# Transition to turbulence in wind-drift layers

Gregory LeClaire Wagner  a Gregory Wagner<EMAIL_ADDRESS>Nick Pizzo
b,c Luc Lenain  c Fabrice Veron d  aMassachusetts Institute of Technology
bUniversity of Rhode Island Graduate School of Oceanography
cScripps Institution of Oceanography, University of California, San Diego
dUniversity of Delaware

###### Abstract

A light breeze rising over calm water initiates an intricate chain of events
that culminates in a centimeters-deep turbulent shear layer capped by gravity-
capillary ripples. At first, viscous stress accelerates a laminar wind-drift
layer until small surface ripples appear. Then a second “wave-catalyzed”
instability grows in the wind-drift layer, before sharpening into along-wind
jets and downwelling plumes, and finally devolving into three-dimensional
turbulence. This paper elucidates the evolution of wind-drift layers after
ripple inception using wave-averaged numerical simulations with a random
initial condition and a constant-amplitude representation of the incipient
surface ripples. Our model reproduces qualitative aspects of laboratory
measurements similar those reported by Veron & Melville (2001), validating the
wave-averaged approach. But we also find that our results are disturbingly
sensitive to the amplitude of the prescribed surface wave field, raising the
question whether wave-averaged models are truly “predictive” if they do not
also describe the evolution of the coupled evolution of the surface waves
together with the flow beneath.

##  1 Introduction

The appearance of surface ripples beneath gusts of wind is an everyday
experience on the water, belying a surprisingly intricate chain of events
unfolding beneath the surface. There, an accelerating wind-drift layer breeds
two instabilities in sequence: first the surface instability that generates
ripples, followed by a subsurface instability whose growth, finite amplitude
saturation, and destabilization to three-dimensional perturbations ultimately
gives way to persistent turbulence in the centimeters-thick wind-drift layer.

This ubiquitous transition-to-turbulence scenario was observed in a series of
laboratory experiments reported by Melville et al. (1998), Veron & Melville
(1999) and Veron & Melville (2001) that subjected an initially quiescent wave
tank to a turbulent airflow rapidly accelerated from rest to a constant
airspeed. One of Veron & Melville (2001)’s key results is that both the
generation of surface ripples and the transition to turbulence are suppressed
by surfactant layered on the water surface. The surfactant experiment proves
that ripples are intrinsic to the second slow instability implicated in the
turbulent transition of the wind-drift layer under typical conditions
(disproving Handler et al. (2001)’s hypothesis, repeated by Thorpe (2004),
that the transition to turbulence is convective.)

Motivated by Veron & Melville (2001)’s experimental results, we propose a
wave-averaged model based on the “Craik-Leibovich” (CL) Navier-Stokes
equations (Craik & Leibovich, 1976) for the development of wind-drift layers —
eventually leading to a transition to turbulence — after the appearance of
capillary ripples. We focus narrowly on a comparison with a new laboratory
experiment similar to those reported by Veron & Melville (2001) and described
in section 2. The predictions of our wave-averaged model are developed in
section 3. We mix analytical results from Veron & Melville (2001) on the
initial laminar developments with a linear instability analysis of the wind-
drift layer just after ripple inception, and with numerical simulations of
nonlinear development of the second slow instability from ripple inception to
fully developed wind-drift turbulence.

We have two goals: first, we seek a more detailed understanding of the wind-
drifted transition to turbulence. Second, we seek to validate the wave-
averaged Craik-Leibovich (CL) momentum equation, which is central to
parameterization of ocean surface boundary layer turbulence (see for example
D’Asaro et al. (2014); Harcourt (2015); Reichl & Li (2019)). Toward this
second goal we make some progress and find that our CL-based model
qualitatively replicates the laboratory measurements — most strikingly during
the transition to turbulence depicted in figure 4. Yet we also find our
results are delicately sensitive to the parameters of the prescribed ripples,
which owing to uncertainty about the evolving, two-dimensional state of the
ripples surrounding the transition to the turbulence, prevents unambiguous
conclusions about CL validity. In section 4, we argue that this sensitivity
implies that CL is “incomplete” because it does not also predict the response
of the wave field to the currents and turbulence beneath.

##  2 Laboratory experiments of winds rising over calm water

This paper uses an experiment similar to those reported by Melville et al.
(1998) and Veron & Melville (2001) The experiment was conducted in the 42-m
long, 1-m wide, 1.25-m high wind-wave-current tank at the Air-Sea Interaction
Laboratory of the University of Delaware, and used a computer-controlled
recirculating wind tunnel to accelerate a turbulent airflow to 10
$\mathrm{m\,s^{-1}}$ over 65 s. The water depth was maintained at 0.71 m and
observations were collected at a fetch of 12 m. An artificial wave-absorbing
beach dissipated wave energy and eliminate wave reflections at the downwind
end of the tank.

###  2.1 Laser-induced fluorescence (LIF) observations

The evolution of initially-surface-concentrated dye was observed with a Laser-
Induced Fluorescence (LIF) system. Images were acquired with a CCD camera (Jai
TM4200CL, 2048 × 2048 pixels) equipped with an 85 mm Canon EF lens focused at
the air-water interface. Illumination was provided by a thin 3 mm thick laser
light sheet generated by a pulsed dual-head Nd-Yag laser (New Wave Research,
120 mJ/pulse, 3–5 ns pulse duration). The laser light illuminated a thin layer
of fluorescent dye carefully applied to the water surface prior to each
experiment. Observations were conducted with the light sheet in both along-
wind and transverse directions. The LIF camera collected images at a 7.2Hz
frame rate and with a field of view of 11.6 x 11.6 cm in the along-wind
configuration, and 13.9 x 13.9 cm in the transverse direction. An edge
detection algorithm based on local variations of image intensity gradients,
computed by kernel convolution was used to identify the location of the
surface in the LIF images (Buckley & Veron, 2017).

###  2.2 Thermal Marking Velocimetry (TMV)

In addition to LIF, we employed Thermal Marking Velocimetry (TMV), as
developed by Veron & Melville (2001) and Veron et al. (2008), to measure the
surface velocity by tracking laser-generated Lagrangian heat markers in
thermal imagery of water surfaces. In the present experiment, infrared images
of the surface were captured by a 14-bit, $640\times 512$ quantum well
infrared photodetector (QWIP — 8.0-9.2$\mu$m) FLIR SC6000 infrared camera
operated at a 43.2 Hz frame rate, with an integration time of 10 ms, and a
stated rms noise level below 35 mK. After image correction to account for the
slightly off-vertical viewing angle of the imager, the resulting image sizes
were $24.6\times 24.6$ cm.

The infrared imager is sensitive enough to detect minute, turbulent
temperature variations in the surface thermal skin layer (Jessup et al., 1997;
Zappa et al., 2001; Veron & Melville, 2001; Sutherland & Melville, 2013). It
thus easily detects active weakly-heated markers, generated by a 60 W air-
cooled $\mathrm{CO_{2}}$ laser (Synrad Firestar T60) equipped with an
industrial marking head (Synrad FH Index) and two servo-controlled scanning
mirrors programmed to lay down a pattern of 16 spots with 0.8 cm diameter and
at a frequency of 1.8 Hz.

The spatially averaged surface velocity was estimated by tracking the
geometric centroid of these Lagrangian heat markers for approximately one
second. Both Gaussian interpolation (which has sub-pixel resolution due to the
Gaussian pattern of the laser beam) and a standard cross-correlation technique
yielded similar estimates for the surface velocity.

###  2.3 Summary of experimental results

Figure 1 summarizes the experimental results. Figure 1a shows a time series of
estimated wave steepness, and figure 1b shows the measured average surface
velocity using TMV. The thick gray line in figure 1 plots $At$, where
$A=1\,\mathrm{cm\,s^{-1}}$ showing that the surface current increases linearly
in time. (The time axis for laboratory measurements is adjusted to meet this
line, which constitutes a definition of “$t=0$”.) Following Veron & Melville
(2001), figures 1a–b divide the development of the waves and currents into
four stages:

  1. 1.

Viscous acceleration, $t=0$–$16$ s. In the first stage, viscous stress between
the accelerating wind and water accelerates a shallow, laminar, viscous wind-
drift layer.

  2. 2.

Wave-catalyzed “Langmuir” shear instability, $t=16$–$18$ s. At $t\approx 16$
s, detectable capillary ripples appear. A wave-catalyzed shear instability —
which obey the same dynamics as “Langmuir circulation”, which often refers to
much larger scale motions in the ocean surface boundary layer Craik &
Leibovich (1976) — immediately starts to develop and grow in the wind-drift
layer.

  3. 3.

Self-sharpening, $t=18$–$20$ s. When the shear instability reaches finite
amplitude, nonlinear amplification due to perturbation self-advection sharpens
the instability features into narrow jets and downwelling plumes.

  4. 4.

Langmuir turbulence, $t>20$ s. The self-sharpened circulations develop
significant three-dimensional characteristics and transition to fully
developed Langmuir turbulence.

Figure 1: Summary of laboratory measurements: (a) an estimate of the steepness
of the surface wave field that combines amplitude data with wavenumbers
$k=2\pi/3\,\mathrm{cm^{-1}}$ and $k=2\pi/5\,\mathrm{cm^{-1}}$; (b) average
surface along-wind velocity.

##  3 A wave-averaged model for the transition to turbulence in wind-drift
layers

The main purpose of this paper is to build a model for the four-stage
evolution of the wind-drift layer, focusing on the dynamics after ripple
inception.

###  3.1 Viscous acceleration

As the wind starts to accelerate, viscous stress across the air-water
interface drives a laminar wind-drift current. The thick gray line in figure 1
indicates that the average surface velocity nearly obeys

$U(z=0,t)\equiv U_{0}(t)=A\,t\,,$ (1)

where $A\approx 1\,\mathrm{cm\,s^{-2}}$. Veron & Melville (2001) point out
that the viscous stress consistent with linear surface current acceleration is

$\boldsymbol{\tau}(t)=\alpha\sqrt{t}\,\boldsymbol{\hat{x}}$ (2)

where $\boldsymbol{\tau}$ is the downwards kinematic stress across the air-
water interface, $\boldsymbol{\hat{x}}$ is the along-wind direction
($\boldsymbol{\hat{y}}$ and $\boldsymbol{\hat{z}}$ are the cross-wind and
vertical directions), and $\alpha\approx 1.2\times
10^{-5}\,\mathrm{m^{2}\,s^{-5/2}}$ produces $A=\alpha\sqrt{4/\pi\nu}\approx
1\,\mathrm{cm\,s^{-1}}$ given the kinematic viscosity of water,
$\nu=1.05\times 10^{-6}\,\mathrm{m^{2}\,s^{-1}}$. The laminar viscous solution
beneath (2) is (Veron & Melville, 2001)

$U(z,t)=U_{0}(t)\left[\left(1+\delta^{2}\right)\mathrm{erfc}\left(-\tfrac{\sqrt{2}}{2}\delta\right)+\delta\sqrt{\tfrac{2}{\pi}}\exp\left(-\tfrac{1}{2}\delta^{2}\right)\right]\quad\text{where}\quad\delta\equiv\frac{z}{\sqrt{2\nu
t}}\,.$ (3)

Viscous acceleration continues until gravity-capillary ripples appear at the
air-water interface when $t\approx\tilde{t}\equiv 16$ seconds and thus
$U_{0}(t)\approx\tilde{U}_{0}\equiv 16\,\mathrm{cm\,s^{-1}}$.

###  3.2 Instability of the wind-drift layer catalyzed by incipient capillary
ripples

As soon as ripples appear on the water surface, a second, slower, non-
propagating instability begins to grow. Remarkably, this second instability is
catalyzed by and therefore requires the presence of capillary ripples: for
example Veron & Melville (2001) show that instability and turbulence are
suppressed if ripple generation is suppressed by layering a surfactant on the
water surface.

Interestingly, ripple inception is not explained by linear theory (Young &
Wolfe, 2014). We neverthless assume that the ensuing dynamics are described by
the weakly-nonlinear and wave-averaged “Craik-Leibovich” momentum equation.
This ansatz is supported by the data in figure 1a, which plots an estimate of
the wave steepness $\epsilon\equiv ak$, where $a$ is the surface wave
amplitude (readily measured in the lab) and $k\approx
2\pi/3\,\mathrm{cm^{-1}}$–$2\pi/5\,\mathrm{cm^{-1}}$ is the gravity-capillary
wavenumber for ripples with wavelengths between 3 and 5 cm (slightly larger
than the minimum gravity-capillary wavelength 1.7 cm). Apparently, by the time
ripples reach detectable amplitudes they have small slopes with
$\epsilon<0.1$.

The wave-averaged Craik-Leibovich equation (Craik & Leibovich, 1976)
formulated in terms of the Lagrangian-mean momentum
$\boldsymbol{u}^{\mathrm{L}}$ of the wind-drift layer is

$\boldsymbol{u}^{\mathrm{L}}_{t}+\left(\boldsymbol{u}^{\mathrm{L}}\bcdot\bnabla\right)\boldsymbol{u}^{\mathrm{L}}-\left(\bnabla\times\boldsymbol{u}^{\mathrm{S}}\right)\times\boldsymbol{u}^{\mathrm{L}}+\bnabla
p^{\mathrm{E}}=\nu\triangle\boldsymbol{u}^{\mathrm{L}}-\nu\triangle\boldsymbol{u}^{\mathrm{S}}+\boldsymbol{u}^{\mathrm{S}}_{t}\,,$
(4)

where $\boldsymbol{u}^{\mathrm{S}}$ is the Stokes drift of the field of
capillary ripples and $p^{\mathrm{E}}$ is the Eulerian-mean pressure. The
asymptotic derivation of the CL equation (4) requires $\epsilon\ll 1$. We
require $\boldsymbol{u}^{\mathrm{L}}$ to be divergence-free (Vanneste & Young,
2022),

$\bnabla\bcdot\boldsymbol{u}^{\mathrm{L}}=0\,.$ (5)

The Stokes drift associated with monochromatic capillary ripples propagating
in the along-wind direction $\boldsymbol{\hat{x}}$ is

$\boldsymbol{u}^{\mathrm{S}}(z,t)=\mathrm{e}^{2kz}\epsilon^{2}c(k)\,\boldsymbol{\hat{x}}\,,\qquad\text{where}\qquad
c(k)=\sqrt{\frac{g}{k}+\gamma k}$ (6)

is the phase speed of gravity-capillary waves in deep water with gravitational
acceleration $g=9.81\,\mathrm{m\,s^{-2}}$ and surface tension
$\gamma=7.2\times 10^{-5}\,\mathrm{m^{3}\,s^{-2}}$. In all cases considered
here, the Stokes drift (6) is minuscule compared to the mean current
$\boldsymbol{u}^{\mathrm{L}}\sim U$.

We invoke the power method (Constantinou, 2015) to investigate the stability
of the wind-drift layer immediately following ripple generation. In our
implementation of the power method we extract the fastest growing mode
perturbing the steady shear flow $\tilde{U}(z)$, such that

$\boldsymbol{u}^{\mathrm{L}}(y,z,t)=\tilde{U}(z)\,\boldsymbol{\hat{x}}+\boldsymbol{u}(y,z,t)\,,$
(7)

where $\tilde{U}(z)\equiv U(z,\tilde{t})$ represents the wind-drift profile
“frozen” at $\tilde{t}=16$ s and $\boldsymbol{u}=(u,v,w)$ is the perturbation
velocity. Inserting (7) into (4)–(5), introducing a streamfunction $\psi$ with
the convention $(v,w)=(-\psi_{z},\psi_{y})$, and neglecting terms that depend
only on the mean flow $U$ or $u^{S}$ yields the two-dimensional system

$\displaystyle u_{t}+\mathrm{J}(\psi,u)+\Omega\,\psi_{y}=\nu\triangle u\,,$
(8)
$\displaystyle\triangle\psi_{t}+\mathrm{J}(\psi,\triangle\psi)+u^{\mathrm{S}}_{z}u_{y}=\nu\triangle^{2}\psi\,,$
(9)

where $\triangle\psi=w_{y}-v_{z}$ is the $x$-component of the perturbation
vorticity, $\mathrm{J}(a,b)=a_{y}b_{z}-a_{z}b_{y}$ is the Jacobian operator,
and $\Omega=\tilde{U}_{z}-u^{\mathrm{S}}_{z}$ is the Eulerian-mean shear — or,
as we prefer, the mean, total cross-wind vorticity
$\bnabla\times\left(\tilde{U}\boldsymbol{\hat{x}}-\boldsymbol{u}^{\mathrm{S}}\right)=\Omega\boldsymbol{\hat{y}}$.
The power method isolates the fastest growing linear modes of (8)–(9) by
iterating over short integrations of the fully nonlinear CL equations (4)–(5)
from $t=\tilde{t}$ to $t=\tilde{t}+\Delta t$ and repeatedly downscaling
$\boldsymbol{u}$ via (7) to ensure each integration has essentially linear
dynamics.

Figure 2:  Structure of the most unstable eigenmode for wave steepness
$\epsilon=0.1$ in a $10\times 5$ cm domain in $(y,z)$. (a) Structure of the
cross-wind perturbation $v^{\prime}(y,z)$ for wave steepness $\epsilon=0.1$ in
a $10\times 5$ cm domain in $(y,z)$, (b) root-mean-square ($y$-averaged)
perturbation profiles

.

Figure 2 shows the structure of the most unstable mode for $\epsilon=0.1$. The
mode is necessarily sinusoidal in the horizontal because (8)-(9) is
horizontally-uniform and has alternating upwelling and downwelling regions,
with a much larger streamwise component $u^{\prime}$ than cross-stream and
vertical components $v^{\prime}$ and $w^{\prime}$. Figure 3 shows the results
of a parameter sweep from $\epsilon=0.04$ to $\epsilon=0.3$, illustrating how
increasing $\epsilon$ leads to faster growth rates and decreasing wavelengths
of the fastest growing mode. We recover Veron & Melville (2001)’s experimental
result that shear instability does not occur without surface waves.

Figure 3: (a) Growth rate, (b) growth time-scale (inverse of the growth rate),
and (c) wavelength of the most unstable mode of a wave-catalyzed instability
of the wind-drift layer “frozen” at $\tilde{t}=16$ seconds calculated using
the power method (Constantinou, 2015) in two domains 10 cm and 40 cm wide.

Note that the kinetic energy source for growing perturbations is the mean
shear $\tilde{U}(z)$ and there is no energy exchange between perturbations and
the surface wave field within the context of the wave-averaged equations
(4)–(5). To see this, consider that (4)–(5) conserves total kinetic energy
$\int\tfrac{1}{2}|\boldsymbol{u}^{\mathrm{L}}|^{2}\,\mathrm{d}V$ when $\nu=0$
and $\partial_{t}\boldsymbol{u}^{\mathrm{S}}=0$ (viscous stress is
negligible). This is why we characterize the shear instability as “wave-
catalyzed”: while the presence of waves is necessary for instability, and
while the instability growth rate is strongly affected by wave amplitude, the
kinetic energy of the growing perturbation is derived solely from the mean
shear.

###  3.3 Self-sharpening circulations with jets and plumes

When the wave-catalyzed shear instability reaches finite amplitude, it begins
to self-sharpen, producing narrow along-wind jets and downwelling plumes. The
sharpening — but still two-dimensional — plumes then transport a measureable
amount of mean momentum downwards before becoming unstable to three-
dimensional perturbations and thereby transitioning to fully-developed
turbulence. This nonlinear sharpening and depletion of the average near-
surface momentum occurs between 17.5–20 seconds, as evidenced by the red
shaded region in figure 1b.

To simulate the second wave-catalyzed instability through finite amplitude and
toward transition to turbulence, we propose a simplified model based on the
wave-averaged equations (4)–(5) with two main components representing (i) the
capillary ripples and (ii) the initial condition at $\tilde{t}=16$ seconds. We
model the evolving capillary ripples as steady, monochromatic surface waves
with wavenumber $k=2\pi/3\,\mathrm{cm^{-1}}$. We model the condition of the
wave tank at $t=16$ seconds with

$\boldsymbol{u}^{\mathrm{L}}\,|_{t=\tilde{t}}=\tilde{U}(z)\boldsymbol{\hat{x}}+\mathbb{U}^{\prime}\,\boldsymbol{\Xi}(x,y,z)\,,$
(10)

where $\mathbb{U}^{\prime}$ is an initial noise amplitude and
$\boldsymbol{\Xi}$ is a vector whose components are normally-distributed
random numbers with zero mean and unit variance.

Through experimentation, we find that the instability and transition to
turbulence are only weakly sensitive to the wavenumber $k$. The tuning
parameters of our model are therefore (i) the amplitude of the initial
perturbation $\mathbb{U}^{\prime}$, and (ii) the wave steepness $\epsilon$. We
discuss possible interpretations for $\mathbb{U}^{\prime}$ in section 4.

We also simulate the evolution of dye concentration $d$ via

$\partial_{t}\theta+\boldsymbol{u}^{\mathrm{L}}\bcdot\bnabla\theta=\kappa\triangle\theta\,,$
(11)

with molecular diffusivity $\kappa=10^{-7}\,\mathrm{m^{2}\,s^{-1}}$, the
smallest we can reasonably afford computationally. (The correspondance between
$\theta$ and rhodamine is imperfect because the molecular diffusivity of
rhodamine is $\kappa=10^{-9}\,\mathrm{m^{2}\,s^{-1}}$.) We initialize $\theta$
with a $\delta$-function at the surface. We integrate (4)–(5) and (11) given
(6) using Oceananigans (see Ramadhan et al. 2020 and Wagner et al. 2021) with
a second-order staggered finite volume method on a single A100 GPU in a
$10\times 10\times 5$ cm domain in $(x,y,z)$ with 0.13 mm regular spacing in
$x,y$ and variable spacing in $z$ with $\min(\Delta z)\approx
0.26\,\mathrm{mm}$, corresponding to $768\times 768\times 512$ finite volume
cells.

Figure 4: (a) Maximum horizontal velocity $u$. The grey dots are from the
laboratory experiments while the blue line shows the numerical experiments.
(b) Vertical velocity. (c-l) Evolution of the wind-drift layer after the
emergence of capillary ripples.

The results are visualized in figure 4. Figure 4a compares the average surface
velocity diagnosed from the simulation with the laboratory measurements
presented in figure 1b. Figure 4b plots the maximum absolute vertical
velocity, $\max|w^{L}|$. Figures 4c–l compare the simulated dye concentration
on $(y,z)$ slices with LIF measurements of rhodamine from the laboratory
experiment, showing the particularly good qualitative agreement between
simulated and measured dye features. Visualizations are shown at $t=18.1$,
19.3, 20.0, 20.7, and 21.7 seconds.At $t=18.1$ s (figures 4c and d), the
sharpened plumes have only just started advect appreciable amounts of dye. At
$t=19.3$ seconds (figures 4 e and f), the plumes are beginning to roll up into
two-dimensional mushroom-like structures. (Note the small, unexplained
discrepancy between simulated and measured average surface velocities around
$18.1<t<19.3$.) At $t=20.0$ seconds and $t=20.7$ (figures 4g, h, i, and j)
three-dimensionalization and transition to turbulence are underway. At
$t=21.7$ both the simulated and measured dye concentrations appear to be mixed
by three-dimensional turbulence.

Figure 5 illustrates the sensitivity of the wave-averaged model to amplitude
of the specified surface ripples and to the amplitude of the random initial
perturbation. Figures 5a and b plot the surface-averaged along-wind velocity
$u$ and maximum vertical velocity $w$ for two wave amplitudes $\epsilon=0.1$
and $\epsilon=0.11$, and for two initial perturbaiton ampltidues
$\mathbb{U}^{\prime}=5\,\mathrm{cm\,s^{-1}}$ and
$\mathbb{U}^{\prime}=10\,\mathrm{cm\,s^{-1}}$. The dependence of the maximum
vertical velocity is the most evocative: doubling the initial perturbation
shortens the self-sharpening phase (in which the maximum vertical velocity in
figure 5b flattens before increasing sharply during the transition to
turbulence) by a factor of five. Of the three cases plotted in figure 5, only
$\epsilon=0.11$ and $\mathbb{U}^{\prime}=5\,\mathrm{cm\,s^{-1}}$ yield the
satisfying agreement depicted in figure 4.

Figure 5: Sensitivity of (a) surface-averaged along-wind velocity $u$ and (b)
maximum vertical velocity to the specification of the surface wave field and
initial perturbations.

###  3.4 Langmuir turbulence

Following three-dimensionalization, momentum and dye are rapidly mixed to
depth. Figure 6 visualizes (a) the $x$-momentum and (b) dye concentration at
$t=23.4$ seconds, showing how the flow is organized into narrow along-wind
streaks and broader downwelling regions — classic characteristics of Langmuir
turbulence (Sullivan & McWilliams, 2010).

Figure 6: (a) Simulated $x$-momentum and (b) dye concentration at $t=23.4$
seconds, showing the streaks and jets that characterize Langmuir turbulence.

In figure 7, we compare the rate which dye is mixed to depth in the
simulations versus measured by LIF in the lab. Figure 7a shows the simulated
horizontally-averaged tracer concentration in the depth-time $(z,t)$ plane,
while figure 7b shows a corresponding laboratory measurements extracted from
LIF measurements in the $(y,z)$-plane. In figures 7a and b, a light blue line
shows the height $z_{99}(t)$ defined as the level above which 99% of the
simulated tracer concentration resides,

$\int_{z_{99}(t)}^{0}\theta\,\mathrm{d}z=0.99\int_{-H}^{0}\theta\,\mathrm{d}z\,.$
(12)

Using $z_{99}(t)$ to compare the tracer mixing rates exhibited in figures 7a
and b, we conclude that the simulations provided a qualitatively accurate
prediction of dye mixing rates. If anything, the simulation overpredicts the
dye mixing rate — but the data probably does not warrant more than broad
qualitative conclusions.

Figure 7: Visualization of mixing rates during measured and simulated wave-
catalyzed instability via depth-time $(z,t)$ diagrams of horizontally-averaged
in (a) simulations and (b) LIF-measurements. The blue lines denotes the depth
above which 99% of the simulated dye resides; (b) suggests that the
simulations overpredict dye mixing rates.

##  4 Discussion

This paper describes a wave-averaged model for the evolution of wind-drift
layers following the inception of capillary ripples. The wave-averaged model
predicts that, following ripple incpetion, the wind-drift layer is immediately
susceptible to the growth of a second, slower, “wave-catalyzed” instability.
Wave-averaged simulations show that the evolution of the wave-catalyzed
instability from initial growth through transition to turbulence is sensitive
not only to the amplitude of the surface ripples, but also to the amplitude of
the perturbations that seed the growth of the second-instability and also
destabilize the jets and plumes during the transition to turbulence.

We model the seeding and destabilizing perturbations modeled as random
velocity fluctuations imposed at the time of ripple inception. However, in
wind-drift layers in the laboratory or natural world, perturbations may be
continuously introduced both by turbulent pressure fluctuations in the air
and, perhaps, by inhomogeneities in the ripple field (see figures 3 and 15 in
Veron & Melville 2001). The natural prevalance of the striking coherent
structures observed in the laboratory and visualized in figure 4 is therefore
uncertain.

One of the original goals of this work was to probe the potential weaknesses
of the wave-averaged Craik-Leibovich (CL) equation, which are widely used for
process studies and paramterization of ocean surface boundary layer turbulence
(Sullivan & McWilliams, 2010). In particular, the derivation of the CL
equation requires the restrictive assumptions that (i) the surface wave field
is nearly linear; and (ii) the timescale of the turbulence is much longer than
the time scale of the waves, But despite qualitative success, firm conclusions
about CL validity prove elusive due to the strong sensitivity of our results
to ripple amplitude — which is evolving and two-dimensional in the laboratory
experiments rather than uniform and steady, as in our model. This sensitivity,
together with Veron & Melville (2001)’s observations that the ripple field is
refracted and organized by turbulence in the wind-drift layer, suggests that
two-way wave-turbulence coupling is important and should be described in a
“predictive” theory for turbulent boundary layers affected by surface waves.
Further progress requires not just theoretical advances to couple wave
evolution with the CL equations, but also experiments that obtain more precise
two-dimensional measurements of the evolution of the capillary ripples.

###### Acknowledgements.

Acknowledgements. We acknowledge stimulating discussions with Bill Young and
Navid Constantinou.

## References

  * Buckley & Veron (2017) Buckley, Marc P & Veron, Fabrice 2017 Airflow measurements at a wavy air–water interface using piv and lif. Experiments in Fluids 58 (11), 161.
  * Constantinou (2015) Constantinou, Navid C 2015 Formation of large-scale structures by turbulence in rotating planets. arXiv preprint arXiv:1503.07644 .
  * Craik & Leibovich (1976) Craik, Alex DD & Leibovich, Sidney 1976 A rational model for Langmuir circulations. Journal of Fluid Mechanics 73 (3), 401–426.
  * D’Asaro et al. (2014) D’Asaro, Eric A, Thomson, J, Shcherbina, AY, Harcourt, RR, Cronin, MF, Hemer, MA & Fox-Kemper, B 2014 Quantifying upper ocean turbulence driven by surface waves. Geophysical Research Letters 41 (1), 102–107.
  * Handler et al. (2001) Handler, RA, Smith, GB & Leighton, RI 2001 The thermal structure of an air–water interface at low wind speeds. Tellus A 53 (2), 233–244.
  * Harcourt (2015) Harcourt, Ramsey R 2015 An improved second-moment closure model of langmuir turbulence. Journal of Physical Oceanography 45 (1), 84–103.
  * Jessup et al. (1997) Jessup, AT, Zappa, Christopher J & Yeh, Harry 1997 Defining and quantifying microscale wave breaking with infrared imagery. Journal of Geophysical Research: Oceans 102 (C10), 23145–23153.
  * Melville et al. (1998) Melville, W Kendall, Shear, Robert & Veron, Fabrice 1998 Laboratory measurements of the generation and evolution of Langmuir circulations. Journal of Fluid Mechanics 364, 31–58.
  * Ramadhan et al. (2020) Ramadhan, Ali, Wagner, Gregory, Hill, Chris, Campin, Jean-Michel, Churavy, Valentin, Besard, Tim, Souza, Andre, Edelman, Alan, Ferrari, Raffaele & Marshall, John 2020 Oceananigans. jl: Fast and friendly geophysical fluid dynamics on gpus. Journal of Open Source Software 5 (53).
  * Reichl & Li (2019) Reichl, Brandon G & Li, Qing 2019 A parameterization with a constrained potential energy conversion rate of vertical mixing due to langmuir turbulence. Journal of Physical Oceanography 49 (11), 2935–2959.
  * Sullivan & McWilliams (2010) Sullivan, Peter P & McWilliams, James C 2010 Dynamics of winds and currents coupled to surface waves. Annual Review of Fluid Mechanics 42, 19–42.
  * Sutherland & Melville (2013) Sutherland, Peter & Melville, W Kendall 2013 Field measurements and scaling of ocean surface wave-breaking statistics. Geophysical Research Letters 40 (12), 3074–3079.
  * Thorpe (2004) Thorpe, SA 2004 Langmuir circulation. Annu. Rev. Fluid Mech. 36, 55–79.
  * Vanneste & Young (2022) Vanneste, Jacques & Young, William R 2022 Stokes drift and its discontents. Philosophical Transactions of the Royal Society A 380 (2225), 20210032.
  * Veron & Melville (1999) Veron, Fabrice & Melville, W Kendall 1999 Pulse-to-pulse coherent doppler measurements of waves and turbulence. Journal of Atmospheric and Oceanic Technology 16 (11), 1580–1597.
  * Veron & Melville (2001) Veron, Fabrice & Melville, W Kendall 2001 Experiments on the stability and transition of wind-driven water surfaces. Journal of Fluid Mechanics 446, 25–65.
  * Veron et al. (2008) Veron, Fabrice, Melville, W Kendall & Lenain, Luc 2008 Wave-coherent air–sea heat flux. Journal of physical oceanography 38 (4), 788–802.
  * Wagner et al. (2021) Wagner, Gregory L, Chini, Gregory P, Ramadhan, Ali, Gallet, Basile & Ferrari, Raffaele 2021 Near-inertial waves and turbulence driven by the growth of swell. Journal of Physical Oceanography 51 (5), 1337–1351.
  * Young & Wolfe (2014) Young, WR & Wolfe, CL 2014 Generation of surface waves by shear-flow instability. Journal of fluid mechanics 739, 276–307.
  * Zappa et al. (2001) Zappa, C. J., Asher, W. E. & Jessup, A. T. 2001 Microscale wave breaking and air-water gas transfer. Journal of Geophysical Research: Oceans 106 (C5), 9385–9391.


11institutetext: Center for Computational Engineering and Networking, Amrita
School Of Engineering, Amrita vishwa vidyapeetham, Coimbatore, India. 11email:
<EMAIL_ADDRESS>22institutetext: Graduate School, Computer Science
Department
Texas State University. 22email<EMAIL_ADDRESS>Center for Artificial Intelligence, Prince Mohammad Bin Fahd University,
Khobar, Saudi Arabia.
33email<EMAIL_ADDRESS>
# Deep Learning based Frameworks for Handling Imbalance in DGA, Email, and URL
Data Analysis

Simran K 11 Prathiksha Balakrishna 22 Vinayakumar Ravi 3311 Soman KP 11

###### Abstract

Deep learning is a state of the art method for a lot of applications. The main
issue is that most of the real-time data is highly imbalanced in nature. In
order to avoid bias in training, cost-sensitive approach can be used. In this
paper, we propose cost-sensitive deep learning based frameworks and the
performance of the frameworks is evaluated on three different Cyber Security
use cases which are Domain Generation Algorithm (DGA), Electronic mail
(Email), and Uniform Resource Locator (URL). Various experiments were
performed using cost-insensitive as well as cost-sensitive methods and
parameters for both of these methods are set based on hyperparameter tuning.
In all experiments, the cost-sensitive deep learning methods performed better
than the cost-insensitive approaches. This is mainly due to the reason that
cost-sensitive approach gives importance to the classes which have a very less
number of samples during training and this helps to learn all the classes in a
more efficient manner.

###### Keywords:

Cyber Security Deep learning Cost-sensitive learning Imbalanced data.

##  1 Introduction

Cyber Security is an area which deals with techniques related to protecting
data, programs, devices, and networks from any attack, damage, and
unauthorized access [1]. There are various methods in Cyber Security to secure
systems as well as networks. The classical method is a signature-based system.
A signature-based system relies on regular expressions which give domain-level
knowledge. The main issue is that these signature-based systems can identify
only described malware and cannot detect novel types of attacks and even
existing variant types of attacks. In order to detect “0-day” malware, the
researchers have followed the application of machine learning [2].

Recently, the application of deep learning architectures are employed in Cyber
Security use cases and these models can extract features implicitly whereas
machine learning algorithms require manual feature engineering [3], [4], [5],
[6]. To classify DGA generated domains, different deep learning approaches
were proposed in [7], [1], and [2]. The real-time datasets are highly
imbalanced in nature and in order to handle it properly the concept of data
mining approaches can be used. In this direction, numerous amount of research
is being performed. In [9], an LSTM based model is proposed to handle
multiclass imbalanced data for detection of DGA botnet. In this work, the LSTM
model is adapted to be cost-sensitive and performed better than other cost-
insensitive approaches. The main objectives of this paper are:

  1. 1.

This work proposes a cost-sensitive deep learning based framework for Cyber
Security.

  2. 2.

The performance of cost-sensitive approaches are evaluated on three different
use cases in security namely, DGA, Email, and URL.

  3. 3.

The performance of cost-sensitive models are compared with cost-insensitive
models.

  4. 4.

Various hyperparameter tuning methods are employed to identify the optimal
network parameters and network structures.

The remaining of this paper is arranged in the following order: Section 2
documents a survey of the literature related to DGA, URL, and Email followed
by background related to NLP, deep learning, and cost-sensitive concepts in
Section 3. Section 4 provides a description of dataset. Section 5 describes
the details of the proposed architecture. Section 6 reports the experiments,
results, and observations made by the proposed architecture. Section 7
concludes the paper with remakes on future work of research.

##  2 Literature Survey on deep learning based DGA, URL, and Email data
analysis

###  2.1 Domain Generation Algorithms (DGAs)

In [8], an LSTM network was proposed for real-time prediction of DGA generated
domains. This work implemented binary as well as multiclass classification of
DGA. This network has a detection rate of 90% and a false positive (FP) rate
of 1:10000. In [10], convolutional neural network (CNN) and LSTM deep learning
models were utilized to classify large amounts of real traffic. Simple steps
were followed to obtain pure DGA and non-DGA samples from real DNS traffic and
achieved a false positive rate of 0.01%. In [11], deep learning based approach
was proposed to classify domain name as malicious or benign. Performance of
various deep learning techniques like recurrent neural network (RNN), LSTM,
and classical machine learning approaches were compared. A highly scalable
framework was proposed by [12] for situational awareness of Cyber Security
threats. This framework analyses domain name system event data. Deep learning
approaches for detection and classification of pseudo-random domain names were
proposed in [13]. Comparison between different deep learning approaches like
LSTM, RNN, I-RNN, CNN, and CNN-LSTM was performed. RNN and CNN-LSTM performed
significantly better than other models and got a detection rate of 0.99 and
0.98 respectively. A data-driven approach was utilized in [14] to detect
malware-generated domain names. This approach uses RNN and has achieved an
F1-score of 0.971. A combined binary and multiclass classification model was
proposed in [9] to detect DGA botnet. This model uses LSTM network and has the
capability to handle imbalanced multiclass data. A comprehensive survey on
detection of malicious domain using DNS data was performed by [15].

###  2.2 Uniform Resource Locator (URL)

A comprehensive and systematic survey to detect malicious URL using machine
learning methodologies was conducted by [16]. URLNet was proposed in [17]
which is an end-to-end system to detect malicious URL. This deep learning
framework contains word CNNs as well as character CNNs and has the capability
to learn nonlinear URL embedding directly from the URL. In [18], various deep
learning frameworks such as RNN, I-RNN, LSTM, CNN, CNN-LSTM were utilized to
classify real URL’s into malicious and benign at the character level. LSTM and
CNN-LSTM performed significantly better than other models and achieved an
accuracy of 0.9996 and 0.9995 respectively. A comparative study using shallow
and deep networks was performed by [19] for malicious URL’s detection. In this
work, CNN-LSTM network outperformed other networks by achieving an accuracy of
98%. In [20], three models namely, support vector machine (SVM) algorithm
based on term frequency - inverse document frequency (TF-IDF), logistic
regression algorithm and CNN based on the word2vec features were used to
detect and predict malicious URLs. An online deep learning framework was
proposed in [21] for detecting malicious DNS and URL. The framework utilized
character-level word embedding and CNN. In this work, a real-world data set
was utilized and the models performed better than state-of-art baseline
methods. URLDeep was proposed in [22] to detect malicious URL’s. This deep
learning framework based on dynamic CNN can learn a non-linear URL address. A
cost-sensitive framework firstfilter was proposed in [23] to detect malicious
URL. This network can handle large-scale imbalanced network data.

###  2.3 Electronic mail (Email)

A complete review for filtering of email spam was proposed in [24]. Machine
learning based techniques and trends for email spam filtering were also
discussed in this work. In [25], a machine learning based approach was
proposed to classify email space. This framework basically classifies an email
into spam and non-spam. This work also proposed a platform-independent
progressive web app (PWA). In [26], deep learning based frameworks were
proposed for email classification. This work proposed LSTMs and CNNs network
which outperformed baseline architectures. CNN performed better than LSTM and
achieved an F1 score of 84.0%. [27] proposed a multi-modal framework based on
model fusion (MMA-MF) to classify email. This model fuses CNN and LSTM model.
Image part of the email is processed by the CNN model whereas the text part of
the email is sent to the LSTM model separately. Accuracy with a range between
92.64% to 98.48% is achieved by this method.

##  3 Background

This section discusses the details behind the text representation, deep
learning architectures and the concept of cost-sensitive model.

###  3.1 Text representation

####  3.1.1 Keras Embedding:

Word embedding takes sequence and similarities into account to convert words
into dense vectors of real numbers. Keras provides an embedding layer with few
parameters such as dictionary size, embedding size, length of the input
sequence and so on. These parameters are hyperparameters and can have an
impact on the performance. The weights are taken randomly at first. These
weights are tuned during backpropagation with respect to other deep learning
layers. Generally, Keras embedding learns embedding of all the words or
characters in the training set but the input word or character should be
represented by a unique integer. Keras111https://keras.io/ is neural network
library available for the public which has different neural network building
blocks like RNN, CNN, etc and also other common layers like dropout, pooling,
etc.

####  3.1.2 N-gram:

From a given sequence of text, the continuous sequences of $N$ items are
called are N-gram. N-gram with $N=1$ is known as a unigram and it takes one
word/character at once. $N=2$ and $N=3$ are called bigram and trigram
respectively and will take two and three words/characters at a time. If $n$
words/characters are to be taken at once then $N$ will be equal to $n$.

###  3.2 Machine Learning

####  3.2.1 Naive Bayes:

is a simple but surprisingly powerful algorithm which is based on Bayes
theorem principle. Given the prior information of conditions that may be
related with the occasion, it finds the probability of occurrence of an event.

####  3.2.2 Decision Tree:

is another supervised machine learning algorithm. The decision tree is
constructed by continuously splitting the data-dependent on certain
parameters. Decision trees consist of leaves and nodes where leaves are the
results of each decision made and nodes are the decision processes. Iterative
Dichotomiser 3 (ID3) algorithm is the most commonly used algorithm to produce
these trees. Using Decision Trees both classification and regression are
possible for discrete and continuous data.

####  3.2.3 AdaBoost:

is an ensemble machine learning classifier like random forest which utilizes a
number of weak classifiers to make a strong classifier. Many machine learning
algorithms performance can be boosted using AdaBoost. Training set which is
used to iteratively retrain the algorithm is chosen based on the accuracy of
previous training. At every iteration, there is a weight given to every
trained classifier which is dependent on the accuracy achieved by the
classifier. The items that were not correctly classified are given higher
weights which makes them have a higher probability in next classifier.
Classifier which has an accuracy of 50 percent or more are given zero weight
whereas negative weights are given to classifier which has accuracy less the
50 percent. As the number of iterations is increased, the accuracy of the
classifier is improved.

####  3.2.4 Random Forest (RF):

At first, random forest delivers multiple decision trees. These different
decision trees are then merged to get the correct classification. The accuracy
of this algorithm is directly proportional to the number of decision trees.
Without hyperparameter tuning, random forest gives a very good performance. To
reduce overfitting, it utilizes the ensemble learning method while making the
decision trees. Different types of data such as binary, numerical or
categorical can be given as input to this algorithm.

####  3.2.5 Support Vector Machine (SVM):

is another supervised machine learning algorithm which creates a hyperplane to
split the data attributes between at least two classes. Every data attribute
is projected onto an n-dimensional space. The hyperplane is created in a way
such that the distance between the most nearby point of each class and the
hyperplane is maximized. Hard margin SVM and soft margin SVM are the two type
of SVM where hard margin SVM is the SVM which draws a hyperplane in linear
manner whereas soft margin SVM is the SVM which draws the hyperplane in non-
linear manner.

###  3.3 Deep Learning Architectures

####  3.3.1 Deep Neural Network (DNN):

is an advanced model of classical feed-forward network (FNN). As the name
indicates the DNN contains many hidden layers along with the input and output
layer. When the number of layer increases in FFN causes the vanishing and
exploding gradient issue. To handle these issues, the $ReLU$ non-linear
activation was introduced. $ReLU$ helps to protect weights from vanishing by
the gradient error. Compared to other non-linear functions, $ReLU$ is more
robust to the first-order derivative function since it does not become zero
for high positive as well as high negative values.

####  3.3.2 Convolutional Neural Network (CNN):

is the most commonly used deep learning architecture in computer vision
applications as it has the capability to extract spatial features. The three
layers in CNN are convolution layer, pooling layer, and fully connected layer.
Convolution layer contains filters that slide over the data to capture the
optimal features and these features collectively are termed as a feature map.
The dimension of the feature map is high and to reduce the dimension pooling
layer is used. Min, max or average are the three pooling operations. Finally,
the pooling features are passed into a fully connected layer for
classification. For binary classification, $sigmoid$ activation function is
used whereas for multiclass classification, $softmax$ activation function is
used.

####  3.3.3 Long short-term memory (LSTM):

is a special type of recurrent neural network. It takes care of the issue of
exploding and vanishing gradient. A cell of LSTM comprises of four major parts
namely, input, state cell, three gates and output. The concatenation of the
previous output and present input is the input of this LSTM cell. The focal
piece of the LSTM cell is called as a state cell which holds the information
about the previous sequences. The three gates in an LSTM cell are forget gate,
input gate, and output gate. Which information to be remembered or which
information to forget is decided by the forget gate. The information relevant
to the present input is taken to the cell state by the input gate. What
information should be passed as the output of the LSTM cell is decided by the
output gate. The output of the present cell gets concatenated with the input
of the next cell.

####  3.3.4 CNN - LSTM:

CNN - LSTM architecture was developed for spatial time series prediction
problems as LSTM alone cannot handle inputs with spatial structure like
images. It consists of CNN layers to exact the features of the input data and
LSTM for supporting sequence predictions. In the end, it is connected to a
fully connected layer to get the classified output.

###  3.4 Cost-sensitive Model

Models normally treat all samples equally which makes them sensitive to the
class imbalance problem. Class imbalance problem arises when there are classes
which have very small samples in comparison to other classes in the training
data. This problem can be handled using cost-sensitive models. The cost-
sensitive deep learning architectures consider all the samples equally. These
models give importance to the classes that have more number of samples during
training and limits the learning capability to the classes that have very less
number of samples. Cost-sensitive learning served as an important method in
real-world data mining applications and provides an approach to carefully
handle the class imbalance problem. Let’s assume that the samples have equal
cost at first. $C[i,i]$ indicates the misclassification cost of the class $i$,
which is generated using the class distribution as

$C[i,i]=\left(\frac{1}{n_{i}}\right)^{\gamma}$ (1)

Where $\gamma\in[0,1]$. 0 indicates that cost-sensitive deep learning
architectures are diminished to cost-insensitive and 1 indicates that $C[i,i]$
is inversely proportional to the class size $n_{j}$.

##  4 Description of the Data set

In this work, three different data sets were utilized for the three use cases.
For DGA, domain names have to be classified as legitimate or malicious. For
Email, classification result should be either legitimate or spam. For URL, URL
should be classified as legitimate or malicious. The data set is divided into
train data and test data. The train data set was used to train the models
whereas the test data set was used to test the trained models. The train and
test dataset of DGA composed of 38,276 legitimate, 53,052 malicious and 12,753
legitimate, 17,690 malicious domain name samples respectively. The legitimate
domain names are collected from Alexa222https://support.alexa.com/hc/en-
us/articles/200449834-Does-Alexa-have-a-list-of-its-top-ranked-websites and
OpenDNS333https://www.opendns.com/ and DGA generated domain names are
collected from OSINT Feeds444https://osint.bambenekconsulting.com/feeds/. The
train dataset is collected from November, 2017 to December 2017 and the test
dataset is collected from January 2018 to Feburary 2018. The train and test
dataset of email composed of 19,337 legitimate, 24,665 spam and 8,153
legitimate, 10,706 email samples respectively. The train and test dataset of
email are collected from Enron555https://www.cs.cmu.edu/ enron/ and
PU666http://www.aueb.gr/users/ion/data/PU123ACorpora.tar.gz. The train and
test dataset of URL composed of 23,374 legitimate, 11,116 malicious and 1,142
legitimate, 578 malicious samples respectively. The legitimate URLs are
collected from Alexa.com and DMOZ directory777https://dmoz-odp.org/ and
malicious URLs are collected from malwareurl.com, Phishtank.com,
OpenPhish.org, malwaredomainlist.com, and malwaredomains.com. The train
dataset is collected from March, 2018 to April 2018 and the test dataset is
collected from September, 2018 to October, 2018. All the datasets are unique
as well as the train and test datasets are disjoint to each other.

##  5 Proposed Architecture

The proposed architecture is shown in Figure 1. The diagram located in top
shows the training process involved in cost-insensitive deep learning model.
The other diagram shows the training process involved in the cost-sensitive
deep learning model. In the cost-sensitive deep learning model, we introduce
cost-weights to make the classifier to give importance to the classes which
have very less number of samples and give less importance to the classes which
have more number of samples. This enables to avoid imbalanced problems in
classification.

Figure 1: Cost-insensitive and cost-sensitive deep learning based
architectures.

##  6 Experiments, Results, and Observations

All the classical machine learning algorithms are implemented using Scikit-
learn888https://scikit-learn.org/ and the deep learning models are implemented
using TensorFlow999https://www.tensorflow.org/ with
Keras101010https://keras.io/ framework. All the models are trained on GPU
enabled TensorFlow. Various statistical measures are utilized in order to
evaluate the performance of the proposed classical machine learning and deep
learning models.

We have trained various classical machine learning and deep learning model
which can be cost-sensitive or cost-insensitive using the trained datasets.
The performance of the trained models is evaluated on test data.

Table 1: Results for DGA Analysis.

Model | Accuracy | Precision | Recall | F1-score | TN | FP | FN | TP
---|---|---|---|---|---|---|---|---
Naive Bayes | 68.1 | 99.3 | 45.5 | 64.4 | 12,700 | 53 | 9,653 | 8037
Decision Tree | 79.7 | 76.5 | 93.8 | 84.3 | 7,654 | 5,099 | 1091 | 16,599
AdaBoost | 82.8 | 79.2 | 95.6 | 86.6 | 8,300 | 4,453 | 770 | 16,920
RF | 84.1 | 80.5 | 95.8 | 87.5 | 8,651 | 4,102 | 736 | 16,954
SVM | 85.2 | 81.7 | 96.2 | 88.3 | 8,932 | 3,821 | 680 | 17,010
DNN | 86.8 | 83.7 | 96.1 | 89.5 | 9,434 | 3,319 | 688 | 17,002
CNN | 94.3 | 92.1 | 98.7 | 95.3 | 11,263 | 1,490 | 233 | 17,457
LSTM | 94.4 | 93.0 | 97.6 | 95.3 | 11,457 | 1,296 | 421 | 17,269
CNN-LSTM | 95.2 | 93.2 | 99.0 | 96.0 | 11,478 | 1,275 | 174 | 15,716
Cost-sensitive models
CNN | 95.4 | 93.2 | 99.5 | 96.2 | 11,464 | 1,289 | 97 | 17,593
LSTM | 95.5 | 93.2 | 99.6 | 96.3 | 11,470 | 1,283 | 74 | 17,616
CNN-LSTM | 95.6 | 93.2 | 99.7 | 96.3 | 11,467 | 1,286 | 59 | 17,631

Table 2: Results for Email Analysis.

Model | Accuracy | Precision | Recall | F1-score | TN | FP | FN | TP
---|---|---|---|---|---|---|---|---
Naive Bayes | 68.8 | 99.4 | 45.3 | 62.2 | 8,122 | 31 | 5,855 | 4,851
Decision Tree | 82.9 | 80.0 | 95.4 | 87.1 | 4,521 | 2,527 | 487 | 10,138
AdaBoost | 91.3 | 88.6 | 97.1 | 92.7 | 6,815 | 1,338 | 310 | 10,396
RF | 92.0 | 89.9 | 96.7 | 93.2 | 6,984 | 1,169 | 349 | 10,357
SVM | 92.3 | 92.3 | 94.4 | 93.3 | 7,304 | 849 | 599 | 10,107
DNN | 93.0 | 90.0 | 98.6 | 94.1 | 6,980 | 1,173 | 145 | 10,561
CNN | 93.6 | 92.6 | 96.4 | 94.5 | 7,326 | 827 | 382 | 10,324
LSTM | 93.7 | 91.9 | 97.5 | 94.6 | 7,239 | 914 | 270 | 10,436
CNN-LSTM | 94.0 | 92.2 | 97.6 | 94.8 | 7,270 | 883 | 253 | 10,453
Cost-sensitive models
CNN | 94.2 | 92.7 | 97.4 | 95.0 | 7,334 | 819 | 276 | 10,430
LSTM | 94.3 | 92.7 | 97.6 | 95.1 | 7,333 | 820 | 254 | 10,452
CNN-LSTM | 94.7 | 92.8 | 98.3 | 95.5 | 7,341 | 812 | 187 | 10,519

All the models are parameterized as optimal parameters play a significant role
in obtaining better performance. For machine learning algorithms, we have not
done any hyperparameter tuning. We have used the default parameters of Scikit-
learn. To convert text into numerical values, Keras embedding was used with an
embedding dimension of 128. Different architectures namely, DNN, CNN, LSTM,
and CNN-LSTM are used. For DNN, 4 hidden layers with units 512, 384, 256, 128
and a finally dense layer with 1 hidden unit. In between the hidden layer
dropout of 0.01 and batch normalization are used. Dropout was used to reduce
overfitting and batch normalization was used to increase the speed. In CNN, 64
filters with filter length 3 and followed by maxpooling with pooling length 2
are used. Followed by a dense layer with 128 hidden units and dropout of 0.3.
Finally a dense layer with one hidden unit. LSTM contains 128 memory blocks
followed by dropout of 0.3 and finally dense layer with one hidden unit. In
CNN-LSTM architecture, we connected CNN network with LSTM network. CNN has 64
filters with filter length 3, followed by a maxpooling layer having pooling
length 2. Followed by LSTM network having 50 memory blocks and finally a dense
layer with one hidden unit is added. All the experiments are run till 100
epochs with a learning rate of 0.01, and $adam$ optimizer.

Table 3: Results for URL Analysis.

Model | Accuracy | Precision | Recall | F1-score | TN | FP | FN | TP
---|---|---|---|---|---|---|---|---
Naive Bayes | 45.1 | 37.9 | 98.8 | 54.7 | 205 | 937 | 7 | 571
Decision Tree | 81.8 | 73.3 | 72.1 | 72.7 | 990 | 152 | 161 | 417
AdaBoost | 87.1 | 83.8 | 76.3 | 79.9 | 1,057 | 85 | 137 | 441
RF | 90.0 | 90.6 | 78.4 | 84.0 | 1,095 | 47 | 125 | 453
SVM | 81.0 | 88.4 | 50.0 | 63.9 | 1,104 | 38 | 289 | 289
DNN | 90.8 | 92.5 | 79.1 | 85.3 | 1,105 | 37 | 121 | 457
CNN | 92.9 | 91.9 | 86.5 | 89.1 | 1,098 | 44 | 78 | 500
LSTM | 93.4 | 97.2 | 82.7 | 89.3 | 1,128 | 14 | 100 | 478
CNN-LSTM | 94.4 | 96.5 | 86.5 | 91.2 | 1,124 | 18 | 78 | 500
Cost-sensitive models
CNN | 93.4 | 96.0 | 83.7 | 89.5 | 1,122 | 20 | 94 | 484
LSTM | 94.5 | 93.7 | 89.8 | 91.7 | 1,107 | 35 | 59 | 519
CNN-LSTM | 94.7 | 93.1 | 91.0 | 92.0 | 1,103 | 39 | 52 | 526

The detailed performance analysis of all the models are reported in Table 1
for DGA analysis, Table 2 for Email analysis, and Table 3 for URL analysis. As
shown in the tables, the performance of deep learning models is better than
the machine learning models. More importantly, the performance of cost-
sensitive deep learning models is better than the cost-insensitive models.
This is primarily because cost-sensitive models can give certain weights to
the classes which helps to reduced overfitting and underfitting during
training. We can see in all the three Tables that the cost-sensitive hybrid
network of CNN-LSTM performed better than the other network like CNN and LSTM.

##  7 Conclusion and Future Work

This paper proposes a generalized cost-sensitive deep learning model for Cyber
Security use cases such as DGA, Email, and URL. However, the model can be
applied on other Cyber Security use cases also. The cost-sensitive hybrid
model composed of CNN and LSTM can extract spatial and temporal features and
can obtain better perform on any type of data sets. Implementing this model in
real time data analysis with Big data and Streaming can be considered a good
direction for future work.

## Acknowledgements

This research was supported in part by Paramount Computer Systems and Lakhshya
Cyber Security Labs. We are grateful to NVIDIA India, for the GPU hardware
support to research grant. We are also grateful to Computational Engineering
and Networking (CEN) department for encouraging the research.

## References

  * [1] Mahdavifar, S., & Ghorbani, A. A. (2019). Application of deep learning to cybersecurity: A survey. Neurocomputing, 347, 149-176.
  * [2] Apruzzese, G., Colajanni, M., Ferretti, L., Guido, A., & Marchetti, M. (2018, May). On the effectiveness of machine and deep learning for cyber security. In 2018 10th International Conference on Cyber Conflict (CyCon) (pp. 371-390). IEEE.
  * [3] Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., Al-Nemrat, A., & Venkatraman, S. (2019). Deep Learning Approach for Intelligent Intrusion Detection System. IEEE Access, 7, 41525-41550.
  * [4] Vinayakumar, R., Soman, K. P., Poornachandran, P., & Menon, P. A deep-dive on Machine learning for Cybersecurity use cases. In Machine Learning for Computer and Cyber Security: Principle, Algorithms, and Practices. CRC Press.
  * [5] Vinayakumar, R., & Soman, K. P. (2018). DeepMalNet: evaluating shallow and deep networks for static PE malware detection. ICT express, 4(4), 255-258.
  * [6] Vinayakumar, R., Soman, K. P., & Poornachandran, P. (2019). A Comparative Analysis of Deep Learning Approaches for Network Intrusion Detection Systems (N-IDSs): Deep Learning for N-IDSs. International Journal of Digital Crime and Forensics (IJDCF), 11(3), 65-89.
  * [7] Berman, D. S., Buczak, A. L., Chavis, J. S., & Corbett, C. L. (2019). A survey of deep learning methods for cyber security. Information, 10(4), 122.
  * [8] Woodbridge, J., Anderson, H. S., Ahuja, A., & Grant, D. (2016). Predicting domain generation algorithms with long short-term memory networks. arXiv preprint arXiv:1611.00791.
  * [9] Tran, D., Mac, H., Tong, V., Tran, H. A., & Nguyen, L. G. (2018). A LSTM based framework for handling multiclass imbalance in DGA botnet detection. Neurocomputing, 275, 2401-2413.
  * [10] Yu, B., Gray, D. L., Pan, J., De Cock, M., & Nascimento, A. C. (2017, November). Inline DGA detection with deep networks. In 2017 IEEE International Conference on Data Mining Workshops (ICDMW) (pp. 683-692). IEEE.
  * [11] Vinayakumar, R., Soman, K. P., & Poornachandran, P. (2018). Detecting malicious domain names using deep learning approaches at scale. Journal of Intelligent & Fuzzy Systems, 34(3), 1355-1367.
  * [12] Vinayakumar, R., Poornachandran, P., & Soman, K. P. (2018). Scalable framework for cyber threat situational awareness based on domain name systems data analysis. In Big Data in Engineering Applications (pp. 113-142). Springer, Singapore.
  * [13] Vinayakumar, R., Soman, K. P., Poornachandran, P., & Sachin Kumar, S. (2018). Evaluating deep learning approaches to characterize and classify the DGAs at scale. Journal of Intelligent & Fuzzy Systems, 34(3), 1265-1276.
  * [14] Lison, P., & Mavroeidis, V. (2017). Automatic detection of malware-generated domains with recurrent neural models. arXiv preprint arXiv:1709.07102.
  * [15] Zhauniarovich, Y., Khalil, I., Yu, T., & Dacier, M. (2018). A survey on malicious domains detection through DNS data analysis. ACM Computing Surveys (CSUR), 51(4), 67.
  * [16] Sahoo, D., Liu, C., & Hoi, S. C. (2017). Malicious URL detection using machine learning: a survey. arXiv preprint arXiv:1701.07179.
  * [17] Le, H., Pham, Q., Sahoo, D., & Hoi, S. C. (2018). URLnet: Learning a URL representation with deep learning for malicious URL detection. arXiv preprint arXiv:1802.03162.
  * [18] Vinayakumar, R., Soman, K. P., & Poornachandran, P. (2018). Evaluating deep learning approaches to characterize and classify malicious URL’s. Journal of Intelligent & Fuzzy Systems, 34(3), 1333-1343.
  * [19] Vazhayil, A., Vinayakumar, R., & Soman, K. P. (2018, July). Comparative Study of the Detection of Malicious URLs Using Shallow and Deep Networks. In 2018 9th International Conference on Computing, Communication and Networking Technologies (ICCCNT) (pp. 1-6). IEEE.
  * [20] Abdi, F. D., & Wenjuan, L. MALICIOUS URL DETECTION USING CONVOLUTIONAL NEURAL NETWORK.
  * [21] Jiang, J., Chen, J., Choo, K. K. R., Liu, C., Liu, K., Yu, M., & Wang, Y. (2017, October). A deep learning based online malicious URL and DNS detection scheme. In International Conference on Security and Privacy in Communication Systems (pp. 438-448). Springer, Cham.
  * [22] Wanda, P., & Jie, H. J. URLDeep: Continuous Prediction of Malicious URL with Dynamic Deep Learning in Social Networks.
  * [23] Vu, L., Nguyen, P., & Turaga, D. (2016). Firstfilter: a cost-sensitive approach to malicious URL detection in large-scale enterprise networks. IBM Journal of Research and Development, 60(4), 4-1.
  * [24] Bhowmick, A., & Hazarika, S. M. (2016). Machine learning for e-mail spam filtering: review, techniques and trends. arXiv preprint arXiv:1606.01042.
  * [25] Alurkar, A. A., Ranade, S. B., Joshi, S. V., Ranade, S. S., Sonewar, P. A., Mahalle, P. N., & Deshpande, A. V. (2017, November). A proposed data science approach for email spam classification using machine learning techniques. In 2017 Internet of Things Business Models, Users, and Networks (pp. 1-5). IEEE.
  * [26] Eugene, L., & Caswell, I. (2017). Making a Manageable Email Experience with Deep Learning.
  * [27] Yang, H., Liu, Q., Zhou, S., & Luo, Y. (2019). A Spam Filtering Method Based on Multi-Modal Fusion. Applied Sciences, 9(6), 1152.