# An Empirical Proxy for the Second Integral of Motion
in Rotating Barred or Tri-axial Potentials

Yu-Jing Qin Steward Observatory, University of Arizona, 933 N Cherry Ave,
Tucson, AZ 85721, USA  Juntai Shen Juntai Shen<EMAIL_ADDRESS>Department
of Astronomy, School of Physics and Astronomy, Shanghai Jiao Tong University,
800 Dongchuan Road, Shanghai 200240, China  Key Laboratory for Particle
Astrophysics and Cosmology (MOE) / Shanghai Key Laboratory for Particle
Physics and Cosmology, Shanghai 200240, China  Shanghai Astronomical
Observatory, Chinese Academy of Sciences, 80 Nandan Road, Shanghai 200030,
China

###### Abstract

We identify an effective proxy for the analytically unknown second integral of
motion ($I_{2}$) for rotating barred or tri-axial potentials. Planar orbits of
a given energy follow a tight sequence in the space of the time-averaged
angular momentum and its amplitude of fluctuation. The sequence monotonically
traces the main orbital families in the Poincaré map, even in the presence of
resonant and chaotic orbits. This behavior allows us to define the “Calibrated
Angular Momentum,” the average angular momentum ($\overline{L_{z}}$)
normalized by the amplitude of its fluctuation (${\sigma_{L_{z}}}$), as a
numerical proxy for $I_{2}$. It also implies that the amplitude of fluctuation
in $L_{z}$, previously underappreciated, contains valuable information. This
new proxy allows one to classify orbital families easily and accurately, even
for real orbits in $N$-body simulations of barred galaxies. It is a good
diagnostic tool of dynamical systems, and may facilitate the construction of
equilibrium models.

Galaxy Dynamics, Orbits, Stellar Dynamics, Barred Spiral Galaxies

##  1 Introduction

An integral of motion (IoM) $I(\mathbf{x},\mathbf{v})$ is any time-independent
function of the phase-space coordinates that is strictly conserved along an
orbit. The isolating IoMs, unlike the non-isolating ones, are of great
importance as they reduce the dimensionality of the phase space non-trivially
and impose fundamental constraints on a dynamical system (Binney & Tremaine,
2008).

Isolating IoMs can be categorized into classical IoMs and nonclassical IoMs.
Classical IoMs have known analytical expressions, while nonclassical IoMs do
not. Examples of classical IoMs include the Hamiltonian in any time-
independent potential, all components of the angular momentum vector in
spherical potentials, and the axial component of angular momentum ($L_{z}$)
for axisymmetric potentials. They reflect the symmetries and conservation laws
of the system via Noether’s theorem. Higher degree of symmetry in Keplerian
and harmonic potentials allows even more isolating IoMs. For separable
potentials in a certain coordinate system, the equation of motion can be
decomposed to decoupled motions in each direction, and the classical IoMs may
be obtained (e.g., Stäckel potentials).

nonclassical IoMs, on the contrary, do not have known analytic expressions of
phase-space coordinates $\mathbf{x}$ and $\mathbf{v}$. Their existence is
inferred by the fact that a numerically-integrated orbit at a given energy is
confined to a closed invariant curve (e.g. Henon & Heiles, 1964) in the
Poincaré map, also known as the “surfaces of section” (SoS). Realistic
potentials often contain such nonclassical integrals, which are usually dubbed
as the second ($I_{2}$) or the third integral ($I_{3}$), since they are in
addition to the classical integrals like $H$ and/or $L_{z}$. In a Hamiltonian
system with $n$ degrees of freedom, regular orbits which admit $n$ isolating
IoMs appear as closed 111However, invariant curves may become non-closed,
splitting into two disconnected line segments, under certain conditions in a
rotating frame (Binney et al., 1985; Xia & Shen, 2021). Thus the defining
characteristic of regular orbits is quasi-periodicity. invariant curves in the
Poincaré map, as they are confined to $n$-D toroidal surfaces (“orbital
tori”). Conversely, chaotic orbits have fewer than $n$ isolating IoMs, so they
are diffusive in the Poincaré map. The non-reducible frequency components of
an orbit also indicate the number of isolating IoMs, where each fundamental
frequency corresponds to an action variable ($J$) in action-angle coordinates
(Binney & Spergel, 1982, 1984; Laskar, 1993; Valluri & Merritt, 1998).

For a steady-state system, the distribution function can be parameterized
using only the isolating IoMs (Lynden-Bell, 1962). Given their elegant
properties and fundamental roles in classical mechanics, IoMs are extensively
used as diagnostic tools for dynamical systems.

Here we focus on the nonclassical IoMs in rotating barred potentials which are
common and useful in astronomy. Nearly two-thirds of disk galaxies in the
Universe contain a central elongated bar structure (e.g. Menéndez-Delmestre et
al., 2007; Masters et al., 2011), including our own Milky Way (e.g. Blitz &
Spergel, 1991; Binney et al., 1991). Bars are not static structures: in a disk
galaxy they rotate rapidly. Tri-axial elliptical galaxies may also have some
figure rotation similar to barred galaxies. The orbital structure in a
rotating barred potential has been extensively studied (Contopoulos & Grosbol,
1989; Sellwood & Wilkinson, 1993; Patsis et al., 2002; Skokos et al., 2002;
Binney & Tremaine, 2008); the common regular orbital families include prograde
$x_{1}$ orbits, retrograde $x_{4}$ orbits, and $x_{2}$/$x_{3}$ orbits if an
Inner Lindblad Resonance (ILR) exists.

In a rotating non-axisymmetric potential, the only classical IoM is the Jacobi
integral ($H_{\mathrm{J}}=H-\mathbf{\Omega}\cdot\mathbf{L}$), which is the
Hamiltonian in the rotating frame. Note that the angular momentum is not an
IoM in either the inertial or bar-corotating frame. The Poincaré map for 2D
planar orbits in a rotating barred potential shows clear nested invariant
curves, implying that at least some orbits are confined to orbital tori by an
additional IoM ($I_{2}$) besides $H_{\mathrm{J}}$.

Our main motivation is to identify an empirical proxy for the analytically-
unknown $I_{2}$ in a rotating barred potential, which can immediately
facilitate the classification of orbits of a given energy. Angular momentum is
time-varying in a rotating barred potential, but interestingly we can indeed
find such a proxy in the angular momentum space. The amplitude of fluctuation
in $L_{z}$ may also contain valuable information on orbits but was not given
enough attention in the past. With simple 2D orbits of test particles, we
demonstrate that the “Calibrated Angular Momentum”, the average angular
momentum ($\overline{L_{z}}$) normalized by the amplitude of its fluctuation
(${\sigma_{L_{z}}}$), is an excellent numerical proxy for $I_{2}$.

##  2 Potential and Orbital Integration

Without loss of generality, we adopt a rotating logarithmic bar potential of
the following form (Equation 3.103 in Binney & Tremaine, 2008):

$\Phi_{\mathrm{L}}(x,y)=\frac{1}{2}v_{0}^{2}\ln\left(R_{\mathrm{c}}^{2}+x^{2}+\frac{y^{2}}{q^{2}}\right)\quad(0<q\leq
1).$ (1)

$\Phi_{\mathrm{L}}$ is stationary in a frame that rotates at angular speed
$\Omega_{\mathrm{b}}$.

At $R=\sqrt{(x^{2}+y^{2}/q^{2})}\ll R_{\mathrm{c}}$, $\Phi_{\mathrm{L}}$
approximates the potential of the two-dimensional harmonic oscillator. At
$R\gg R_{\mathrm{c}}$ and $q\simeq 1$, $\Phi_{\mathrm{L}}\simeq v_{0}^{2}\ln
R$, which yields a nearly constant circular speed curve as observed in many
disk galaxies.

The equipotentials of $\Phi_{\mathrm{L}}$ have constant axial ratio $q$. The
axial ratio $q_{\rho}\equiv b/a$ of the isodensity surfaces at large radius is
(Equation 2.72b in Binney & Tremaine, 2008):

$q_{\rho}^{2}\simeq q^{4}\left(2-\frac{1}{q^{2}}\right)\quad\left(R\gg
R_{\mathrm{c}}\right).$ (2)

In our standard model, we adopt $R_{\mathrm{c}}=0.1$, $q=0.84$ (i.e.,
$q_{\rho}\simeq 0.54$ according to Equation 2), $v_{0}=1$, and
$\Omega_{\mathrm{b}}=1$. The units of length, velocity, and acceleration are
arbitrary. These parameters place the bar Corotation Radius (CR) at
$R_{\mathrm{CR}}=0.995$ (also the position for the $\mathrm{L}_{1}$ and
$\mathrm{L}_{2}$ Lagrangian points). The Jacobi energy at $R_{\mathrm{CR}}$ is
$E_{\mathrm{J,CR}}=-0.495$.

We also tested other analytical and self-consistent $N$-body bar potentials
and verified that our main conclusions remain unchanged.

For clarity and cleanness, in this paper we focus mainly on 2D planar orbits
of test particles which are numerically integrated. The initial conditions of
our test particles are randomly generated inside the equipotential surface to
sample all possible orbital families, and the timestep is adaptively adjusted
so that each orbit is integrated for about 800 azimuthal periods and each
period is sampled by at least 512 points using a 4th-order Runge-Kutta
integrator. The conservation of Jacobi energy ${E_{\mathrm{J}}}$ is generally
better than $4\times 10^{-10}$ for 800 periods.

Figure 1:  Left: (a). Poincaré SoS at ${E_{\mathrm{J}}}=-1.08$ with the
outmost dashed curve as the zero-velocity curve, i.e., the boundary of the
energetically allowed region. Each closed curve corresponds to an orbit.
Right: (b). The morphology transformation of the corresponding orbits in (a).
The first $x_{4}$ orbit corresponds to the center of left island in (a), then
the orbits gradually transition to the last $x_{1}$ orbit corresponding to the
center of right island in (a). The invariant curves in (a) are also color-
coded with the CAM $\equiv\overline{L_{z}}/{\sigma_{L_{z}}}=-\cot\phi$ of the
orbits. There is a continuous and smooth morphological transition from the
periodic $x_{4}$ orbit to the periodic $x_{1}$ orbit, following the monotonic
increase in CAM (or $\phi$).

##  3 Results

Figure 1a shows the Poincaré SoS at ${E_{\mathrm{J}}}=-1.08$ for our rotating
barred potential. Each curve corresponds to an orbit with this
${E_{\mathrm{J}}}$, and is the record of ($y$, $v_{y}$) whenever the orbit
crosses the bar minor axis ($y$-axis) with $v_{x}<0$ (to eliminate the sign
ambiguity). Figure 1a shows two predominant regular orbital families within
$R_{\mathrm{CR}}$, namely the retrograde $x_{4}$ family (the left island of
nested curves) and the prograde $x_{1}$ family (the right island). The center
points of the two islands are the periodic $x_{4}$ and $x_{1}$ orbits,
respectively. As discussed in the §1, the fact that an orbit at a given energy
is confined to a closed “invariant curve” indicates that this “regular” orbit
admits an additional nonclassical IoM ($I_{2}$) at the given
${E_{\mathrm{J}}}$. Thus, one may regard the invariant curves of regular
orbits in the SoS as a contour plot of $I_{2}$, where $I_{2}$ changes
monotonically as regular orbits transition from one family to another.

Figure 1b shows the morphological transformation of the corresponding orbits
in (a). The first orbit is a nearly periodic $x_{4}$ orbit corresponding to
the center of the left island in Figure 1a. As we move away from the periodic
$x_{4}$ orbit, the enclosed area in the $x_{4}$ island in the SoS expands, the
amplitude of radial oscillations increases, and orbits become thicker
rosettes. When we leave the outskirt of $x_{4}$ island and move into the
$x_{1}$ orbital family, orbits become more “box-shaped”. Further along the
sequence, orbits become more elongated in the direction of the bar major axis,
their enclosed area in SoS gradually shrinks to zero when reaching the
periodic $x_{1}$ orbit, which is the last orbit in Figure 1b corresponding to
the center of the right island in Figure 1a. There is a continuous transition
of orbital morphology, covering the entire phase space at the given
${E_{\mathrm{J}}}$, from $x_{4}$ to $x_{1}$ families which is accompanied by a
monotonic change in $I_{2}$ respected by each regular orbit.

Searching for a proxy of $I_{2}$, we study orbits in the space of angular
momentum ($L_{z}$) computed in the co-rotating reference frame of the bar. As
expected, $L_{z}$ is not a conserved quantity and is time-varying. Averaged
over time, we can compute the mean angular momentum ($\overline{L_{z}}$) and
the standard deviation (${\sigma_{L_{z}}}$) of an orbit, where

${\sigma_{L_{z}}}\equiv\sqrt{\overline{[L_{z}(t)-\overline{L_{z}}]^{2}}}$

reflects the amplitude of fluctuation over the duration of orbital
integration. We have tested that halving or doubling the total time duration
of orbital integration changes the values of $\overline{L_{z}}$ and
${\sigma_{L_{z}}}$ by only $\lesssim 1\%$ for regular orbits, but they do
change by a larger fraction for chaotic orbits (see discussions regarding
Figure 4).

Figure 2: Orbital distribution in the angular momentum space
($\overline{L_{z}}$, ${\sigma_{L_{z}}}$) for our rotating barred potential.
Colors indicate their energies (${E_{\mathrm{J}}}$). Note that the green curve
(${E_{\mathrm{J}}}=-1.08$) corresponds to the orbits shown in Figure 1. An
orbital sequence at a given ${E_{\mathrm{J}}}$ always starts from the periodic
$x_{4}$ (the leftmost point), and ends at the periodic $x_{1}$ (the rightmost
point).

Mapped into the angular momentum space of ($\overline{L_{z}}$,
${\sigma_{L_{z}}}$), the orbits with a given ${E_{\mathrm{J}}}$ follow a
compact and nearly continuous sequence, and sequences of different energies
are clearly separated in a nested layout (Figure 2). Even more strikingly, the
sequence in Figure 2 directly and monotonically traces the nested invariant
curves in the SoS and the continuous morphological transformation from $x_{4}$
to $x_{1}$ orbits. Each sequence in the angular momentum space starts with a
periodic $x_{4}$ orbit at the leftmost end and terminates at a periodic
$x_{1}$ orbit at the rightmost end. Regular orbits connecting the periodic
$x_{4}$ and the periodic $x_{1}$ in the SoS as illustrated in Figure 1 also
keep their order in the angular momentum sequence. Such a monotonic mapping
from the angular momentum sequence to invariant curves in the SoS indicates
that these sequences do trace the monotonic change in $I_{2}$, hence it can
serve as a proxy of $I_{2}$. The nested compact sequences also imply that both
$\overline{L_{z}}$ and ${\sigma_{L_{z}}}$ are nearly continuous functions of
${E_{\mathrm{J}}}$ and $I_{2}$.

We note that the location in a sequence in Figure 2, which follows $I_{2}$,
can actually be uniquely and monotonically represented by the angle $\phi$
labeled in Figure 2. $\phi$ is equivalent to the Calibrated Angular Momentum
(CAM)

$\mathrm{CAM}\equiv\overline{L_{z}}/{\sigma_{L_{z}}}$

since $\cot\phi=-\overline{L_{z}}/{\sigma_{L_{z}}}$. The invariant curves in
the SoS (Figure 1a) are also color-coded with CAM. The smooth color variation
from $x_{4}$ to $x_{1}$ families in the SoS again confirms that CAM indeed
monotonically traces $I_{2}$ for regular orbits. Previous works used the
average angular momentum to approximate $I_{2}$ in the vicinity of parent
$x_{1}$/$x_{4}$ orbits (Binney & Tremaine, 2008; Valluri et al., 2016).
However, the monotonicity of $\overline{L_{z}}$ is not ensured;
$\overline{L_{z}}$ increases in the $x_{4}$ branch, but may decrease slightly
in the $x_{1}$ branch. We have verified that the non-monotonicity of
$\overline{L_{z}}$ is more pronounced in bars formed self-consistently from
disk instabilities, such as the $N$-body bar model in Shen et al. (2010).
Intriguingly, $\overline{L_{z}}$, after being normalized with
${\sigma_{L_{z}}}$, then becomes a monotonic and unique tracer of the entire
phase space at a given ${E_{\mathrm{J}}}$, smoothly connecting the $x_{1}$ and
$x_{4}$ families into a single sequence.

Figure 3:  Zoom-in view of “knots” in the CAM sequence in Figure 2. The “knot”
is produced by a 3:4 (azimuthal:radial) resonance (top middle inset). The weak
chaos surrounding this resonance creates a discontinuity in the smooth
distribution of $\overline{L_{z}}/{\sigma_{L_{z}}}$ across a wide range of
energies (black points are for ${E_{\mathrm{J}}}=-0.652$). The top left and
top right insets show a smooth transition of orbital morphology near this
resonance.

Figure 2 also shows that the sequences in the angular momentum space have tiny
breaks and “knots” for sufficiently high ${E_{\mathrm{J}}}$. Figure 3 zooms in
on one such break and “knot” region with much longer orbital integration
(around 6400 periods), and reveals that these features are associated with a
high-order resonance. It is well-known that stable high-order resonances can
alter their local phase space structure and induce chaos around them. Orbital
morphology in the insets of Figure 3 clearly shows that the “knot” is actually
a line segment due to a 3:4 (azimuthal:radial) resonance (lower inset of
Figure 3), and the break around the “knot” may be related to the weakly
chaotic orbits surrounding the resonance. The top tip of the line segment is a
periodic 3:4 resonant orbit. Breaks and “knots” of a certain resonance are
clearly aligned across different energies, carving out a valley across
multiple sequences. Although high-order resonances and weak chaos appear as
small localized breaks in the CAM sequence, they do not affect its global
trend. In other words, the continuous sequence in the angular momentum space,
also in CAM as the numeric proxy for $I_{2}$, is insensitive to local,
microscopic phase space structures like high-order resonances.

The phase space structure illustrated in Figure 1 is almost completely
dominated by regular orbits of $x_{1}$ and $x_{4}$ families, but a rotating
barred potential may also have other major resonant families like
$x_{2}$/$x_{3}$ and strong chaos around them. Thus, one may wonder if the CAM
parameter is still an effective proxy of $I_{2}$ for regular orbits in the
presence of strong chaos.

To study the phase space and the angular momentum space when $x_{2}$/$x_{3}$
families and strong chaos are present we reduce the pattern speed to
$\Omega_{\mathrm{b}}=0.4$. Chaotic orbits have only one IoM and are not
confined to orbital tori; they eventually fill the phase-space volume bounded
by the nearby regular orbits of the same energy. Thus chaotic orbits will
drift in the angular momentum space; their $\overline{L_{z}}$ and
${\sigma_{L_{z}}}$ could change significantly after a long period of time. We
may trace chaotic orbits using their drift in the angular momentum space. We
cut the orbit into two equal halves and estimate their
$(\overline{L_{z}},{\sigma_{L_{z}}})$ separately. The differences between the
two halves ($\Delta\overline{L_{z}}$ and $\Delta{\sigma_{L_{z}}}$) may be used
to define the “normalized drift”:

$\delta
l=\sqrt{(\Delta\overline{L_{z}})^{2}+(\Delta{\sigma_{L_{z}}})^{2}}/\sqrt{\overline{L_{z}}^{2}+{\sigma_{L_{z}}}^{2}}.$

The distribution of $\delta l$ has a sharp break around 0.0224. Thus, we
consider those orbits with $\delta l>0.0224$ as possible chaotic orbits
(painted grey in Figure 4). Note that $\delta l$ is also reflected in the
narrowness of the angular momentum sequence and the chaotic zone.

Figure 4 shows the $\overline{L_{z}}$–${\sigma_{L_{z}}}$ distribution of the
orbits in the model with $\Omega_{\mathrm{b}}=0.4$. Short branches of the
$x_{2}$ orbital family are clearly visible in the lower right corner of Figure
4. Similar to the sequences of $x_{1}$ and $x_{4}$ families, periodic $x_{2}$
orbits are at the rightmost ends of these $x_{2}$ branches, and an $x_{2}$
orbit moves leftward along the sequence as it gradually deviates from the
parent periodic $x_{2}$ orbit. The presence of an $x_{2}$ branch also induces
a chaotic zone in the angular momentum space. Compared to the canonical case
in Figure 2, the region near the maximum of ${\sigma_{L_{z}}}$ on each
sequence becomes diffuse, twisted, and dominated by strongly chaotic orbits.

Figure 4: Phase space structure for the model with $x_{2}$ orbits for
${E_{\mathrm{J}}}=$-0.57, -0.68, and -0.80 (blue, green, red, respectively).
Note that the potential’s long axis is horizontal. Compared to the canonical
case shown in Figure 2, there is a strong, prograde (positive
$\overline{L_{z}}$) $x_{2}$ sub-sequence. There is no sub-sequence for $x_{3}$
orbital family since it is unstable. Between the sequences of $x_{1}$ and
$x_{4}$ orbits, there is a diffuse zone of strongly chaotic orbits (grey
colored for those with $\delta l>0.0224$). The orbits are integrated for 3200
azimuthal periods. Typical orbits from each regular orbital family and the
chaotic zone are illustrated in insets.

The presence of the $x_{2}$ branch has complicated the phase space structure.
Unlike high-order resonances which only alter the local, microscopic phase
space structure, the presence of a strong resonance like $x_{2}$ can
significantly reshape the phase space. Although parts of the
$x_{1}$–$x_{4}$–$x_{2}$ sequence are interrupted by the presence of strong
chaos, $\overline{L_{z}}/{\sigma_{L_{z}}}$ remains valid in tracing the local
phase space structure of all stable islands of the $x_{1}$, $x_{4}$, and
$x_{2}$ families. Since the angular momentum space is presumably a projection
of the ${E_{\mathrm{J}}}$–$I_{2}$ space, it is not surprising that chaotic
orbits, which do not respect $I_{2}$, are “detached” from the sequences of
regular orbits. Instead, they become “clouds” of scattered points in the
angular momentum space (grey points in Figure 4). Weakly chaotic orbits
diffuse slower, thus they may still remain close to the angular momentum
sequence. Surprisingly and fortunately, even chaotic orbits roughly follow the
CAM sequence and do not affect much its monotonicity, except for the strongly
chaotic zone at the upper tip of the $x_{1}$ branch, where the monotonicity
fails locally.

##  4 Discussions

###  4.1 Asymptotic behaviors in limiting cases

CAM remains a well-behaved proxy of $I_{2}$ in most limiting cases as we
discuss below. A non-rotating bar, like stationary triaxial potentials, is
dominated by box orbits and loop orbits (Binney & Tremaine, 2008). Box orbits
(like Lissajous figures) have zero net angular momentum while loop orbits have
non-zero net angular momentum. As $\Omega_{\mathrm{b}}$ gradually approaches
zero, $x_{4}$/$x_{2}$ orbits in rotating barred potentials become
retrograde/prograde loop orbits, and $x_{1}$ orbits become box orbits with
$\overline{L_{z}}=0$ (Valluri et al., 2016). For the loop orbits,
$|\overline{L_{z}}|$ and ${\sigma_{L_{z}}}$ form an anti-correlated sequence
at a given energy (due to the trade-off between rotation and random motions),
thus $\overline{L_{z}}$ is the most obvious proxy of $I_{2}$. However, CAM, in
addition to $\overline{L_{z}}$, still remains a good proxy of $I_{2}$. Also,
the interconnection of boxy/loop orbits to $x_{1}$/$x_{4}$/$x_{2}$ orbits
again reveals the continuity of orbital families in the phase space (Binney &
Spergel, 1984).

As $q$ in Equation 1 approaches unity, we get an axisymmetric disk which
supports only loop orbits with the canonical momentum $p_{\phi}=L_{z}$ being
an exact integral of motion and ${\sigma_{L_{z}}}=0$. When the axisymmetric
disk is viewed in a rotating frame with angular speed $\Omega_{\mathrm{b}}$,
the angular momentum in the corotating frame,
$L_{z}=p_{\phi}-\Omega_{\mathrm{b}}R^{2}$, is no longer an integral. The CAM
sequence of loop orbits (corresponding to $x_{4}$ and $x_{1}$ in a rotating
barred potential) becomes a distorted arch in angular momentum space; the
prograde side of the arch is distorted towards $\overline{L_{z}}=0$ and vice
versa for the retrograde side. This is similar to the case in Figure 2, where
the $x_{1}$ branch is closer to $\overline{L_{z}}=0$ than the $x_{4}$ branch.
Again, CAM, in addition to $\overline{L_{z}}$, is still a good proxy of
$I_{2}$ in the axisymmetric case despite the fact that $L_{z}$ (unlike
$p_{\phi}$) is not an integral.

###  4.2 Advantages and Potential Applications.

CAM is a good proxy of $I_{2}$ even in the presence of high-order resonances
and chaotic orbits. CAM fixes the issue of non-monotonicity of
$\overline{L_{z}}$ in tracing the orbital families by taking into account the
amplitude of fluctuation in the time-varying $L_{z}$ (${\sigma_{L_{z}}}$),
which contains valuable information but was previously underappreciated. CAM
is also independent of the Hamiltonian of the system (${E_{\mathrm{J}}}$), and
can serve as a good diagnostic of dynamical systems.

We have verified that it is well-behaved in generic rotating bar or tri-axial
potentials, including a self-consistent $N$-body bar model designed to match
the Milky Way boxy bar/bulge (Shen et al., 2010). It may be generalized to
other Hamiltonian systems – any Hamiltonian that has position-like and
momentum-like variables, from which we could construct angular-momentum-like
variables.

There are many potential applications of the empirical proxy. An immediate
application of CAM is accurate and quick orbital classification in a barred
potential without knowing the detailed properties of the orbital families.
This is particularly useful for 3D orbits whose phase space cannot be easily
visualized. The CAM orbital classification method is complementary to
frequency-based classification methods (Binney & Spergel, 1982; Valluri &
Merritt, 1998). Note that neither irreducible frequency components nor
frequency ratios are proper substitutions of IoMs. As a proxy for $I_{2}$, CAM
is more directly related to the fundamentals of orbits. There are less
degeneracies associated with CAM ($I_{2}$) than frequency-based methods since
orbits with the same frequency ratio can be distinguished by their intrinsic
differences in ${E_{\mathrm{J}}}$ and $I_{2}$. For example, one can easily
distinguish $x_{1}$ and $x_{2}$ orbits with CAM whereas additional constraints
are required to separate them in frequency-based methods (e.g. Valluri &
Merritt 1998; Valluri et al. 2016). The computation of CAM is also
computationally less expensive than the Numerical Analysis of Fundamental
Frequencies (NAFF) method (Laskar, 1993). We have successfully applied it to
classify real orbits in $N$-body simulations of barred galaxies, and the
results will be presented in a follow-up paper.

###  4.3 Limitations

CAM is only an empirical proxy of the analytically-unknown $I_{2}$. Numerical
integration over a sufficient number of periods with a priori knowledge of the
potential is required to accurately compute CAM. In contrast, a genuine IoM is
only a function of phase-space coordinates at any moment. It is also important
to keep in mind that CAM may not be the only proxy of $I_{2}$ for a given
barred potential. Several other methods have been developed to estimate or
approximate IoMs, particularly action variables, for numerically-integrated
orbits in generic triaxial or axisymmetric potentials (Sanders & Binney, 2014,
2016).

##  5 Summary

We discover a good proxy for the second integral of motion $I_{2}$ in rotating
barred or tri-axial models, namely CAM
$\equiv\overline{L_{z}}/{\sigma_{L_{z}}}$, which monotonically traces various
orbital families at a given energy in a rotating barred potential even in the
presence of resonant and chaotic orbits. This empirical proxy of $I_{2}$ may
be used to parameterize pseudo distribution functions (DFs) in the
construction of dynamical models, such as Schwarzschild (Schwarzschild, 1979)
or made-to-measure models (Syer & Tremaine, 1996), for real-world observations
of rotating barred or triaxial galaxies. However, we need a priori information
about the potential to carry out the calculation. Also, CAM-based pseudo DFs
do not measure the true phase space density, as CAM is only a dimensionless
numerical proxy.

Despite its effectiveness, we still do not fully understand why CAM is such a
good proxy of $I_{2}$. Further study is needed to better understand this
relationship. Investigation in the framework of Hamiltonian perturbation
theory, and focus on more complicated orbital cases (e.g. real 3D orbits in an
$N$-body simulation), could be illuminating.

We thank Scott Tremaine, Jerry Sellwood, and anonymous referee for helpful
comments. The research presented here is partially supported by the National
Key R&D Program of China under grant No. 2018YFA0404501; by the National
Natural Science Foundation of China under grant Nos. 12025302, 11773052,
11761131016; by the “111” Project of the Ministry of Education of China under
grant No. B20019; and by the Chinese Space Station Telescope project. J.S.
acknowledges support from a Newton Advanced Fellowship awarded by the Royal
Society and the Newton Fund. This work made use of the Gravity Supercomputer
at the Department of Astronomy, Shanghai Jiao Tong University, and the
facilities of the Center for High Performance Computing at Shanghai
Astronomical Observatory.

## References

  * Binney et al. (1985) Binney, J., Gerhard, O. E., & Hut, P. 1985, MNRAS, 215, 59, doi: 10.1093/mnras/215.1.59
  * Binney et al. (1991) Binney, J., Gerhard, O. E., Stark, A. A., Bally, J., & Uchida, K. I. 1991, MNRAS, 252, 210
  * Binney & Spergel (1982) Binney, J., & Spergel, D. 1982, The Astrophysical Journal, 252, 308, doi: 10.1086/159559
  * Binney & Spergel (1984) —. 1984, Monthly Notices of the Royal Astronomical Society, 206, 159, doi: 10.1093/mnras/206.1.159
  * Binney & Tremaine (2008) Binney, J., & Tremaine, S. 2008, Galactic Dynamics: Second Edition
  * Blitz & Spergel (1991) Blitz, L., & Spergel, D. N. 1991, The Astrophysical Journal, 379, 631, doi: 10.1086/170535
  * Contopoulos & Grosbol (1989) Contopoulos, G., & Grosbol, P. 1989, Astronomy and Astrophysics Reviews, 1, 261, doi: 10.1007/BF00873080
  * Henon & Heiles (1964) Henon, M., & Heiles, C. 1964, AJ, 69, 73, doi: 10.1086/109234
  * Laskar (1993) Laskar, J. 1993, Celestial Mechanics and Dynamical Astronomy, 56, 191, doi: 10.1007/BF00699731
  * Lynden-Bell (1962) Lynden-Bell, D. 1962, Monthly Notices of the Royal Astronomical Society, 124, 1, doi: 10.1093/mnras/124.1.1
  * Masters et al. (2011) Masters, K. L., Nichol, R. C., Hoyle, B., et al. 2011, Monthly Notices of the Royal Astronomical Society, 411, 2026, doi: 10.1111/j.1365-2966.2010.17834.x
  * Menéndez-Delmestre et al. (2007) Menéndez-Delmestre, K., Sheth, K., Schinnerer, E., Jarrett, T. H., & Scoville, N. Z. 2007, The Astrophysical Journal, 657, 790, doi: 10.1086/511025
  * Patsis et al. (2002) Patsis, P. A., Skokos, C., & Athanassoula, E. 2002, Monthly Notices of the Royal Astronomical Society, 337, 578, doi: 10.1046/j.1365-8711.2002.05943.x
  * Sanders & Binney (2014) Sanders, J. L., & Binney, J. 2014, MNRAS, 441, 3284, doi: 10.1093/mnras/stu796
  * Sanders & Binney (2016) —. 2016, MNRAS, 457, 2107, doi: 10.1093/mnras/stw106
  * Schwarzschild (1979) Schwarzschild, M. 1979, ApJ, 232, 236, doi: 10.1086/157282
  * Sellwood & Wilkinson (1993) Sellwood, J. A., & Wilkinson, A. 1993, Reports on Progress in Physics, 56, 173, doi: 10.1088/0034-4885/56/2/001
  * Shen et al. (2010) Shen, J., Rich, R. M., Kormendy, J., et al. 2010, The Astrophysical Journal Letters, 720, L72, doi: 10.1088/2041-8205/720/1/L72
  * Skokos et al. (2002) Skokos, C., Patsis, P. A., & Athanassoula, E. 2002, MNRAS, 333, 847, doi: 10.1046/j.1365-8711.2002.05468.x
  * Syer & Tremaine (1996) Syer, D., & Tremaine, S. 1996, Monthly Notices of the Royal Astronomical Society, 282, 223, doi: 10.1093/mnras/282.1.223
  * Valluri & Merritt (1998) Valluri, M., & Merritt, D. 1998, ApJ, 506, 686, doi: 10.1086/306269
  * Valluri et al. (2016) Valluri, M., Shen, J., Abbott, C., & Debattista, V. P. 2016, The Astrophysical Journal, 818, 141, doi: 10.3847/0004-637X/818/2/141
  * Xia & Shen (2021) Xia, T. Y., & Shen, J. 2021, ApJ, submitted


# When deep learning meets security

Majd Latah
Department of Computer Science
Ozyegin University
<EMAIL_ADDRESS>Corresponding Author

## I. Introduction

Machine learning techniques have proven to be very useful in networking [1] in
general and security related topics in particular [2,3,4]. Deep learning
[5-7], on the other hand, has improved the state-of-the-art for many machine
learning tasks such as speech recognition, objection detection and natural
language understanding. The main advantage is that this approach allows
learning very complex functions by a general-purpose learning approach [5]. It
is worth noting that we exclude deep intrusion detection systems from this
study due to the fact that many other researchers have already conducted a
similar survey to cover that particular subject [8,9].

## II. Deep learning in security

### i. Malware Detection

Tobiyama et al. [10] proposed malware process detection based on process
behavior. The authors used long short term memory (LSTM) for feature
extraction and convolutional neural network (CNN) for classification. A
process behavior is a sequence of API calls. The features were extracted from
the process behavior log files which were transferred to an image that
contains local features. Theses local features mostly represents the process
activities. Therefore, one can apply CNN in order to capture these local
features and correctly classify these images. An overview of the proposed
method in [10] is shown in Figure 1. In the experimental study the authors
used 81 malware process log files and 69 benign process log files for the
training and validation stages. The authors executed the malware files in the
Cuckoo Sandbox and traced the process behavior in order to determine the
produced and injected processes. The authors also validated the classifier
with 5-fold cross validation. The best result (AUC= 0.96) achieved when the
feature image size was 30x30.

Figure 1: Overview of the proposed deep learning approach in [10]

Rhode et al. [11] investigated the possibility of prediction whether an
executable is malicious or not based on behavioural data. The study showed
that the model achieved high level of accuracy (94%) based only on the first 5
seconds of the file execution using 3000 ransomware samples without prior
exposure to these samples. In addition, the model achieved an accuracy of 96%
in less than 10 seconds. The selected features were 10 continuous machine
activity data metrics instead of using categorical API calls. Due to the fact
that API calls can be manipulated which may lead to incorrect classification
for the input samples. In addition, continous data allows a large number of
states to be represented in a small vector. As shown in Figure 2, Cuckoo
Sandbox was used in order to collect activity data of Portable Executable (PE)
samples. The collected features are: system CPU usage, user CPU use, packets
sent, packets received, bytes sent, bytes received, memory use, swap use, the
total number of processes currently running and the maximum process ID
assigned. The authors used gated recurrent unit (GRU) in stead of LSTM cells
due to their training speed. The authors stated that the model should be re-
trained regularly with newly discovered samples, which may lead to adjustments
in the proposed architecture too.

Figure 2: Overview of the proposed deep learning model in [11]

Chen et al. [12] proposed, HeNet, a hierarchical ensemble neural network based
on control flow characterization of program execution. As shown in Figure 3,
HeNet consists of a low-level behavior model and a top-level ensemble model.
HeNet was tested against ROP attacks against Adobe Reader 9.3 in Windows R7 32
bit. The dataset used in the experimental study consists of 348 benign and 299
malicious PDF samples. HeNet achieved high level of accuracy (100%) and zero
level of false positives (0%). In addition to a higher classification accuracy
when compared to traditional machine learning algorithms.

Figure 3: Overview of the proposed deep learning model in [12]

Hardy et al. [13] proposed a malware detection model based on stacked
AutoEncoders (SAEs). The model uses Windows API calls produced from the
collected PE files. As shown on Figure 4, the PE parser is used to extract the
Windows API calls from each file. The API query database, converts the API
calls to a 32-bit representation for the corresponding API functions.
Thereafter, the SAE is used in order to perform feature learning, fine-tuning
and malware detection. The experimental study conducted on large dataset
collected from Comodo Cloud Security Center. The dataset contained 50000 file
samples, where 22500 are malware, 22500 are benign files, and 5000 are
unknown. The proposed model outperformed ANN, SVM, NB, and DT in malware
detection with 96.85% level of accuracy.

Figure 4: Overview of the proposed deep learning model in [13]

Hou et al. [14], proposed an Android malware detection framework based on
Linux kernel system calls and stacked AutoEncoders (SAEs). A new dynamic
analysis method named Component Travelsal was introduced for automatically
execution of the code routines of each given Android app. In order to capture
the relationships among the system calls, a weighted directed graph was
constructed where each graph node represents a system call and its size
indicates its frequency, whereas a directed edge indicates the sequential flow
of system calls made and includes a weight that implies the frequency the
successor node called after the predecessor node. Each node with its weight,
each edge with its weight, as well as the in-degree and out-degree of each of
the nodes is used as the input feature for the proposed deep learning model.
The experimental study was conducted on large dataset collected from Comodo
Cloud Security Center. The dataset contains 3000 android apps, half of which
are benign, while the other half are malicious. Compared with traditional
machine learning methods, the detection performance is enhanced by using deep
learning framework with a high level of accuracy (93.68%).

Figure 5: Overview of the proposed deep learning model in [14]

Yuan et al. [15], proposed, DroidDetector, an online deep-learning based
Android malware detection engine. The authors conducted static and dynamic
analyses to extract features from each app. The extracted features fall into
three main categories: (1) required permissions, (2) sensitive APIs and (3)
dynamic behaviors. DroidDetector achieved 96.76% detection accuracy, which
outperforms traditional machine learning techniques. In the static phase
includes parsing the two files AndroidManifest.xml and classes.dex in order to
obtain a total of 120 permissions required by the app. The dynamic phase
includes running each app in DroidBox in order to execute a dynamic taint
analysis and monitor a total of 13 of the app actions. As shown in Figure 6,
the deep learning model used in this study consists of two phases, the
unsupervised pretraining phase and supervised back-propagation phases. the
pre-training phase, the Deep Belief Networks (DBN) is hierarchically built by
stacking a number of Restricted Boltzmann Machines (RBM). In the back-
propagation phase, the pre-trained DBN was tuned with labeled samples in a
supervised way. The experimental study was conducted on three public app sets.
The first benign app set was randomly crawled from the Google Play Store and
contains a total of 20000 apps. The other two malicious app sets were
respectively collected from the Contagio Community (there are only about 400
apps) and Genome Project (including 1260 malicious apps).

Figure 6: Overview of the proposed deep learning model in [15]

Huang and Stokes [16] proposed, MtNet, a multi-task deep learning malware
classification architecture which is trained for two tasks including binary
classification which predicts whether an unknown file is malicious or benign
and 100-class family classification which predicts if the file belongs to one
of 98 important families, a generic malware class, or the benign class. The
authors used low-level features extracted from dynamic analysis of the file as
input for the training stage. These features are a sequence of application
programming interface (API) call events plus their parameters and a sequence
of null-terminated objects recovered from system memory during emulation. The
final number of selected features was reduced to 50000 based on mutual
information feature selection. Training a neural network with this large input
dimension is computationally intensive. Therefore, the authors used random
projection technique in order to reduce the data size. MtNet trained and
tested on an extremely large dataset consisting of 6.5 million, 2.85 million
examples were extracted from malicious files and 3.65 million from benign
files. The set of malicious files has 1.3 million belonging to the 98 malware
families and 1.55 million from the generic malware class. A set of 4.5 million
samples were used for training and another set of 2.0 million for a hold out
test set. The experimental results showed that MtNet achieved a binary malware
error rate of 0.358% and family error rate of 2.94%. The multi-task learning
improved the classification results and showed low false positive rates (under
0.07%).

Figure 7: Overview of the proposed multi-task deep learning malware
classification architecture in [16]

Azmoodeh et al. [17], proposed a deep Eigenspace learning approach to classify
malicious and bening IoT applications. They extracted OpCode sequence of 1078
benign and 128 malware from ARM compatible IoT applications. The selected
features (OpCodes) of each sample are converted into a graph which is for
classification based on deep convolutional networks. They used Objdump in
order to extract the OpCodes. Thereafter, one can use n-gram Op-Code sequence
to classify malware using their disassembled codes. In addition, they proposed
class-wise information gain to overcome the problem of imbalanced datasets and
select the top 82 features. As shown in Figure 8, the proposed approach
consists of 2 phases: (1) OpCode-Sequence Graph Generation phase and (2) Deep
Eigensapce Learning phase. Eigensapce learning was proposed due to the fact
that Eigenvectors and eigenvalue are two main components in the graph’s
spectrum. The first two eigenvectors and eigenvalues of the samples are used
as input values for the model. The proposed system achieved an accuracy of
98.37% and a precision rate of 98.59%. In addition to, the ability to mitigate
junk code insertion attacks.

Figure 8: Overview of the proposed method in [17]

Kolosnjaji et al. [18], proposed a classification of malware system call
sequences based on convolutional and recurrent network layers. As shown in
Figure 9, the authors combined convolutional and recurrent layers in one
neural network in which the convolutional layer is used for feature
extraction. The input of the system is 60 distinct system calls. The dataset
used in study was collected from three different sources: Virus Share,
Maltrieve and private collections. Sample labels are obtained using services
of VirusTotal where the hash of the malware file compared to the service’s
database. Then the authors performed clustering on the signatures from
different antivirus programs in order to obtain ground truth classes from the
resulting clusters where these clusters contain 4753 malware samples. The
experimental study showed that the proposed approach outperformed the
traditional machine learning approaches and achieved an average of 85.6% on
precision and 89.4% on recall.

Figure 9: Overview of the proposed deep learning model in [18]

Rigaki and Garcia [19], showed that malware behavioral patterns can be
modified using GANs in order to mimic Facebook chat. The real-life testing
scenario was developed using the Stratosphere behavioral IPS in a router,
whereas the malware and the GAN were deployed in the local network, and the
command & control server was deployed in the cloud. The authors used an open
source Remote Access Trojan (RAT), called Flu, which was modified in order to
receive the input from the generator and adapt its behavior accordingly. Flu
inquires the GAN using the HTTP API, which in turn reply with three
parameters: total byte size, duration of the next network flow, and time delta
between the current flow and the next one.

### ii. Botnet Detection

Botshark [20] is a deep learning-based approach for botnet traffic analyzing
from both centralized and P2P botnets. Botshark consists of two deep
structures where the first layer employs stacked Autoencoders for feature
extraction and the second layer uses CNNs in order to train a classifier for
botnet detection. The authors used network traffic from ISCX dataset [21]
which includes 44.97% malicious flows from 16 different centralized and
decentralized botnet topologies as well as normal traffic. The authors
extracted NetFlows from network traffic using the Argus [22] tool. The
extracted features contain: (1) byte-based features, (2) time-based features,
(3) packet-based features. The experimental study showed 0.91% true positive
rate with 0.13% of false positive rate.

The authors of [23] used LSTM approach to model the behavior of network
traffic as a sequence of states that changes over time. The authors used LSTM
approach to model the behavior of network traffic as a sequence of states that
changes over time. The behavior of a connection is computed based on three
features of each flow: size, duration and periodicity. Then, assigning to each
flow a state symbol based on the extracted features and an assignment
strategy. Finally, each connection will have its own string of symbol used for
represents its behavior. The proposed LSTM architecture was evaluated against
two different datasets where the first one was used for training and the
second one was used for testing purpose. The authors used sampling approach
for dealing with the imbalanced datasets. They also studied the optimal length
of connection states required for the input layer in LSTM and consequently the
best results were achieved by 25 connection states. The LSTM model showed
0.809% attack detection rate with 0.03% of false alarm rate when tested on the
second dataset. The experimental results showed that this approach was able to
detect TCP based malicious connections. However, it failed in identifying most
of the HTTP and HTTPS traffic. In addition to some of SMTP (SPAM) traffic. A
solution for this problem, is observe the network traffic across multiple
layers of the network and monitor the sequences of bot activities together
which possibly can be merged based on a context and aim [24].

In [25], Yin et al. used generative adversarial networks (GANs) for generating
’fake’ samples in order to expand the number of labeled samples where a
3-layer LSTM network was used as generator and the discriminator was replaced
with a botnet detector. The authors selected 16 flow-based features. The
experimental study was conducted on ISCX botnet dataset. The false positive
rate of the GAN-based model was decreased from 19.19% to 15.59%.

Tran et al. [26] proposed a novel LSTM approach in order to detect modern
sophisticated botnets that employ domain generation algorithm (DGA) to
generate a large number of domains that can be used in order to communicated
with Command and Control (C&C) server. DGA classification can be seen as a
multiclass task [25], which can be either retrospective or real-time manner.
The real time detection which is mainly based on the domain name and
linguistic features. This is much difficult due to the fact that linguistic
features it can be bypassed by the malware author [27]. In general, LSTM is
sensitive to the multiclass imbalance problem. In other words, it is naturally
biased towards the prevalent classes, which results in an inability of
detecting the uncommon other DGA families [26]. The new proposed algorithm
adopts the cost-sensitivity principle [28] in order to target the class
imbalance problem, by making the learning biased towards the small classes.
The authors modified the backward pass (i.e. the error computation) of the
original LSTM. This new algorithm has showed an enhancement of 7% in terms of
macro-averaging recall, precision and F1-score with respect to the original
LSTM and other state-of-the-art solutions. The cost-sensitive LSTM, however,
reduced the accuracy on the prevalent non-DGA class. It is also worth
mentioning that cost-sensitive LSTM is superior to RUSBoost, oversampling and
Threshold-moving methods and achieved much higher macro-averaging F1-score
with respect to HMM, C5.0, LSTM, the cost-sensitive SVM, cost-sensitive C4.5
and Weighted Extreme Learning Machine on the multiclass imbalanced dataset
[26].

Figure 10: Overview of the proposed method in [26]

On the other hand, in the context of social bot detection for social media
platforms, traditional deep learning techniques for text classification
depended mainly on only textual features [28,29]. However, employing
additional features can be more efficient and shows better results. In [29]
deep neural network based on contextual (LSTM) architecture that exploits both
content and metadata in order to detect social bots at the tweet level.
Contextual LSTM is a natural language processing (NLP) model based on deep
learning paradigm. The dataset [30] includes over 8386 accounts and 11834866
tweets. The authors used both 10 account-level features for the first level
and 6 tweet level features for the second level. This approach showed a high
level of accuracy (> 99% AUC) for user-level detection.

### iii. Malicious Code Detection

Hendler et al. [31] used deep learning model for detecting malicious
PowerShell commands based on character-level convolutional neural networks.
The authors used a large dataset which consists of 66388 distinct PowerShell
commands; 6290 labeled as malicious and 60098 labelled as benign. The authors
treated the command as a raw signal at character level and applied to it a one
dimensional CNN for text classification task. The input feature length is
1,024, therefore if a command is longer than that it will be truncated. The
best performance was achieved by an ensemble detector that combines a
traditional NLP-based classifier with a CNN-based classifier.

Figure 11: Overview of the proposed CNN architecture in [31]

Wang et al. [32], used stacked denoising auto-encoders in order to extract
high-level features from JavaScript code. Denoising auto-encoder is an
extension of traditional auto-encoders, which can reconstruct the inputs from
a noisy corrupted data by minimizing the reconstruction loss. The JavaScript
code was converted to binary feature vectors. As shown in Figure 12, a
logistic regression classifier is applied to the output of the last hidden
layer of the auto-encoder in order to classify the JavaScript code to the
appropriate class. The authors evaluated our model on a large dataset, which
contains over 27000 samples. For dimensionality reduction the authors used
sparse random projection method to reduce target dimensionality which resulted
in 480 dimensionalities. The experimental study showed that the proposed model
can attain a high level of accuracy (95%) with a false positive rate less than
4.2%. The limitation of the model proposed in [32] is the long training time.
However, it has a high-speed testing time. In addition, the proposed method
outperformed other traditional machine learning algorithms in terms of
precision, recall, f-measure, RMSE and testing time.

Figure 12: Overview of the proposed approach in [32]

Saxe and Berlin [33] proposed, eXpose, a convolutional neural network approach
for detecting malicious URLs, file paths and registry keys. The training
dataset used in this research consists of a total of 14788254 instances:
8332360 benign and 6455894 malicious samples whereas the testing dataset
consists of a total of 11531955 instances: 10121981 benign and 1409974
malicious samples. The authors used n-gram feature extractor and manually
extracted features. These features were randomly hashed into 1024-dimensional
vector. Thereafter, they were fed into a deepMLP model. eXpose outperformed
manual feature extraction approaches, achieving a 5%-10% detection rate gain
at 0.1% false positive rate compared to these baselines.

## III. Conclusion

This paper gives an overview of the potential of deep learning techniques in
the security field. We mainly observed the high accuracy and efficiency of
deep learning models in malware and botnet detection. In addition to their
application in malicious code detection. These models showed a significant
improvement when compared to tradition machine learning approaches. Therefore,
we conclude that these models will have an increased adoption in modern
security solutions and applications.

## References

  * [1] Latah, M., Toker, L.: ‘Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview’, 2018, arXiv preprint arXiv:1803.06818.
  * [2] Xiao, L., Wan, X., Lu, X., Zhang, Y. Wu, D.: ‘IoT Security Techniques Based on Machine Learning’,2018, arXiv preprint arXiv:1801.06275.
  * [3] Li, J., Zhao, Z., Li, R.: ‘A Machine Learning Based Intrusion Detection System for Software Defined 5G Network’, IET Networks, 2018, 7,(2), pp. 53-60. DOI: 10.1049/iet-net.2017.0212
  * [4] Mishra, P., Varadharajan, V., Tupakula, U. Pilli, E.S.: ‘A Detailed Investigation and Analysis of using Machine Learning Techniques for Intrusion Detection’, IEEE Communications Surveys & Tutorials, 2018, DOI: 10.1109/COMST.2018.2847722
  * [5] LeCun, Y., Bengio, Y., Hinton, G.: ‘Deep learning. nature’, 2016, 521(7553), pp. 436-444, DOI: 10.1038/nature14539
  * [6] Deng, L.: ‘A tutorial survey of architectures, algorithms, and applications for deep learning’, APSIPA Transactions on Signal and Information Processing, 2014, 3,(e2), pp. 1-19. DOI: 10.1017/atsip.2013.9
  * [7] Deng, L., Yu, D.: ‘Deep learning: methods and applications. Foundations and Trends in Signal Processing’, 2014, 7,(3–4), pp.197-387. DOI: 10.1561/2000000039
  * [8] Kwon, D., Kim, H., Kim, J., Suh, S.C., Kim, I. Kim, K.J.: ‘A survey of deep learning-based network anomaly detection’, Cluster Computing, 2017, pp.1-13. DOI: 10.1007/s10586-017-1117-8
  * [9] Hodo, E., Bellekens, X., Hamilton, A., Tachtatzis, C., Atkinson, R.: Shallow and deep networks intrusion detection system: A taxonomy and survey, 2017, arXiv preprint arXiv:1701.02145.
  * [10] Tobiyama, S., Yamaguchi, Y., Shimada, H., Ikuse, T. and Yagi, T., 2016, June. ‘Malware detection with deep neural network using process behavior. In IEEE 40th Annual Conference on Computer Software and Applications, Atlanta, USA, June 2016, pp. 577-582.
  * [11] Rhode, M., Burnap, P., Jones, K., ‘Early-stage malware prediction using recurrent neural networks’, Computers & Security, 2018, 77, pp.578-594.
  * [12] Chen, L., Sultana, S. and Sahita, R., ‘HeNet: A Deep Learning Approach on Intel Processor Trace for Effective Exploit Detection, 2018, arXiv preprint arXiv:1801.02318.
  * [13] Hardy, W., Chen, L., Hou, S., Ye, Y. and Li, X., 2016, January. ‘DL4MD: A deep learning framework for intelligent malware detection’. In Proceedings of the International Conference on Data Mining (DMIN). The Steering Committee of The World Congress in Computer Science, Computer Engineering and Applied Computing (WorldComp), Las Vegas, USA, July 2016, pp. 61-67.
  * [14] Hou, S., Saas, A., Chen, L., Ye, Y., 2016, October. ‘Deep4maldroid: A deep learning framework for android malware detection based on linux kernel system call graphs’. In 2016 IEEE/WIC/ACM International Conference on Web Intelligence Workshops (WIW), Omaha, USA, Oct. 2016, pp. 104-111.
  * [15] Yuan, Z., Lu, Y. and Xue, Y., ‘Droiddetector: android malware characterization and detection using deep learning’, Tsinghua Science and Technology, 2016, 21,(1), pp.114-123, DOI: 10.1109/TST.2016.7399288
  * [16] Huang, W. and Stokes, J.W., 2016, July. ‘MtNet: a multi-task neural network for dynamic malware classification’. In International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, San Sebastian, Spain, July 2016, pp. 399-418.
  * [17] Azmoodeh, A., Dehghantanha, A., Choo, K.K.R.: ‘Robust Malware Detection for Internet Of (Battlefield) Things Devices Using Deep Eigenspace Learning’, IEEE Transactions on Sustainable Computing, 2018. DOI: 10.1109/TSUSC.2018.2809665
  * [18] Kolosnjaji, B., Zarras, A., Webster, G. Eckert, C.: ‘Deep learning for classification of malware system call sequences’. In Australasian Joint Conference on Artificial Intelligence, Hobart, Australia, December 2016, pp. 137-149.
  * [19] Rigaki, M., Garcia, S.: ‘Bringing a GAN to a Knife-fight: Adapting Malware Communication to Avoid Detection’. 1st deep learning and security workshop, San Francisco, USA, May 2016.
  * [20] Homayoun, S., Ahmadzadeh, M., Hashemi, S., Dehghantanha, A., Khayami, R.: ‘BoTShark: A deep learning approach for botnet traffic detection’, Cyber Threat Intelligence, 2018, pp.137-153, DOI: 10.1007/978-3-319-73951-9_7
  * [21] Unb iscx botnet dataset, 2017. http://www.unb.ca/cic/datasets/index.html
  * [22] Argus- auditing network activity, jan 2017, http://qosient.com/argus
  * [23] Torres, P., Catania, C., Garcia, S., Garino, C.G.: ‘An analysis of recurrent neural networks for botnet detection behavior’. In Biennial Congress of Argentina (ARGENCON), Buenos Aires, Argentina, June 2016, pp. 1-6.
  * [24] Acarali, D., Rajarajan, M., Komninos, N., Herwono, I.: ‘Survey of approaches and features for the identification of HTTP-based botnet traffic’, Journal of Network and Computer Applications, 2016, 76, pp.1-15. DOI: 10.1016/j.jnca.2016.10.007
  * [25] Yin, C., Zhu, Y., Liu, S., Fei, J., Zhang, H.: ‘An enhancing framework for botnet detection using generative adversarial networks’. In IEEE 2018 International Conference on Artificial Intelligence and Big Data (ICAIBD), Chengdu, China, May 2018, pp. 228-234.
  * [26] Tran, D., Mac, H., Tong, V., Tran, H.A., Nguyen, L.G.: ‘A LSTM based framework for handling multiclass imbalance in DGA botnet detection’, Neurocomputing, 2018, 275, pp.2401-2413. DOI: 10.1016/j.neucom.2017.11.018
  * [27] Schiavoni, S., Maggi, F., Cavallaro, L. and Zanero, S.: ‘Phoenix: DGA-based botnet tracking and intelligence’. in: Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), Egham, UK, July 2014, pp. 192–211 .
  * [28] Kukar, M., Kononenko, I.: ‘Cost-sensitive learning with neural networks’. In: Proceedings of the Thirteenth European Conference on Artificial Intelligence (ECAI), Brighton, UK, Aug. 1998, pp. 445–449.
  * [29] Kudugunta, S., Ferrara, E., ‘Deep Neural Networks for Bot Detection’, 2018, arXiv preprint arXiv:1802.04289.
  * [30] Ferrara, E., Varol, O., Davis, C., Menczer, F. and Flammini, A.: ‘The rise of social bots’, Commun. ACM, 2016, 59, (7), pp. 96-104. DOI: 10.1145/2818717
  * [31] Hendler, D., Kels, S. Rubin, A.: ‘Detecting Malicious PowerShell Commands using Deep Neural Networks’. In Proceedings of the 2018 on Asia Conference on Computer and Communications Security, Incheon, Republic of Korea, June 2018, pp. 187-197.
  * [32] Wang, Y., Cai, W.D., Wei, P.C.: ‘A deep learning approach for detecting malicious JavaScript code’, Security and Communication Networks, 2016, 9, (11), pp. 1520-1534. DOI: 10.1002/sec.1441
  * [33] Saxe, J. and Berlin, K.: ‘eXpose: A character-level convolutional neural network with embeddings for detecting malicious URLs, file paths and registry keys’, 2017, arXiv preprint arXiv:1702.08568.