}^{2}$ for a DM mass of 30 GeV at 90% C.L Aprile
_et al._ (2018). On the other hand, the astronomical gamma ray observations
constrain the velocity averaged cross section of dark matter annihilation into
gamma rays $\langle\sigma v\rangle_{\gamma}$. The Fermi-LAT satellite has
performed this indirect DM search and constraint the cross section to be
$\langle\sigma v\rangle_{\gamma}\lesssim 10^{-29}\text{cm}^{3}\text{s}^{-1}$
Ackermann  _et al._ (2013). Notice that there are promising searches using
neutrino telescopes like IceCube Halzen and Klein (2010), Antares Ageron  _et
al._ (2011), and KM3Net Adrian-Martinez  _et al._ (2016). Limits on the
annihilation cross section for the typical WIMP mass range are not as
competitive as other limits obtained with other astroparticle messengers. In
additon, neutrinos are used to set bounds on spin-dependent direct dectection
cross section infered from the capture and annihilation of DM in the Sun
Aartsen  _et al._ (2016); Bhattacharya  _et al._ (2019). The tightest limits
are at $m_{DM}\simeq 500$ GeV with $\sigma_{SD}\lesssim 10^{-40}\,{\rm
cm}^{2}$..

###  III.4 Neutrino oscillation parameters

The neutrino masses are obtained after diagonalisation of the mass matrix
given in eq. (13). The relation between $M_{\nu}$ and the diagonal mass matrix
is given by,

$M_{\nu}=U_{\nu}^{*}\,\text{diag}(m_{\nu_{1}},m_{\nu_{2}},m_{\nu_{3}})\,U_{\nu}^{\dagger}$
(20)

where $m_{\nu_{i}}$ are the neutrino masses. Here we are not assuming a
flavor-diagonal mass matrix for chaged leptons. Therefore, the lepton mixing
matrix is difined as $U_{L}\equiv
U_{\ell}^{\dagger}U_{\nu}=U_{L}(\theta_{12},\theta_{13},\theta_{23},\delta_{\text{CP}})$,
where $\theta_{ij}$ are the mixing angles and $\delta_{\text{CP}}$ corresponds
to the Dirac CP-violating phase. $U_{\nu}$ and $U_{\ell}$ are the matrices
that diagonalise the neutrino and charged lepton square mass matrices
$M_{\nu}^{\dagger}M_{\nu}$ and $M_{\ell}M_{\ell}^{\dagger}$ respectively. The
lepton mixing angles $\theta_{ij}$ are determined by neutrino oscillation
experiments. From global fits of neutrino oscillation parameters de Salas  _et
al._ (2018) (for other fits of neutrino oscillation parameters we refer the
reader to Capozzi  _et al._ (2016); Esteban  _et al._ (2019)) the best fit
values and the $1\sigma$ intervals for a normal neutrino mass ordering (NO)
are

$\displaystyle|\Delta m_{\text{sol}}^{2}|=7.55^{+0.20}_{-0.16}\,\times
10^{-5}\,\text{eV}^{2},\ \ |\Delta m_{\text{atm}}^{2}|=2.50\pm 0.03\,\times
10^{-3}\,\text{eV}^{2},$
$\displaystyle\theta_{12}/^{\circ}=34.5^{+1.2}_{-1.0},\ \
\theta_{13}/^{\circ}=8.45^{+0.16}_{-0.14},\ \
\theta_{23}/^{\circ}=47.7^{+1.2}_{-1.7},\ \ \text{and}\ \
\delta_{\text{CP}}/^{\circ}=218^{+38}_{-27}.\ \ $ (21)

##  IV Numerical analysis

We have mentioned that the nature of the DM candidate in this model could be
either fermionic or scalar. This is the lightest particle with odd charge
under the $\mathbb{Z}_{2}$ symmetry and running in the neutrino mass
generation loop as shown in Fig. 1.

In our study we will focus in the case in which the DM is the lightest
Majorana particle 111 In Ref. Toma and Vicente (2014); Vicente and Yaguna
(2015); Ibarra  _et al._ (2016) has bee analyzed the situation where the DM is
the Majorana fermion within the simplest scotogenic model. Note that the case
in which the DM is the neutral component of the inert doublet $\eta$ is
similar to the studies for inert doublet model Belyaev  _et al._ (2018)., i.e.
$N_{1}$. Therefore, in this case the DM annihilates via the t- and s-channel
In Fig. 2 . The former is mediated by a Majorana fermion $N_{i}$ and by the
inert scalars. It has been shown that the bounds on lepton flavor violation
(LFV) processes, e.g. $\mu\to e\gamma$, demand small neutrino Yukawas (namely,
$Y^{\nu}\ll 1$) and hence the t-channel mediated by the inert scalars becomes
suppressed inducing DM overabundance Toma and Vicente (2014); Vicente and
Yaguna (2015). However, we show that we can keep suppressed the inert scalar
mediated t-channel and thanks to the s-channel mediated by the singlet
$\sigma$ it is possible to account for the right amount of DM relic abundance.
As a result, it is crucial to have a non-vanishing mixing angle between CP-
even parts of the Higgs doublet $\Phi$ and the iso-singlet $\sigma$, eq. (7),
and in agreement with current experimental data.

Figure 2: Feynman diagrams for the annihilation channels of the fermion dark
matter in the model. On the left annihilation into SM particles. On the right
annihilation into Majorons and higgses.

For the numerical analysis we have used the MicrOMEGAS Belanger  _et al._
(2002) and performed a scan over all free parameters of the model. For the
dimensionless parameters in the scalar sector we took the following intervals:

$10^{-6}\leq|\lambda_{2,...,8}|\leq 1,$ (22)

and $\lambda_{1}$ being determined by the SM Higgs mass. We are taking $h_{1}$
as the SM Higgs then $m_{h_{1}}=125$ GeV. On the other hand, we are varying
the mass of $h_{2}$ within the range $m_{h_{2}}\in[20,2000]$ GeV. Notice that
we are taking masses below 125 GeV which is in perfect agreement with both the
LHC and LEP constraints as long as the doublet-singlet mixing given by
$\sin\alpha$ in eq. (7) is less than 20% Bonilla  _et al._ (2015).

For the masses of the inert scalars we considered the following ranges,

$m_{\eta_{R}}\in[110,5000]\leavevmode\nobreak\ \text{GeV},\ \
m_{\eta^{\pm}}\in[135,5000]\leavevmode\nobreak\ \text{GeV},$ (23)

and mass of the CP-odd part $\eta_{I}$ is determined by using the relation
$\lambda_{5}v_{\Phi}^{2}=(m^{2}_{\eta_{R}}-m^{2}_{\eta_{I}})$. For the lepton
number breaking scale, namely the singlet’s vev $v_{\sigma}$, we have used
$v_{\sigma}\in[500,10000]\leavevmode\nobreak\ \text{GeV}$. Bear in mind that
this vev provides the mass of the heavy Majorana fermions, $N_{i}$, whose
masses (taken to be diagonal) are varied in the following ranges,

$m_{N_{1}}\in[8,1000]\leavevmode\nobreak\ \text{GeV}\ \ \text{and}\ \
m_{N_{2,3}}\in[100,5000]\leavevmode\nobreak\ \text{GeV}.$ (24)

Since $N_{1}$222There are regions of the parameter space for $M_{N_{1}}<8$ GeV
but those are below the neutrino floor. is the DM candidate of the theory we
have to impose $m_{N_{1}}<m_{N_{(2,3)}}<m_{\eta_{(R,I,\pm)}}$ 333We discard
contributions to the DM abundance produced by co-annihilation processes, i.e.
$m_{N_{(2,3)}}\lesssim 1.1\,m_{N_{1}}$. . The above considerations are made in
such a way that they all satisfy the theoretical and experimental constraints
described in Sec. III. We computed the value of the $S$ and $T$ parameters
using the expressions given in Grimus  _et al._ (2008a, b), taking $U=0$
Tanabashi  _et al._ (2018) and keeping those solutions that are in agreement
with the bounds given in eq. (19). It is worth to mention that we considered
only S and T within the $90\%$ level shown in Fig. (10.6) from reference
Tanabashi  _et al._ (2018). In addition, we calculated the light neutrino
masses feeding the neutrino mass expression given in eq. (13) and assumed
normal ordering for neutrino masses 444For simplicity, we have assumed that
the Yukawa matrices $Y^{\nu}$ and $Y^{N}$ are real and diagonal. Following
this assumption, the Yukawa matrix for charge lepton is non-diagonal (such
that, $U_{L}=U_{\ell}^{\dagger}U_{\nu}=U_{\ell}^{\dagger}$) in order to fit
neutrino oscillation experimental data in eq. (20).. Then, we took as valid
only the points that satisfy the best fit values from the global fit of
neutrino oscillation parameters555The sum of neutrino masses was restricted
using the cosmological limit provided by Planck, namely $\sum m_{\nu}<0.12$ eV
Vagnozzi  _et al._ (2017); Aghanim  _et al._ (2018). de Salas  _et al._
(2018).

Our last requirement is that the annihilation cross section of the fermion DM
candidate into Majorons (see Fig. 2) is subdominant at the moment of the
freeze-out in order to guarantee detectability in DM direct detection
experiments and to avoid direct detection cross sections in regions far below
the neutrino floor.

###  IV.1 Viable dark matter mass regions

Figure 3: $\text{Dark matter mass}-\sigma_{\text{SI}}$ plane showing the
solutions in the model that satisfy all theoretical and experimental
constraints given in Section III. The latest bound on direct dark matter
detection is set by the XENON1T experiment Aprile  _et al._ (2018) (top shaded
area). The dashed lines represent the expected sensitivities in forthcoming
experimental searches such as XENONnT Aprile  _et al._ (2016), LUX-ZEPLIN (LZ)
Akerib  _et al._ (2018), DarkSide 20k Aalseth  _et al._ (2018), DARWIN Aalbers
_et al._ (2016) and PandaX-4T Zhang  _et al._ (2019).

Following the considerations that we stated previously, we show in Fig. 3 the
nucleon-dark matter spin-independent cross section $\sigma_{SI}$ as a function
of the fermion DM mass, $m_{N_{1}}$. From the numerical analysis we have found
three different viable mass regions for a fermion DM candidate within the
model. We refer as viable to those solutions that fulfil the theoretical and
experimental bounds given in Section III. These are:

  * •

the low mass region, with an approximate DM mass range $8\leavevmode\nobreak\
\text{GeV}\lesssim m_{N_{1}}\lesssim 20\leavevmode\nobreak\ \text{GeV}$ and
$b\bar{b}$ as dominant annihilation channel;

  * •

the resonant region, where $m_{N_{1}}\lesssim m_{h}/2$ (with
$m_{h}=125.09\leavevmode\nobreak\ \text{GeV}$); and

  * •

the high mass region, for DM masses above 80 GeV where the fermion DM
annihilates efficiently into the gauge bosons, i.e. $N_{1}N_{1}\to VV$ with
$V=(Z,W)$.

In all these domains, the DM annihilation into Majorons $(N_{1}N_{1}\to JJ)$
at the moment of the freeze-out is always below 10%. The latest bound coming
from direct detection searches of dark matter particles is set the XENON1T
experiment Aprile  _et al._ (2018) and is defined by the top shaded area in
Fig. 3. The dark red points showed in the $m_{N_{1}}-\sigma_{\text{SI}}$ plane
account for 100% of the DM relic abundance while the solutions in purple and
pink correspond only to a fraction of the DM abundance. Notice that in the
high mass region it is most likely a fermion DM with a mass around 500 GeV
accounting for the whole amount of DM in the Universe. There are few points
around $m_{N_{1}}\sim 10$ GeV and $m_{N_{1}}\sim 100$ GeV that could not be
distinguished from the neutrino floor background (bottom shaded area). Fig. 3
also displays the future sensitivities for dark matter searches in direct
detection experiments such as XENONnT Aprile  _et al._ (2016) and LUX-ZEPLIN
Akerib  _et al._ (2018), DarkSide-20k Aalseth  _et al._ (2018), DARWIN Aalbers
_et al._ (2016), and PandaX-4T Zhang  _et al._ (2019). For completeness we
provide three benchmarks in Appendix A within each mass neighbourhood and
their corresponding outputs.

Figure 4: Predictions for the velocity averaged cross section of dark matter
annihilation into gamma rays $\langle\sigma v\rangle_{\gamma}$ as function of
the dark matter mass $m_{N_{1}}$. The dashed line represent the limit set by
Fermi-LAT satellite results Ackermann  _et al._ (2013).

Fig. 4 shows the predictions for the velocity averaged cross section of dark
matter annihilation into gamma rays $\langle\sigma v\rangle_{\gamma}$ as
function of dark matter mass $m_{N_{1}}$. We have found that the annihilation
cross section of dark matter into gamma rays is up to two orders magnitude
below the limit set by Fermi-LAT satellite results Ackermann  _et al._ (2013)
on the indirect DM search (cyan dashed line in Fig. 4). This is the case for
fermion DM with a mass inside the low mass region. One can see that there are
solutions in the high mass region that are ruled out by observations. In
particular, the indirect search of DM excludes some points where the fermion
DM represent only a fraction of the DM relic abundance. As before, all points
satisfy the theoretical and experimental constraints listed in Section III and
the dark red points correspond to the solutions that account for the whole
amount of DM in the Universe. The lighter (purple and pink) colors would
require the existence of other DM candidates to explain observations, eq. (1).

##  V Conclusions

In this work we have studied the scotogenic model with spontaneous breaking of
lepton number. We have shown that it is possible to account for the whole
amount of DM relic density thanks to the scalar singlet used to break lepton
number which mixes with the CP-even part of the SM Higgs doublet. Notice that
this DM annihilation portal is absent in the simplest version of the
scotogenic model, where lepton number is explicitly broken by the Majorana
mass term, $N_{i}N_{i}$. In our analysis the LFV processes are suppressed
because the neutrino Yukawas are kept small, then experimental constraints are
naturally respected. We present a numerical analysis of the parameter space of
the model and the predictions for the nucleon-dark matter spin-independent
cross section $\sigma_{SI}$. We show that there are three different DM mass
regions that can explain the DM relic abundance, satisfy current experimental
constraints as well as the limits on $\sigma_{SI}$ reported XENON1T. We also
included the future sensitivities of experiments that are devoted to search
for the direct dark matter detection.

###### Acknowledgements.

We would like to thank A. Vicente and one of the referees for pointing out a
missing factor $1/2$ in eq. 13. The work of C.B. was supported by the
Collaborative Research Center SFB1258. R.L. was supported by Universidad
Católica del Norte through the Publication Incentive program No. CPIP20180343.
LMGDLV, J.M.L. and E.P. are supported by DGAPA-PAPIIT IN107118 and CONACyT
CB-2017-2018/A1-S-13051 (México). C.B. would like to thank IFUNAM for the
hospitality while part of this work was carried out.

##  Appendix A Benchmarks

Here we present three benchmarks (BM1, BM2, BM3) corresponding to the
different mass regions described in Section IV.1 where the fermion DM satisfy
all experimental and theoretical constraints summarized in Section III, see
Tables 2 and 3. Additionally, these representative points are such that the DM
particle $N_{1}$ constitute 100% of the relic abundance in the Universe, see
Table 4.

The values for the dimensionless parameters in the Lagrangian as well as the
dimensionful parameters in the scalar potential are shown in Table 2. Notice
that the neutrino Yukawas $Y^{\nu}_{i}$ (with $i=1,2,3$) are small and as a
result LFV processes are suppressed. We include as example in Table 3 the
branching fractions of $\mu\to e\gamma$ for each benchmark.

|  $m_{N_{1}}$[GeV] |  $m_{N_{2}}$[GeV] |  $m_{N_{3}}$[GeV] |  $m_{\eta_{R}}$[GeV] |  $m_{\eta_{I}}$[GeV] |  $m_{\eta^{\pm}}$ [GeV] |  $m_{h_{2}}$[GeV] |  $v_{\sigma}$[TeV] |  $\mu_{2}^{2}$ [GeV2]
---|---|---|---|---|---|---|---|---|---
BM1 | 10 | 119 | 316 | 520 | 536 | 486 | 20.7 | 10.4 | 2.1$\times 10^{5}$
BM2 | 59.1 | 184 | 410 | 666 | 675 | 645 | 149 | 1.08 | 4.60$\times 10^{5}$
BM3 | 707 | 924 | 940 | 1132 | 1119 | 1119 | 1498 | 5.80 | 6.98$\times 10^{6}$

| $\sin\alpha$ | $\lambda_{1}$ | $\lambda_{2}$ | $\lambda_{3}$ | $\lambda_{4}$ | $\lambda_{5}$ | $\lambda_{6}$ | $\lambda_{8}$
---|---|---|---|---|---|---|---|---
BM1 | 1.31$\times 10^{-1}$ | 1.27$\times 10^{-1}$ | 8.93$\times 10^{-1}$ | -6.7$\times 10^{-1}$ | 1.4 | -2.82$\times 10^{-1}$ | 3.17$\times 10^{-6}$ | 8.19$\times 10^{-4}$
BM2 | 1.57$\times 10^{-1}$ | 1.30$\times 10^{-1}$ | 1 | -1.4$\times 10^{-1}$ | 1.1 | -1.99$\times 10^{-1}$ | 9.35$\times 10^{-3}$ | -6.76$\times 10^{-2}$
BM3 | 1.63$\times 10^{-1}$ | 9.23 $\times 10^{-1}$ | 1.63 | 1.63 | 6.47 $\times 10^{-1}$ | -3.40$\times 10^{-1}$ | 3.24$\times 10^{-2}$ | -1.48$\times 10^{-1}$

| $Y^{N}_{1}$ | $Y^{N}_{2}$ | $Y^{N}_{3}$ | $Y^{\nu}_{1}$ | $Y^{\nu}_{2}$ | $Y^{\nu}_{3}$
---|---|---|---|---|---|---
BM1 | 6.78$\times 10^{-4}$ | 8.04$\times 10^{-3}$ | 2.14$\times 10^{-2}$ | -1.61$\times 10^{-4}$ | -4.99$\times 10^{-5}$ | -4.18$\times 10^{-5}$
BM2 | 3.86$\times 10^{-2}$ | 1.20$\times 10^{-1}$ | 2.68$\times 10^{-1}$ | -3.22$\times 10^{-5}$ | -2.75$\times 10^{-5}$ | -4.70 $\times 10^{-5}$
BM3 | 8.61$\times 10^{-2}$ | 1.12$\times 10^{-1}$ | 1.14$\times 10^{-1}$ | -6.33$\times 10^{-6}$ | -8.88$\times 10^{-5}$ | -3.17$\times 10^{-5}$

Table 2: The values for the dimensionful parameters are shown on the top
table. The values for the dimensionless parameters in the scalar sector and
the neutrino sector are also given.

| $\mathcal{B}_{\text{inv}}$ | BR($h_{2}\to JJ$) | BR($h_{2}\to h_{1}h_{1}$) |  $\Gamma(h_{1})$[MeV]
---|---|---|---|---
BM1 | 3.5$\times 10^{-2}$ | 9.8$\times 10^{-2}$ | - | 3.9
BM2 | 9.7$\times 10^{-2}$ | 9.2$\times 10^{-1}$ | - | 4.2
BM3 | 4$\times 10^{-3}$ | 1.6$\times 10^{-2}$ | 2.3$\times 10^{-1}$ | 3.8

| BR($\mu\rightarrow e\gamma$) | S | T
---|---|---|---
BM1 | 4.9$\times 10^{-23}$ | 4.3$\times 10^{-3}$ | 3.0$\times 10^{-3}$
BM2 | 6.8$\times 10^{-28}$ | 2.7$\times 10^{-4}$ | 3.2$\times 10^{-3}$
BM3 | 3.8$\times 10^{-28}$ | 6.9$\times 10^{-4}$ | 3.2$\times 10^{-3}$

Table 3: The top table shows that (BM1, BM2, BM3) satisfy current experimental
constraints in the Higgs sector. The bottom one is used to illustrate how
these solutions are in agreement with the bounds coming from LFV processes as
well as the electroweak precision tests.

Finally, Table 4 shows the main DM annihilation channels in the model and
prediction in the DM sector.

| BR($N_{1}N_{1}\to b\bar{b}$) | BR($N_{1}N_{1}\to JJ$) | BR($N_{1}N_{1}\to h_{2}h_{2}$) | BR($N_{1}N_{1}\to ZZ$)
---|---|---|---|---
BM1 | 7.8$\times 10^{-1}$ | 9.8$\times 10^{-2}$ | - | -
BM2 | 5.9$\times 10^{-1}$ | 9.9$\times 10^{-2}$ | - | 2.34$\times 10^{-2}$
BM3 | 1.4$\times 10^{-5}$ | 1.4$\times 10^{-2}$ | - | 2.37$\times 10^{-1}$

|  $BR(N_{1}N_{1}\to W^{+}W^{-}$) |  $\sigma_{\text{SI}}$[pb] | $\langle\sigma v\rangle_{\gamma}$ | $\Omega_{c}h^{2}$
---|---|---|---|---
BM1 | - | 9.4$\times 10^{-12}$ | 1.7$\times 10^{-34}$ | 1.21$\times 10^{-1}$
BM2 | 2$\times 10^{-1}$ | 3.4$\times 10^{-12}$ | 1.0$\times 10^{-32}$ | 1.20$\times 10^{-1}$
BM3 | 4.7$\times 10^{-1}$ | 2.2$\times 10^{-10}$ | 4.5$\times 10^{-29}$ | 1.19$\times 10^{-1}$

Table 4: Main DM annihilation channels in the model.

## References

  * Whitehead (2016) L. H. Whitehead (MINOS), Nucl. Phys. B908, 130 (2016), arXiv:1601.05233 [hep-ex] .
  * Decowski (2016) M. P. Decowski (KamLAND), Nucl. Phys. B908, 52 (2016).
  * Abe  _et al._ (2017) K. Abe _et al._ (T2K), Phys. Rev. Lett. 118, 151801 (2017), arXiv:1701.00432 [hep-ex] .
  * de Salas  _et al._ (2018) P. F. de Salas, D. V. Forero, C. A. Ternes, M. Tortola, and J. W. F. Valle, Phys. Lett. B782, 633 (2018), arXiv:1708.01186 [hep-ph] .
  * Capozzi  _et al._ (2016) F. Capozzi, E. Lisi, A. Marrone, D. Montanino, and A. Palazzo, Nucl. Phys. B908, 218 (2016), arXiv:1601.07777 [hep-ph] .
  * Esteban  _et al._ (2019) I. Esteban, M. C. Gonzalez-Garcia, A. Hernandez-Cabezudo, M. Maltoni, and T. Schwetz, JHEP 01, 106 (2019), arXiv:1811.05487 [hep-ph] .
  * Minkowski (1977) P. Minkowski, Phys. Lett. 67B, 421 (1977).
  * Yanagida (1979) T. Yanagida,  _Proceedings: Workshop on the Unified Theories and the Baryon Number in the Universe: Tsukuba, Japan, February 13-14, 1979_ , Conf. Proc. C7902131, 95 (1979).
  * Mohapatra and Senjanovic (1980) R. N. Mohapatra and G. Senjanovic, Phys. Rev. Lett. 44, 912 (1980), [,231(1979)].
  * Schechter and Valle (1980) J. Schechter and J. W. F. Valle, Phys. Rev. D22, 2227 (1980).
  * Schechter and Valle (1982) J. Schechter and J. W. F. Valle, Phys. Rev. D25, 774 (1982).
  * Foot  _et al._ (1989) R. Foot, H. Lew, X. G. He, and G. C. Joshi, Z. Phys. C44, 441 (1989).
  * Aghanim  _et al._ (2018) N. Aghanim _et al._ (Planck), (2018), arXiv:1807.06209 [astro-ph.CO] .
  * Ma (2006) E. Ma, Phys. Rev. D73, 077301 (2006), arXiv:hep-ph/0601225 [hep-ph] .
  * Hagedorn  _et al._ (2018) C. Hagedorn, J. Herrero-García, E. Molinaro, and M. A. Schmidt, JHEP 11, 103 (2018), arXiv:1804.04117 [hep-ph] .
  * Blennow  _et al._ (2019) M. Blennow, E. Fernandez-Martinez, A. Olivares-Del Campo, S. Pascoli, S. Rosauro-Alcaraz, and A. V. Titov, Eur. Phys. J. C79, 555 (2019), arXiv:1903.00006 [hep-ph] .
  * Fileviez Pérez  _et al._ (2019) P. Fileviez Pérez, C. Murgui, and A. D. Plascencia, Phys. Rev. D100, 035041 (2019), arXiv:1905.06344 [hep-ph] .
  * Babu and Ma (2008) K. S. Babu and E. Ma, Int. J. Mod. Phys. A23, 1813 (2008), arXiv:0708.3790 [hep-ph] .
  * Chikashige  _et al._ (1981) Y. Chikashige, R. N. Mohapatra, and R. D. Peccei, Phys. Lett. 98B, 265 (1981).
  * Joshipura and Rindani (1992) A. S. Joshipura and S. D. Rindani, Phys. Rev. Lett. 69, 3269 (1992).
  * Romao  _et al._ (1992) J. C. Romao, F. de Campos, and J. W. F. Valle, Phys. Lett. B292, 329 (1992), arXiv:hep-ph/9207269 [hep-ph] .
  * Joshipura and Valle (1993) A. S. Joshipura and J. W. F. Valle, Nucl. Phys. B397, 105 (1993).
  * Bonilla  _et al._ (2015) C. Bonilla, J. W. F. Valle, and J. C. Romão, Phys. Rev. D91, 113015 (2015), arXiv:1502.01649 [hep-ph] .
  * Kubo  _et al._ (2006) J. Kubo, E. Ma, and D. Suematsu, Phys. Lett. B642, 18 (2006), arXiv:hep-ph/0604114 [hep-ph] .
  * Aranda  _et al._ (2019) A. Aranda, C. Bonilla, and E. Peinado, Phys. Lett. B792, 40 (2019), arXiv:1808.07727 [hep-ph] .
  * Aad  _et al._ (2015) G. Aad _et al._ (ATLAS, CMS), Phys. Rev. Lett. 114, 191803 (2015), arXiv:1503.07589 [hep-ex] .
  * Lindner  _et al._ (2016) M. Lindner, M. Platscher, C. E. Yaguna, and A. Merle, Phys. Rev. D94, 115027 (2016), arXiv:1608.00577 [hep-ph] .
  * Kadastik  _et al._ (2009) M. Kadastik, K. Kannike, and M. Raidal, Phys. Rev. D80, 085020 (2009), [Erratum: Phys. Rev.D81,029903(2010)], arXiv:0907.1894 [hep-ph] .
  * Heister  _et al._ (2002) A. Heister _et al._ (ALEPH), Phys. Lett. B543, 1 (2002), arXiv:hep-ex/0207054 [hep-ex] .
  * Tanabashi  _et al._ (2018) M. Tanabashi _et al._ (Particle Data Group), Phys. Rev. D98, 030001 (2018).
  * Lundstrom  _et al._ (2009) E. Lundstrom, M. Gustafsson, and J. Edsjo, Phys. Rev. D79, 035013 (2009), arXiv:0810.3924 [hep-ph] .
  * Peskin and Takeuchi (1990) M. E. Peskin and T. Takeuchi, Phys. Rev. Lett. 65, 964 (1990).
  * Peskin and Takeuchi (1992) M. E. Peskin and T. Takeuchi, Phys. Rev. D46, 381 (1992).
  * Aprile  _et al._ (2018) E. Aprile _et al._ (XENON), Phys. Rev. Lett. 121, 111302 (2018), arXiv:1805.12562 [astro-ph.CO] .
  * Ackermann  _et al._ (2013) M. Ackermann _et al._ (Fermi-LAT), Phys. Rev. D88, 082002 (2013), arXiv:1305.5597 [astro-ph.HE] .
  * Halzen and Klein (2010) F. Halzen and S. R. Klein, Rev. Sci. Instrum. 81, 081101 (2010), arXiv:1007.1247 [astro-ph.HE] .
  * Ageron  _et al._ (2011) M. Ageron _et al._ (ANTARES), Nucl. Instrum. Meth. A656, 11 (2011), arXiv:1104.1607 [astro-ph.IM] .
  * Adrian-Martinez  _et al._ (2016) S. Adrian-Martinez _et al._ (KM3Net), J. Phys. G43, 084001 (2016), arXiv:1601.07459 [astro-ph.IM] .
  * Aartsen  _et al._ (2016) M. G. Aartsen _et al._ (IceCube), JCAP 1604, 022 (2016), arXiv:1601.00653 [hep-ph] .
  * Bhattacharya  _et al._ (2019) A. Bhattacharya, A. Esmaili, S. Palomares-Ruiz, and I. Sarcevic, JCAP 1905, 051 (2019), arXiv:1903.12623 [hep-ph] .
  * Toma and Vicente (2014) T. Toma and A. Vicente, JHEP 01, 160 (2014), arXiv:1312.2840 [hep-ph] .
  * Vicente and Yaguna (2015) A. Vicente and C. E. Yaguna, JHEP 02, 144 (2015), arXiv:1412.2545 [hep-ph] .
  * Ibarra  _et al._ (2016) A. Ibarra, C. E. Yaguna, and O. Zapata, Phys. Rev. D93, 035012 (2016), arXiv:1601.01163 [hep-ph] .
  * Belyaev  _et al._ (2018) A. Belyaev, G. Cacciapaglia, I. P. Ivanov, F. Rojas-Abatte, and M. Thomas, Phys. Rev. D97, 035011 (2018), arXiv:1612.00511 [hep-ph] .
  * Belanger  _et al._ (2002) G. Belanger, F. Boudjema, A. Pukhov, and A. Semenov, Comput. Phys. Commun. 149, 103 (2002), arXiv:hep-ph/0112278 [hep-ph] .
  * Grimus  _et al._ (2008a) W. Grimus, L. Lavoura, O. M. Ogreid, and P. Osland, J. Phys. G35, 075001 (2008a), arXiv:0711.4022 [hep-ph] .
  * Grimus  _et al._ (2008b) W. Grimus, L. Lavoura, O. M. Ogreid, and P. Osland, Nucl. Phys. B801, 81 (2008b), arXiv:0802.4353 [hep-ph] .
  * Vagnozzi  _et al._ (2017) S. Vagnozzi, E. Giusarma, O. Mena, K. Freese, M. Gerbino, S. Ho, and M. Lattanzi, Phys. Rev. D96, 123503 (2017), arXiv:1701.08172 [astro-ph.CO] .
  * Aprile  _et al._ (2016) E. Aprile _et al._ (XENON), JCAP 1604, 027 (2016), arXiv:1512.07501 [physics.ins-det] .
  * Akerib  _et al._ (2018) D. S. Akerib _et al._ (LUX-ZEPLIN), (2018), arXiv:1802.06039 [astro-ph.IM] .
  * Aalseth  _et al._ (2018) C. E. Aalseth _et al._ , Eur. Phys. J. Plus 133, 131 (2018), arXiv:1707.08145 [physics.ins-det] .
  * Aalbers  _et al._ (2016) J. Aalbers _et al._ (DARWIN), JCAP 1611, 017 (2016), arXiv:1606.07001 [astro-ph.IM] .
  * Zhang  _et al._ (2019) H. Zhang _et al._ (PandaX), Sci. China Phys. Mech. Astron. 62, 31011 (2019), arXiv:1806.02229 [physics.ins-det] .


# The Panacea Threat Intelligence and Active Defense Platform

Adam Dalton,1 Ehsan Aghaei,3 Ehab Al-Shaer,3 Archna Bhatia,1
Esteban Castillo,4 Zhuo Cheng,3 Sreekar Dhaduvai,2 Qi Duan,3 Md Mazharul
Islam,3
Younes Karimi,2 Amir Masoumzadeh,2 Brodie Mather,1 Sashank Santhanam,3
Samira Shaikh,3 Tomek Strzalkowski4 Bonnie J. Dorr1
1IHMC, Ocala, FL, USA<EMAIL_ADDRESS>
2SUNY, Albany, NY, USA<EMAIL_ADDRESS>
3UNCC, Charlotte, NC, USA {eaghaei,ealshaer,zcheng5,qduan,
<EMAIL_ADDRESS>
4Rensselaer Polytechnic Institute, Troy, NY, USA<EMAIL_ADDRESS>
We describe Panacea, a system that supports natural language processing (NLP)
components for active defenses against social engineering attacks. We deploy a
pipeline of human language technology, including Ask and Framing Detection,
Named Entity Recognition, Dialogue Engineering, and Stylometry. Panacea
processes modern message formats through a plug-in architecture to accommodate
innovative approaches for message analysis, knowledge representation and
dialogue generation. The novelty of the Panacea system is that uses NLP for
cyber defense and engages the attacker using bots to elicit evidence to
attribute to the attacker and to waste the attacker’s time and resources.

##  1 Introduction

Panacea (Personalized AutoNomous Agents Countering Social Engineering Attacks)
actively defends against social engineering (SE) attacks. Active defense
refers to engaging an adversary during an attack to extract and link
attributable information while also wasting their time and resources in
addition to preventing the attacker from achieving their goals. This contrasts
with passive defenses, which decrease likelihood and impact of an attack
Denning (2014) but do not engage the adversary.

SE attacks are formidable because intelligent adversaries exploit technical
vulnerabilities to avoid social defenses, and social vulnerabilities to avoid
technical defenses Hadnagy and Fincher (2015). A system must be socially aware
to find attack patterns and indicators that span the socio-technical space.
Panacea approaches this by incorporating the F3EAD (Find, Fix, Finish,
Exploit, Analyze, and Disseminate) threat intelligence cycle Gomez (2011). The
find phase identifies threats using language-based and message security
approaches.The fix phase gathers relevant and necessary information to engage
the adversaries and plan the mitigations that will prevent them from
accomplishing their malicious goals. The finish phase performs a decisive and
responsive action in preparation for the exploit phase for future attack
detection. The analysis phase exploits intelligence from conversations with
the adversaries and places it in a persistent knowledge base where it can be
linked to other objects and studied additional context. The disseminate phase
makes this intelligence available to all components to improve performance in
subsequent attacks.

Panacea’s value comes from NLP capabilities for cyber defense coupled with
end-to-end plug-ins for ease of running NLP over real-world conversations.
Figure 1 illustrates Panacea’s active defense in the form of conversational
engagement, diverting the attacker while also delivering a link that will
enable the attacker’s identity to be unveiled.

Figure 1: Active Defense against Social Engineering: Attacker’s email (left)
yields bot’s response (right)

###  1.1 Use Cases

Panacea’s primary use cases are: (1) monitoring a user’s inbox to detect SE
attacks; and (2) engaging the attacker to gain attributable information about
their true identity while preventing attacks from succeeding. Active SE
defense tightly integrates offensive and defensive capabilities to detect and
respond to SE campaigns. Engaging the adversary uniquely enables extraction of
indicators required to confidently classify a communication as malicious.
Active defenses also carry significant risk because engagement can potentially
harm an individual’s or organization’s reputation. Thus, high confidence
classification is vital.

####  1.1.1 Monitoring and Detection

Panacea includes an initial protection layer based on the analysis of incoming
messages. Conceptual users include end users and IT security professionals.
Each message is processed and assigned a label of friend, foe, or unknown,
taking into account headers and textual information of each message. The data
obtained from this analysis is converted into threat intelligence and stored
in a knowledge graph for use in subsequent phases, e.g., for meta analysis and
message analysis in a broader context within a thread or in similar messages
delivered to multiple users.

####  1.1.2 Engagement and Attribution

Passive defenses are finished once a threat is discovered, defused, and
deconstructed; at this point Panacea’s active defenses become engaged.
Panacea’s active defenses respond to the attacker’s demands, reducing the risk
that the attacker will catch on that they’ve been fingered. As such, any
requests made by Panacea are more likely to be fulfilled by the attacker,
bulwarked by hopes of eventual payoff. Such requests are implemented as a
collection of flag seeking strategies built on top of a conversational theory
of asks. Flags are collected using information extraction techniques. Future
work includes inferential logic and deception detection to unmask an attacker
and separate them from feigned identities used to gain trust.

##  2 Related Work

Security in online communication is a challenge due to: (1) attacker’s speed
outpacing that of defenders to maintain indicators Zhang et al. (2006); (2)
phishing site quality high enough that users ignore alerts Egelman et al.
(2008); (3) user training falling short as users forget material and fall prey
to previously studied attacks Caputo et al. (2013); the divergent goals of the
attacker and defender Li et al. (2020); and (4) defensive system maintainers
who may ignore account context, motivations, and socio-economic status of the
targeted user Oliveira et al. (2017). Prior studies Bakhshi et al. (2008);
Karakasilitiosis et al. (2006) demonstrate human susceptibility to SE attacks.
Moving from bots that detect such attacks to those that produce “natural
sounding” responses, i.e., conversational agents that engage the attacker to
elicit identifying information, is the next advance in this arena.

Prior work extracts information from email interactions Dada et al. (2019),
applies supervised learning to identify email signatures and forwarded
messages Carvalho and Cohen (2004), and classifies email content into
different structural sections Lampert et al. (2009). Statistical and rule-
based heuristics extract users’ names and aliases Yin et al. (2011) and
structured script representations determine whether an email resembles a
password reset email typically sent from an organization’s IT department Li
and Goldwasser (2019). Analysis of chatbot responses Prakhar Gupta and Bigham
(2019) yields human-judgement correlation improvements. Approaches above
differ from ours in that they require extensive model training.

Our approach relates to work on conversational agents, e.g., response
generation using neural models Gao et al. (2019); Santhanam and Shaikh (2019),
topic models Dziri et al. (2018), self-disclosure for targeted responses
Ravichander and Black (2018), topic models Bhakta and Harris (2015), and other
NLP analysis Sawa et al. (2016). All such approaches are limited to a pre-
defined set of topics, constrained by the training corpus. Other prior work
focuses on persuasion detection/prediction Hidey and McKeown (2018) but for
judging when a persuasive attempt might be successful, whereas Panacea aims to
achieve effective dialogue for countering (rather than adopting) persuasive
attempts. Text-based semantic analysis is also used for SE detection Kim et
al. (2018), but not for engaging with an attacker. Whereas a bot might be
employed to warn a potential victim that an attack is underway, our bots
communicate with a social engineer in ways that elicit identifying
information.

Panacea’s architecture is inspired by state-of-the-art systems in cyber threat
intelligence. MISP Wagner et al. (2016) focuses on information sharing from a
community of trusted organizations. MITRE’s Collaborative Research Into
Threats (CRITs) Goffin (2020) platform is, like Panacea, built on top of the
Structured Threat Intelligence eXchange (STIX) specification. Panacea differs
from these in that it is part of operational active defenses, rather than
solely an analytical tool for incident response and threat reporting.

##  3 System Overview

Panacea’s processing workflow is inspired by Stanford’s CoreNLP annotator
pipeline Manning et al. (2014a), but with a focus on using NLP to power active
defenses against SE. A F3EAD-inspired phased analysis and engagement cycle is
employed to conduct active defense operations. The cycle is triggered when a
message arrives and is deconstructed into STIX threat intelligence objects.
Object instances for the identities of the sender and all recipients are found
or created in the knowledge base. Labeled relationships are created between
those identity objects and the message itself.

Once a message is ingested, plug-in components process the message in the find
phase, yielding a response as a JSON object that is used by plug-in components
in subsequent phases. Analyses performed in this phase include message part
decomposition, named entity recognition, and email header analysis. The fix
phase uses components dubbed deciders, which perform a meta-analysis of the
results from the find phase to determine if and what type of an attack is
taking place. Ask detection provides a fix on what the attacker is going after
in the fix phase, if an attack is indicated. Detecting an attack advances the
cycle to the finish phase, where response generation is activated.

Each time Panacea successfully elicits a response from the attacker, the new
message is exploited for attributable information, such as the geographical
location of the attack and what organizational affiliations they may have.
This information is stored as structured intelligence in the knowledge base
which triggers the analysis phase, wherein the threat is re-analyzed in a
broader context. Finally, Panacea disseminates threat intelligence so that
humans can build additional tools and capabilities to combat future threats.
color=green,inline, ]Archna: please make sure descriptions of all the phases
are consistent at different places they are mentioned in the paper.

##  4 Under the Hood

Panacea’s main components are presented: (1) Message Analysis Component; and
(2) Dialogue Component. The resulting system is capable of handling the
thousands of messages a day that would be expected in a modern organization,
including failure recovery and scheduling jobs for the future. Figure 2 shows
Panacea throughput while operating over a one month backlog of emails, SMS
texts, and LinkedIn messages.color=green,inline, ]Archna: Figure 2 does not
show what proportion was emails, what proportion SMS and LinkedIn
respectively. Unless only one of them was a big majority and the other two
types of messages were rare, I think it would look good that Panacea was able
to handle messages coming from different sources and use them without getting
overwhelmed.

Figure 2: Panacea components run asynchronously in the background for scaling
and so new components can be added and removed based on the underlying task.

###  4.1 Message Analysis Component

Below we describe the structural aspects of messages and their associated
processing.

####  4.1.1 Email Header Classification

When communication takes place over a network, metadata is extracted that
serves as a user fingerprint and a source for reputation scoring. Email
headers, for example, contain authentication details and information about the
mail servers that send, receive, and relay messages as they move from outbox
to inbox. To distinguish between benign and malicious emails, Panacea applies
a multistage email spoofing, spamming, and phishing detector consisting of:
(1) a signature-based detector, (2) an active investigation detector, (3) a
receiver-oriented anomaly detector, and (4) a sender-oriented anomaly
detector.

####  4.1.2 Email Content Classification

Dissecting email headers is not enough for detecting malicious messages. Many
suspicious elements are related to email bodies that contain user messages
related to a specific topic and domain. Analyzing email content provides
valuable insight for detecting threats in conversations and a solid
understanding of the content itself. Panacea incorporates machine learning
algorithms that, alongside of header classifiers, digest email exchanges:

##### Benign/non-benign classifier:

Word embedding vectors Bengio et al. (2006); Mikolov et al. (2013) trained on
email samples from different companies (e.g., Enron) are extracted using
neural networks Sherstinsky (2013), i.e., back-propagation model with average
word vectors as features. This classifier provides a binary prediction
regarding the nature of emails (friend or foe).

##### Email threat type classifier:

Spam, phishing, malware, social-engineering and propaganda are detected,
providing fine-grained information about the content of emails and support for
motive detection (i.e., attacker’s intention).

##### Email zone classifier:

Greetings, body, and signature are extracted using word embedding implemented
as recurrent neural network with handcrafted rules, thus yielding senders,
receivers and relevant entities to enable response generation.

All classifiers support active detection of malicious emails and help in the
engagement process of automated bots. Additionally, all trained models have an
overall accuracy of 90% using a cross validation approach against well known
email collections like Enron Klimt and Yang (2004) and APWG Oest et al. (2018)
among other non-public datasets, which makes them reasonably reliable in the
context of passive defenses.

####  4.1.3 Behavioral Modeling

If an adversary is able to compromise a legitimate account, then the header
and content classifiers will not be sufficient to detect an attack. The social
engineer is able to extract contacts of the account owner and send malicious
content on their behalf, taking advantage of the reputation and social
relationships attributed to the hijacked account. Two distinctive approaches
address these issues:

##### Impersonation Detector:

Sender entities are extracted from the email message and a personalized
profile is created for each one, with communication habits, stylometric
features, and social network. The unique profiled model is used to assess
whether this email has been written and sent by an account’s legitimate owner.
If a message arrives from a sender that does not have a profile, Panacea
applies similarity measures to find other email addresses for the unknown
entity. This serves as a defense against impersonation attacks where the
social engineer creates an email account using a name and address similar to
the user of an institutional account for which a model is available. If
Panacea links the unknown account to an institutional account, then that
account’s model is used to determine whether a legitimate actor is using an
unknown account, or a nefarious actor is attempting to masquerade as an
insider in order to take advantage of the access such an account would have.

Receiving Behavior Classifier. Individual profiles are built for the receiving
behavior of each entity (how and with whom this entity communicates) and new
emails are evaluated against the constructed models. To build unique profiles,
all messages sent to each particular entity are collected.

####  4.1.4 Deciders

Panacea must have high confidence in determining that a message is coming from
an attacker before deploying active defense mechanisms. A strategy-pattern
approach fits different meta-classifiers to different situations. Four
classification strategies, called Deciders, combine all component analyses
after a message is delivered to an inbox to make the final friend/foe
determination. The Decider API expects all component analyses to include a
friend/foe credibility score using six levels defined by the Admiralty Code
JDP 2-00 (2011). Deciders may be deterministic through the application of rule
based decision making strategies or they may be trained to learn to identify
threats based on historical data.

####  4.1.5 Threat Intelligence

Panacea stores component analysis results in a threat intelligence knowledge
base for aggregation of attack campaigns with multiple turns, targets, and
threads. The knowledge base adheres to STIX 2.0 specifications and implements
MITRE’s ATT&CK framework Strom et al. (2017) to enable attribution and
anticipatory mitigations of sophisticated SE attacks. Panacea recognizes
indicators of compromise based on features of individual emails as well as
historical behavior of senders and recipients. Intrusion sets and campaigns
are thus constructed when malicious messages color=green,inline, ]Archna: do
we have gold truth on malicious messages, may be we should specify that
explicitly, but may be it is already mentioned, I might have missed it. are
discovered subsequently linked to threat actors based on attribution patterns,
such as IP address, message templates, socio-behavioral indicators, and
linguistic signatures. This feature set was prioritized to work with Unit 42’s
ATT&CK Playbook Viewer. The knowledge base uses a PostgreSQL database backend
with an application layer built with Ruby on Rails.

###  4.2 Dialogue Component

Panacea’s dialogue component consists of three key sub-components: Ask/Framing
Detection (to determine the attacker’s demand), Motive Detection (to determine
the attacker’s goal), and Response Generation (to reply to suspicious
messages).

####  4.2.1 Ask/Framing Detection

Once an email is processed as described above, linguistic knowledge and
structural knowledge are used to extract candidate Ask/Framing pairs and to
provide the final confidence-ranked output.

##### Application of Linguistic Knowledge:

Linguistic knowledge is employed to detect both the ask (e.g., buy gift card)
and the framing (e.g., lose your job, get a 20% discount). An ask may be, for
example, a request for something (GIVE) or an action (PERFORM). On the other
hand, framing may be a reward (GAIN) or a risk (LOSE), for example.
Ask/framing detection relies on Stanford CoreNLP constituency parses and
dependency trees Manning et al. (2014b), coupled with semantic role labeling
(SRL) Gardner et al. (2017), to identify the main action and arguments. For
example, click here yields click as the ask and its argument here.

Additional constraints are imposed through the use of a lexicon based on
Lexical Conceptual Structure (LCS) Dorr and Olsen (2018); Dorr and Voss
(2018), derived from a pool of team members’ collected suspected
scam/impersonation emails. Verbs from these emails were grouped as follows:
$\bullet$ PERFORM: connect, copy, refer $\bullet$ GIVE: administer,
contribute, donate $\bullet$ LOSE: deny, forget, surrender $\bullet$ GAIN:
accept, earn, grab, win

Additional linguistic processing includes: (1) categorial variation Habash and
Dorr (2003) to map between different parts of speech, e.g., reference(N)
$\rightarrow$ refer(V) enables detection of an explicit ask from you can
reference your gift card; and (2) verbal processing to eliminate spurious asks
containing verb forms such as sent or signing in sent you this email because
you are signing up.

##### Application of Structural Knowledge:

Beyond meta-data processing described previously, the email body is further
pre-processed before linguistic elements are analyzed. Lines are split where
div, p, br, or ul tags are encountered. Placeholders are inserted for
hyperlinks. Image tags are replaced with their alt text. All styling,
scripting, quoting, replying, and signature are removed.

Social engineers employ different link positionings to present “click bait,”
e.g., “Click here” or “Contact me (jw11@example.com).” Basic link processing
assigns the link to the appropriate ask (e.g., click here). Advanced link
processing ties together an email address with its corresponding PERFORM ask
(e.g., contact me), even if separated by intervening material.

##### Confidence Score and Top Ask:

Confidence scores are heuristically assigned: (1) Past tense events are
assigned low or 0 confidence; (2) The vast majority of asks associated with
URLs (e.g<EMAIL_ADDRESS>are found to be PERFORM asks with highest
confidence (0.9); (3) a GIVE ask combined with any ask category (e.g.,
contribute $50) is less frequently found to be an ask, thus assigned slightly
lower confidence (0.75); and (4) GIVE by itself is even less likely found to
be an ask, thus assigned a confidence of 0.6 (e.g., donate often). Top ask
selection then selects highest confidence asks at the aggregate level of a
single email. This is crucial for downstream processing, i.e., response
generation in the dialogue component. For example, the ask “PERFORM contact
(jw11@example.com)” is returned as the top ask for “Contact me.
(jw11@example.com).”

####  4.2.2 Motive Detection

In addition to the use of distinct tools for detecting linguistic knowledge,
Panacea extracts the attacker’s intention, or motive. Leveraging the
attacker’s demands (asks), goals (framings) and message attack types (from the
threat type classifier), the Motive Detection module maps to a range of
possible motive labels: financial information, acquire personal information,
install malware, annoy recipient, etc. Motive detection maps to such labels
from top asks/framings and their corresponding threat types. Examples are
shown here:

${\underbrace{\mathit{Give}}_{\text{
Ask}}+\underbrace{\mathit{Finance\>info}}_{\text{Ask
type}}+\underbrace{\mathit{Spam}}_{\text{Email
threat}}\rightarrow\textit{Financial\>info}}$
${\underbrace{\mathit{Gain}}_{\text{
Framing}}+\underbrace{\mathit{Credentials}}_{\text{Ask
type}}+\underbrace{\mathit{Malware}}_{\text{Email
threat}}\rightarrow\textit{Install\>malware}}$

These motives are used later for enhancing a response generation process which
ultimately creates automatic replies for all malicious messages detected in
the Panacea platform.

####  4.2.3 Response Generation

Response generation is undertaken by a bot using templatic approach to yield
appropriate responses based on a hierarchical attack ontological structure and
ask/framing components. The hierarchical ontology contains 13 major categories
(e.g., financial details). Responses focus on wasting the attacker’s time or
trying to gain information from the attacker while moving along F3EAD threat
intelligence cycle Gomez (2011) to ensure that the attacker is kept engaged.
The response generation focuses on the find, finish and exploit states. The
bot goes after name, organization, location, social media handles, financial
information, and is also capable of sending out malicious links that obtain
pieces of information about the attacker’s computer.

A dialogue state manager decides between time wasting and information seeking
based on motive, ontological structure and associated ask/framing of the
message. For example, if an attack message has motive financial details and
ontological structure of bank information, coupled with a PERFORM ask, the
dialogue state manager moves into an information gathering phase and produces
this response: “Can you give me the banking information for transferring
money? I would need the bank name, account number and the routing information.
This would enable me to act swiftly.” On the other hand if the attacker is
still after financial information but not a particular piece of information,
the bot wastes time, keeping the attacker in the loop.

##  5 Evaluation

Friend/foe detection (Message Analysis) and response generation (Dialogue) are
evaluated for effectiveness of Panacea as an effective intermediary between
attackers and potential victims.

###  5.1 Message Analysis Module

The DARPA ASED program evaluation tests header and content modules against
messages for friend/foe determination. Multiple sub-evaluations check system
accuracy in distinguishing malicious messages from benign ones, reducing the
false alarm rate, and transmitting appropriate messages to dialogue components
for further analysis. Evaluated components yield $\sim$90% accuracy.
Components adapted for detecting borderline exchanges (unknown cases) are
shown to help dialogue components request more information for potentially
malicious messages.

###  5.2 Dialogue Module

The ASED program evaluation also tests the dialogue component. Independent
evaluators communicate with the system without knowledge of whether they are
interacting with humans or bots. Their task is to engage in a dialogue for as
many turns as necessary. Panacea bots are able to sustain conversations for an
average of 5 turns (across 15 distinct threads). Scoring applied by
independent evaluators yield a rating of 1.9 for their ability to display
human-like communication (on a scale of 1–3; 1$=$bot, 3$=$human). This score
is the highest amongst all other competing approaches (four other teams) in
this independent program evaluation.

##  6 Conclusions and Future Work

Panacea is an operational system that processes communication data into
actionable intelligence and provides active defense capabilities to combat SE.
The F3EAD active defense cycle was chosen because it fits the SE problem
domain, but specific phases could be changed to address different problems.
For example, a system using the Panacea processing pipeline could ingest
academic papers on a disease, process them with components designed to extract
biological mechanisms, then engage with paper authors to ask clarifying
questions and search for additional literature to review, while populating a
knowledge base containing the critical intelligence for the disease of
interest.

Going forward, the plan is to improve Panacea’s plug-in infrastructure so that
it is easier to add capability without updating Panacea itself. This is
currently possible as long as new components use the same REST API as existing
components. The obvious next step is to formalize Panacea’s API. We have found
value to leaving it open at this early state of development as we discover new
challenges and solutions to problems that emerge in building a large scale
system focused on the dangers and opportunities in human language
communication.

## Acknowledgments

This work was supported by DARPA through AFRL Contract FA8650-18- C-7881 and
Army Contract W31P4Q-17-C-0066. All statements of fact, opinion or conclusions
contained herein are those of the authors and should not be construed as
representing the official views or policies of DARPA, AFRL, Army, or the U.S.
Government.

## References

  * Bakhshi et al. (2008) Taimur Bakhshi, Maria Papadaki, and Steven Furnell. 2008.  A practical assessment of social engineering vulnerabilities.  In _Proceedings of the Second International Symposium on Human Aspects of Information Security & Assurance_.
  * Bengio et al. (2006) Yoshua Bengio, Holger Schwenk, Jean-Sébastien Senécal, Fréderic Morin, and Jean-Luc Gauvain. 2006.  _Neural Probabilistic Language Models_, pages 137–186. Springer Berlin Heidelberg, Berlin, Heidelberg.
  * Bhakta and Harris (2015) Ram Bhakta and Ian G. Harris. 2015.  Semantic analysis of dialogs to detect social engineering attacks.  _Proceedings of the 2015 IEEE 9th International Conference on Semantic Computing (IEEE ICSC 2015)_ , pages 424–427.
  * Caputo et al. (2013) Deanna D Caputo, Shari Lawrence Pfleeger, Jesse D Freeman, and M Eric Johnson. 2013\.  Going spear phishing: Exploring embedded training and awareness.  _IEEE Security & Privacy_, 12(1):28–38.
  * Carvalho and Cohen (2004) Vitor Carvalho and William Cohen. 2004.  Learning to extract signature and reply lines from email.  In _First Conference on Email and Anti-Spam_ , pages 1–8. CEAS.
  * Dada et al. (2019) Emmanuel G. Dada, Joseph S. Bassi, Haruna Chiroma, Shafi’i M. Abdulhamid, Adebayo O. Adetunmbi, and Opeyemi E. Ajibuwa. 2019.  Machine learning for email spam filtering: review, approaches and open research problems.  _Heliyon_ , 5(6):1–23.
  * Denning (2014) Dorothy E. Denning. 2014.  Framework and principles for active cyber defense.  _Computers & Security_, 40:108–113.
  * Dorr and Voss (2018) Bonnie Dorr and Clare Voss. 2018.  STYLUS: A resource for systematically derived language usage.  In _Proceedings of the First Workshop on Linguistic Resources for Natural Language Processing_ , pages 57–64, Santa Fe, New Mexico, USA. Association for Computational Linguistics.
  * Dorr and Olsen (2018) Bonnie J. Dorr and Mari Broman Olsen. 2018.  Lexical conceptual structure of literal and metaphorical spatial language: A case study of push.  In _Proceedings of the First International Workshop on Spatial Language Understanding_ , pages 31–40.
  * Dziri et al. (2018) Nouha Dziri, Ehsan Kamalloo, Kory W Mathewson, and Osmar Zaiane. 2018.  Augmenting neural response generation with context-aware topical attention.  _arXiv preprint arXiv:1811.01063_.
  * Egelman et al. (2008) Serge Egelman, Lorrie Faith Cranor, and Jason Hong. 2008.  You’ve been warned: An empirical study of the effectiveness of web browser phishing warnings.  In _Proceedings of the SIGCHI Conference on Human Factors in Computing Systems_ , CHI ’08, pages 1065–1074, New York, NY, USA. ACM.
  * Gao et al. (2019) Jianfeng Gao, Michel Galley, Lihong Li, et al. 2019.  Neural approaches to conversational ai.  _Foundations and Trends in Information Retrieval_ , 13(2-3):127–298.
  * Gardner et al. (2017) Matt Gardner, Joel Grus, Mark Neumann, Oyvind Tafjord, Pradeep Dasigi, Nelson F. Liu, Matthew Peters, Michael Schmitz, and Luke S. Zettlemoyer. 2017\.  Allennlp: A deep semantic natural language processing platform.  In _Proceedings of Workshop for NLP Open Source Software (NLP-OSS)_.
  * Goffin (2020) Mike Goffin. 2020.  CRITs - Collaborative Research Into Threats.
  * Gomez (2011) Jimmy A. Gomez. 2011.  The targeting process: D3A and F3EAD.  _Small Wars Journal_ , 1:1–17.
  * Habash and Dorr (2003) Nizar Habash and Bonnie J. Dorr. 2003.  A categorial variation database for english.  In _In Proceedings of the Human Language Technology and North American Association for Computational Linguistics (NAACL) Conference_ , pages 96–102.
  * Hadnagy and Fincher (2015) Christopher Hadnagy and Michele Fincher. 2015.  _Phishing Dark Waters_.  Wiley Online Library.
  * Hidey and McKeown (2018) Christopher Hidey and Kathleen McKeown. 2018.  Persuasive Influence Detection: The Role of Argument Sequencing.  In _Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence_ , pages 5173–5180, San Francisco, California, USA.
  * JDP 2-00 (2011) JDP 2-00. 2011.  _Understanding and intelligence support to joint operations (JDP 2-00)_.  Ministry of Defence (UK).
  * Karakasilitiosis et al. (2006) A. Karakasilitiosis, S. M. Furnell, and M. Papadaki. 2006.  Assessing end-user awareness of social engineering and phishing.  In _Proceedings of the Australian Information Warfare and Security Conference_.
  * Kim et al. (2018) Myeongsoo Kim, Changheon Song, Hyeji Kim, Deahyun Park, Yeeji Kwon, Eun Namkung, Ian G Harris, and Marcel Carlsson. 2018.  Catch me, yes we can!-pwning social engineers using natural language processing techniques in real-time.
  * Klimt and Yang (2004) Bryan Klimt and Yiming Yang. 2004.  The enron corpus: A new dataset for email classification research.  In _Machine Learning: ECML 2004_ , pages 217–226. Springer Berlin Heidelberg.
  * Lampert et al. (2009) Andrew Lampert, Robert Dale, and C’ecile Paris. 2009.  Segmenting email message text into zones.  In _Proceedings of the 2009 Conference on Empirical Methods in Natural Language Processing_ , page 919–928. Association for Computational Linguistics.
  * Li and Goldwasser (2019) Chang Li and Dan Goldwasser. 2019.  Encoding social information with graph convolutional networks forPolitical perspective detection in news media.  In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_ , pages 2594–2604, Florence, Italy. Association for Computational Linguistics.
  * Li et al. (2020) Yu Li, Kun Qian, Weiyan Shi, and Zhou Yu. 2020.  End-to-end trainable non-collaborative dialog system.  _ArXiv_ , abs/1911.10742.
  * Manning et al. (2014a) Christopher D. Manning, Mihai Surdeanu, John Bauer, Jenny Finkel, Steven J. Bethard, and David McClosky. 2014a.  The Stanford CoreNLP natural language processing toolkit.  In _Association for Computational Linguistics (ACL) System Demonstrations_ , pages 55–60. ACL.
  * Manning et al. (2014b) Christopher D. Manning, Mihai Surdeanu, John Bauer, Jenny Finkel, Steven J. Bethard, and David McClosky. 2014b.  The Stanford CoreNLP natural language processing toolkit.  In _Association for Computational Linguistics (ACL) System Demonstrations_ , pages 55–60.
  * Mikolov et al. (2013) Tomas Mikolov, Ilya Sutskever, Kai Chen, Greg Corrado, and Jeffrey Dean. 2013.  Distributed representations of words and phrases and their compositionality.  In _Proceedings of the 26th International Conference on Neural Information Processing Systems - Volume 2_ , pages 3111–3119. Curran Associates Inc.
  * Oest et al. (2018) Adam Oest, Yeganeh Safei, Adam Doupe, Gail-Joon Ahn, Brad Wardman, and Gary Warner. 2018.  Inside a phisher’s mind: Understanding the anti-phishing ecosystem through phishing kit analysis.  In _Proceedings of the 2018 APWG Symposium on Electronic Crime Research, eCrime 2018_ , pages 1–12. IEEE Computer Society.
  * Oliveira et al. (2017) Daniela Oliveira, Harold Rocha, Huizi Yang, Donovan Ellis, Sandeep Dommaraju, Melis Muradoglu, Devon Weir, Adam Soliman, Tian Lin, and Natalie Ebner. 2017.  Dissecting spear phishing emails for older vs young adults: On the interplay of weapons of influence and life domains in predicting susceptibility to phishing.  In _Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems_ , CHI ’17, pages 6412–6424, New York, NY, USA. ACM.
  * Prakhar Gupta and Bigham (2019) Tiancheng Zhao Amy Pavel Maxine Eskenazi Prakhar Gupta, Shikib Mehri and Jeffrey Bigham. 2019.  Investigating evaluation of open-domain dialogue systems with human generated multiple references.  In _Proceedings of the 20th Annual Meeting of the Special Interest Group on Discourse and Dialogue_ , Stockholm, Sweden. Association for Computational Linguistics.
  * Ravichander and Black (2018) Abhilasha Ravichander and Alan W. Black. 2018.  An empirical study of self-disclosure in spoken dialogue systems.  In _Proceedings of the 19th Annual SIGdial Meeting on Discourse and Dialogue, Melbourne, Australia, July 12-14, 2018_ , pages 253–263.
  * Santhanam and Shaikh (2019) Sashank Santhanam and Samira Shaikh. 2019.  A survey of natural language generation techniques with a focus on dialogue systems-past, present and future directions.  _arXiv preprint arXiv:1906.00500_.
  * Sawa et al. (2016) Yuki Sawa, Ram Bhakta, Ian Harris, and Christopher Hadnagy. 2016.  Detection of social engineering attacks through natural language processing of conversations.  In _Proceedings of the 2016 IEEE Tenth International Conference on Semantic Computing (ICSC)_ , pages 262–265.
  * Sherstinsky (2013) Alex Sherstinsky. 2013.  Fundamentals of recurrent neural network (rnn) and long short-term memory (lstm) network.  pages 1–39. Cornell University.
  * Strom et al. (2017) Blake E. Strom, Joseph A. Battaglia, Michael S. Kemmerer, William Kupersanin, Douglas P. Miller, Craig Wampler, Sean M. Whitley, and Ross D. Wolf. 2017.  Finding cyber threats with att&ck-based analytics.  _The MITRE Corporation, Tech. Rep._ , 1(1).
  * Wagner et al. (2016) Cynthia Wagner, Alexandre Dulaunoy, Gérard Wagener, and Andras Iklody. 2016\.  Misp: The design and implementation of a collaborative threat intelligence sharing platform.  In _Proceedings of the 2016 ACM on Workshop on Information Sharing and Collaborative Security_ , pages 49–56. ACM.
  * Yin et al. (2011) Meijuan Yin, Xiao Li, Junyong Luo, Xiaonan Liu, and Yongxing Tan. 2011.  Automatically extracting name alias of user from email.  _International Journal of Engineering and Manufacturing_ , 1:14–24.
  * Zhang et al. (2006) Yue Zhang, Serge Egelman, Lorrie Faith Cranor, and Jason I. Hong. 2006.  Phinding phish: Evaluating anti-phishing tools.  Technical report, Carnegie Mellon University.