11institutetext: University of Coimbra, CISUC, DEI
11email<EMAIL_ADDRESS>bmsousa<EMAIL_ADDRESS>
# MONDEO: Multistage Botnet Detection

Duarte Dias 11 Bruno Sousa 11 Nuno Antunes 11

###### Abstract

Mobile devices have widespread to become the most used piece of technology.
Due to their characteristics, they have become major targets for botnet-
related malware. FluBot is one example of botnet malware that infects mobile
devices. In particular, FluBot is a DNS-based botnet that uses Domain
Generation Algorithms (DGA) to establish communication with the Command and
Control Server (C2). MONDEO is a multistage mechanism with a flexible design
to detect DNS-based botnet malware. MONDEO is lightweight and can be deployed
without requiring the deployment of software, agents, or configuration in
mobile devices, allowing easy integration in core networks. MONDEO comprises
four detection stages: Blacklisting/Whitelisting, Query rate analysis, DGA
analysis, and Machine learning evaluation. It was created with the goal of
processing streams of packets to identify attacks with high efficiency, in the
distinct phases. MONDEO was tested against several datasets to measure its
efficiency and performance, being able to achieve high performance with
RandomForest classifiers. The implementation is available at github.

###### Keywords:

Botnet DDoS FluBot AIDS Mobile Malware

##  1 Introduction

Mobile technology has been a massive success since its introduction, amassing
a large portion of the active devices on the internet. These devices are low-
powered, portable, and can use both LAN and WAN, giving them great
versatility.

The security aspect of technology has been historically neglected. Mobile
devices are no different. Even with the introduction of measures such as
Google Play Protect[1] and Apple App Security [2], malware is still able to
sneak its way into users’ devices.

Mobile-related malware can occur under many formats and with many objectives,
data exfiltration and financial damage, as mentioned in [3]. In particular,
this document focuses on DNS-based malware that uses Domain Name Generation
(DGA) algorithms as an evasive tactic, to hide its communications with Command
and Control (C2) server(s). Diverse solutions for DGA approaches are
available, such as Intel DGA [4] and DGA Detective [5], having different
performance levels and requirements.

###  1.1 FluBot

In 2021, large amounts of botnet-focused malware started spreading on the
internet. This malware can perform ransomware attacks and Distributed Denial
of Service (DDoS), among other malware-specific functionalities [6, 7]. FluBot
was one of the most reported, mainly due to its massive lateral spreading
capabilities.

FluBot-infected applications act receivers for a Command and Control (C2)
network. Upon installation, the malware first hides from the user using
several evasive tactics, in order to ensure its long stay in the infected
device. Its removal is also non-trivial, requiring a full device wipe.
According to ProDaft’s report [6], FluBot can emulate well-known banking
sites, steal 2-Factor Authentication (2FA) codes sent via SMS, exfiltrate
data, uninstall applications, perform actions on users’ behalf, among other
vulnerabilities.

Botnets, such as FluBot impact not only end-users but also network operators.
Internet service providers (ISPs) having users with infected devices suffer
from increased network traffic, reducing the overall quality of the network.
For instance, Domain Generation Algorithms (DGA) perform large amounts of DNS
queries before connecting to the Command and Control- C2 Server(s) [7].

###  1.2 Malware Detection

There are several methods to detect malware-infected systems. The static
analysis comprises the methods that can be used without running the malware.
Analyzing the malware’s checksum is a form of static analysis. If the malware
had been previously identified, then the hash comparison would quickly
identify the presence of the identified malware. More in-depth static analysis
dissects the program, analyzing its code, in order to understand its behavior.

The dynamic analysis consists of evaluating the malware while it is running.
This practice is more dangerous and should only be performed in a safe
environment (a sandbox). The dynamic analysis allows the researcher to
identify runtime behaviour that may otherwise be impossible to find. To combat
dynamic analysis, some malware has evolved to avoid running if it detects it
is running in a virtualized environment.

Signature-based malware detection aims to identify the malware by relying on a
list of well-known behaviours (these include, network traffic patterns, file
hashes, system calls, etc). Signature-based detection usually provides
accurate results at the expense of speed of detection (can only detect malware
whose behaviour has been previously documented).

Anomaly-based detection expands the concept of signature detection, detecting
malware based on unusual activity patterns. Such patterns include network
traffic, connection timing, and system behaviour through the analysis of
system calls. Anomaly-based detection does not need a previous baseline to
detect new malware, granting better results on dynamic malware changes, at the
cost of lower accuracy rates.

According to Singh et al., [8], DNS-based botnet malware can be divided into
five categories botnet: Anomaly, Flow, Flux, DGA, and Bot Infection. Following
this classification, Flutbot is considered to be a DGA-based malware.

AI has proven to be a valuable method for the detection of botnets. Examples
include HANABot [9], MABDS [10] or BotMark [11], which make use of techniques
such as Reinforcement Learning, Adaboost, K-Nearest Neighbors (kNN), Support
Vector Machines (SVM), and Isolated Forests.

###  1.3 MONDEO

MONDEO was implemented as a proof-of-concept (POC), using a docker container
running python-flask, using RESTful API responses, and was evaluated with
datasets both created in the laboratory and by collecting data on a deployed
DNS server. The results show the suitability of MONDEO to be deployed in
network infrastructures of operators with minimal overhead and with accurate
precision levels.

Regarding performance, MONDEO aims to be time efficient, balancing accuracy
and speed of detection to deliver precise results using production-grade
scenarios as a baseline for tool design.

MONDEO provides a solution that does not require software deployment, agents,
or configuration in mobile devices. To achieve this, it comprises a flexible
multistage pipeline, which processes streams of packets, providing a per-
request floating-point classification (0 to 1, Non-infected to Infected). This
approach combines anomaly detection, DGA-based detection, and machine learning
in an effort to obtain better and faster results. MONDEO also innovates in the
aspect that the results of some phases can be used to configure the initial
phase, where blacklists and/or whitelists are applied.

The solution of MONDEO is available at github.

###  1.4 Structure

The document considers the following structure. Section 2 presents an overview
of the state-of-the-art botnet detection, as well as relevant literature on
the Flubot malware. The section concludes by comparing the MONDEO approach to
other state-of-the-art approaches. Section 3 details the MONDEO pipeline,
carefully describing each step; Section 4 presents the evaluation methodology,
while Section 5 documents the achieved results; Section LABEL:sec:fw discusses
possible changes and additions to be made to MONDEO; Section 6 concludes the
document providing an overview of the technology as well as a final analysis.

##  2 Related Work and MONDEO positioning

This section presents the related work and positions MONDEO regarding the SoA.

###  2.1 Related Work

Khraisat et al. [12] provide an overview of Network-based Intrusion Detection
Systems (NIDS), Host-based Intrusion Detection systems (HIDS) Signature-based
detection (SIDS), and Anomaly-Based detection (AIDS). It also provides an
overview of algorithms and techniques used in machine learning detection
approaches.

Manmeet Singh et al. [8] survey DNS-based botnet detection frameworks,
documenting the usage of different techniques. This work divides detection
into five categories: anomaly-based, flow-based, flux-based (e.g., using IP
information), DGA-based, and Bot infection detection-based. According to the
research, the majority of the works identified rely on data for DNS response-
based features, which take a longer time to perform accurate detection.

Majda Wazzan et al. [13] survey botnet detection mechanisms for IoT devices,
including connected cameras, routers, and Android devices. For threats such as
Mirai and Reaper, detection techniques are documented for different malware
phases such as Reconnaissance, Spread, and Attack. MONDEO shares similarities
in detection techniques used such as Adaboost, K-Nearest Neighbors (kNN),
Support Vector Machines (SVM), and Isolated Forests. Noticeably, detection
using such techniques is performed during the attack phase, where infected
devices establish communication with the C2 server and act actively in
attacks.

Ying Xing et al. [14] survey botnet detection techniques including honeypot
analysis, communication signatures (e.g. using white and blacklists), Deep
Learning techniques (both based on Neural networks or based on Reinforcement
Learning), statistical analysis, distributed approaches and also combination
methods. The work includes recent approaches for Moving Target Defense (MTD),
also detailing combination methods like HANABot [9] or MABDS [10] which use
multiple techniques to detect botnet requiring the deployment of agents in the
mobile devices and at the network side like honeypot agents.

Rosa et al. [15] provide an overview of machine learning techniques for
malware detection in Industrial Autonomous Control Systems (IACS). For
detection using Artificial intelligence (AI), the techniques with the best
results mentioned are k-Nearest Neighbour (kNN), Support Vector Machines
(SVM), and Isolated Forests.

Salsabila et al.[16] analyze FluBot using a combination of static and dynamic
analysis. This paper focuses on disassembling the malware and analyzing the
underlying code, as well as documenting the runtime behaviour of the malware
in the infected device.

BotMark [11] is a botnet detection strategy based on several techniques and
with multiple steps. Techniques include pre-processing, hybrid analysis, and
bot detection. The approach was created to be protocol independent and
therefore, the used features do not depend on the protocol used, for example,
packets per second (PPS) and standard deviation of payload size. BotMark
employs kNN techniques for clustering and identifying distinct communication
flows. While the evaluation achieves high accuracy in datasets with Mirai,
Ares, and Black-Energy, BotMark does not include whitelists or blacklists,
meaning it can provide false negatives in the traffic patterns of legitimate
applications like Redis or Zookeeper with similar characteristics of malware
in botnets.

###  2.2 MONDEO - Innovation and approach comparison

MONDEO is positioned as an approach that combines several phases with
accuracy, efficiency and integration purposes. The multi-staged approach
allows network operators to perform botnet detection using existing
whitelist/blacklisting approaches, without requiring the installation of any
in mobile phones.

When compared to other approaches that can detect FluBot-based attacks,
Salsabila et al. [16] focus on static and runtime behaviour analysis, whereas
MONDEO focuses on network-based detection. Bellizi et al. [17] analyze memory
dumps using the JIT-MF framework to detect malware in the users’ system, such
as FluBot. MONDEO does not focus on the user device but on identifying malware
from the perspective of the mobile carrier, presenting a solution that does
not imply any contribution from the infected user. Chiscop et al. [18]
identify FluBot based on its DGA behaviour, MONDEO combines DGA detection with
other features, such that detection can be performed more efficiently.

Regarding other network-related botnet detection approaches, Singh et al. [8]
present solutions where both DNS replies/answers, where MONDEO only require
the usage of DNS requests for detection.

Other works also propose a multilayered approach to botnet detection.
Almutiari et al. [9] propose HANABot, a machine-learning-based evaluation
algorithm that uses features from both the network and the host. Wang et al.
[10] propose BBDP, behaviour-based botnet detection in parallel. This approach
uses 5 stages to detect botnets, consisting of traffic reduction, feature
extraction, data partitioning, DNS detection, and TCP detection. Of the
mentioned stages, MONDEO shares only the DNS detection stage.

The main MONDEO’s novelty is related not to the underlying detection
principles used, but to how the approach is taken and how resources are
combined to ensure efficient and accurate detection.

##  3 MONDEO Implementation Details

MONDEO is a multistage pipeline configured for flexibility and efficiency. It
contains 4 evaluation stages: 1- Whitelisting/Blacklisting; 2- Query Rate
Analysis; 3- DGA Evaluation; and 4- Machine Learning Evaluation. The diverse
stages rely on current practices regarding access control in networks like the
whitelists/blacklists and requests ratios. The DGA and ML are specific to the
Flubot malware behaviour. Figure 1 illustrates the pipeline.

Figure 1: MONDEO overall stages and feedback loop

Each phase may generate an evaluation resulting in one of 3 actions:

  * •

Benign when part of a regular request. This is present in all the phases,
except phase 2 which does not do this classification.

  * •

Infected when belonging to malware requests.

  * •

Pass for next stage when a phase considers it does not have enough
information, having the packet transit to the next phase.

The last phase with Machine Learning models always produces a definite
evaluation, either Benign or Infected.

The ML and DGA phases support a feedback loop which is able to automatically
populate both white and blacklists, further improving efficiency, especially
on the subsequent analysis, where requests can be evaluated in the first
phase.

MONDEO uses solely DNS queries for botnet detection, which is relevant for
mobile network operators, as most mobile users rely upon the default DNS
servers on their devices, usually provided by the operator. Furthermore, by
working on the side of the network operator, MONDEO removes the need for an
end user to install agents, and applications to run on their devices.

###  3.1 Phase 1 - Whitelisting/Blacklisting

A whitelist and blacklist correspond to lists where domains are catalogued and
directly compared against the queried domain. If a domain is in the whitelist,
the packet passes evaluation whereas if the packet is in the blacklist, the
packet is immediately flagged as infected. For efficiency, a hash-based
structure guarantees $O(1)$ search complexity. If the list is too big to be
reliably implemented using hash-based data structures, binary structures are a
good second option, with an associated $O(log(n)$ complexity for the search
operation.

The options described above take into consideration a full (1-1) direct match.
To improve the performance, the Free Level Domain (FLD) can be stripped from
the full query domain, and, while it has slightly lower precision, it doesn’t
affect results too much. For example, the domain “.netflix.com” contains
several FLD’s, namely ftl.netflix.com, api-global.netflix.com.

The Proof of Concept (PoC) elaborated to evaluate MONDEO employs a linear
search with $(O(n))$ complexity with FLD stripping.

The whitelist and blacklist can be dynamically improved by adding domains to
the list according to the runtime decision of other phases (such as phases 3
and 4) on those domains. That is through the feedback loop. Nonetheless, it
should be noted that adding to a whitelist without manual confirmation can be
dangerous from a security standpoint.

###  3.2 Phase 2 - Query Rate Analysis

Analyzing the FluBot action pattern reveals that, to establish a connection
with the C2 server, FluBot spams several thousands of queries in a short
period of time until it connects with the real C2 server.

This pattern can be detected by implementing a mechanism to detect a high
query rate. An efficient approach makes implementation nontrivial, as the best
structure would require an event-driven data structure, such as a doubly-
linked list, where both ends of the lists are updated whenever a new packet is
processed, ensuring the time interval, $\Delta t$, is maintained.

A simpler but also efficient approach was used in the PoC. Instead of keeping
track of all of the events (i.e. packets) at any given time window, the
difference between any 2 contiguous packets is measured. For example, if
Packet_1 arrived at timestamp $t1=1$ and Packet_2 arrived at $t2=2$ then they
diverge in one time-unit, which cannot necessarily be measured in seconds.
Using this approach sensitivity can be parameterized in 2 ways:

  * •

$\Delta F$ refers to the divergence interval in time units;

  * •

$K$ specifies the threshold in the number of packets that surpass the
divergence threshold.

If $\Delta F=0$ then packets must arrive with the same timestamp (the smallest
value possible and, therefore, the least of packets are caught). $K$ limits
false positives delaying warnings. For example, in situations where a
legitimate service makes 5 queries under $\Delta F$ time, it is not reported
for any $K\leq 5$. Algorithm 1 summarises the steps that are performed in the
Query Ratio analysis phase.

Input: time of packets ($tpkt_{1}$ … $tpkt_{n}$), $\Delta F$, $K$

Output: Decision if abnormal Request Ratio $flagInfected$

1 $\Delta T=tpkt_{n}-tpkt_{n-1}$

2 $cnt=n$

3 if  _$\Delta T\leq\Delta F$_ then

4 if  _$cnt\leq K$_ then

5 $flagInfected=true$

6 else

7 $flagInfected=false$

8 end if

9

10else

11 $flagInfected=false$

12 end if

Algorithm 1 Query Rate and sensitivity configuration

###  3.3 Phase 3 - DGA Detection

Any packet passing phase 2 has its Fully Qualified Domain Name (FQDN) analyzed
by a DGA checker. DGAs produce random-but-deterministic FQDNs names that are
used in FluBot’s DNS requests. The attacker registers FQDN(s) as legitimate C2
server(s), and if that one gets blacklisted, the attacker quickly registers a
new one. This technique is much more resilient than using static IPs.

In the MONDEO PoC we have considered two main implementations of the DGA
detector:

  * •

DGA Intel (DGAIntel) [4], maintained by Intel

  * •

DGA Detective (DGADet) [5], result from the H2020 SOCCRATES research project.

The open-source solutions perform analysis of the DNS requests, resulting in a
floating point evaluation where 0 indicates that a domain is non-DGA generated
and 1 that it is DGA-Generated. The acceptance/rejection criteria were defined
with lower and upper boundaries as follows:

  * •

$lower\leq 0.1$ means immediate acceptance.

  * •

$upper\geq 0.9$ delineates immediate rejection.

###  3.4 Phase 4 - Machine Learning Detection

The last phase of the pipeline performs a machine learning evaluation. As
expected this phase takes more time and should evaluate, fewer requests to
reduce the impact in the detection of Flubot. This phase produces a binary
output where 0 is not infected, and 1 is an infected packet.

####  3.4.1 Feature Selection

The features used are summarized in Table LABEL:table:features and are taken
from DNS requests. Some of the fields were converted to numeric values for
efficiency concerns. The IP addresses used bit conversion for each decimal
octet of an IP address version 4. [ cap=Selected Feature Set, caption=Selected
Feature Set, label=table:features, pos=!htb, doinside=, center, nostar ]m2.5cm
m5cm m2.5cm Feature ID & Description ML Data TypeIP Src Source IP performing
request Bit Conversion
IP Dst Destination of DNS request Bit Conversion
Length Size of the Payload Integer
DNS Flag Info Regarding Flags Boolean
DNS Questions N. of requests in DNS message Integer
Query Type Qry Type: A, AAAA, CNAME, PTR integer
Qry Name Null If DNS name is NULL or not Boolean
Timestamp Indication packet creation time Integer

####  3.4.2 Model Training

The training data included a total of 10.000 data points, from which there is
a 50/50 split between a fabricated packet set using the Alexa Top 1 million
domain list [19], and lab-generated malware samples (see Section 4.1). The
Alexa Top 1 million was used since it contains the most well-known, or used
domains in the Internet. The names were used to generate DNS requests with
names of these domains, such as www.facebook.com.

The trained ML model uses an 80/20 test/train split, where 80% of the data is
used to train the model and the remaining 20% is used to test the accuracy of
the model. The model is implemented in Python using the scikit-learn, using
RandomForest, IsolationForest, MPLC, and SVM model classifiers. Such models
provide an acceptable tradeoff regarding classification accuracy and
performance [20].

##  4 MONDEO Evaluation Methodology

This section documents the evaluation methodology to assess the performance of
MONDEO.

###  4.1 DNS Experimental Setup and Datasets

To create a realistic dataset a DNS server was configured using ISC BIND. The
information present in the datasets included captured DNS packets from the
regular (non-infected) DNS clients.

The data collected comes from volunteers, which configured their devices to
use the DNS server. About 20 users participated in the experiment with their
mobile phones and laptops. The collection of DNS data was performed during a
period of three months.

To assess the behaviour of FluBot safely, Android Studio was used to sandbox
the malware samples. The samples with FluBot malware were available in three
distinct applications, UPS, Correos and DHL, as summarised in table
LABEL:table:Malware.

[ cap=FluBot malware sample information, caption=FluBot malware sample
information, label=table:Malware, pos=!htb, doinside=, center, nostar ]m2cm
m2cm m7.0cm Name & File(s) DescriptionUPS 83 Application that mimics official
UPS app
Correos 108, Lab Application that mimics Correos app
DHL 125 Application similar to DHL app for tracking

The profile for the emulated device was based on Google’s Pixel 4, running the
Android API 29. This device is also used in related works assessing the
behaviour of mobile devices [21, 22]. Malware was activated in specific time
windows such that clear samples could be captured.

###  4.2 Evaluation Methodology

The MONDEO framework was evaluated under two parameters: the accuracy of
detection and the efficiency of detection.

####  4.2.1 Machine Learning Model

The goal is to verify the findings in the state of the art [20] regarding the
applicability of the ML classifiers models like RandomForest, IsolationForest,
MPLC, and SVM.

To assess the accuracy of the machine-learning models, we have used the
metrics provided by scikit-learn for the diverse models, as summarised in
Table LABEL:table:PerfMetricsML.

[ cap=Metrics for ML Accuracy, caption=Metrics for ML Accuracy,
label=table:PerfMetricsML, pos=!htb, doinside=, center, nostar ]m0.12 m0.13
m0.64 Metric & Unit DescriptionPrecision $0\leq x\leq 1$ Ratio $TP/(TP+FP)$
where TP is the number of true positives and FP the false positives.
Recall $0\leq x\leq 1$ Ratio $TP/(TP+FN)$ measuring the percentage of actual
infected samples correctly classified.
F1-Score $0\leq x\leq 1$ Determined by the formula
$2*(\frac{Precision*Recall}{Precision+Recall})$. 1 represents the best score
and 0 the worst.
Accuracy $0\leq x\leq 1$ Determined by matching predicted labels with y_true
(real value).
Support $x\geq 0$ Number of occurrences of each class in y_true.

####  4.2.2 MONDEO Pipeline

MONDEO’s evaluation was performed in a virtual machine configured with 4vCPUS
and 16GB of RAM. MONDEO’s performance was evaluated individually in each phase
in terms of processing time per phase and the overall number of packets
processed.

The solution is implemented in two dockers:

  * •

MONDEO core assuring functionalities in Phase 1, Phase 2 and Phase 4.

  * •

MONDEO DGA which implements Phase 3 only, running the specific solutions of
the DGA Intel and DGA Detective.

MONDEO core which in one containing the phases

[ cap=Tests in MONDEO Pipeline Evaluation, caption=Tests in MONDEO Pipeline
Evaluation, label=table:FilesEval, pos=!htb, doinside=, center, nostar ]m1cm
m1.5cm m2.5cm m4.8cm Test Type File(s) Description#1 Infected 83, 108, 125,
Lab With samples of malware
#2 Benign 23, 240, Alexa Only with regular DNS requests

The test data used was retrieved from the DNS packet collection setup
(summarised in Table LABEL:table:FilesEval). In addition, test #2 included a
crafted sample, based on Alexa Top 1 Million [19] list, which includes the
most visited domains on the internet, as described in section 3. The dataset
of Alexa increases the number of the tested domains, adding reliability to the
experiments.

The metrics used to assess the performance of MONDEO are summarised in Table
LABEL:table:PerfMetricsDataPipeline [ cap=Performance Metrics in the MONDEO
Pipeline, caption=Performance Metrics in the MONDEO Pipeline,
label=table:PerfMetricsDataPipeline, pos=!htb, doinside=, center, nostar
]m2.8cm m1.5cm m6.8cm Metric Unit DescriptionPackets Processed % Ratio of
packets processed in each phase, considering the total of captured packets
Processing Time ms Time to process a packet in each phase
Classification n/a Final classification of MONDEO, if the packet is flagged as
Infected or is identified as Benign.

To perform the measurement of time, the TimeIt python package was included in
the developed PoC. This module directly measures the time taken by Python
methods, returning a 16-digit decimal value.

The resources consumed in terms of CPU and memory usage, as well as the amount
of input and output traffic, are exchanged for the classification process.

##  5 Evaluation Results

This section presents the evaluation results, according to the evaluation
methodology, and chosen models.

###  5.1 ML Model Accuracy

The ML model accuracy results are summarised in Table
LABEL:table:MLAccuracyResults. The model has higher accuracy and efficiency
when the value of the diverse metrics is higher. The main goal of the
distinction models is to assess the one that is more suited to MONDEO
multistage pipeline.

[ cap=ML Accuracy of the Different Classifiers, caption=ML Accuracy of the
Different Classifiers, label=table:MLAccuracyResults, pos=!htb, doinside=,
center, nostar ]m2.2cm m2cm m1.9cm m1.4cm m1.4cm m1.4cm Classifier Category
Precision Recall F1-score SupportRandomForest Benign (0) 1.00 1.00 1.00 1014
Infected (1) 1.00 1.00 1.00 986
Accuracy 1.00 2000
SVM Benign (0) 1.00 0.51 0.68 953
Infected (1) 0.69 1.00 0.82 1047
Accuracy 0.77 2000
MLPC Benign (0) 1.00 0.00 0.00 1021
Infected (1) 0.49 1.00 0.82 979
Accuracy 0.49 2000
IsolationForest Benign (0) 1.00 0.00 0.00 955
Infected (1) 0.57 0.75 0.65 1045
Accuracy 0.39 2000

In terms of accuracy, the RandomForest is the classifier with the best
performance, being able to correctly classify all the non-infected and
infected samples. All the models are able to classify the non-infected samples
but differ when classifying the infected samples, with MLPC providing the
worst performance in terms of precision and accuracy. Given such results, the
RandomForest is chosen as the classifier to be used in the Pipeline. The
results achieved with the ensemble modes like RandomForest and IsolationForest
are in line with the achieved results in SoA for anomaly detection [20]
(recall section 3.4.2).

###  5.2 MONDEO Pipeline Performance

The results in the MONDEO Pipeline are presented considering tests summarised
in Table LABEL:table:FilesEval, for three approaches: 1) DGAInt \- DGAIntel
without a feedback loop, 2) DGAInt-Fed \- DGAIntel with the feedback loop, 3)
DGADet \- DGA Detective without a feedback loop. It should be noted that the
samples are not balanced, Test #1 contains a majority of Infected samples
while Test #2 contains only Non-infected packets.

(a) Benign

(b) Infected

Figure 2:
Ratio of Packets Process per Test

Figures 2(a) and 2(b) show the percentage of packets by the phase they left
the pipeline in the three DGA approaches, for the Benign and Infected files.
In both cases, the use of the feedback loop in the DGAInt-Fed leads to higher
ratios of packets being processed at the blacklist phase - Phase 1. Also, as
expected the query analysis ratio in Phase 2 is able to identify a high
percentage of packets (above 58%). Phase 3 with the employment of DGA is also
responsible for classifying a significant portion of packets depending if the
file is benign or malign, above 70% and above 20%, respectively.

(a) Benign

(b) Infected

Figure 3:
Processing Time per Phase and Test

Figure 3(a) and 3(b) illustrate the processing time of packets in each phase.
The phase with higher processing time is the one associated with the
RandomForest ML model, as expected - Phase 4. Indeed the difference is around
60ms between the performance of Phase 1 and Phase 4, in the Benign and
Infected files. In Figure 3(a) there are also some flagged packets that are
classified as belonging to malicious requests. In the same line as the ML
model, Phase 3 is also the one that takes more time due to the invocation of
the DGA algorithms. In the Infected test case, as depicted in Figure 3(b), the
use of the feedback loop introduces additional processing, which impacts
processing time in Phase 3 and Phase 4. The lower times in Phase 1 and Phase 2
demonstrate the relevance of supporting these filtering functionalities
towards highly efficient filtering approaches, with the possibility of being
incorporated into existing security mechanisms like firewalls.

###  5.3 MONDEO Pipeline Overhead

This subsection details the overhead results of the pipeline in terms of used
resources: CPU, memory and the exchanged traffic in each approach.

Figure 4: CPU usage ratio

The reported values for the CPU and memory utilisation are obtained from the
docker statistics, each was collected in regular intervals (each 2s) during
the experiments.

Figure 4 depicts the CPU utilisation ratio in the diverse tests. The
approaches, leading to higher CPU utilisation are the ones that do not use the
feedback loop, namely the DGAInt and the DGADet. The reason is associated with
a higher number of packets being processed in Phase 3 and Phase 4, as
previously discussed.

Figure 5: Memory usage ratio

As depicted in Figure 5, the memory usage ratio is low (below 6%) in all the
tests. The difference between the Benign and Infected files is neglectable
(below 0.1%), which demonstrates that MONDEO has a low memory footprint,
despite having high ratios of CPU usage.

Figure 6: Input and output overhead in bytes

Figure 6 depicts the impact regarding the exchanged traffic within each test.
This metric translates the amount of information (packets) that is sent to the
dockers where MONDEO is implemented and the respective answers. According to
the evaluated scenario, there is a tendency to have less exchange of
information with the feedback loop. This is due to the fact of avoiding
communication with the docker running the DGA service, impacting, therefore
the input and output traffic in both containers.

##  6 Conclusions

This paper proposes and validates MONDEO as a multistage approach for botnet
detection, targeting malware relies on the DNS protocol and DGA obfuscation
technique. MONDEO is a flexible and scalable mechanism that does not require
software deployment or configuration in mobile devices. Thus, it is suitable
to be implemented by network operators to combat such types of malware.

MONDEO relies on well-known detection approaches employed for botnet
detection, such as DGA and flow information characteristics, to process
streams of packets with high efficiency. MONDEO also supports white and
blacklist that can use feedback loops to improve efficiency.

The evaluation results demonstrate the suitability of MONDEO to be deployed in
network infrastructures of operators with minimal overhead and with accurate
precision levels.

Our next steps focus on the integration of policies and defence mechanisms,
such that the results are mapped to mitigation tactics. Examples include
blacklisting devices, and enabling dynamic policies through policy control. In
addition, we will work with encrypted DNS traffic that is transmitted using
HTTPS protocol.

## Acknowledgments

This work is funded by project AIDA (POCI-01-0247-FEDER045907), co-financed by
the European Regional Development Fund (ERDF) through the Operational Program
for Competitiveness and Internationalisation (COMPETE 2020) and by the
Portuguese Foundation for Science and Technology (FCT) under CMU Portugal.
This work is funded by the FCT - Foundation for Science and Technology,
I.P./MCTES through national funds (PIDDAC), within the scope of CISUC R&D Unit
- UIDB/00326/2020 or project code UIDP/00326/2020.

## References

  * [1] Google, “Google play protect,” https://developers.google.com/android/play-protect, Last visit 2022-09-08.
  * [2] Apple, “App security overview,” https://support.apple.com/guide/security/app-security-overview-sec35dd877d0/web, Last visit 2022-09-08, May 2022.
  * [3] A. Qamar, A. Karim, and V. Chang, “Mobile malware attacks: Review, taxonomy & future directions,” _Future Generation Computer Systems_ , vol. 97, pp. 887–909, 2019.
  * [4] R. Mallarapu, https://github.com/sudo-rushil/dgaintel, Last Visit: 2022-08-08, 2020\.
  * [5] TNO, “Dga detective,” https://github.com/COSSAS/dgad, Last Visit: 2022-08-08, 2020\.
  * [6] A. Bilal, “Flubot malware analysis report,” https://github.com/prodaft/malware-ioc/blob/master/FluBot/FluBot.pdf, March 2021\.
  * [7] C. S. Lyman Chapin, David Priscillo, “Malware landscape 2022 a study of the scope and distribution of malware,” https://interisle.net/MalwareLandscape2022.pdf, June 2022.
  * [8] M. Singh, M. Singh, and S. Kaur, “Issues and challenges in DNS based botnet detection: A survey,” _Computers & Security_, vol. 86, pp. 28–52, 2019\.
  * [9] S. Almutairi, S. Mahfoudh, S. Almutairi, and J. S. Alowibdi, “Hybrid Botnet Detection Based on Host and Network Analysis,” _Journal of Computer Networks and Communications_ , vol. 2020, 2020.
  * [10] K. Wang, C.-Y. Huang, L.-Y. Tsai, and Y.-D. Lin, “Behavior-based botnet detection in parallel,” _Security and Communication Networks_ , vol. 7, no. 11, pp. 1849–1859, 2014.
  * [11] W. Wang, Y. Shang, Y. He, Y. Li, and J. Liu, “BotMark: Automated botnet detection with hybrid analysis of flow-based and graph-based traffic behaviors,” _Information Sciences_ , vol. 511, pp. 284–296, 2020.
  * [12] P. V. Ansam Khraisat, Iqbal Gondal and J. Kamruzzaman, “Survey of intrusion detection systems: techniques, datasets and challenges,” _Cybersecurity 2_ , vol. 1, no. 20, 2019.
  * [13] M. Wazzan, D. Algazzawi, O. Bamasaq, A. Albeshri, and L. Cheng, “Internet of things botnet detection approaches: Analysis and recommendations for future research,” _Applied Sciences (Switzerland)_ , vol. 11, no. 12, 2021.
  * [14] Y. Xing, H. Shu, H. Zhao, D. Li, and L. Guo, “Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation,” _Mathematical Problems in Engineering_ , vol. 2021, p. 6640499, 2021.
  * [15] L. Rosa, T. Cruz, M. B. de Freitas, P. Quitério, J. Henriques, F. Caldeira, E. Monteiro, and P. Simões, “Intrusion and anomaly detection for the next-generation of industrial automation and control systems,” _Future Generation Computer Systems_ , vol. 119, pp. 50–67, 2021\.
  * [16] H. Salsabila, S. Mardhiyah, and R. B. Hadiprakoso, “Flubot malware hybrid analysis on android operating system,” in _2022 International Conference on Informatics, Multimedia, Cyber and Information System (ICIMCIS)_. IEEE, 2022, pp. 202–206.
  * [17] J. Bellizzi, M. Vella, C. Colombo, and J. Hernandez-Castro, “Responding to targeted stealthy attacks on android using timely-captured memory dumps,” _IEEE Access_ , vol. 10, pp. 35 172–35 218, 2022.
  * [18] I. Chiscop, F. Soro, and P. Smith, “Ai-based detection of dns misuse for network security,” in _Proceedings of the 1st International Workshop on Native Network Intelligence_ , 2022, pp. 27–32.
  * [19] H. Target, https://hackertarget.com/top-million-site-list-download/, Last visit 2021-09-08, July 2020.
  * [20] M. U. Togbe, M. Barry, A. Boly, Y. Chabchoub, R. Chiky, J. Montiel, and V.-T. Tran, “Anomaly detection for data streams based on isolation forest using scikit-multiflow,” in _Computational Science and Its Applications – ICCSA 2020_ , O. Gervasi, B. Murgante, S. Misra, C. Garau, I. Blečić, D. Taniar, B. O. Apduhan, A. M. A. C. Rocha, E. Tarantino, C. M. Torre, and Y. Karaca, Eds. Cham: Springer International Publishing, 2020, pp. 15–30.
  * [21] O. Rybakov, N. Kononenko, N. Subrahmanya, M. Visontai, and S. Laurenzo, “Streaming keyword spotting on mobile devices,” in _Interspeech 2020_. ISCA, oct 2020.
  * [22] S. Trotta, D. Weber, R. W. Jungmaier, A. Baheti, J. Lien, D. Noppeney, M. Tabesh, C. Rumpler, M. Aichner, S. Albel, J. S. Bal, and I. Poupyrev, “2.3 soli: A tiny device for a new human machine interface,” in _2021 IEEE International Solid- State Circuits Conference (ISSCC)_ , vol. 64, 2021, pp. 42–44.


11institutetext: Department of Physics, Huazhong University of Science and
Technology, Wuhan 430074, China

# TDE associated with the QPEs from GSN 069: disruption of a common envelope?

Di Wang

###### Abstract

Context.  X-ray quasi-periodic eruptions(QPEs) from galactic nucleus have been
found in several galaxies. Among them, GSN 069 is the only one with a tidal
disruption event(TDE), which was recently found to have brightened again 9
years after the main outburst.

Aims. However, the origin of this TDE is still unclear.

Methods. By comparing the fallback time with observation, we found it can not
be the disruption of the envelope of a single star in the tidal stripping
model. Thus, we suggest that it is a disruption of a common envelope(CE).

Results. By calculating the fallback rate of such a model, we reproduce the
second peak in the observational TDE. If this model is true, this TDE will be
the closest one to a direct observation of CE.

##  1 Introduction

GSN 069 is the first galaxy found to have X-ray quasi-periodic
eruptions(QPEs), which originate in the region around the supermassive black
hole(SMBH) (Miniutti et al., 2019). The nature of the QPEs is still unclear.
The most competitive model is the tidal stripping model suggested by King
(2020). The eruptions are produced by SMBH accretion of material which is
stripped from a star moving around the SMBH at the periastron. The star can be
the white dwarf(WD), main-sequence star, or the evolved star Zhao et al.
(2022); King (2022); Chen et al. (2022). In such a model, QPEs from GSN 069
are produced from a WD-SMBH system with high eccentricity(King, 2020; Wang et
al., 2022).

Although QPEs have since been seen in other galaxies (Giustini et al., 2020;
Song et al., 2020a; Arcodia et al., 2021; Chakraborty et al., 2021), GSN 069
remains the most special one. It is the only galaxy with QPEs that is
associated with a TDE, which is found to be re-brightening after 9yr since the
main peak appeared (Miniutti et al., 2023).

The origin of this TDE is puzzling. Wang et al. (2022) suggested that the WD
orbiting SMBH is captured from a binary system via Hill mechanism (Hills,
1988), and then the TDE is produced by the disruption of the envelope of the
progenitor of the WD. However, Miniutti et al. (2023) argued that the
disrupted mass estimated from the light curve is much larger than the mass of
a typical WD envelope. The disruption of the remaining material of the WD can
not explain the second peak, the timescale of which is much longer than
predicted.

In this Letter, we found that the disruption of the envelope of a single star
always predicts a much shorter timescale than the observation in the WD-SMBH
model with the Hill mechanism, which is shown in Section 2. So we suggest the
TDE from GSN 069 is the disruption of a common envelope(CE), and calculate its
fallback rate in Section 3. We apply this model on GSN 069 in Section 4 and
make discussions in Section 5.

##  2 TDE of the envelope of single star

The fallback timescale of TDE is determined by the specific binding energy of
the most bound material

$t_{fb}=2\pi GM_{\mathrm{BH}}(-2\epsilon)^{-3/2},$ (1)

where the $G$ is the gravitational constant, $M_{\mathrm{BH}}$ is the mass of
the supermassive black hole, and $\epsilon$ is the specific binding energy.

The specific binding of the most bound debris is

$\epsilon\approx\epsilon_{i}+\frac{GM_{\mathrm{BH}}}{R_{t}^{2}}R_{*},$ (2)

where $R_{t}$ is the disrupted radius and $R_{*}$ is the radius of the
disrupted star, $\epsilon_{i}$ is the specific binding energy of the disrupted
star and is equal to zero for a parabolic orbit.

If the TDE from GSN 069 is the disruption of an evolved star after it is
captured, $\epsilon_{i}$ is equal the specific binding energy of the orbiting
WD. Then the fallback timescale of the TDE is smaller than the orbital period
of the WD, which is the period of QPEs, about 9 hrs (Miniutti et al., 2019).
It is much smaller than the observational timescale of the TDE from GSN 069,
about 1000 days (Miniutti et al., 2023).

So the disruption must occur before the capture of the WD. In this case, the
velocity of the disrupted envelope contains two components: the orbital
velocity of the disrupted star $v_{*}$ and the velocity of the binary $v_{b}$
relative to the SMBH. Assuming the binary is in a parabolic orbit, the
specific binding energy of the disrupted star is

$\epsilon_{i}\approx v_{*}v_{b}\cos\theta,$ (3)

where $\theta$ is the angle between $v_{*}$ and $v_{b}$. The $v_{*}^{2}/2$
term is ignored.

The capture of the WD corresponds to the $\theta\approx-\pi$, so the timescale
corresponding to the specific binding energy $\epsilon_{i}\approx-v_{*}v_{b}$
is the orbital period of captured WD. Because $v_{*}v_{b}$ is much higher than
the second term in the Eq. 2 and leads to a positive binding energy. If
$\theta$ is close to $0$, corresponding to the situation that the disrupted
star is the companion of the progenitor of the captured WD, the disrupted
envelope will be fully unbound. So to produce the observational long
timescale, the angle $\theta$ must be close to $\pi/2$.

Assuming the WD is captured at the periastron, the disrupted distance needs to
be large enough to ensure the angle $\theta$ close to $\pi/2$. The capture
distance is (Amaro-Seoane, 2018)

$R_{H}=\left(\frac{M_{\mathrm{BH}}}{m_{b}}\right)^{1/3}a_{b}.$ (4)

Here $m_{*}$ and $m_{c}$ are the mass of the disrupted star and its companion,
respectively. $m_{b}=m_{*}+m_{c}$ is the total mass of the binary, and $a_{b}$
is the separation of the binary.

The disrupted radius is (Gezari, 2021)

$R_{t}=\left(\frac{M_{\mathrm{BH}}}{m_{*}}\right)^{1/3}R_{*}.$ (5)

So the ratio of them is

$\frac{R_{t}}{R_{H}}=\left(\frac{m_{*}+m_{c}}{m_{*}}\right)^{1/3}\frac{R_{*}}{a_{b}},$
(6)

which is independent of the mass of the SMBH. To avoid the disruption of the
evolved star by the companion, the separation needs to satisfy

$a_{b}>\left(\frac{M_{c}}{m_{*}}\right)^{1/3}R_{*}.$ (7)

And the companion is outside the envelope of the evolved star, requiring

$a_{b}>R_{*}+R_{c}.$ (8)

The above two conditions together give the upper limit of $R_{t}/R_{H}$. As
shown in Fig. 1, $R_{t}$ can be larger than $R_{H}$ when the companion is much
more compact than the disrupted star. And the maximum $R_{t}$ is about
$1.25R_{H}$.

Figure 1: The value of $R_{t}/R_{H}$ for the companion star of various
densities and masses. Here $\rho_{c}$ and $\rho_{*}$ is the average density of
the companion and the disrupted star, respectively. The solid line represents
$R_{t}/R_{H}=1$.

The time for the binary to move from distance $R_{t}$ to periastron $R_{H}$ is

$t=-\frac{\frac{1}{2}\tan\frac{f}{2}+\frac{1}{6}\tan^{3}\frac{f}{2}}{\bar{n}},$
(9)

where $f$ is true anomaly, can be obtained by
$\sec^{2}\frac{f}{2}=R_{t}/R_{H}$ ($f$ is negative). And $\bar{n}$ is averaged
angular velocity

$\bar{n}=\sqrt{\frac{GM_{\mathrm{BH}}}{8R_{H}^{3}}}=\sqrt{\frac{G(m_{*}+m_{c})}{8a_{b}^{3}}}=\frac{n_{b}}{2\sqrt{2}}.$
(10)

Here $n_{b}=\sqrt{G(m_{*}+m_{c})/a_{b}^{3}}$ is the angular velocity of the
binary. So the change of angle caused by orbital motion in the binary is

$\Delta\theta=-n_{b}t=\sqrt{2}\tan\frac{f}{2}+\frac{\sqrt{2}}{3}\tan^{3}\frac{f}{2}.$
(11)

Fig. 1 gives an upper limit of $R_{t}/R_{H}$ about 1.25, which corresponds to
a minimum $f$. So the maximum $\Delta\theta$ can be obtained by Eq. 11 and is
about 0.766 rad. Due to the maximum of $R_{t}/R_{H}$ being small, the change
in the direction of the orbital velocity of the binary in the parabolic orbit
can be ignored. So the change of $\theta$ in Eq. 3 roughly equal to
$\Delta\theta$.

Such an angle corresponds to $\epsilon_{i}\approx-0.72v_{*}v_{b}$. Combined
with $t_{fb}\sim(-\epsilon)^{-3/2}$, the maximum timescale of TDE in this
situation is about 1.6 times than the orbital period of the captured WD, still
much smaller than the observational value.

Now, we can safely rule out the situations that TDE from GSN 069 is the
disruption of the envelope of either of the stars in the binary. The one
remaining possible scenario is that it is the disruption of a CE that contains
the double stars in it. In this scenario, the velocity of the envelope is the
orbital velocity, and $\epsilon_{i}$ is zero for a parabolic orbit. So the
observational timescale of the TDE can be easily produced.

##  3 TDE of the CE

The structure of the CE is still unclear (Ivanova et al., 2013). Here we only
consider the effect of the differential rotation of the CE. We adopt a similar
model with the early works111The previous works use a 1D model in the
spherical coordinate, where the rotational velocity only depends on the
distance to the centre. The following calculations need the full structure of
the CE. Thus, we adopt the cylindrical coordinate and assume that the
rotational velocity only depends on the distance to the rotational axis.
(Meyer & Meyer-Hofmeister, 1979; Meng & Podsiadlowski, 2017; Song et al.,
2020b). The envelope is co-rotating with the binary at the centre and then
decays power-law outwards. The rotational angular velocity can be described by

$\Omega=\cases{\Omega}_{0},&s\leq s_{0}\\\
\Omega_{0}\left(\frac{s}{s_{0}}\right)^{-\alpha},s>s_{0}{}$ (12)

where the $s$ is the distance to the rotational axis, $s_{0}$ and $\Omega_{0}$
are the distance and the rotational angular velocity at the boundary of the
binary.

###  3.1 Effect of rotation on specific binding energy

Under the frozen-in approximation, the fallback rate of the TDE is (Gezari,
2021)

$\dot{M}=\frac{dM}{d\epsilon}\frac{d\epsilon}{dt}=\frac{2\pi}{3}\left(GM_{\mathrm{BH}}\right)^{2/3}\frac{dM}{d\epsilon}t^{-5/3}.$
(13)

It strongly depends on the distribution of the specific binding energy in the
star.

The rotation can affect the specific binding energy by providing an additional
speed. Assuming the centre of mass(COM) is on a parabolic orbit, the specific
binding energy with rotation is (Golightly et al., 2019)

$\epsilon\approx\left(\@vec{v}\times\@vec{\Omega}+\frac{GM_{\mathrm{BH}}}{R_{t}^{3}}\<EMAIL_ADDRESS>(14)

Here $\@vec{v}$ and $\@vec{R_{t}}$ are the velocity and the position of the
COM relative to the central black hole while the star begins to be disrupted,
respectively. And $\@vec{\Omega}$ is the rotational angular velocity,
$\@vec{r}$ is the position within the star relative to the COM. Only the
lowest order of the rotation is considered in this letter.

The specific binding energy can also be viewed as a projection of the position
$\@vec{r}$ in the direction
$\@vec{R}_{P}=\@vec{v}\times\@vec{\Omega}+\frac{GM_{\mathrm{BH}}}{R_{t}^{3}}\@vec{R}_{t}$,
only depends on the projection distance. For the case of the rigid rotation,
the projection vector $\@vec{R}_{P}$ is independent of the position
$\@vec{r}$, as in the case of no rotation ($\@vec{\Omega}=0$). Thus, the star
with rigid rotation has a similar distribution of the specific binding energy
with the star without rotation. Both of them have isoenergetic surfaces that
are the plane perpendicular to the projection vector $\@vec{R}_{P}$, only the
magnitude of the specific binding energy is different. So the disruption of
the star with rigid rotation has a similar evolution of the fallback rate with
the star without rotation, as shown in Golightly et al. (2019).

If the rotation is differential, the projection vector $\@vec{R}_{P}$ is
dependent on the position $\@vec{r}$, then the equipotential surfaces are no
longer planar but curved, which depends on the distribution of the rotation
$\@vec{\Omega}$.

Here we consider a simple case. A CE with mass $M_{*}$ and radius $R_{*}$ is
disrupted at the periastron, and the direction of rotation is perpendicular to
the orbital plane, which means that the $\hat{v}$, $\hat{\Omega}$ and
$\hat{R}_{t}$ are perpendicular to each other. With $\hat{\Omega}$ as the
z-axis and $\hat{R}_{t}$ as the x-axis, using the cylindrical coordinate
$(s,\phi,z)$, the equation 14 can be rewritten as

$\displaystyle\epsilon$
$\displaystyle=s\left(\frac{GM_{\mathrm{BH}}}{R_{t}^{2}}+\Omega
v\right)\cos\phi$ (15)
$\displaystyle=\epsilon_{0}\bar{s}(1+k\bar{s}^{-\alpha})\cos\phi.$

Here $\bar{s}\equiv s/R_{*}$ is the normalized distance. And
$\epsilon_{0}\equiv GM_{\mathrm{BH}}R_{*}/R_{t}^{2}$ is the standard specific
binding energy of the star without rotation. Here we assume that the
distribution of the rotation is power law, e.g.
$\Omega=\Omega_{s}\bar{s}^{-\alpha}$, where the $\Omega_{s}$ is the rotational
velocity on the surface of the envelope. The parameter $k$ is

$\displaystyle k$
$\displaystyle\equiv\frac{\Omega_{s}v}{(GM_{\mathrm{BH}}/R_{t}^{2})}=\Omega_{s}\sqrt{\frac{2R_{t}^{3}}{GM_{\mathrm{BH}}}}$
(16)
$\displaystyle=\sqrt{2}\frac{\Omega_{s}}{\Omega_{*}}=k_{0}\bar{s}_{0}^{\alpha-\frac{3}{2}},$

where $k_{0}\equiv\sqrt{2M_{c}/M_{*}}$. In the derivation of the above
equation, the velocity of the parabolic orbit
$v=\sqrt{2GM_{\mathrm{BH}}/R_{t}}$, and the disrupted radius
$R_{t}=(M_{\mathrm{BH}}/M_{*})^{1/3}R_{*}$ is adopted. And
$\Omega_{*}\equiv\sqrt{GM_{*}/R_{*}^{3}}$ is the break-up rotation velocity of
the star.

Figure 2: The distribution of $\bar{\epsilon}$ with $k_{0}=1$,
$\bar{s}_{0}=0.1$ and $\alpha=3$. The red star is the stationary point, and
the corresponding $\bar{\epsilon}$ is represented by the dash line.

We show an example of $\bar{\epsilon}$ distribution with $k_{0}=1$,
$\bar{s}=0.1$ and $\alpha=3$ in Fig. 2, and only care about the regions with
$\bar{\epsilon}<0$. There is a stationary point near which the change in
$\bar{\epsilon}$ slows down. The isoenergetic surface through this point
delineates the distribution of $\bar{\epsilon}$ into three regions. The
smallest $\bar{\epsilon}$ is found close to the core, followed by those close
to the SMBH, and finally the highest $\bar{\epsilon}$ is distributed on the
sides. A smaller gradient of $\bar{\epsilon}$ near the stationary point
predicts a higher $\mathrm{d}M/\mathrm{d}\epsilon$ here and therefore a peak
in the fallback rate here.

This position of the stationary point can be obtained by solving the minimum
value of the equation 15 with $\cos\phi=-1$,

$\displaystyle\bar{s}_{p2}$ $\displaystyle=(k(\alpha-1))^{1/\alpha},$ (17)

which corresponds to the specific binding energy

$\bar{\epsilon}_{p2}=-\frac{\alpha(k(\alpha-1))^{1/\alpha}}{\alpha-1}.$ (18)

Then the time of the second peak can be obtained by Eq. 1. For the given
$\alpha>1$, The higher $k$ predicts the earlier peak.

###  3.2 Fallback rate

The mass of disrupted star can be expressed as
$M=\iiint\rho\bar{s}\,\mathrm{d}\bar{s}\mathrm{d}\bar{z}\mathrm{d}\phi$. By
transformation from cylindrical coordinate $(\bar{s},\phi,\bar{z})$ to
coordinate $(\bar{s},\bar{\epsilon},\bar{z})$, it becomes

$\displaystyle\frac{\mathrm{d}M}{\mathrm{d}\epsilon}$
$\displaystyle=\frac{-2}{\epsilon_{0}}\iint\left|\frac{\partial(\bar{s},\phi,\bar{z})}{\partial(\bar{s},\bar{\epsilon},\bar{z})}\right|\rho\bar{s}\,\mathrm{d}\bar{s}\mathrm{d}\bar{z}$
(19)
$\displaystyle=\frac{2}{\epsilon_{0}}\int\frac{\rho_{z}\bar{s}}{\sqrt{\bar{s}^{2}(1+k\bar{s}^{-\alpha})^{2}-\bar{\epsilon}^{2}}}\,\mathrm{d}\bar{s}.$

Here $\rho_{z}\equiv\int\rho\mathrm{d}z$ is the column density. Then the
fallback rate can be obtained by Eq. 13. Here we show fallback rate with
$R_{*}=1\,R_{\odot}$, $M_{*}=1\,M_{\odot}$,
$M_{\mathrm{BH}}=10^{6}\,M_{\odot}$, $\alpha=3$ and $k_{0}=1$ in Fig. 3. The
disrupted star is assumed to be spherical, and the density is assumed to be
constant.

Figure 3: Fallback rate for the different rotation. Comparing the case of no
rotation, the disruption of envelope with differential rotation shows a second
peak in the decay phase. The larger the core, the earlier the peak appears.
The earlier fallback with differential rotation is caused by the innermost
material, which have the lowest specific binding energy.

Comparing the curve of the envelope without rotation, the disruption of the
envelope with differential rotation as expected shows a second peak. A larger
core leads to the stationary point further away from the core, thus producing
earlier peaks that are also stronger. Before this peak appears, the curve
decays similarly to the case without rotation, due to the small rotation of
the material in the outer layers of the disrupted envelope. The fallback
before the main peak is the accretion of the innermost material, which has the
smallest binding energy.

##  4 Application on the TDE from GSN 069

Although our calculated fallback rate reproduces the second peak of the
observational light curve, direct comparison between them is inappropriate.

Under frozen-in approximation, pressure and self-gravity in the accretion flow
are neglected. In Fig. 3 it can be seen that the material in the core is the
first to fallback, and they may interact with material near the stationary
point thereby exchanging energy, which leads to the broadening of the second
peak. And since the stationary point corresponds to a region of high density
in the accretion flow, self-gravity could potentially lead to self-bound of
the material around the stationary point and thus narrowing of the second
peak. However, these effects only affect the shape of the second peak and not
the time of its appearance.

The gravitation of the core significantly affects the fallback curve and can
make it go from a -5/3 decay to a -9/4 decay, which is the curve of a partial
tidal disruption event (Coughlin & Nixon, 2019). But this effect is global, so
it shouldn’t significantly affect the relative time of the appearance of the
second peak versus the main peak.

The density distribution of the disrupted envelope also significantly affects
the fallback curve. The realistic density distribution of the CE should be
quite different from the constant density we assumed. Although its exact
distribution is not known, the stationary point that appears in the specific
binding energy distribution will still produce a peak in the fallback rate
curve as long as the density distribution is relatively smooth.

Therefore, the only parameter that can be used to make comparisons with
observations is the relative time between the appearance of the second peak
and the main peak. The specific binding energy of the most bound material is
$\bar{\epsilon}_{p1}=-(1+k)$ by Eq. 15. The ratio of the fallback time between
the main peak and the second peak is

$\frac{t_{p2}}{t_{p1}}=\left(\frac{\bar{\epsilon}_{p2}}{\bar{\epsilon}_{p1}}\right)^{-3/2}=\left(\frac{\alpha(k(\alpha-1))^{1/\alpha}}{(\alpha-1)(1+k)}\right)^{-3/2},$
(20)

which only depends on the rotation distribution of the CE.

Miniutti et al. (2023) have fitted the light curve of the two peaks of the TDE
from GSN 069 using a formula of Gaussian rise plus power-law decay with index
-9/4. They found $t^{obs}_{p1}\simeq 500-800\mathrm{\leavevmode\nobreak\ d}$
and $t^{obs}_{p2}\simeq 3750-3900\mathrm{\leavevmode\nobreak\ d}$. We adopt
their median value and obtain $(t_{p2}/t_{p1})_{obs}\simeq 4.7-7.8$.

They found the accreted mass is about $M_{\mathrm{accr}}=0.23M_{\odot}$ by
integrating the light curve as well. So the mass of the disrupted envelope is
about $0.46M_{\odot}$ considering the unbound material. The mass of WD is
about $0.21M_{\odot}$(King, 2020). Assuming the companion has a similar mass
with the WD, we have $k_{0}=1$.

Figure 4: Constraint on the rotation decay index $\alpha$ and the relative
scale of the core $\bar{s}_{0}$. Two solid line represent
$(t_{p2}/t_{p1})_{obs}=$ 4.7 and 7.8. The area they enclose is the constrained
region of the parameters.

Now the rotation distribution can be constrained. As shown in Fig. 4, rotation
decay index $\alpha$ and the relative scale of core $\bar{s}_{0}$ is
constrained in a narrow region. If $\alpha$ is taken as 3 suggested by Meyer &
Meyer-Hofmeister (1979), $\bar{s}_{0}$ is about 0.02. The radius of the
envelope can be obtained by the fallback time $R_{*}\simeq 5-12R_{\odot}$
(Miniutti et al., 2023). Thus, the separation of the binary in the core is
about $11-26R_{\oplus}$.

As discussions in the section 2, the TDE occurs before the capture of the WD
at the periastron. So the $\hat{v}$ is no longer perpendicular to
$\hat{R}_{t}$ when the envelope is disrupted. However, it only slightly
affects the constraint on the rotation disruption. Detailed calculations are
shown in Appendix A.

##  5 Discussion

While the TDE of CE can explain the second peak of the light curve of GSN 069,
there is also a serious issue that the lifetime of CE is very short, and the
probability that we will see such events directly is very low. Simulations
show that the maximum lifetime is only about $10^{5}$ times the orbital period
of the binary in the core(Gagnier & Pejcha, 2023). This timescale is only 273
years for a 1-day orbital period.

Another possibility is that the disrupted envelope is a circumbinary disk,
which might be formed by the remaining material in the post-CE stage(Ivanova
et al., 2013). If so, the circumbinary disk must not be a Keplerian disk,
because it would be disrupted by very slight tidal force.

To understand the detailed nature of the disrupted envelope, hydrodynamics
simulations are necessary. Not only do the curves need to take into account
the interactions between the accreted material, but also the realistic density
and rotation distributions of the CE need to be simulated. If it can be
confirmed that the TDE from GSN 069 is a disruption of CE, then it is the
closest one can get to a direct observation of the CE.

Our model also strongly relies on the validity of the tidal stripping model
with the Hill mechanism. However, there are some alternative models for QPEs
(Ingram et al., 2021; Pan et al., 2022; Xian et al., 2021; Franchini et al.,
2023; Lu & Quataert, 2023). Future improvements in the understanding of the
QPEs are very important for checking our model.

On the other hand, some other TDEs are having a re-brightening peak (Jiang et
al., 2019; Wevers et al., 2023; Malyali et al., 2023). Our model provides an
alternative interpretation for such TDEs. Furthermore, our model also can
produce a third peak if the disrupted envelope is in an eccentric orbit, which
will make the binding energy of the stationary point further away from SMBH
positive.

###### Acknowledgements.

This work was supported by the National Key Research and Development Program
of China(No. 2020YFC2201400) and National SKA Program of China
(2020SKA0120300).

## References

  * Amaro-Seoane (2018) Amaro-Seoane, P. 2018, Living Reviews in Relativity, 21, 4
  * Arcodia et al. (2021) Arcodia, R., Merloni, A., Nandra, K., et al. 2021, Nature, 592, 704
  * Chakraborty et al. (2021) Chakraborty, J., Kara, E., Masterson, M., et al. 2021, The Astrophysical Journal Letters, 921, L40
  * Chen et al. (2022) Chen, X., Qiu, Y., Li, S., & Liu, F. 2022, The Astrophysical Journal, 930, 122
  * Coughlin & Nixon (2019) Coughlin, E. R. & Nixon, C. 2019, The Astrophysical Journal Letters, 883, L17
  * Franchini et al. (2023) Franchini, A., Bonetti, M., Lupi, A., et al. 2023, Astronomy & Astrophysics, 675, A100
  * Gagnier & Pejcha (2023) Gagnier, D. & Pejcha, O. 2023, Astronomy & Astrophysics, 674, A121
  * Gezari (2021) Gezari, S. 2021, Annual Review of Astronomy and Astrophysics, 59, 21
  * Giustini et al. (2020) Giustini, M., Miniutti, G., & Saxton, R. D. 2020, Astronomy & Astrophysics, 636, L2
  * Golightly et al. (2019) Golightly, E. C., Coughlin, E. R., & Nixon, C. 2019, The Astrophysical Journal, 872, 163
  * Hills (1988) Hills, J. G. 1988, Nature, 331, 687
  * Ingram et al. (2021) Ingram, A., Motta, S. E., Aigrain, S., & Karastergiou, A. 2021, Monthly Notices of the Royal Astronomical Society, 503, 1703
  * Ivanova et al. (2013) Ivanova, N., Justham, S., Chen, X., et al. 2013, The Astronomy and Astrophysics Review, 21, 1
  * Jiang et al. (2019) Jiang, N., Wang, T., Mou, G., et al. 2019, The Astrophysical Journal, 871, 15
  * King (2020) King, A. 2020, Monthly Notices of the Royal Astronomical Society: Letters, 493, L120
  * King (2022) King, A. 2022, Monthly Notices of the Royal Astronomical Society, 515, 4344
  * Lu & Quataert (2023) Lu, W. & Quataert, E. 2023, Monthly Notices of the Royal Astronomical Society, 524, 6247
  * Malyali et al. (2023) Malyali, A., Liu, Z., Rau, A., et al. 2023, Monthly Notices of the Royal Astronomical Society, 520, 3549
  * Meng & Podsiadlowski (2017) Meng, X. & Podsiadlowski, P. 2017, Monthly Notices of the Royal Astronomical Society, 469, 4763
  * Meyer & Meyer-Hofmeister (1979) Meyer, F. & Meyer-Hofmeister, E. 1979, Astronomy and Astrophysics, vol. 78, no. 2, Sept. 1979, p. 167-176., 78, 167
  * Miniutti et al. (2023) Miniutti, G., Giustini, M., Arcodia, R., et al. 2023, Astronomy and Astrophysics, 670, A93
  * Miniutti et al. (2019) Miniutti, G., Saxton, R., Giustini, M., et al. 2019, Nature, 573, 381
  * Pan et al. (2022) Pan, X., Li, S.-L., Cao, X., Miniutti, G., & Gu, M. 2022, The Astrophysical Journal Letters, 928, L18
  * Song et al. (2020a) Song, J., Shu, X., Sun, L., et al. 2020a, Astronomy & Astrophysics, 644, L9
  * Song et al. (2020b) Song, R., Meng, X., Podsiadlowski, P., & Cui, Y. 2020b, Astronomy & Astrophysics, 633, A41
  * Wang et al. (2022) Wang, M., Yin, J., Ma, Y., & Wu, Q. 2022, The Astrophysical Journal, 933, 225
  * Wevers et al. (2023) Wevers, T., Coughlin, E., Pasham, D., et al. 2023, The Astrophysical Journal Letters, 942, L33
  * Xian et al. (2021) Xian, J., Zhang, F., Dou, L., He, J., & Shu, X. 2021, The Astrophysical Journal Letters, 921, L32
  * Zhao et al. (2022) Zhao, Z., Wang, Y., Zou, Y., Wang, F., & Dai, Z. 2022, Astronomy & Astrophysics, 661, A55

##  Appendix A The disruption before reaching periastron

If the disruption occurs before the envelope reaches the periastron, i.e.,
$\beta\equiv R_{t}/R_{p}>1$. In this case, $\hat{v}$ is no longer
perpendicular to $\hat{R}_{t}$ when the envelope is disrupted. Assuming it
rotates in the direction of $\hat{R}_{t}$ by an angle $\gamma$, then Eq. 15
becomes

$\epsilon=\epsilon_{0}\bar{s}(\cos\phi+k\bar{s}^{-\alpha}\cos(\phi+\gamma)).$
(21)

For a parabolic orbit, $\gamma$ can be obtained by

$\sin\gamma=\frac{\sqrt{\beta}}{2}\sin f,$ (22)

where true anomaly $f$ is obtained by $\cos f=2/\beta-1$.

Figure 5: Same as Fig. 2, but with $\beta=10$. Figure 6: Same as Fig. 4, but
with $\beta=10$.

As shown in Fig. 5, the $\bar{\epsilon}$ distribution with $\beta=10$ is
rotated compared with the distribution with $\beta=1$. The position of the
stationary can be obtained by solving

$\displaystyle\frac{\partial\bar{\epsilon}}{\partial\bar{s}}$
$\displaystyle=\bar{s}^{-\alpha}\left[(1-\alpha)k\cos(\phi+\gamma)+\bar{s}^{\alpha}\cos\phi\right]=0$
(23) $\displaystyle\frac{\partial\epsilon}{\bar{s}\partial\phi}$
$\displaystyle=-k\bar{s}^{-\alpha}\sin(\phi+\gamma)-\sin\phi=0.$

Then the time of the second peak can be obtained by the corresponding
$\epsilon$. As shown in the Fig. 6, the constraint on the rotation
distribution with $\beta=10$ gives slightly smaller $\alpha$ and slightly
larger $\bar{s}$ than those with $\beta=1$.