# Benchmarking the Benchmark - Analysis of Synthetic NIDS Datasets

Siamak Layeghy, Marcus Gallagher, Marius Portmann  School of ITEE, The
University of Queensland, Brisbane, Australia

###### Abstract

Network Intrusion Detection Systems (NIDSs) are an increasingly important tool
for the prevention and mitigation of cyber attacks. Over the past years, a lot
of research efforts have aimed at leveraging the increasingly powerful models
of Machine Learning (ML) for this purpose. A number of labelled synthetic
datasets generated have been generated and made publicly available by
researchers, and they have become the benchmarks via which new ML-based NIDS
classifiers are being evaluated. Recently published results show excellent
classification performance with these datasets, increasingly approaching 100
percent performance across key evaluation metrics such as accuracy, F1 score,
etc. Unfortunately, we have not yet seen these excellent academic research
results translated into practical NIDS systems with such near-perfect
performance.

This motivated our research presented in this paper, where we analyse the
statistical properties of the benign traffic in three of the more recent and
relevant NIDS datasets, (CIC, UNSW, …). As a comparison, we consider two
datasets obtained from real-world production networks, one from a university
network and one from a medium size Internet Service Provider (ISP). Our
results show that the two real-world datasets are quite similar among
themselves in regards to most of the considered statistical features. Equally,
the three synthetic datasets are also relatively similar within their group.
However, and most importantly, our results show a distinct difference of most
of the considered statistical features between the three synthetic datasets
and the two real-world datasets. Since ML relies on the basic assumption of
training and test datasets being sampled from the same distribution, this
raises the question of how well the performance results of ML-classifiers
trained on the considered synthetic datasets can translate and generalise to
real-world networks. We believe this is an interesting and relevant question
which provides motivation for further research in this space.

###### keywords:

Network traffic, feature distribution, IDS Dataset, NetFlow, Traffic
Characteristics

††journal: Arxiv.org

##  1 Introduction

Network Intrusion Detection Systems (NIDSs) are an important defence mechanism
to protect computer networks against an increasing diversity, sophistication
and volume of cyber attacks. Due to the tremendous progress in Machine
Learning (ML) over the last few years, in particular Deep Neural Networks
(DNNs), there has been a lot of recent research into leveraging the power of
novel ML models for Network Intrusion Detection Systems. In particular
supervised ML methods have shown great potential over traditional signature-
based NIDS. As with any supervised ML problem, the availability of high
quality labelled datasets is absolutely critical. For many years, the KDD99
dataset [1] has been the most widely used benchmark dataset for the evaluation
of NIDSs. However, it is well established that the dataset has significant
limitations [2] the main one being its age, it was created over two decades
ago. Given that Youtube, Facebook, Spotify, mainstream cloud computing and
smartphones did not exist when the dataset was created, one can appreciate
that the pattern of network traffic has undergone a profound change since
then.

Furthermore, the type and sophistication of network attacks have undergone an
equally dramatic change in the last 20+ years 111It is quite suprising that
the KDD99 dataset is still used today???. The need for more recent and
relevant NIDS datasets has been clearly identified [2], and has lead to the
development of a range of new datasets over the last few years. In contrast to
ML application areas such as image classification, where high quality
benchmark datasets can relatively easily be generated, this is a much harder
problem in the context of NIDSs. Ideally, we would have datasets collected
from real production networks, with realistic network patterns of benign
traffic, together with a wide range of correctly labelled attack traffic.
Since such ideal NIDS datasets are not readily available, researchers have
recently developed a range of new synthetic datasets, which have become the
new benchmarks. These synthetic datasets are typically generated in a
controlled and relatively small simulation or test-bed environment, where both
normal traffic and attack traffic are created and labelled. Each of these
datasets typically has its own dedicated feature set, which is collected and
represented in a flow-based format. Over the past few years, researchers have
extensively used these synthetic datasets to evaluate a wide range of new
proposed ML-based intrusion detection models and methodologies. Recently
published results show increasingly excellent classification performance,
approaching 100% across the key performance metrics, such as accuracy,
F1-score, etc. Consequently, one could assume that the problem of ML-based
NIDS has been largely solved. Arguably, this is not quite the case, and the
excellent results achieved in recently published academic research have not
yet translated into practical, near-perfect intrusion detection systems
deployed in real-world production networks. This apparent gap has motivated
our research presented in this paper.

ML generally assumes that statistical properties of training data are the same
as for testing data. Therefore, in order for the performance of an ML-
classifier trained and evaluated on synthetic datasets to generalise and
translate to a real network scenario, the statistical properties of both
datasets would have to be similar. Our aim was therefore to compare the
statistical properties of synthetic NIDS datasets with those of real world
network traffic. Our aim was therefore to compare the statistical properties
of synthetic datasets with those of network traffic obtained from real, large-
scale production networks. In our analysis, we focused on benign (non-attack)
traffic, due to the lack of attack labels in the production network traffic
available to us. For our analysis, we have considered three recently published
and widely used synthetic datasets UNSW-NB15 [2], CIC-IDS2017 [3] and TON-IOT
[4]. The datasets contain 44 to 85 number of features in different formats. We
further used two datasets from large-scale production networks, collected in
2019, one from a medium sized Australian ISP, and the other from the
University of Queensland network with $\sim$100 and $\sim$700 flows per second
respectively. The real-world datasets were in Netflow/IPFIX format, which is
widely available in

In order to enable the comparison of the five datasets, we require them to be
in the same format. For this, we leveraged our previous work [5], where we
converted synthetic NIDS datasets from their proprietary feature set and
format to the standard Netflow/IPFIX format 222Datasets are available here ….
In [6], we argue the benefits of having a standard feature set and dataset
format, and also show that, somewhat surprisingly, ML-classifiers achieve
higher performance using the Netflow feature set and format, compared to the
original version.

For our comparison, we considered 9 practically relevant statistical features,
such as flow duration, flow size, packet size, plus a number of IP address and
port number related features. We compared the statistical distributions via
box plots and CDF of each feature across the five considered datasets. We
further quantified the distance of the different feature distributions using
the Wasserstein metric [7]. Finally, we calculated and visualised the
embedding of the 9 features into a 2 dimensional feature space, using four
different embedding algorithms.

Our analysis provided the following key findings. The two real-world datasets,
despite the fact that they had been collected from quite different networks,
exhibit a high degree of similarity in the traffic feature distributions.
Similarly, the synthetic datasets are quite similar amongst themselves in
regards to most traffic features. However, and most interestingly, our
analysis found a highly significant difference between the synthetic datasets
and the real-world datasets in regards to most of the considered feature
statistics.

To the best of our knowledge, this paper provides the first analysis of recent
synthetic NIDS datasets and their comparison to real word traffic, We believe
our results are relevant due to the extensive use of these synthetic datasets
as a benchmark to evaluate ML-based NIDS models and algorithms, and they
motivate future research into the development of new datasets that more
closely match the properties of traffic in large scale real-world networks.
This is an important goal in order to allow the translation and generalisation
of the excellent NIDS performance achieved in academic research into NIDSs
that are increasingly practically relevant and widely deployed in practical
settings.

The rest of this paper is organised as follows. After explaining the
background in the next section, the three synthetic datasets along with the
two real-world network traffic datasets that are used as references for this
purpose, are introduced in Section 3. The next section provides various
qualitative comparisons between features distributions of the synthetic
datasets and the real-world datasets. Then, Section 5 quantifies the
differences of feature distributions among two groups of datasets. Section 6
provides the related works in the field and Section 7 concludes the paper and
provides the insights from our study.

##  2 Background

###  2.1 Network Intrusion Detection Systems

The main approaches for building network-based intrusion detection systems
(IDS) include misuse detection or rule-based, anomaly detection, and a third
hybrid approach, which tries to combine benefits of the first two approaches
[8]. In misuse detection systems, detection is based on the known attack
signatures or rules. In anomaly detection, most of the methods define a normal
traffic model and then identify anomalies as deviations from the normal model.
While misuse-based IDSs have low false positive ratios, they fail to detect
new types of attacks / intrusions since they have designed to detect specific
types of intrusions. Anomaly-based IDSs, on the other hand, have higher false
positive ratios but are potentially capable of detecting unknown attacks /
intrusions. The anomaly-detection systems are implemented using various
techniques, and hence there are various categories of anomaly-based IDS [9].

The main approaches for the network anomaly detection include Statistical,
Machine Learning, Soft Computing, Knowledge-based, and Combination Learner
methods. In the statistical methods, generally a model is fitted to the given
data (usually normal behaviour), either via parametric or non-parametric
techniques. Then, by applying statistical inference tests, the probability
that an instance is generated by the model is calculated. If such probability
is low, the instance is considered anomaly [10]. In the soft computing
approach, which includes methods based on Genetic Algorithms (GA), Fuzzy Set
Theoretic (FST), Rough Set (RS), and Ant Colony and Artificial Immune Systems
(AIS), persistant features of data are detected and categorized without
environmental feedback. For instance, in methods based on GA, heuristic search
techniques based on evolutionary ideas are used to learn the user profiles,
and in methods based on FST, fuzzy rules are used to determine the likelihood
of specific or general network attacks [8]. In knowledge-based methods,
network events are matched against predefined rules or patterns of attacks,
i.e. attack signatures. Several approaches have been taken in the knowledge-
based methods including expert systems, rule-based, ontology-based, logic-
based and state-transition analysis [10]. The main ingredient of all
combination learner methods, which include ensemble-based, fusion and hybrid
approaches, is combining advantages of different methods to enhance the
performance of anomaly detection. In the case of ensemble-base and fusion
approaches various classifiers are combined and the hybrid approach enhances
the anomaly detection by getting the advantages of misuse detection methods
[8].

Among different methods utilised for implementing the anomaly-detection IDS,
systems based on machine learning have been very common [11]. This approach
includes two methods clustering / outlier-based, and classification-based.
While clustering-based methods do not require labelled datasets for their
training / operation, their evaluation necessitates using labelled datasets.
Training and evaluation of the second sub-category of machine learning based
approach, i.e. classification-based methods, require labelled datasets in
which classes / categories of data are known and included in the dataset as
labels. This allows machine learning algorithms to learn the patterns of
various classes and accordingly classify the dataset records. In the field of
anomaly detection, these classes are mainly normal and anomaly classes. The
anomaly class can be further divided into different types of anomalies such as
network failures, intrusions and other types of attacks.

##  3 Datasets Explored in This Study

In this study we have used three Synthetic / testbed-based IDS benchmark
datasets which we are compared with two real-world network traffic records.

###  3.1 Synthetic Datasets

The Synthetic / testbed-based datasets selected for this study are chosen from
the most recent IDS benchmark datasets that published from 2015 till 2019.

####  3.1.1 UNSW-NB15 Dataset

This is the oldest dataset among the three selected datasets, which is
published in 2015 by the Cyber Range Lab of the Australian Centre for Cyber
Security (ACCS) [2]. The dataset has consisted of 2,540,044 flows including
87.35% benign and 12.65% attack flows. The traffic flows are represented in 49
features generated by Argus and Bro-IDS from traffic of a test bed in which 9
different attack types are combined with normal background testbed traffic.
This dataset is also published in the form of raw pcap files.

####  3.1.2 CIC-IDS2017 Dataset

This dataset has been generated by Canadian Institute for Cybersecurity in
2017 [3]. The main priority in generating this dataset is stated by authors as
having realistic background traffic. They have used their own developed tool
for network analysis, CICFlowMeter, to generate a dataset in which flows are
labeled based on time stamp, source, and destination IPs, source and
destination ports, protocols and attack. They have also provided the dataset
represented by extracted features definition. They have included 21 different
network attack in this dataset, which includes most of the major network
breaches such as DoS, DDoS, different scans, Botnet, and various types of Web
and Infiltration attacks. They ran individual class of attacks separately and
provided them in a separate CSV files, as for normal background traffic of
their test bed. The dataset is also published in raw pcap format.

####  3.1.3 TON-IOT Dataset

This is a newer dataset published by ACCS in 2019, encompassing a broader
scope compared to their previous dataset [2], which includes traffic records
from their testbed network and IoT devices along with logs of the operating
systems [4]. The network traffic records, explored in our work, are
represented in the form of 22,339,021 network flows using 44 features
extracted by Bro-IDS. The background / benign traffic constitutes 3.56% of
dataset and the remaining flows (96.44%) are 9 different attack records. This
dataset is also published in the raw pcap format.

###  3.2 Real-World Network Traffic Records

In order to compare the above testbed-based datasets with real-world traffic,
we collected two sets of network traffics. Since we are looking for the
aspects of network traffic that must be valid in any network type, we selected
two completely different networks. This is an important basis in our study to
avoid biased judgement and be able to generalise the results to any network
type. As such, the two network traffic records explained in this section, not
only are collected from two different types of networks, but they also belong
to two different organization with various administration requirements and
ruling polices who serve different types of customers. In addition, these two
sets of network traffic have been recorded in two different time period, 2017
and 2019, to maximise the possibility of result generalisation.

####  3.2.1 Internet Service Provider Traffic Dataset

The first real-world dataset utilised in this study is the NetFlow records
from an Australian Internet Service Provider (ISP) backbone network. This ISP
is a provider of enterprise-grade managed services such as Internet, MPLS,
VoIP, and cloud with dual point of presences (PoPs) in all major Australian
capital cities, New Zealand, Hong Kong and Manilla. Most of the customers of
the ISP are businesses and companies with multiple offices, sometimes
thousands of offices around the country, that use ISP’s services for the
connectivity and other network and Internet services. For collecting the
traffic records we used the nprobe [12] software on a server to extract
NetFlow records with about 20 fields. The whole traffic from ISP’s backbone
network was mirrored and aggregated toward the nprobe server where after
extracting NetFlow records stored them in another collector server. These
records reflect the whole traffic in the monitored part of ISP’s backbone
network without any sampling or exemptions. We have collected these NetFlow
records for about 30 days in June 2017 and it includes about 400GB of flow
records.

####  3.2.2 University of Queensland (UQ) Dataset

The next real-world dataset we have used in this study includes NetFlow
records collected form the LAN of faculty of Engineering, Architecture and
Information Technology (EAIT), The University of Queensland. The EAIT faculty
consists of five schools including Architecture, Chemical Engineering, Civil
Engineering, Information Technology and Electrical Engineering, and Mechanical
and Mining Engineering. We used similar setup for collecting this dataset,
i.e. using nprobe NetFlow exporter with the same set of fields that we used on
ISP NetFlows. The data collection in this site started on early Feb. 2019 and
continued for about 50 days. The recorded data includes all the traffic flows
in the monitored part of the network including all wired and wireless
communications, servers’ traffic and all workstations in all subsidiary
schools of EAIT faculty, totally about 4TB.

Table 1 shows a summary information relating the five datasets studied in this
paper. This information includes the type of dataset, i.e. is it a synthetic
or real-world dataset, the percentage of attack and benign flows from total
records of the dataset, number of features, the year dataset is collected /
published, size, type and the tools used to generate / collect the dataset.

Table 1: Summary information of datasets studied in this paper |  |  |  |  |  |
---|---|---|---|---|---|---
Dataset |  Synthetic / Real-world |  Attack (%) |  Number of Features |  Year |  Format |  Generation Tool
|  |  |  |  |  |
|  |  |  |  |  |
UNSW-NB15 [2] |  Synthetic |  12.65 |  49 |  2015 |  proprietary flow format |  Argus / Bro
|  |  |  |  |  |
|  |  |  |  |  |
CIC-IDS2017 [3] |  Synthetic |  28.16 |  85 |  2017 |  proprietary flow format |  CICFlowMeter
|  |  |  |  |  |
|  |  |  |  |  |
TON_IOT [4] |  Synthetic |  96.44 |  44 |  2019 |  proprietary flow format |  Security Onion / Bro
|  |  |  |  |  |
|  |  |  |  |  |
ISP [Our] |  Real-World |  0 |  20 |  2017 |  NetFlow |  nprobe
|  |  |  |  |  |
|  |  |  |  |  |
UQ [Our] |  Real-World |  0 |  20 |  2019 |  NetFlow |  nprobe
|  |  |  |  |  |

##  4 Statistical Analysis of Network Traffic Features

As discussed in Section 6.2, anomalies typically change statistical
distribution of some traffic features [13, 14, 15]. Hence, we cannot expect to
acquire similar results from the comparison of statistical distributions of
these benchmark datasets containing anomalies / attacks with that of the real-
world traffic records with unknown attack inclusion status. So, we needed to
make sure that the selected parts of both groups of datasets are attack free
(normal traffic).

As such, we had two issues to address before starting our analysis. First, to
select attack free parts from benchmark datasets, and second, to make sure the
selected parts of the real-world traffic does not include attacks. The first
problem was relatively easy, as normal / background traffic were provided in
separate files in UNSW-NB15 [2], CIC-IDS2017 [3] and TON_IOT [4], and we used
the provided metadata to exclude all the attack flows. The second task was
rather difficult. Initially, we asked for the attack / anomaly logs in the ISP
and our university IT department related to the selected part of the traffic.
Then, we applied our under-development AI-based anomaly detection algorithms
on these recordings. Finally, any detected anomalies by algorithms were
investigated in complete details and discussed with the corresponding network
administration for final decision. In this way, an anomaly-free part of the
traffic was selected equivalent to 24 hours of both ISP and UQ traffic
records.

Table 2 shows the list of traffic features we have used in this statistical
distributions comparison. The first column is the name of feature, the second
column is the NetFlow (V9) fields used to calculate the feature, and the third
column is the formula / equation applied for the calculation. Since some of
the needed NetFlow fields were not provided in the original published
benchmark datasets, we had to use their provided packet captures (pcap files)
to generate the NetFlow records. For this, after determining the attack free
parts of the benchmark datasets, as explained above, the corresponding pcap
files were identified and fed to nprobe [12] software to generate NetFlow
records.

All the NetFlow fields utilised in our study have previously been used for
characterising anomaly traffic in at least one or more studies [13, 14, 15],
except the L7_PROTO that was not easily provided by devices in the past. As
such, comparing these datasets with real-world traffic, in terms of
statistical distributions of these features, provides a realistic measure of
similarity to the real-world traffic. This is a missing meaningful
benchmarking of these datasets that can indicate their suitability for
benchmarking the IDS algorithms and systems in the real-world scenarios.

In this study we provide two sets of comparisons. Initially we qualitatively
investigate distribution of these features by comparing their boxplots and
Cumulative Distribution Functions (CDFs), and later their embeddings, in this
section. This enables us to observe the difference in distribution of these
features between the real-world traffic and testbed-based datasets. Then we
quantify these qualitative comparisons using quantitative distance metrics in
the next section.

Table 2: List of Traffic features investigated in this study, along with
NetFlow fields utilised to calculate these features and how they are
calculated

Feature |  NetFlow Fields |  How to  Calculate
---|---|---
flow duration |  FIRST_SWITCHED(FS), LAST_SWITCHED(LS) |  Ls - FS
flow size (in Bytes) |  IN_BYTES(IB), OUT_BYTES(OB) |  IB + OB
packet time (average) |  FIRST_SWITCHED(FS), IN_PKTS(IP), LAST_SWITCHED(LS), OUT_PKTS(OP) |  $\textstyle\frac{\text{{LS - FS}}}{\text{{IP + OP}}}\hskip 85.35826pt$
packet size |  IN_BYTES(IB), OUT_BYTES(OB), IN_PKTS(IP), OUT_PKTS(OP) |  $\textstyle\frac{\text{{IB + OB}}}{\text{{IP + OP}}}\hskip 85.35826pt$
number of source IPs per destination IP |  SRC_IP, DST_IP |  COUNT(SRC_IP) per DST_IP
number of source IPs per destination PORT |  SRC_IP, DST_PORT |  COUNT(SRC_IP) per DST_PORT
number of destination IPs per source PORT |  DST_IP, SRC_PORT |  COUNT(DST_IP) per SRC_PORT
number of destination Ports per source port |  SRC_PORT, DST_PORT |  COUNT(DST_PORT) per SRC_PORT
number of L7 protocols per destination port |  L7_PROTO, DST_PORT |  COUNT(L7_PROTO) per DST_PORT

###  4.1 Qualitative Comparison of Feature Distributions

In this section, we are providing boxplot and CDF of all the features listed
in Table 2 for all five datasets, including the three testbed-based datasets
and two real-world traffic records, side by side.

(a)

(b)

(c)

(d)

Figure 1: Comparing the flow durations and flow sizes within the two real
world datasets. a) and b) show the flow durations of ISP, and sampled UQ
dataset, and c) and d) show their flow sizes correspondingly. In each figure,
the selected sample day is highlighted in blue color

####  4.1.1 Feature Variability Within the Dataset

Before comparing the feature distributions between groups, we investigated the
feature distribution within various samples of the same dataset. Figure 1
shows two examples of comparing feature distribution within the individual
datasets. Figure 1-a and b show the distribution of flow durations for
different days of ISP and sampled UQ datasets ($\sim 20$ sample per minute)
respectively, and Figure 1-c and d show distribution of flow sizes for
different days of ISP and sampled UQ datasets respectively. In all figures,
the red circles show the median, the red crosses show the mean, and the lines
/ bars show the standard deviation (STD) of the feature. The y axis is shown
in logarithmic scale for the flow sizes (1-c and d) due to the presence of
very large flows, which has compressed the main part of the feature range.

As seen, while there are variations in the distribution of features among
different days of both datasets, the main characteristics of distributions are
similar, i.e. means, and medians are very close and STDs are almost in the
same range. This clearly indicates that distribution of these features is an
inherent quality of these datasets and its comparison is indeed meaningful. In
addition, the it shows that the statistical parameters of selected sample day
from each dataset, which is highlighted in blue, is not significantly
different from the rest of the dataset.

####  4.1.2 Flow Duration

Figure 2 shows the distribution of flow duration for all five datasets. In
Figure 2-a the three

(a)  (b)

Figure 2: Comparing the flow duration in five datasets a) boxplots, and b)
CDFs

left-most boxplots are the three synthetic datasets and two right-most are the
real-world traffic records. In all boxplots shown in this paper, the whiskers
indicate a maximum distance of 1.5 times IQR above and below IQR. As seen,
while the two real-world datasets have completely different IQR from all three
synthetic datasets, they have significant overlap. This can be further
confirmed by Figure 2-b in which the CDFs of two real-world traffic records
move close together and far from the three synthetic datasets all the way to
the right corner of the figure.

####  4.1.3 Flow Size (in Bytes)

The next feature distribution compared between these five dataset is the flow
size (in Bytes). Figure 3 compares the distribution of flow sizes in (a) by
boxplots and in (b) by CDFs. While in Figure 3-a there is a meaningful
distinction between IQRs of the two synthetic datasets TON_IOT and UNSW_NB15,
and two real-world datasets, the IQR of CIC has a major overlap with two real-
world datasets. In addition, the overlap between IQRs of the two real-world
datasets is still significant. This can be further confirmed by investigating
the CDF of flow size in these datasets as shown in Figure 3-b. Here, we have
used logarithmic scale for the horizontal axis. This is because of the very
large outlier values that make the main part of the curves very tiny. The
conclusion from figure 3-a can be confirmed here as well. The two real-world
datasets close together from the beginning to the end, CIC also closely moves
together with them, but TON_IOT and UNSW_NB15 have separate path. It worth to
mention that we have also computed similar graphs for the distribution of flow
sizes in number of packets, i.e. the total number of packets in flows (IP +
OP), but since the result were very similar to flow sizes in Bytes (Figure 3)
we gave up to include them.

(a)  (b)

Figure 3: Comparing the flow sizes (in Bytes) in five datasets a) boxplots,
and b) CDFs

####  4.1.4 Packet Time (average)

Figure 4 shows the distribution of packet times for the five datasets. The
average packet time / duration is computed by dividing flow duration by total
number of packets in flow, as shown in the Table 2. Since it takes into
account, at the same time, the flow duration and number of packets, it
reflects traffic characteristics in two dimensions time and volume. Again, the
similarity between two real-world datasets, and their distance to synthetic
datasets is very clear.

(a)  (b)

Figure 4: Comparing the packet times in five datasets a) boxplots, and b) CDFs

####  4.1.5 Packet Size

Figure 5 shows packet size distribution for the five datasets. Although it is
hard to separate the real-world and synthetic datasets in Figure 5-a, due to
the major overlap between IQRs of both groups, further investigation, as seen
in Figure 5-b, reveals a pattern similar to previous features. While the
distinction between groups is clear, the difference, in this case, is not as
significant as in the case of the previous features. Though, the phenomena of
two real-world datasets moving close together, separate from others, from
beginning of the CDF till its end, is still observed. The horizontal axis in
Figure 5-b is again in logarithmic scale, to highlight the main part of the
graph, which is compressed due to the outliers with very large values.

(a)  (b)

Figure 5: Comparing the packet sizes in five datasets a) boxplots, and b) CDFs

####  4.1.6 Number of Source IPs per Destination IP

The next row of the Table 2 indicates a feature that is computed by counting
number of source IP addresses per each destination IP address. This feature is
specifically important for the detection and identification of DDoS attacks.

(a)  (b)

Figure 6: Comparing the number of source IPs per destination IP in five
datasets a) boxplots, and b) CDFs

Figure 6 shows the distribution of this feature for the five datasets in (a)
using boxplots, and in (b) using CDFs. As in Figure 6-a, the two real-world
datasets have a completely similar IQR that is totally different from
UNSW_NB15 and TON_IOT, and the IQR of CIC dataset is overlapping with the
real-world datasets. Figure 6-b also confirms this by showing that the CDF
curves of the two real-world datasets move close together from beginning to
the end. The CDF curve of CIC starts close to the real-world datasets but
somewhere in the end of the range separates from them. However, the CDF curves
of the UNSW_NB15 and TON_IOT take a distinct path from early beginning to the
end. These results are completely inline with the previous results, i.e.
results of the previous features. As mentioned earlier, the results in this
section includes the initial analysis and we have done the precise statistical
tests for all feature distribution comparisons, that their results will be
provided the results in the next subsection.

(a)  (b)

Figure 7: Comparing the number of source IP addresses per destination port in
five datasets a) boxplots, and b) CDFs

####  4.1.7 Number of Source IPs per Destination Port

This feature is again important in detecting DoS and DDoS and scanning
attacks. The feature distribution for the five datasets are depicted in Figure
7-a in boxplots and in Figure 7-b in CDFs. The distinction between the real-
world and synthetic datasets is very clear in both boxplots and CDF curves. In
Figure 7-a, the three synthetic datasets (red boxplots) have very small IQR,
in contrast to two real-world datasets (blue boxplots), which have large
overlapped IQR. The CDF curves have exactly the same situation, i.e. the two
real-world datasets are relatively close together from beginning all the way
to the end, and distinct from synthetic datasets.

(a)  (b)

Figure 8: Comparing the number of destination IP addresses per source port in
five datasets a) boxplots, and b) CDFs

####  4.1.8 Number of Destination IPs per Source Port

Again, this feature is important in detecting DoS, DDoS and scanning attacks.
The boxplots and CDF curves of the feature distribution for the five datasets
are depicted in Figure 8-a and 8-b respectively. The situation of feature
distribution is completely similar to the previous feature. The two real-world
datasets have very close distributions in both boxplots and CDFs, and they are
distinct from the synthetic datasets.

####  4.1.9 Number of Destination Ports per Source Port

This feature is also important in detecting DDoS and scanning attacks. The
feature distribution for the five datasets are depicted in boxplots (Figure
9-a ) and CDF curves (Figure 9-b). Like the two previous features, the
distributions of the feature in two real-world datasets are very close in both
boxplots and CDFs, and they are distinct from the synthetic datasets with an
exception of UNSW_NB15 which gets close to the real-world datasets in parts of
its CDF curve.

(a)  (b)

Figure 9: Comparing the number of destination ports per source port in five
datasets a) boxplots, and b) CDFs

####  4.1.10 Number of L7 Protocols per Destination Port

This is the last feature used in this study for the comparison of the
synthetic datasets with the real-world traffic. While due to the lack of
availability of L7 protocol in the fields exported by NetFlow exporters in the
past, it has not been utilised in the anomaly detection studies referred in
our study, it is an important feature in network security. Intuitively, many
well-known protocols have been used with specific destination ports, such as
the HTTP and port 80. As such, the number of L7 protocols utilised with each
port can be attributed to the normal behavior, i.e. characteristics, of a
network and changes in its distribution can be an indicator of abnormal
network situation.

(a)  (b)

Figure 10: Comparing the number of L7 protocols per destination port in five
datasets a) boxplots, and b) CDFs

The distribution of this feature for the five datasets are shown in Figure 10.
The boxplots are shown in Figure 10-a in which the three synthetic datasets
are depicted in red color in the left most side and the two real-world
datasets are depicted in blue in the right-most side of the figure. As seen,
the IQRs of the two real-world datasets are totally separate from the
synthetic datasets. Although the real-world datasets seem to have non-
overlapping IQRs, their both differences to synthetic datasets’ IQRs are
stronger than their difference. Similar situation can be understood from the
CDF curves as shown in Figure 10-b that confirms relative closeness of the
real-world datasets compared to synthetic datasets. While this intuitive
analysis gives us a sense of the feature distribution comparison between these
five datasets, the results provided by running Kruskal-Wallis test in the next
subsection will provide the final findings.

###  4.2 Comparing Dimensionality Reduced Feature Distributions

Here we visualize the feature distributions after applying various methods of
embedding, on the set of all nine features listed in Table 2, and compare the
five datasets. For this purpose, we use four different methods of
dimensionality reduction techniques including Linear Discriminant Analysis
(LDA), Multi-dimensional Scaling(MDS), Spectral Embedding and Principle
Component Analysis (PCA). The resulting embeddings of features after applying
dimensionality reduction on each dataset are plotted in Figure 11-a, b, c and
d respectively. Embeddings of each dataset is plotted using a different marker
and color to illustrate the differences of their distributions.

(a)

(b)

(c)

(d)

Figure 11: Embedding samples all the five datasets using a) Linear
Discriminant Analysis (LDA), b) Multi-dimensional Scaling(MDS), c) Spectral
Embedding, and d) Principle Component Analysis (PCA)

In Figure 11-a, LDA is the dimensionality reduction method applied to the
features. The horizontal axis represents the first embedded component and the
vertical axis represents the second embedded component. As per previous
figures, dark and light blue colors are used for UQ and ISP and the orange,
light and dark red are used for UNSW_NB15, TON_IOT and CIC_IDS respectively.
As seen, the embedded points from the two real-world datasets are vastly
spread in the direction of the first embedded component, while the embedded
points of the synthetic datasets are mostly located in the area of small
values. Similar results can be seen in Figure 11-d, where PCA is applied for
dimensionality reduction and the horizontal and vertical axes represent the
first and second principle components respectively.

The other two embedding show another pattern in which the real-world and
synthetic datasets are separated across both embedded components. In Figure
11-b and Figure 11-c, which illustrate the results of MDS and spectral
embedding dimensionality reduction methods, the horizontal and vertical axes
represent the first and second embedded component respectively. In both
figures, the embedded points of the synthetic datasets are mostly accumulated
in a small area of the surface, while the embedded points of the real-world
datasets are spread in much larger area. These results are another indication
of the vast differences between the statistical features of the real-world
datasets and the normal part of these synthetic datasets.

##  5 Quantifying the Distance Between Distributions

In the previous section we have shown that distributions of traffic
characteristics features of the benign / attack-free parts of the three
selected IDS datasets are statistically different from the real-world traffic.
This distribution difference is visualised for several features that are
commonly used for implementing anomaly and intrusion detection systems, in
terms of their CDF and boxplot comparison. While these visualizations are
clear indications of the difference between the two groups of datasets, they
do not provide a measure of how an individual dataset is far from the other
one.

(a)  (b)

(c)  (d)

(e)  (f)

Figure 12: Wasserstein distances between the samples of the five datasets in
terms of a) flow duration, b) flow size, c) (average) packet time, d) packet
size, e) number of destination ports per source port, and f) number of
destination IP addresses per source port

In this section, we are quantifying the difference between these
distributions. There are a range of metrics that can be used to measure the
distance between two distributions / probability density functions as reviewed
in [16]. Each metrics comes with its assumptions about distributions, which
defines the accuracy of the measurement. The distance metric that we are using
in this section is Wasserstein distance, which is also known as the Earth
Mover’s distance, and is commonly used in the machine learning applications.
The Wasserstein distance $W$ of two distribution $u$ and $v$ is given by [7]

$W(u,v)=\inf_{\pi\in\Gamma(u,v)}\int_{\mathbb{R}\times\mathbb{R}}|x-y|d\pi(x,y)$
(1)

where $\Gamma(u,v)$ is the set of (probability) distributions on
$\mathbb{R}\times\mathbb{R}$ whose marginals are $u$ and $v$ on the first and
second factors respectively. The inf stands for infimum, also known as the
greatest lower bound. If $S$ is a subset of set $T$ (partially ordered), then
inf$(S)$ is the greatest element of $T$ which is less than or equal to all
elements of $S$. Th Wasserstein distance of $u$ and $v$ can also be stated in
terms of their CDFs, $U$ and $V$ as [7]

$W(u,v)=\int_{-\infty}^{+\infty}|U-V|$ (2)

which in the case of our study can be applied to CDFs of features computed in
Section 4.1.

Figure 12 shows the Wasserstein distances between each pair of the five
datasets that are used in this study, in the form of a heatmap diagram, for
six features. In Figure 12-a the distance between flow duration distributions
is measured. The value of the Wasserstein distances are shown on each entry,
in addition to visualising by color. Since the Wasserstein distance metric is
symmetric, distance from distribution a to b is the same as distance from b to
a. For instance, the distance between UNSW_NB15 and UQ and vice versa is
$0.51$. As seen, except CIC-IDS, the distances between synthetic datasets and
the real-world datasets is bigger than real-world to real-world distances.

Figure 12-b, c, d, e, and f show the Wasserstein distances for the
distribution of flow size, packet time, packet size, number of destination
ports per source ports and number of destination IPs per source port,
respectively. The differences between the real-world and all synthetic
datasets are more significant for the rest of features.

(a)  (b)

Figure 13: Averaged distances between datasets over all 9 features in Table 2
using a) heatmap , and b) distance to UQ and ISP

In order to summarise the overall differences between these datasets in a
single number, the Wasserstein distances of all features are calculated and
averaged. Figure 13-a shows the averaged Wasserstein distance over all
features listed in Table 2. Since the main subject in this paper is the
distance between the real-world and synthetic datasets, these values are
summarised in Figure 13-b. The horizontal axis indicates the distance to UQ
dataset, and the vertical axis indicates distance to ISP dataset. As distance
of UQ to UQ dataset is zero, it is placed on vertical axis $(x=0)$, similarly
the ISP dataset is placed on horizontal axis $(y=0)$. In this way, the
coordinates of each dataset represents its averaged distances to the two real-
world datasets. As seen, the CIC-IDS dataset is closest dataset to UQ and ISP,
and TON_IOT and UNSW_NB15 are placed in farther locations. The main purpose of
this representation is to clearly show the distances between the real-world
and synthetic datasets. While the two real-world datasets are placed in small
distances from each other, all the three synthetic datasets are in much
farther distances.

##  6 Related Works

In order to select the previous works regarding the subject, we have
considered three aspects. First the role of network traffic characteristics,
i.e features of network traffic that affect normal network behavior. Then, we
looked for those features that are considered for detecting and identifying
network traffic anomalies. Finally, we looked for other works in the field of
IDS dataset evaluation and summarised these works method and how they
evaluated the publicly available IDS datasets.

###  6.1 Network Traffic Characteristics

Many previous works that discuss characteristics of network traffic such as
[17] and [18] focus on traffic volume variations in time to explain main
features of network traffic. In [19], they use Principle Component Analysis
(PCA) to investigate the the origin-destination flows of network as an
essential part of network traffic modelling, and finding solution to a wide
variety of problems including traffic engineering, capacity planning and
anomaly detection. While timeseries and time variations of traffic volume play
a significant role in many aspects of network such as design and
implementation, there are other features of network traffic that are equally
important when discussing traffic characteristics. This has been clearly
illustrated in two other previous studies [20] and [21] which investigate
network traffic not only via its timeseries, but also by analysing its
statistical distributions. In [20] by collecting a petabyte of measurement
data over two months, they discovered and reported traffic characteristics
patterns. They not only investigated the features related to traffic volume,
but they also studied other features such as flow duration and flow inter-
arrival time.

In[21], they studied the traffic characteristics of 10 distinct datacentre
networks with different organisational administrations such as university,
enterprise, and cloud services providers. They studied the traffic patterns of
these datacentres by investigating the flow and packet-level properties of
various layer-7 applications, and the impact of these applications on network
congestion and link and network utilisation. In their study, they investigated
a range of packet and flow statistical distributions such as number of flows
per second, flow inter-arrival time, flow size, flow duration, and packet
size. Unlike previous works, they not only took into account the time domain
distribution of the traffic features, but they also considered the statistical
measures such as Cumulative Distribution Function (CDF). In addition, they
investigated these measures per layer 7 applications, and provided the
distribution of corresponding statistical measures per various layer 7
applications. They use these measures to understand the normal patterns of
network traffic in various levels such as edge, aggregation and core links.

###  6.2 Network Anomalies Characteristics

The next group of studies investigate the network traffic characteristics to
understand abnormal network behavior and detect anomalies. In this group of
studies, various statistics, measures and distributions of several network
traffic features have been utilised for detecting abnormal network behaviors.
They not only take into account a broader range of network traffic features,
they also consider the statistical measures and distributions of these
features. Furthermore, some of the studies in this group apply their method on
traffic records collected from the real world, mainly backbone networks, which
is a stronger evaluation of their proposed method.

In [13], this argument is explained by illustrating the role and importance of
the distributions of packet features, such as IP addresses and ports observed
in flow traces, in detecting and identifying the structure of a wide range of
network anomalies. They state that clustering network traffic based on the
distribution of these features creates meaningful clusters of anomalies and
such clusters can be utilised for detecting new anomalies and automatic
classification of anomalies. In this way, by investigating these
distributions, they are able to not only detect the volume-based anomalies,
but also detect many other anomalies that do not change traffic volume
significantly. They validate their proposed methods on data collected from two
backbone networks (Abilene and Geant) and conclude that feature distributions
is a key ingredient in general network anomaly detection framework.

In [14], they monitored anomalies and collected network traffic records of the
same backbone networks (Abilene and Geant), in order to determine which
network parameters affect detectability of network anomalies, and how these
parameters influence the characteristics of anomalies. They recorded 3 weeks
of traffic and routing data from both networks and detected three specific
anomalies by applying Kalman filter. While they stated that detecting
anomalies is significantly dependent on the network design, monitoring
infrastructure, and anomaly-detection technique, they investigated variations
of the entropy of four features of network traffic, namely source and
destination IP addresses and source and destination (L4) Ports. They concluded
that it is not possible to detect all anomalies in a network, based on a
single method for Internet-Wide anomaly detection.

In the last study of this group, based on the idea proposed in [13], using the
traffic feature distribution for anomaly detection, histograms of eight
network traffic features have been investigated [15]. These features include
the source and destination IP addresses, source and destination (L4) ports,
TCP flags, (L4) protocol number, packet size, and flow duration. While they
have listed the possible benefits of each feature for detecting specific type
of anomaly, they stated that combination of features can reveal changes in the
network traffic, which would be invisible otherwise. They applied their
proposed method on the data collected from one datacentre, and one campus
network and an IDS benchmark dataset.

The results of these studies, collectively, show that network traffic features
distribution play a significant role in the detection of network anomalies in
both real world and benchmark datasets. However, this has rarely been
investigated in the evaluation of publicly available datasets. In the next
subsection, we briefly explore the available review papers that have evaluated
these benchmark datasets.

###  6.3 IDS Dataset Evaluation

While there are many publicly available IDS benchmark datasets that have been
frequently utilised for the evaluation of new and existing IDS algorithms,
studies that evaluate these datasets themselves are very rare. In this
subsection we explore the two studies that we have found in this space.

The first study investigates usefulness of DARPA dataset for the evaluation of
IDSs [22]. They use two signature-based IDSs, Snort [23] and Cisco IDS, along
with two anomaly detection methods to evaluate DARPA datasets based on the
methodology proposed by MIT Lincoln Laboratory for IDS evaluation. Their
results indicate that this dataset is useful for the evaluation of intrusion
detection systems. Since this evaluation includes only a single dataset, and
it is rather an old study investigating even an older dataset, the results
cannot be generalised for other datasets.

The report in [24] is the only study we found evaluating multiple IDS
datasets. They systematically evaluate 11 publicly accessible IDS datasets
published between 1998 till 2016, and conclude that most of these datasets are
out of date and unreliable for the evaluation of the IDS algorithms. By
investigating the shortcoming of the existing datasets, they provide a
framework for the evaluation of IDS datasets. This framework consists of 11
features which a benchmark IDS dataset should possess, and hence define a
corresponding score for each of their studied benchmark datasets. These
features include complete network configuration, complete traffic, labeled
dataset, complete interaction, complete capture, available protocols, attack
diversity, anonymity, heterogeneity, feature set, and metadata. The main
approach in defining these features, which are proposed based on the
observations of the existing benchmark datasets, is to prevent the previous
dataset shortcomings. However, it is not discussed how having these features
guarantees the fitness or enhances the fitness of a synthetic IDS dataset for
the real-world evaluation scenarios.

As such, we are proposing for the first time, a criteria for a benchmark
dataset, that can be used to evaluate the similarity of a synthetic / testbed-
based IDS dataset to the real-world network traffic records. We explain this
methodology in the coming sections by first explaining the datasets utilised
in our study.

##  7 Conclusion

The benchmark datasets for Network Intrusion Detection Systems (NIDSs) are
commonly used by academic and industrial network security researchers for the
evaluation of the anomaly detection and NIDS algorithms. In most of the
methods based on the machine learning techniques, statistical features of the
network traffic play a significant role in the performance of the
classification of normal and anomalous traffic. However, these benchmark
datasets have never been analysed in terms of the statistical features of
their traffic records. The statistical distributions of the attack / anomaly
traffic features are usually different from the normal traffic. As such, the
normal / benign traffic records of these datasets are the main parts which
should simulate / mimic normal / benign the real-world traffic in which the
anomaly detection algorithms are supposed to work.

The main purpose of this paper is to introduce tools and methodologies that
can measure how realistic is the evaluation of an NIDS algorithm via a
synthetic dataset. Currently, this has not been addressed in the network
security research field. This paper, tries to address this gap not only by
proposing the required tool and methodology, but also by applying the proposed
methodology on three recent NIDS datasets, and comparing them to two diverse
real-world network traffic datasets.

We initially propose nine traffic features that can be used for this purpose.
Then, we illustrate the statistical distributions of these features for the
synthetic and real-world datasets. We also use four different dimensionality
reduction methods to embed the set of nine features in a 2-dimensional
Euclidean space and visualise the resulting embeddings for all datasets. In
both cases, the statistical distributions and dimensionality reduced
visualisations, there are significant distinctions between the two groups of
datasets, the real world and synthetic. In addition, the differences among
members of each group is much less significant, e.g. the two real-world
datasets are more similar together than to the synthetic datasets, despite
their diverse origin.

While the illustrated distributions clearly indicate the differences in the
traffic features of the synthetic and real-world datasets, differences between
the real-world datasets and each of the synthetic datasets varies from one
dataset to another. We propose a metric to quantify these differences between
statistical distributions of features of each pair of datasets. The proposed
metric also clearly indicates that difference between the two real-world
datasets, despite the fact that they represent two different types of networks
from two different organisation and geographical-location, is much less than
to either of synthetic datasets.

Based on these results, we believe that the evaluation of anomaly detection
and NIDS algorithms using synthetic datasets, which are not created in the
context of real-world traffic, does not guarantee their classification
performance in the real-world scenarios. The addressing of this gap
constitutes the future work of our research where we are proposing a
methodology for creating NIDS benchmark datasets that their traffic feature
distributions comply with that of the real-world traffic.

## References

  * [1] University of California, Irvine, “KDD Cup 1999 Data.” http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html, 1999.  Accessed: 2020-07-30.
  * [2] N. Moustafa and J. Slay, “UNSW-NB15: A Comprehensive Data set for Network Intrusion Detection systems (UNSW-NB15 Network Data Set),” in Military communications and information systems conference (MilCIS) (pp. 1-6). IEEE., pp. 1–6, IEEE, 2015.
  * [3] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” ICISSP 2018 - Proceedings of the 4th International Conference on Information Systems Security and Privacy, vol. 2018-Janua, pp. 108–116, 2018.
  * [4] N. Moustafa, “ToN_IoT datasets.” http://dx.doi.org/10.21227/fesz-dm97, 2019.
  * [5] M. Sarhan, S. Layeghy, N. Moustafa, and M. Portmann, “Netflow datasets for machine learning-based network intrusion detection systems,” in Big Data Technologies and Applications, (Cham), pp. 117–135, Springer International Publishing, 2021.
  * [6] M. Sarhan, S. Layeghy, N. Moustafa, and M. Portmann, “Towards a standard feature set of nids datasets.” https://arxiv.org/abs/2101.11315, 2021.
  * [7] A. Ramdas, N. G. Trillos, and M. Cuturi, “On wasserstein two-sample testing and related families of nonparametric tests,” Entropy, vol. 19, no. 2, p. 47, 2017.
  * [8] Monowar H. Bhuyan, Dhruba Kumar Bhattacharyya, and Jugal Kumar Kalita, “Network Anomaly Detection: Methods, Systems and Tools,” IEEE Communications Surveys & Tutorials, vol. 16, no. 1, pp. 303–336, 2014.
  * [9] Hung-Jen Liao, Chun-Hung Richard Lin, Ying-Chih Lin, Kuang-Yuan Tung, H.-j. Liao, C.-h. R. Lin, Y.-c. Lin, and K.-y. Tung, “Intrusion detection system: A comprehensive review,” Journal of Network and Computer Applications, vol. 36, no. 1, pp. 16–24, 2013.
  * [10] Monowar H. Bhuyan, Dhruba K. Bhattacharyya, and Jugal K. Kalita, Network Traffic Anomaly Detection and Prevention Concepts, Techniques, and Tools.  Springer, 2017.
  * [11] M. H. Bhuyan, D. K. Bhattacharyya, and J. K. Kalita, “Network Anomaly Detection: Methods, Systems and Tools,” IEEE Communications Surveys & Tutorials, vol. 16, no. 1, pp. 303–336, 2014.
  * [12] Ntop, “nProbe, An Extensible NetFlow v5/v9/IPFIX Probe for IPv4/v6.” https://www.ntop.org/guides/nprobe/cli_options.html, 2017.
  * [13] A. Lakhina, M. Crovella, and C. Diot, “Mining anomalies using traffic feature distributions,” SIGCOMM Comput. Commun. Rev., vol. 35, no. 4, pp. 217–228, 2005.
  * [14] A. Soule, H. Ringberg, F. Silveira, J. Rexford, and C. Diot, “Detectability of traffic anomalies in two adjacent networks,” in International Conference on Passive and Active Network Measurement, vol. 4427 LNCS, pp. 22–31, Springer Berlin Heidelberg, 2007.
  * [15] Andreas Kind, Marc Ph. Stoecklin, and Xenofontas Dimitropoulos, “Histogram-based traffic anomaly detection,” IEEE Transactions on Network and Service Management, vol. 6, no. 2, pp. 110–121, 2009.
  * [16] Sung-Hyuk Cha, “Comprehensive Survey on Distance/Similarity Measures between Probability Density Functions,” International Journal of Mathematical Models and Methods in Applied Sciences, vol. 1, no. 4, pp. 300–307, 2007.
  * [17] Kevin Thompson, Gregory J. Miller, and Rick Wilder, “Wide-area Internet traffic patterns and characteristics,” IEEE Network, vol. 11, no. 6, pp. 10–23, 1997.
  * [18] L. Liu, H. H. Jiang, W. Z. Rui, and J. Wang, “Study on the characteristics of network traffic based on STFT,” Proceedings - 2015 2nd International Conference on Information Science and Control Engineering, ICISCE 2015, pp. 485–488, 2015.
  * [19] Anukool Lakhina, Konstantina Papagiannaki, Mark Crovella, Christophe Diot, Eric D. Kolaczyk, and Nina Taft, “Structural analysis of network traffic flows,” SIGMETRICS Perform. Eval. Rev., vol. 32, no. 1, pp. 61–72, 2004.
  * [20] S. Kandula, S. Sengupta, A. Greenberg, P. Patel, and R. Chaiken, “The nature of datacenter traffic: Measurements & analysis,” Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC, pp. 202–208, 2009.
  * [21] Theophilus Benson, Aditya Akella, and David A Maltz, “Network traffic characteristics of data centers in the wild,” in Proceedings of the 10th ACM SIGCOMM conference on Internet measurement, pp. 267–280, ACM, 2010\.
  * [22] C. Thomas, V. Sharma, and N. Balakrishnan, “Usefulness of DARPA dataset for intrusion detection system evaluation,” Data Mining, Intrusion Detection, Information Assurance, and Data Networks Security 2008, vol. 6973, no. March 2008, p. 69730G, 2008.
  * [23] M. Roesch, “Snort – Lightweight Intrusion Detection for Networks,” in Proceedings of LISA 99: 13th Systems Administration Conference, (Seattle, Washington, USA), pp. 229–238, 1999.
  * [24] A. Gharib, I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “An Evaluation Framework for Intrusion Detection Dataset,” in ICISS 2016 - International Conference on Information Science and Security 2016, no. Cic, pp. 0–4, IEEE, 2017.


00footnotetext: $\bf{2020\ Mathematics\ Subject\ Classification\>}.$ 83C05,
53C50, 53Z05.
Key words: Gradient Ricci soliton, Gradient $(m,\tau)$-quasi Einstein soliton,
Generalized Robertson-Walker spacetime, Nonlinear Equations, Differential
Equations, Partial Differential Equations.

# Characterizations of generalized Robertson-Walker spacetimes concerning
gradient solitons

Krishnendu De1, Mohammad Nazrul Islam Khan${}^{2},^{*}$ and Uday Chand De3
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract.

In this article, we examine gradient type Ricci solitons and $(m,\tau)$-quasi
Einstein solitons in generalized Robertson-Walker ($GRW$) spacetimes. Besides,
we demonstrate that in this scenario the $GRW$ spacetime presents the
Robertson-Walker ($RW$) spacetime and the perfect fluid ($PF$) spacetime
presents the phantom era. Consequently, we show that if a $GRW$ spacetime
permits a gradient $\tau$\- Einstein solitons, then it also represents a $PF$
spacetime under certain condition.

∗ Corresponding author

1 Department of Mathematics,

Kabi Sukanta Mahavidyalaya, The University of Burdwan.

Bhadreswar, Hooghly, West Bengal, India.

ORCID iD: https://orcid.org/0000-0001-6520-4520

2Department of Computer Engineering, College of Computer,

Qassim University, Buraydah, Saudi Arabia.

ORCID iD: https: //orcid.org/0000-0002-9652-0355

3Department of Pure Mathematics, University of Calcutta,

West Bengal, India.

ORCID iD: https: //orcid.org/0000-0002-8990-4609

##  1\. Introduction

Suppose $\mathcal{M}^{n}$ is a Lorentzian manifold of dimension $n$ and $g$ is
a Lorentzian metric of signature $(+,+,...,+,-)$. In 1995, the notion of $GRW$
spacetimes was proposed by Alias et al.[1]. A $GRW$ spacetime is a Lorentzian
manifold $\mathrm{M}^{n}$ $\left(n\geq 4\right)$ which can be presented as
$\mathcal{M}=-I\times f^{2}M^{*}$, in which $I$ $\subseteq$ $\mathbb{R}$ (Real
numbers set), $M^{*}$ indicates the Riemannian manifold of dimension (n-1) and
the smooth function $f>0$ is termed as warping function or scale factor. If
$M^{*}$ is of dimension three and is of constant sectional curvature, then the
above stated spacetime represents a $RW$ spacetime. A comprehensive
investigation of $GRW$ spacetimes are presented in ([2]\- [7]).

######  Definition 1.1.

For a scalar function $\psi$ and a 1-form $\omega_{k}$ (non vanishing), let
the condition $\nabla_{k}u_{h}=\omega_{k}u_{h}+\psi g_{kh}$ be obeyed, the
vector field $u$ is then referred to as torse-forming.

The foregoing equation can be expressed as $\nabla_{X}u=\omega(X)u+\psi X$,
$\omega$ being a 1-form. The following theorem has been demonstrated by
Mantica and Molinari [5]:

######  Theorem 1.1.

([5]) The Lorentzian manifold $\mathcal{M}^{n}$ ($n\geq 3$) is a $GRW$
spacetime iff the spacetime permits a unit torse-forming time-like vector
field : $\nabla_{j}u_{k}=\psi(g_{ik}+u_{k}u_{i})$, it is also an eigenvector
of the Ricci tensor.

The $\mathcal{M}$ is termed as a $PF$ spacetime if for the non-vanishing Ricci
tensor $S$, the spacetime fulfills

$S=a_{1}g+b_{1}\eta\otimes\eta,$ (1.1)

where $a_{1},\,b_{1}$ are scalar fields and $g(U_{1},\rho)=\eta(U_{1})$ for
any $U_{1}$ and $g(\rho,\rho)=-1$ in which $\rho$ stands for a unit time-like
vector field of the $PF$ spacetime and $\eta$ is a 1-form. Each and every $RW$
spacetime presents a $PF$ spacetime [8]. However, in the dimension $4$, the
$GRW$ spacetime presents a $PF$ spacetime iff the spacetime is $RW$ [9].

In a $PF$ spacetime the expression of the energy-momentum tensor $T$ is
described as

$T=(\nu+p)\eta\otimes\eta+pg,$ (1.2)

$\nu$ denotes the energy density, $p$ indicates the isotropic pressure [8].

In absence of the cosmological constant in the theory of general relativity,
the Einstein’s field equations which is a highly nonlinear equations, is
written as

$S-\frac{r}{2}g=k^{2}T,$ (1.3)

where $k=\sqrt{8\pi\mathrm{G}}$, $\mathrm{G}$ indicates Newton’s gravitational
constant and the scalar curvature is denoted by $r$.

Using differential equations (1.2) and (1.3), we reveal the equation (1.1),
where

$b_{1}=k^{2}(p+\nu),\,\,a_{1}=\frac{k^{2}(p-\nu)}{2-n}.$ (1.4)

Additionally, for a equation of state (EOS) parameter $\omega$, $\nu$ and $p$
are interconnected by the equation $p=\omega\nu$. The EOS having the shape
$p=p(\nu)$ is named isentropic. According to [10], if $p=0$,
$p=\dfrac{\nu}{3}$, and if $p+\nu=0$, then the PF-spacetime is represented the
dust matter, the radiation and the dark energy era, respectively. Furthermore,
it includes the phantom era when $\omega<-1$. The physical implications are
discussed in ([11]-[14]).

A self-reinforcing wave packet named as a soliton, also called a solitary
wave, maintains its formation while travelling with a constant speed. It is
created when nonlinear and dispersive effects in the medium are neutralised.
Gradient is a common term in mathematics and physics to describe the direction
and magnitude of a force acting on a particle. In other disciplines, such as
chemistry and engineering, the gradient is also used to demonstrate how a
substance’s property changes in relation to other variables.

Hamilton [15] develops the novel idea of Ricci flow. It is referred to as a
Ricci flow [15] if the partial differential equations
$\frac{\partial}{\partial t}g_{ij}(t)=-2S_{ij}$ satisfies the metric of a
Lorentzian manifold $\mathcal{M}$. The Ricci solitons ($RS$) are produced by
the self-similar solutions to the Ricci flow. If a metric of $\mathcal{M}$
obeys the differential equations,

$\mathfrak{L}_{W_{1}}g+2S+2\lambda_{1}g=0,$ (1.5)

it is referred to as a $RS$ [16], in which $\lambda_{1}$ indicates a real
scalar. Also, $\mathfrak{L}_{W}$ stands for the Lie derivative operator and
$W_{1}$ is the potential vector field. Equation (1.5) has the subsequent form

$Hess\,f+S+\lambda_{1}g=0,$ (1.6)

in which the Hessian is denoted by $Hess$ and $D$ stands for the gradient
operator of $g$ if $W_{1}=Df$, for a smooth function $f$. A gradient $RS$ is a
metric that fulfills the partial differential equation (1.6). The gradient
$RS$ is said to have the smooth function $f$ as its potential function.

$RS$s have a significant impact in both physics and mathematics. In physics,
metrics that obey (1.5) are attractive and helpful. In connection to string
theory, theoretical physicists have also been investigating the $RS$ equation.
Friedan, who has done study on various features of $RS$s, has made the initial
contribution to these studies [17]. In [18], Blaga has considered PF spacetime
endowed with a torse-forming vector field to study $\eta$-RSs and
$\eta$-Einstein solitons ($ES$) and deduced a poison equation from the soliton
equation. Chen and Desmukh have characterized $RS$s with the help of
concurrent potential fields and on Euclidean hypersurfaces, under certain
restriction they classify shrinking $RS$s [19]. Also in [20], the authors
investigated compact shrinking gradient $RS$s. Karaka and Ozgur have studied
$RS$s of gradient type on multiply warped product manifolds [21] and obtained
a necessary and sufficient condition for these manifolds to be gradient $RS$s.
In [22], Wang established that an almost $RS$ of gradient type on a
$(k,\mu)^{\prime}$ almost Kenmotsu manifold is a rigid gradient $RS$s.

In [23], the authors have obtained exact solution for the fractional
differential equations and these are emerging from solitons theory. In [24],
the authors have formulated plans that are useful in solving many different
kinds of nonlinear partial differential equations arising in several areas of
applied sciences. In [25], to acquire soliton solutions to the nonlocal
integrable equations, the authors have developed a new formulation of
solutions to Riemann-Hilbert problems with the identity jump matrix. Rezazadeh
has found a new soliton solutions of the complex Ginzburg-Landau equation with
Kerr law nonlinearity in [26]. Here, we may mention that zero curvature
equations make the link between integrable models and geometry manifest, and
the Kronecker product produces new zero curvature representations from old
ones [27].

If there are $\lambda_{1}$, $\tau$ and $m$ $(0<m<\infty)$, three real
constants which obeys the partial differential equation

$\nabla^{2}f+S-\frac{1}{m}df\otimes df=(\lambda_{1}+\tau r)g=\beta_{1}g,$
(1.7)

then the semi-Riemannian metric $g$ on the Lorentzian manifold $\mathcal{M}$
is known as a gradient $(m,\tau)$-quasi Einstein soliton ($QES$), where
$\otimes$ denotes tensor product. If the potential function $f$ is constant,
the soliton becomes trivial, which suggests that the manifold is Einstein.
Additionally, the aforementioned relation turns into a gradient $\tau$-ES when
$m=\infty$. This idea was presented in [28], and Venkatesha et al. examined
[29] $\tau$-$ES$ on almost Kenmotsu manifolds. More recently, in this same
manifold we studied gradient $(m,\tau)$-$QES$ [30].

Many researchers recently examined various types of solitons in $PF$
spacetimes, including $RS$ ([18],[31]), gradient RSs ([31],[32]), Yamabe and
gradient Yamabe solitons ([32], [33]), gradient m-QESs [32], gradient
$\eta$-ESs [31], gradient Schouten solitons [31], Ricci-Yamabe solitons [34],
respectively.

According to the information we have, there are many findings in the
literature about $PF$ spacetimes with solitons, but there are just a few
results in $GRW$ spacetimes. We want to fill this gap in this article and
focus on characterizing the $GRW$ spacetimes that satisfy gradient $RS$ and
gradient $(m,\tau)$-$QES$.

In [5], it is established that a $GRW$ spacetime with divergence free Weyl
tensor is a $PF$ spacetime. The foregoing result raises the question: Is the
preceding result still valid if the condition divergence free Weyl tensor is
substituted by a gradient Ricci soliton, or by a gradient $(m,\tau)$-$QES$?
Here, we provide evidence that the answer to this question is, in fact, ‘yes’
in both cases under certain conditions. Precisely, we prove the subsequent
main theorems.

######  Theorem 1.2.

If a $GRW$ spacetime admits a gradient $RS$ with $\rho f=constant$, then it
becomes a $PF$ spacetime.

######  Theorem 1.3.

If a $GRW$ spacetime permits a gradient $(m,\tau)$-$QES$ with
$\beta_{1}=(n-1)\mu=$constant and $\rho f=$ constant, then it becomes a $PF$
spacetime.

##  2\. Preliminaries

Let $\mathcal{M}$ be a $GRW$ spacetime and hence using Theorem 1.1, we acquire

$\nabla_{U_{1}}\rho=\psi[U_{1}+\eta(U_{1})\rho]$ (2.1)

and

$S(U_{1},\rho)=\xi\eta(U_{1}),$ (2.2)

where $\psi$ is a scalar and $\xi$ is a non-zero eigenvector.

######  Lemma 2.1.

In a $GRW$ spacetime, we have

$R(U_{1},V_{1})\rho=\mu[\eta(V_{1})U_{1}-\eta(U_{1})V_{1}]$ (2.3)

and

$S(U_{1},\rho)=(n-1)\mu\eta(U_{1}),$ (2.4)

where we choose $\mu=(\rho\psi+\psi^{2})$.

Proof. Differentiating covariantly equation (2.1), we obtain

$\displaystyle\nabla_{V_{1}}\nabla_{U_{1}}\rho$ $\displaystyle=$
$\displaystyle(V_{1}\psi)[U_{1}+\eta(U_{1})\rho]$
$\displaystyle+\psi[\nabla_{V_{1}}U_{1}+(\nabla_{V_{1}}\eta(U_{1}))\rho+\psi(V_{1}+\eta(V_{1})\rho)\eta(U_{1})].$

Interchanging $U_{1}$ and $V_{1}$ yields

$\displaystyle\nabla_{U_{1}}\nabla_{V_{1}}\rho$ $\displaystyle=$
$\displaystyle(U_{1}\psi)[V_{1}+\eta(V_{1})\rho]$
$\displaystyle+\psi[\nabla_{U_{1}}V_{1}+(\nabla_{X}\eta(V_{1}))\rho+\psi(U_{1}+\eta(U_{1})\rho)\eta(V_{1})].$

Also, we have

$\displaystyle\nabla_{[U_{1},V_{1}]}\rho=\psi\\{[U_{1},V_{1}]+\eta([U_{1},V_{1}])\rho\\}.$
(2.7)

Equations (2.1), (2), (2) and (2.7) together implies

$\displaystyle R(U_{1},V_{1})\rho$ $\displaystyle=$
$\displaystyle(U_{1}\psi)[V_{1}+\eta(V_{1})\rho]-(V_{1}\psi)[U_{1}+\eta(U_{1})\rho]$
$\displaystyle+\psi^{2}[\eta(V_{1})U_{1}-\eta(U_{1})V_{1}].$

Contracting $V_{1}$ from equation (2), we obtain

$\displaystyle S(U_{1},\rho)$ $\displaystyle=$
$\displaystyle(2-n)(U_{1}\psi)+(\rho\psi)\eta(U_{1})$
$\displaystyle+(n-1)\psi^{2}\eta(U_{1}).$

Combining equations (2.2) and (2), we infer

$\xi\eta(U_{1})=(2-n)(U_{1}\psi)+(\rho\psi)\eta(U_{1})+(n-1)\psi^{2}\eta(U_{1}).$
(2.10)

Setting $U_{1}=\rho$ in (2.10) entails that

$\xi=(n-1)\mu,$ (2.11)

where $\mu=(\rho\psi+\psi^{2})$.

From the last two equations, we acquire

$U_{1}\psi=-(\rho\psi)\eta(U_{1}).$ (2.12)

Using equation (2.12) in equation (2), we get

$R(U_{1},V_{1})\rho=\mu[\eta(V_{1})U_{1}-\eta(U_{1})V_{1}].$

In view of equations (2.2) and (2.11), we provide

$S(U_{1},\rho)=(n-1)\mu\eta(U_{1}).$

This ends the proof.

######  Lemma 2.2.

In a $GRW$ spacetime, we obtain

$\mu\\{U_{1}+\rho\eta(U_{1})\\}=0.$ (2.13)

Proof: From equation (2.3), we get

$R(U_{1},V_{1})\rho=\mu[\eta(V_{1})U_{1}-\eta(U_{1})V_{1}].$

Now,

$\displaystyle(\nabla_{W_{1}}R)(U_{1},V_{1})\rho$ $\displaystyle=$
$\displaystyle\nabla_{W_{1}}R(U_{1},V_{1})\rho-R(\nabla_{W_{1}}U_{1},V_{1})\rho$
$\displaystyle-R(U_{1},\nabla_{W_{1}}V_{1})\rho-R(U_{1},V_{1})\nabla_{W_{1}}\rho.$

Using equations (2.1) and (2.3) in equation (2) entails that

$\displaystyle(\nabla_{W_{1}}R)(U_{1},V_{1})\rho$ $\displaystyle=$
$\displaystyle\\{W_{1}\mu\\}[\eta(V_{1})U_{1}-\eta(U_{1})V_{1}]$
$\displaystyle+\psi\mu[g(V_{1},W_{1})U_{1}-g(U_{1},W_{1})V_{1}]-\psi
R(U_{1},V_{1})W_{1}.$

The well-known second Bianchi identity is given by

$(\nabla_{W_{1}}R)(U_{1},V_{1})\rho+(\nabla_{U_{1}}R)(V_{1},W_{1})\rho+(\nabla_{V_{1}}R)(W_{1},U_{1})\rho=0.$

From the foregoing two equations, we infer

$\displaystyle[\\{W_{1}\mu\\}\eta(V_{1})-\\{V_{1}\mu\\}\eta(W_{1})]U_{1}$
$\displaystyle+[\\{U_{1}\mu\\}\eta(W_{1})-\\{W_{1}\mu\\}\eta(U_{1})]V_{1}$
$\displaystyle+[\\{V_{1}\mu\\}\eta(U_{1})-\\{U_{1}\mu\\}\eta(V_{1})]W_{1}$
$\displaystyle-\psi[R(U_{1},V_{1})W_{1}+R(V_{1},W_{1})U_{1}+R(W_{1},U_{1})V_{1}]=0.$

Putting $W_{1}=\rho$ in the previous equation gives

$\displaystyle[\\{\rho\mu\\}\eta(V_{1})+\\{V_{1}\mu\\}]U_{1}$ (2.15)
$\displaystyle-[\\{U_{1}\mu\\}+\\{\rho\mu\\}\eta(U_{1})]V_{1}$
$\displaystyle+[\\{V_{1}\mu\\}\eta(U_{1})-\\{U_{1}\mu\\}\eta(V_{1})]\rho$
$\displaystyle-\psi[R(U_{1},V_{1})\rho+R(V_{1},\rho)U_{1}+R(\rho,U_{1})V_{1}]=0.$

From equation (2.3), we get

$R(\rho,U_{1})V_{1}=\mu[g(U_{1},V_{1})\rho-\eta(V_{1})U_{1}]$ (2.16)

and

$R(U_{1},\rho)V_{1}=\mu[\eta(V_{1})U_{1}-g(U_{1},V_{1})\rho].$ (2.17)

Using equations (2.3), (2.16) and (2.17) in equation (2.15) entails that

$\displaystyle\\{\rho\mu\\}[\eta(V_{1})U_{1}-\eta(U_{1})V_{1}]$ (2.18)
$\displaystyle+\\{V_{1}\mu\\}[U_{1}+\eta(U_{1})\rho]$
$\displaystyle-\\{U_{1}\mu\\}[V_{1}+\eta(V_{1})\rho]=0.$

Contracting $V_{1}$ from the equation (2.18), we infer

$\mu\\{U_{1}+\rho\eta(U_{1})\\}=0.$

Hence the proof is completed.

######  Lemma 2.3.

In a $GRW$ spacetime, we have

$g((\nabla_{\rho}Q)U_{1}-(\nabla_{U_{1}}Q)\rho,\rho)=0,$ (2.19)

in which the Ricci operator $Q$ is described by
$g(QU_{1},V_{1})=S(U_{1},V_{1})$.

Proof: From equation (2.4), we get

$Q\rho=(n-1)\mu\rho.$ (2.20)

Differentiating equation (2.20), we acquire

$\displaystyle(\nabla_{U_{1}}Q)\rho$ $\displaystyle=$
$\displaystyle(n-1)\\{U_{1}\mu\\}\rho$
$\displaystyle+(n-1)\psi\mu[U_{1}+\eta(U_{1})\rho]$ $\displaystyle-\psi
QU_{1}-(n-1)\psi\mu\eta(U_{1})\rho.$

Using equation (2) and Lemma 2.2, we easily acquire the desired result.

##  3\. Proof of the prime Theorems

Proof of the Theorem 1.2 :

Let us suppose that a $GRW$ spacetime admit a gradient $RS$. Then the equation
(1.6) may be written as

$\nabla_{U_{1}}Df=-QU_{1}-\lambda_{1}U_{1}.$

The foregoing equation and the following relation

$R(U_{1},V_{1})Df=\nabla_{U_{1}}\nabla_{V_{1}}Df-\nabla_{V_{1}}\nabla_{U_{1}}Df-\nabla_{[U_{1},V_{1}]}Df$

give

$R(U_{1},V_{1})Df=(\nabla_{V_{1}}Q)(U_{1})-(\nabla_{U_{1}}Q)(V_{1}).$

Taking inner product of the previous equation with $\rho$ and making use of
Lemma 2.3, we acquire

$g(R(U_{1},V_{1})Df,\rho)=0.$ (3.1)

Again, from equation (2.3) we infer

$g(R(U_{1},V_{1})\rho,Df)=\mu[\eta(V_{1})(U_{1}f)-\eta(U_{1})(V_{1}f)].$ (3.2)

Combining equations (3.1) and (3.2), we get

$-\mu[\eta(V_{1})(U_{1}f)-\eta(U_{1})(V_{1}f)]=0.$ (3.3)

Replacing $V_{1}$ by $\rho$ in equation (3.3), we obtain

$\mu[(U_{1}f)+\eta(U_{1})(\rho f)]=0.$ (3.4)

This entails that either $\mu=0$, or $\mu\neq 0$.

Case (i): If $\mu=0$, then from equation (2.4) we have $S(U_{1},\rho)=0$. This
reflects that the eigenvector $\xi$ is zero, which contradicts the Theorem
1.1.

Case (ii): If $\mu\neq 0$, then from equation (3.4), we reveal

$[(U_{1}f)+(\rho f)\eta(U_{1})]=0,$

which implies

$Df=-(\rho f)\rho.$ (3.5)

Differentiating the equation (3.5), we acquire

$\nabla_{U_{1}}Df=-\\{U_{1}(\rho f)\\}\rho-\psi(\rho
f)\\{U_{1}+\eta(U_{1})\rho\\}.$ (3.6)

If we take $\rho f=c_{1}=$ constant, then either $c_{1}\neq 0$, or $c_{1}=0$.

Case (i): If $c_{1}\neq 0$, then equation (3.6) implies

$\nabla_{U_{1}}Df=-c_{1}\psi\\{U_{1}+\eta(U_{1})\rho\\}.$ (3.7)

Using equation (3.7) in equation (3) yields

$\displaystyle QU_{1}$ $\displaystyle=$ $\displaystyle
c_{1}\psi\\{U_{1}+\eta(U_{1})\rho\\}-\lambda_{1}U_{1},$

which implies

$\displaystyle S(U_{1},V_{1})$ $\displaystyle=$
$\displaystyle\\{c_{1}\psi-\lambda_{1}\\}g(U_{1},V_{1})+c_{1}\psi\eta(U_{1})\eta(V_{1}).$

Therefore, the spacetime under consideration is a $PF$ spacetime.

Case (ii): If $c_{1}=0$, then equation (3.5) gives $Df=0$. Using this in
equation (3) yields

$\displaystyle S(U_{1},V_{1})$ $\displaystyle=$
$\displaystyle-\lambda_{1}g(U_{1},V_{1}).$ (3.8)

We know that

$\displaystyle(divC)(U_{1},V_{1})W_{1}$ $\displaystyle=$
$\displaystyle\frac{n-3}{n-2}[\\{(\nabla_{U_{1}}S)(V_{1},W_{1})-(\nabla_{V_{1}}S)(U_{1},W_{1})\\}$
(3.9)
$\displaystyle-\frac{1}{2(n-1)}\\{g(V_{1},W_{1})dr(U_{1})-g(U_{1},W_{1})dr(V_{1})\\}],$

in which $C$ stands for the Weyl conformal curvature tensor. Therefore using
equation (3.8), from equation (3.9) we acquire $(divC)(U_{1},V_{1})W_{1}=0.$

Thus, the spacetime is a $GRW$ spacetime with $divC=0$ and hence, it is a $PF$
spacetime [5].

Hence the proof is finished.

Since, in $4-$dimension, a $GRW$ spacetime is a $PF$ spacetime iff the
spacetime is a $RW$ spacetime [9]. Therefore, from the above theorem, we
arrive:

######  Corollary 3.1.

In $4-$dimension, for $\rho f=constant$, a $GRW$ spacetime admitting a
gradient $RS$ turns into a $RW$ spacetime.

######  Remark 1.

For $n=4$, comparing the equations (1.1) and (3), we have

$a_{1}g(U_{1},V_{1})+b_{1}\eta(U_{1})\eta(V_{1})=\\{c_{1}\psi-\lambda_{1}\\}g(U_{1},V_{1})+c_{1}\psi\eta(U_{1})\eta(V_{1}).$

Making use of equation (1.4), the foregoing equation yields

$k^{2}(3p-\nu)=-\lambda_{1},$

which implies

$(3p-\nu)=c\,\,(say).$

Hence, the $PF$ spacetime satisfies the EOS $\nu=-3p+$ constant.

If $c=0$, the above equation yields

$\omega=\frac{p}{\nu}=-\frac{1}{3},$

which entails that the $PF$ spacetime presents the phantom era [12].

Proof of the Theorem 1.3 :

Let the $GRW$ spacetime permit a $(m,\tau)$-$QES$. Then the equation (1.7) may
be expressed as

$\nabla_{U_{1}}Df+QU_{1}=\frac{1}{m}g(U_{1},Df)Df+\beta_{1}U_{1}.$ (3.10)

Differentiating covariantly equation (3.10), we obtain

$\displaystyle\nabla_{V_{1}}\nabla_{U_{1}}Df$ $\displaystyle=$
$\displaystyle-\nabla_{V_{1}}QU_{1}+\frac{1}{m}\nabla_{V_{1}}g(U_{1},Df)Df$
(3.11)
$\displaystyle+\frac{1}{m}g(U_{1},Df)\nabla_{V_{1}}Df+\beta_{1}\nabla_{V_{1}}U_{1}+(V_{1}\beta_{1})U_{1}.$

Interchanging $U_{1}$ and $V_{1}$ in the above equation, we get

$\displaystyle\nabla_{U_{1}}\nabla_{V_{1}}Df$ $\displaystyle=$
$\displaystyle-\nabla_{U_{1}}QV_{1}+\frac{1}{m}\nabla_{U_{1}}g(V_{1},Df)Df$
(3.12)
$\displaystyle+\frac{1}{m}g(V_{1},Df)\nabla_{U_{1}}Df+\beta_{1}\nabla_{U_{1}}V_{1}+(U_{1}\beta_{1})V_{1}$

and

$\displaystyle\nabla_{[U_{1},V_{1}]}Df=-Q[U_{1},V_{1}]+\frac{1}{m}g([U_{1},V_{1}],Df)Df+\beta_{1}[U_{1},V_{1}].$
(3.13)

From equations (3.10)-(3.13), we have

$\displaystyle R(U_{1},V_{1})Df$ $\displaystyle=$
$\displaystyle(\nabla_{V_{1}}Q)U_{1}-(\nabla_{U_{1}}Q)V_{1}+\frac{\beta_{1}}{m}\\{(V_{1}f)U_{1}-(U_{1}f)V_{1}\\}$
(3.14)
$\displaystyle+\frac{1}{m}\\{(U_{1}f)QV_{1}-(V_{1}f)QU_{1}\\}+\\{(U_{1}\beta_{1})V_{1}-(V_{1}\beta_{1})U_{1}\\}.$

Taking inner product of equation (3.14) with $\rho$ and using Lemma 2.3, we
infer

$\displaystyle g(R(U_{1},V_{1})Df,\rho)$ $\displaystyle=$
$\displaystyle\frac{\beta_{1}}{m}\\{(V_{1}f)\eta(U_{1})-(U_{1}f)\eta(V_{1})\\}$
(3.15)
$\displaystyle+\frac{1}{m}\\{(U_{1}f)\eta(QV_{1})-(V_{1}f)\eta(QU_{1})\\}$
$\displaystyle+\\{(U_{1}\beta_{1})\eta(V_{1})-(V_{1}\beta_{1})\eta(U_{1})\\}.$

Again, from equation (2.3) we acquire

$g(R(U_{1},V_{1})\rho,Df)=\mu[\eta(V_{1})(U_{1}f)-\eta(U_{1})(V_{1}f)].$
(3.16)

Comparing equations (3.15) and (3.16), we obtain

$\displaystyle-\mu[\eta(V_{1})(U_{1}f)-\eta(U_{1})(V_{1}f)]$ $\displaystyle=$
$\displaystyle\frac{\beta_{1}}{m}\\{(V_{1}f)\eta(U_{1})-(U_{1}f)\eta(V_{1})\\}$
$\displaystyle+\frac{1}{m}\\{(U_{1}f)\eta(QV_{1})-(V_{1}f)\eta(QU_{1})\\}$
$\displaystyle+\\{(U_{1}\beta_{1})\eta(V_{1})-(V_{1}\beta_{1})\eta(U_{1})\\}.$

Replacing $V_{1}$ by $\rho$ in the previous equation, we reveal

$\displaystyle\\{\mu-\frac{\beta_{1}}{m}+\frac{n-1}{m}\mu\\}[(U_{1}f)+\eta(U_{1})(\rho
f)]$ $\displaystyle+\\{(U_{1}\beta_{1})+(\rho\beta_{1})\eta(U_{1})\\}=0.$
(3.17)

If we take $\beta_{1}=(n-1)\mu=$constant (non zero), then from equation (3),
we infer

$[(U_{1}f)+(\rho f)\eta(U_{1})]=0,$

which implies

$Df=-(\rho f)\rho.$ (3.18)

Differentiating the equation (3.18), we acquire

$\nabla_{U_{1}}Df=-\\{U_{1}(\rho f)\\}\rho-\psi(\rho
f)\\{U_{1}+\eta(U_{1})\rho\\}.$ (3.19)

If we take $\rho f=c_{1}=$ constant, then either $c_{1}\neq 0$, or $c_{1}=0$.

Case (i): If $c_{1}\neq 0$, then equation (3.19) implies

$\nabla_{U_{1}}Df=-c_{1}\psi\\{U_{1}+\eta(U_{1})\rho\\}.$ (3.20)

Using equation (3.20) in equation (3.10) gives

$\displaystyle QU_{1}$ $\displaystyle=$ $\displaystyle
c_{1}\psi\\{U_{1}+\eta(U_{1})\rho\\}+\beta_{1}U_{1},$

which implies

$\displaystyle S(U_{1},V_{1})$ $\displaystyle=$
$\displaystyle\\{c_{1}\psi+\beta_{1}\\}g(U_{1},V_{1})+c_{1}\psi\eta(U_{1})\eta(V_{1}).$

Hence, the spacetime taking into account is a $PF$ spacetime.

Case (ii): If $c_{1}=0$, then equation (3.18) yields $Df=0$. Using this in
equation (3.10) gives

$\displaystyle S(U_{1},V_{1})$ $\displaystyle=$
$\displaystyle\beta_{1}g(U_{1},V_{1}).$

Using the foregoing equation in (3.9), we get $divC=0$. Therefore, it is a
$GRW$ spacetime with $divC=0$ and hence, it is a $PF$ spacetime [5].

This ends the proof.

It is known that when $m=\infty$, a gradient $(m,\tau)$-$QES$ produces a
gradient $\tau$-$ES$. In (3), we put $m=\infty$ and easily acquire the
equation (3.18). Therefore, we have:

######  Corollary 3.2.

If a $GRW$ spacetime permits a gradient $\tau$\- $ES$, then the gradient of
the $\tau$\- $ES$ potential function is pointwise collinear with the potential
vector field $\rho$.

Similarly, as corollary 3.1 we acquire:

######  Corollary 3.3.

In $4-$dimension, a $GRW$ spacetime admitting a gradient $(m,\tau)$-$QES$ with
$\beta_{1}=(n-1)\mu=$ constant and $\rho f=constant$ turns into a $RW$
spacetime.

Similarly, as above we can state:

######  Corollary 3.4.

If a $GRW$ spacetime admits a gradient $\tau$\- $ES$ with $\rho f=$ constant,
then it becomes a $PF$ spacetime.

######  Remark 2.

For $n=4$, comparing the equations (1.1) and (3), we have

$a_{1}g(U_{1},V_{1})+b_{1}\eta(U_{1})\eta(V_{1})=\\{c_{1}\psi+\beta_{1}\\}g(U_{1},V_{1})+c_{1}\psi\eta(U_{1})\eta(V_{1}).$

Using (1.4), the previous equation gives

$k^{2}(3p-\nu)=\beta_{1},$

which implies

$(3p-\nu)=c\,\,(say).$

Therefore, the $PF$ spacetime admitting a gradient $(m,\tau)$-$QES$ obeys the
EOS $\nu=-3p+$ constant.

If $c=0$, the above equation yields

$\omega=\frac{p}{\nu}=-\frac{1}{3},$

which implies that the $PF$ spacetime represents the phantom era [12].

##  4\. Discussion

The stage of the physical world’s current modelling is spacetime, which is a
torsion less, time oriented Lorentzian manifold. Albert Einstein first
proposed the idea of general relativity theory in 1915, in which the matter
content of the universe is stated by picking the suitable energy momentum
tensor and is accepted to act like a perfect fluid spacetime in the
cosmological models. $GRW$ spacetimes, where large scale cosmology is staged,
are a natural and extensive extension of $RW$ spacetimes.

This article will be read not only by readers working in this field, but also
by researchers from other engineering disciplines. In future, other
researchers or we, will investigate others solitons in general relativity
theory and cosmology.

## Acknowledgment

We appreciate the Editor’s diligent examination of the manuscript and the
anonymous referees’ insightful criticism which enhanced the paper’s quality.

## Declarations

### Author contribution statement

K. De: Conceived and designed the experiments; Performed the experiments;
Wrote the paper.
M. N. Khan: Performed the experiments; Wrote the paper.
U.C. De: Performed the experiments; Wrote the paper.

### Funding

Researcher would like to thank the Deanship of Scientific Research, Qassim
University, for funding publication of this project.

### Data availability statement

No data was used for the research described in the article.

### Declaration of interests statement

The authors declare no conflict of interest.

### Additional information

No additional information is available for this paper.

## References

  * [1] L. Alias, A. Romero and M. Sánchez, Uniqueness of complete spacelike hypersurfaces of constant mean curvature in generalized Robertson-Walker spacetimes, Gen. Relat. Gravit. 27 (1995), 71.
  * [2] L. Alias, A. Romero and M. Sánchez, compact spacelike hypersurfaces of constant mean curvature in generalized Robertson-Walker spacetimes; in geometry and topology of submanifolds VII, River Edge NJ, USA, World Scientific, 67, 1995.
  * [3] B. Y. Chen, Pseudo-Riemannian Geometry, $\delta$-invariants and Applications, World Scientific, 2011.
  * [4] B. Y. Chen, A simple characterization of generalized Robertson-Walker spacetimes, Gen. Relativ. Gravit. 46, 1833 (5 pages) (2014).
  * [5] C. A. Mantica and L. G. Molinari, Generalized Robertson-Walker spacetimes-A survey, Int. J. Geom. Methods Mod. Phys. 14 (2017), 1730001 (27 pages).
  * [6] C. A. Mantica and L. G. Molinari, On the Weyl and Ricci tensors of Generalized Robertson-Walker spacetimes, J. Math. Phys. 57, 102502 (2016), https://doi.org/10.1063/1.4965714
  * [7] M. Sánchez, On the geometry of generalized Robertson-Walker spacetimes: geodesics, Gen. Relat. Gravit. 30 (1998), 915-932.
  * [8] B. O’Neill, Semi-Riemannian Geometry with Applications to Relativity, Academic Press, New York, 1983.
  * [9] M. Guti$\acute{e}$rrez and B. Olea, Global decomposition of a Lorentzian manifold as a generalized Robertson-Walker space, Differ. Geom. Appl. 27 (2009), 146-156.
  * [10] P.H. Chavanis, Cosmology with a stiff matter era, Phys. Rev. D 92, 103004 (2015).
  * [11] R. R. Caldwell, M. Kamionkowski, N. N. Weinberg, Dark Energy with $w<-1$ causes a cosmic doomsday, Phys. Rev. Lett. 91 (2003) 071301.
  * [12] R. R. Caldwell, A Phantom Menace? Cosmological consequences of a dark energy component with super-negative equation of state, Phys. Lett. B 545 (2002) 23–29.
  * [13] K. De and U.C. De, Almost co-Kähler manifolds and quasi-Einstein solitons, Chaos, Solitons and Fractals, 167, 2023, 113050.
  * [14] A. Sardar, M. N. I. Khan and U. C. De, $\eta-\ast$-Ricci solitons and almost co-Kähler manifolds, Mathematics, 2021, 9, 3200
  * [15] R. Hamilton, The Ricci flow on surfaces, Contemp. Math. 71 (1988), 237-261.
  * [16] R. S. Hamilton, Three-manifolds with positive Ricci curvature, J. Differ. Geom. 17 (1982), 255-306.
  * [17] D. Friedan, Non linear models in $2+\epsilon$ dimensions, Ann. Phys. 163 (1985), 318–410.
  * [18] A. M. Blaga, Solitons and geometrical structures in a perfect fluid spacetime, Rocky Mountain J. Math. 50 (2020), 41-53.
  * [19] B.Y. Chen and S. Deshmukh, Ricci solitons and concurrent vector fields, Balkan J. Geom. Appl., 20 (2015), 14-25.
  * [20] S. Deshmukh, H. Alodan and H. Al-Sodais, A Note on Ricci Soliton, Balkan J. Geom. Appl. 16 (2011), 48-55.
  * [21] F. Karaca and C. Ozgur, Gradient Ricci solitons on multiply warped product manifolds, Filomat, 32 (2018), 4221-4228.
  * [22] Y. Wang, Gradient Ricci almost Solitons on two classes of almost Kenmotsu Manifolds, J. Korean Math. Soc. 23 (2016), 1101-1114.
  * [23] A. Hossein, A. R. Sheikhani and H. Rezazadeh, Exact solutions for the fractional differential equations by using the first integral method, Nonlinear Engineering, vol. 4, no. 1, 2015, pp. 15-22. https://doi.org/10.1515/nleng-2014-0018
  * [24] H. Rezazadeh, D. Kumar, T.A. Sulaiman and H. Bulut, New complex hyperbolic and trigonometric solutions for the generalized conformable fractional Gardner equation, Modern Physics Letters B, Vol. 33, No. 17, 1950196 (2019). https://doi.org/10.1142/S0217984919501963
  * [25] W.X. Ma, Nonlocal PT-symmetric integrable equations and related Riemann-Hilbert problems, Partial Differential Equations in Applied Mathematics 4 (2021) 100190.
  * [26] H. Rezazadeh, New solitons solutions of the complex Ginzburg-Landau equation with Kerr law nonlinearity, Optik (2010), https://doi.org/10.1016/j.ijleo.2018.04.026
  * [27] W.X. Ma and F.K. Guo, Lax Representations and Zero-Curvature Representations by the Kronecker Product, International Journal of Theoretical Physics, Vol. 36, No. 3, 1997.
  * [28] G. Catino and L. Mazzieri, Gradient Einstein solitons, Nonlinear Analysis 132 (2016), 66-94.
  * [29] V. Venkatesha and H.A. Kumara, gradient $\rho$-Einstein soliton on almost Kenmotsu manifolds, Annali Dell’Universita’ Di Ferrara 65 (2019), 375-388.
  * [30] K. De and U.C. De, A note on gradient Solitons on two classes of almost Kenmotsu Manifolds, Int. J. Geom. Methods Mod. Phys. 19 (2022), 2250213 (12 pages). DOI: 10.1142/S0219887822502139
  * [31] U.C. De, C.A. Mantica and Y.J. Suh, Perfect Fluid Spacetimes and Gradient Solitons, Filomat, 36 (2022), 829-842.
  * [32] K. De and U.C. De, A. A. Syied, N. B. Turki and S. Alsaeed, Perfect fluid spacetimes and gradient solitons, Journal of Nonlinear Mathematical Physics, 29 (2022), 843-858. https://doi.org/10.1007/s44198-022-00066-5
  * [33] U.C. De, S.K. Chaubey and S. Shenawy, Perfect fluid spacetimes and Yamabe solitons, J Math Phys. 62, 032501 (2021). https://doi.org/10.1063/5.0033967
  * [34] J.P. Singh and M. Khatri, On Ricci-Yamabe soliton and geometrical structure in a perfect fluid spacetimes, Afrika Mathematica, 32 (2021), 1645-1656.