# Erratum and addendum to the paper: Abundance for Kähler threefolds

Frédéric Campana  ,  Andreas Höring  and  Thomas Peternell  Frédéric Campana,
Institut Elie Cartan, Université Henri Poincaré, BP 239, F-54506. Vandoeuvre-
les-Nancy Cédex, et: Institut Universitaire de France
<EMAIL_ADDRESS>Andreas Höring, Laboratoire de Mathématiques
J.A. Dieudonné, UMR 7351 CNRS, Université de Nice Sophia-Antipolis, 06108 Nice
Cedex 02, France<EMAIL_ADDRESS>Thomas Peternell, Mathematisches Institut,
Universität Bayreuth, 95440 Bayreuth, Germany  thomas.peternell@uni-
bayreuth.de

(Date: April 20, 2023)

###### Abstract.

In this text we signal a serious gap in the proof of the main theorem of our
paper and explain which parts of the statement remain valid. In fact, the main
theorem remains valid unless possibly the variety does not admit positive-
dimensional subvarieties through a very general point and is not bimeromorphic
to a quotient of a torus. This latter case would be ruled out by a Chern class
inequality which holds in the algebraic case but is still unknown in the
Kähler setting.

The proof of Theorem 8.2 in [CHP16] contains a gap. We explain here how to fix
this in most cases, the only remaining case being "simple" threefolds $X$ of
Kodaira dimension $0$, hence through a very general point of $X$ there is no
proper positive-dimensional compact analytic subvariety. In this case it is
expected that $X$ is bimeromorphic to a torus quotient. We explain further how
to reduce Theorem 8.2 to an orbifold Chern class inequality of Bogomolov-
Gieseker type which in the algebraic setting is well-known and proved by
reducing to dimension $2$ by taking hyperplane sections. For recent
developments towards the inequality in the Kähler case, we refer to [JC23].

The issue is concerned with the proof of Equality (33). To be precise, we are
in the following situation. Let $X$ be a normal $\mathbb{Q}$-factorial compact
Kähler threefold such that $(X,0)$ is klt. Further, $X$ carries a divisior
$D\in|mK_{X}|$ with the following properties.

  1. a)

Set $B:={\rm Supp}D$. Then $(X,B)$ is lc and $X\setminus B$ has terminal
singularities.

  2. b)

$K_{X}+B$ is nef with $\nu(K_{X}+B)=2$; further, $\kappa(X)=\kappa(K_{X}+B)$.

  3. c)

For all irreducible components $T\subset B$, we have $(K_{X}+B)_{T}\neq 0$.

  4. d)

$(K_{X}+B)\cdot K_{X}^{2}\geq 0$.

Then we claim that $\kappa(X)\geq 1$.

To prove this, we consider a terminal modification $\mu:X^{\prime}\to X$, set
$L:=m(K_{X}+B)$; $L^{\prime}=\mu^{*}(L)$ and things come down to prove
Equality (33) in [CHP16], stating

(1) $L^{\prime}\cdot(K_{X^{\prime}}^{2}+c_{2}(X^{\prime}))\geq 0.$

To prove Equation (1), we claimed that we may assume that $X$ has canonical
singularities in codimension two. This however is not true in general. Once
Equation (1) is settled (which holds when $X$ has canonical singularities),
the proof given in [CHP16] is complete. Thus we have to treat the case that
$X$ has (possibly) non-canonical singularities. In this case $X$ has quotient
singularities in codimension two. Instead of taking a terminalization, we let
$\mu:X^{\prime}\to X$ be a desingularization. We proceed following the lines
of [Kwc92, chapter14]. As in [Kwc92, Lemma 14.3.1], things come down to prove

(2) $L\cdot(K_{X}^{2}+\hat{c}_{2}(X))\geq 0.$

Since

$L\cdot(K_{X}+B)\cdot B=0,$

this comes by [Kwc92, Lemma 14.3.2] down to show

(3) $L\cdot\hat{c}_{2}(\Omega_{X}(\log B))\geq 0.$

To prove Equation 3, we proceed as in [CHP16] in an orbifold context. We refer
to [GK20] for the notion of orbifold Chern classes in an analytic context. In
particular, we may define the intersection
$\omega\cdot\hat{c}_{2}({\mathcal{F}})$ for a Kähler form $\omega$ on $X$ and
a reflexive sheaf ${\mathcal{F}}$ on $X$ which is a Q-sheaf on $X\setminus S$:
the orbifold Chern class $\hat{c}_{2}({\mathcal{F}})\in H^{4}(X\setminus
S,\mathbb{R})$ extends uniquely to a class $\gamma$ on $X$, and we simply
define

$\omega\cdot\hat{c}_{2}({\mathcal{F}}):=[\omega]\cdot\gamma,$

where $[\omega]\in H^{2}(X,\mathbb{R})$ is the class of $\omega$.

In a first step, we need the following orbifold version of [CHP16, Theorem
7.1].

######  1.

Conjecture. Let $X$ be a normal compact Kähler threefold with only isolated
non-quotient singularities, and let $\alpha$ be a Kähler class on $X$. Let
${\mathcal{F}}$ be an $\alpha-$stable non-zero torsion-free coherent $Q$-sheaf
on $X$. Then we have

$\alpha\cdot\hat{c}_{2}({\mathcal{F}})\geq\big{(}\frac{r-1}{2r}\big{)}\alpha\cdot
c_{1}^{2}({\mathcal{F}}).$

Of course, Conjecture 1 should be true in all dimensions under the assumption
that $X$ has only quotient singularities in codimension $2$. If $X$ is
projective, see [Kwc92, chap.10] for the surface case and [GKPT19, Thm.6.1]

If Conjecture 1 holds for klt spaces, it yields the following orbifold version
of [CHP16, Theorem 7.2].

######  2.

Theorem. Let $(X,\omega)$ be a compact Kähler threefold with isolated non-
quotient singularities, and let ${\mathcal{F}}$ be a non-zero reflexive
coherent $Q$-sheaf on $X$ such that $\det{\mathcal{F}}$ is
$\mathbb{Q}$-Cartier. Suppose that there exists a pseudoeffective class $P\in
N^{1}(X)$ such that

$L:=c_{1}({\mathcal{F}})+P$

is a nef class. Suppose furthermore that for all $0<\varepsilon\ll 1$ the
sheaf ${\mathcal{F}}$ is $(L+\varepsilon\omega)$-generically nef. Then we have

$L\cdot\hat{c}_{2}({\mathcal{F}})\geq\frac{1}{2}(L\cdot
c_{1}^{2}({\mathcal{F}})-L^{3}).$

In particular, if $L\cdot c_{1}^{2}({\mathcal{F}})\geq 0$ and $L^{3}=0$, then

(4) $L\cdot\hat{c}_{2}({\mathcal{F}})\geq 0.$

We aim to apply Theorem 2 for the reflexive sheaf
${\mathcal{F}}=\Omega_{X}(\log B)$ to prove Equation 3. Therefore, we need to
check generic nefness of ${\mathcal{F}}$ which follows from the generic
nefness of $\Omega_{X}$. This is done by the following adaption of [CHP16,
Proposition 8.2].

######  3.

Proposition. Let $X$ be a normal non-algebraic compact Kähler space of
dimension $n$ with klt singularities. Suppose that $\kappa(X)\geq 0$. Then
$\Omega_{X}$ is generically nef with respect to any nef class $\alpha$, i.e.
for every torsion-free quotient sheaf

$\Omega_{X}\rightarrow\mathcal{Q}\rightarrow 0,$

we have $\alpha^{n-1}\cdot c_{1}(\mathcal{Q})\geq 0$.

###### Proof.

We proceed as in [CHP16]. Let $\pi:\hat{X}\to X$ be a desingularization. Using
the same notations as in the proof of [CHP16, Proposition 8.2], we need to
show that

$\pi^{*}(\alpha)^{n-1}\cdot c_{1}(\hat{Q})\geq 0.$

To do this, we apply Enoki’s theorem [Eno88, Theorem 1.4], and need to write
as $\mathbb{Q}$-divisors,

$K_{\hat{X}}=L+D$

with $L$ nef and $D$ effective. Setting $L=0$, we need to show that
$\kappa(\hat{X})\geq 0$. Since $X$ is klt, this is not automatic from
$\kappa(X)=\kappa(K_{X})\geq 0$. Assuming to the contrary that
$\kappa(\hat{X})=-\infty$. Then by [HP16], $\hat{X}$ is uniruled. Since
$\hat{X}$ is not algebraic, $\hat{X}$ cannot be rationally connected, hence we
have a rational almost holomorphic (MRC) quotient

$\hat{f}:\hat{X}\dasharrow\hat{S}$

with $\dim\hat{S}=1,2$. Since $H^{2}(\hat{X},{\mathcal{O}}_{\hat{X}})\neq 0$,
we must have $\dim\hat{S}=2$. Since $\hat{X}$ is not algebraic, the
exceptional set of $\pi$ cannot surject onto $\hat{S}$ and therefore $\hat{f}$
descends to an almost holomorphic map $f:X\dasharrow\hat{S}$ whose general
fiber is a smooth rational curve. This contradicts $\kappa(K_{X})\geq 0$.

∎

###### Proof of Theorem 8.2 in the non-simple case..

In the rest of the paper we point out how directly prove Theorem 8.2 in
[CHP16] \- without using a Bogomolov-Gieseker inequality - in case $X$ has
algebraic dimension $a(X)\geq 1$ or carries a family of curves covering $X$.
For the theory of algebraic reductions, which we will use freely, we refer
e.g. to [CP94]. We will write ${\mathcal{L}}={\mathcal{O}}_{X}(L)$.

1st case: We assume that there exists an almost holomorphic elliptic fibration

$f:X\dasharrow S,$

over a smooth Kähler surface. Since $f$ cannot be a Moishezon morphism,
${\mathcal{L}}$ must be numerically trivial on the general fiber of $f$. We
now consider the graph of the closure of the family of elliptic curves (fibers
of $f$) in $X$ and obtain a birational map $p:Z\to X$ and an equidimensional
morphism $q:Z\to T$, where $T$ is the parameter space of the family
(birational to $S$). We may assume $T$ smooth and $Z$ normal. The line bundle
$\tilde{\mathcal{L}}=p^{*}({\mathcal{L}})$ is $q$-numerically trivial,
actually trivial on the general fiber of $q$ since $H^{0}(X;{\mathcal{L}})\neq
0$. Using Zariski’s lemma [BHPVdV04, III, Lemma 8.2] we obtain that (up to
replacing $L$ by a multiple) we have ${\mathcal{L}}\simeq
q^{*}({\mathcal{G}})$ with a line bundle ${\mathcal{G}}$ on $T$. Since
$\nu(\tilde{\mathcal{L}})=2$, ${\mathcal{G}}$ is big and nef. Thus $S$ is
Moishezon and $\kappa(\tilde{\mathcal{L}})=2$, hence
$\kappa({\mathcal{L}})=2$.

Note that this first case settles in particular the case where the algebraic
dimension $a(X)$ is equal to two: in this case the algebraic reduction defines
an elliptic fibration as above.

2nd case: assume that $a(X)=1$. Here the algebraic reduction is a holomorphic
fiber space

$f:X\to C$

over a smooth curve $C$. Let $X_{c}$ be a general fiber of $f$, a klt surface,
and $\hat{X}_{c}\to X_{c}$ the minimal desingularization. Since $X$ is not
uniruled and since $\kappa(\hat{X}_{c})\leq 0$ for the general fiber of any
algebraic reduction, we conclude $\kappa(\hat{X}_{c})=0$, hence
$\kappa(X_{c})\geq 0$. If the general fiber $X_{c}$ is algebraic, $f$ cannot
have a generic multisection, hence $X_{c}$ must be smooth and minimal. Thus
$B_{|X_{c}}=0$ and ${\mathcal{L}}|_{X_{c}}\simeq{\mathcal{O}}_{X_{c}}$. Since
we may assume $h^{0}(X,{\mathcal{L}}^{\otimes k})=1$ for all $k\geq 1$, we
have $f_{*}({\mathcal{L}})={\mathcal{O}}_{C}$ (anyway we must have
$C=\mathbb{P}_{1}$ by $C_{3,1}$), and thus
${\mathcal{L}}={\mathcal{O}}_{X}(\sum a_{j}D_{j})$ with $a_{j}>0$ and $D_{j}$
fiber components. Since ${\mathcal{L}}$ is nef and numerically trivial on the
general fibre, this implies $\nu({\mathcal{L}})=1$. This contradicts our
assumption $\nu({\mathcal{L}})=2$.

If the general fiber $X_{c}$ is not algebraic, we have $L^{2}\cdot X_{c}=0$.
In fact, $L_{|X_{c}}$ cannot be big, otherwise $X$ would be projective. Then
we see immediately that

$K_{X_{c}}^{2}=K_{X_{c}}\cdot B_{|X_{c}}=B_{|X_{c}}^{2}=0.$

Further, $K_{X_{c}}$ must be nef, otherwise $X_{c}$ has a minimal model whose
canonical divisor is big. By abundance for surfaces, $K_{X_{c}}$ is semiample.

If the Kodaira fibration defines an elliptic fibration on $X_{c}$ we obtain a
covering family of elliptic curves on $X$ and conclude as in the previous
case.

If $K_{X_{c}}$ is torsion, the same holds for ${\mathcal{L}}_{|X_{c}}$. Hence
$f_{*}({\mathcal{L}}^{k})={\mathcal{O}}_{C}$ for some $k$, and we conclude as
before.

3rd case: assume that $a(X)=0$ and $X$ is not simple. In this case $X$ is
Kummer, i.e., bimeromorphic to a quotient of a torus - and there is nothing to
prove - or $X$ has a covering family of elliptic curves, see [CP00]. We
consider again - as in the first case - the graph $p:Z\to X$. Since $a(X)=0$,
$X$ has only finitely many divisiors and therefore $p$ is generically finite.
As before, we deduce $\kappa(p^{*}({\mathcal{L}}))=2$, hence
$\kappa({\mathcal{L}})=2$.

∎

## References

  * [BHPVdV04] Wolf P. Barth, Klaus Hulek, Chris A. M. Peters, and Antonius Van de Ven, _Compact complex surfaces_ , second ed., Ergebnisse der Mathematik und ihrer Grenzgebiete. 3. Folge., vol. 4, Springer-Verlag, Berlin, 2004. MR MR2030225 (2004m:14070)
  * [CHP16] Frédéric Campana, Andreas Höring, and Thomas Peternell, _Abundance for Kähler threefolds_ , Ann. Sci. Éc. Norm. Supér. (4) 49 (2016), no. 4, 971–1025. MR 3552019
  * [CP94] F. Campana and Th. Peternell, _Cycle spaces_ , Several complex variables, VII, Encyclopaedia Math. Sci., vol. 74, Springer, Berlin, 1994, pp. 319–349. MR 1326625
  * [CP00] Frédéric Campana and Thomas Peternell, _Complex threefolds with non-trivial holomorphic $2$-forms_, J. Algebraic Geom. 9 (2000), no. 2, 223–264. MR MR1735771 (2002a:32016)
  * [Eno88] Ichiro Enoki, _Stability and negativity for tangent sheaves of minimal Kähler spaces_ , Geometry and analysis on manifolds (Katata/Kyoto, 1987), Lecture Notes in Math., vol. 1339, Springer, Berlin, 1988, pp. 118–126. MR 961477
  * [GK20] Patrick Graf and Tim Kirschner, _Finite quotients of three-dimensional complex tori_ , Ann. Inst. Fourier (Grenoble) 70 (2020), no. 2, 881–914. MR 4105953
  * [GKPT19] Daniel Greb, Stefan Kebekus, Thomas Peternell, and Behrouz Taji, _The Miyaoka-Yau inequality and uniformisation of canonical models_ , Ann. Sci. Éc. Norm. Supér. (4) 52 (2019), no. 6, 1487–1535. MR 4061021
  * [HP16] Andreas Höring and Thomas Peternell, _Minimal models for Kähler threefolds_ , Invent. Math. 203 (2016), no. 1, 217–264. MR 3437871
  * [JC23] Philipp Naumann Mihai Pǎun Thomas Peternell Xiaojun Wu Junyan Cao, Patrick Graf, _Hermite-einstein metrics in singular settings_ , arXiv preprint 2303.08773 (2023).
  * [Kwc92] János Kollár (with 14 coauthors), _Flips and abundance for algebraic threefolds_ , Société Mathématique de France, Paris, 1992, Papers from the Second Summer Seminar on Algebraic Geometry held at the University of Utah, Salt Lake City, Utah, August 1991, Astérisque No. 211 (1992). MR MR1225842 (94f:14013)


# Towards Automated Classification of Attackers’ TTPs by combining NLP with ML
Techniques

Clemens Sauerwein and Alexander Pfohl  Department of Computer Science
University of Innsbruck
Innsbruck, Austria
<EMAIL_ADDRESS>
###### Abstract

The increasingly sophisticated and growing number of threat actors along with
the sheer speed at which cyber attacks unfold, make timely identification of
attacks imperative to an organisations’ security. Consequently, persons
responsible for security employ a large variety of information sources
concerning emerging attacks, attackers’ course of actions or indicators of
compromise. However, a vast amount of the needed security information is
available in unstructured textual form, which complicates the automated and
timely extraction of attackers’ Tactics, Techniques and Procedures (TTPs). In
order to address this problem we systematically evaluate and compare different
Natural Language Processing (NLP) and machine learning techniques used for
security information extraction in research. Based on our investigations we
propose a data processing pipeline that automatically classifies unstructured
text according to attackers’ tactics and techniques derived from a knowledge
base of adversary tactics, techniques and procedures.

###### Index Terms:

Cyber Threat Intelligence, Natural Language Processing, Machine Learning

##  I Introduction

The increasing complexity, heterogeneity and globally distribution of modern
IT systems combined with the increasing number of sophisticated cyber-attacks
manifest serious threats harming an IT system’s security. Recent high-profile
cyber security events (e.g. WannaCry [1], Meltdown [2] or Spectre [3]) have
shown that the spectrum of possible attacks steadily increases and that the
time frame for organizations to react shrinks constantly [4]. Accordingly,
stakeholders’ responsible for cyber security employ a large variety of
security information sources to obtain information regarding attackers’
tactics, techniques and procedures (TTPs) [5]. These sources range from
unstructured publicly available information sources [5] (e.g. mailing lists,
expert blogs, social media) to inter-organizational cyber threat intelligence
sharing platforms [6, 7, 8]. In this context, a tactic can be considered as a
high-level description of an attacker’s behavior, techniques provide a more
detailed description of a behavior in the context of a tactic, and procedures
an even low-level and detailed description in the context of a technique [9].

Although there are standards (e.g. STIX, OpenIoC,…) for describing TTPs, the
needed information is usually available in unstructured textual form and
cannot be automatically processed or analysed. However, the situation is
exacerbated by the presence of a large amount of security data, which makes it
difficult to capture TTPs in a timely manner through manual processes and
makes security a big data problem [10]. Accordingly, former research suggests
to implement the intelligence cycle [11], including a Processing &
Exploitation step that translates security information into machine-readable
format, to automatically extract TTPs from unstructured security data [12,
13]. While there are some approaches that deal with the extraction of security
information from unstructured text in general, it is unclear which approach is
suitable for extracting TTPs from unstructured text. Furthermore, this
challenge is highlighted by the fact that the OSINT goldmine of threat
intelligence has not yet been comprehensively tapped and offers great
potential for future research and practice [14]. To address this research gap,
we seek to answer the following research questions: (1) What are the current
approaches to extract security information from unstructured text by using NLP
and ML techniques? (2) Which NLP and ML techniques are suitable to extract
attackers’ tactics, techniques and procedures from unstructured threat
information?

In order to address these research questions, we conducted a systematic
literature study to identify how research combines NLP and ML techniques to
automatically extract security information from unstructured text. In a
further step, we evaluated and compared the most commonly used techniques in
order to identify those approaches which are most suitable to automatically
extract attackers’ TTPs. In doing so, we created a training set as input for
these techniques based on the ATT&CK [15] framework. Last but not least, we
propose a processing pipeline which might be used to automatically extract
attackers’ tactics and techniques. The remainder of this paper is structured
as follows: Section II discusses related work regarding security information
extraction. Section III outlines the applied research methodology to identify,
evaluate and compare NLP and corresponding ML techniques for the automated
extraction of attackers’ TTPs. Section IV provides an overview of the used NLP
and ML techniques, evaluates them and proposes an information processing
pipeline to automatically extract attackers’ TTPs. Section V discusses the key
findings and limitations of the research at hand. Section VI concludes the
paper and provides outlook on future work.

##  II Related work

In the past several authors focused on the detection, extraction and analysis
of security information from different data sources [16]. They primarily
focused on the extraction of indicators of compromise [17, 18],
vulnerabilities [19, 20, 21, 22, 23], security events [24], exploits [25] and
other security related information [26, 27, 28, 29, 30, 31, 32]. In doing so,
they rely on sources like hacker forums [33, 34, 35, 36, 37, 38, 39], social
media [19, 24, 25, 27, 28, 29, 30] and other sources [31, 40, 41, 42, 43].

However, only a few contributions focused on the detection and extraction of
TTPs in the last few years. For example, TTPDrill automatically extracts TTPs
from unstructured cyber threat intelligence reports based on a manually
created threat ontology [44]. The same authors developed ActionMiner a
framework that is able to extract a structured list of threat actions from
unstructured threat reports [45]. The MITRE corporation developed the Threat
Report ATT&CK Mapper (TRAM)111https://github.com/mitre-attack/tram (Accessed:
August 2nd, 2021), a web based tool for extracting adversary techniques from
cyber threat intelligence reports in order to map the extracted information to
ATT&CK [15]. Moreover, the rcATT222https://github.com/vlegoy/rcATT (Accessed:
August 2nd, 2021) tool bases on an old version of the ATT&CK framework and
automatically extracts tactics and techniques from unstructured threat reports
[46]. Last but not least, [16] provides a literature review to understand the
source, purpose, and approaches for mining cyberthreat intelligence from
unstructured text.

A variety of approaches and data sources have been used to extract security
information from structured and unstructured texts in the past. Most of them
focus on one specific method for each task (e.g. using TF-IDF for
vectorization), but do not consider other methods and compare them among each
other. Our research addresses this gap by evaluating and comparing different
approaches that combine NLP and ML techniques to extract relevant security
information. Finally, based on these evaluations we propose a processing
pipeline for extracting TTPs from unstructured texts.

##  III Applied research methodology

In order to investigate the used NLP and ML techniques to extract TTPs from
unstructured texts, we we conducted a systematic literature study (see Section
III-A) to identify different approaches combining NLP and ML techniques
followed by an evaluation of the identified techniques (see Section IV-C) by
using an adversary training data set generated from the ATT&CK [15] knowledge
base. Based on our investigations we propose a data processing pipeline for
the classification of TTPs from unstructured text.

###  III-A Systematic Literature Study

The goal of this literature study was to systematize current approaches that
combine NLP and ML techniques to extract security-related information form
unstructured texts. To achieve this goal we conducted a systematic literature
study based on the methodologies by [47] and [48] between January 2021 and
February 2021. In doing so, we applied the following procedure: definition of
search strategy, initial search, paper selection, snowballing and data
extraction. In order to guarantee repeatability and traceability of the
research methodology, a review protocol, including search strategy, search
results, selection criteria, selection procedure and data extraction was
developed. In the course of the definition of the search strategy and with
respect to our research objective and questions, we defined the following
search term for our initial search: (”information security” OR ”vulnerability”
OR ”vulnerabilities” OR ”cyber security” OR ”cybersecurity” OR ”threat
intelligence” OR ”threat” OR ”threats” OR ”cyber threat intelligence” ) AND
(”data mining” OR ”information extraction” OR ”extracting” OR ”extraction OR
”natural language processing” OR ”NLP” OR ”machine learning”). We used the
databases ACM Digital Library, AIS Electronic Library, EBSCOhost, IEEE Xplore
Digital Library, Springer Link, Taylor & Francis Online and Wiley Online
Library. Only papers published between 2009 and 2020 were considered. Our
initial search delivered 5307 papers in total. In the next step we performed
the paper selection. In doing so, we (i) eliminated all duplicates and
excluded all papers that (ii) were not peer-reviewed or are grey or white
literature, (iii) were not available in full text and (iv) have not used a
combination of NLP and ML techniques. By reading the title, abstracts, and
keywords and by skim reading of full texts of all papers, we (v) assessed
their relevance for answering our research questions (see Section I). The
paper selection resulted in a set of 20 papers. To avoid overlooking relevant
papers, we performed one iteration of backward snowballing based on [48]. By
reviewing the citations of our 20 selected papers on Google Scholar with
respect to our paper selection procedure, we identified additional 6 relevant
papers. This procedure resulted in a final set of 26 papers. Finally, we
performed data extraction on the final set of 26 papers based on a concept
matrix. This matrix included the following classification categories: (i) used
NLP techniques and (ii) ML techniques.

TABLE I: Overview of NLP and ML Techniques used in relevant works to extract security-related information form unstructured texts |  |  [44] |  [49] |  [50] |  [30] |  [51] |  [17] |  [18] |  [20] |  [21] |  [26] |  [31] |  [23] |  [22] |  [32] |  [52] |  [53] |  [34] |  [36] |  [37] |  [38] |  [24] |  [27] |  [29] |  [54] |  [41] |  [42] |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---
NLP | Tokenization |  |  1 |  1 |  1 |  1 |  1 |  1 |  |  1 |  |  |  1 |  |  1 |  |  1 |  |  |  1 |  1 |  |  |  1 |  1 |  1 |  1 |
POS Tagging |  1 |  1 |  |  1 |  1 |  1 |  1 |  |  1 |  |  |  1 |  |  |  |  1 |  |  |  1 |  1 |  |  |  1 |  1 |  1 |  1 |
NER |  |  |  |  |  1 |  1 |  1 |  1 |  |  1 |  1 |  |  |  |  |  1 |  1 |  |  1 |  |  1 |  1 |  1 |  1 |  |  1 |
Stemming |  |  1 |  |  1 |  |  |  |  |  1 |  |  |  |  1 |  |  |  |  |  |  |  |  |  |  |  1 |  |  |
Lemmatization |  |  1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  1 |  |  |  |  |  |  |  |  |  |  |
Bag-of-Words |  |  |  |  |  |  |  |  1 |  |  |  |  |  1 |  |  |  |  1 |  1 |  1 |  |  |  |  |  1 |  |  |
TF-IDF |  1 |  |  |  1 |  |  |  |  |  1 |  |  1 |  |  |  |  1 |  |  1 |  |  |  |  |  |  |  |  |  1 |
Word Embedding |  |  |  1 |  |  |  |  1 |  |  |  |  |  1 |  1 |  |  |  |  |  |  1 |  1 |  |  |  |  |  |  |
ML | SVM |  1 |  |  |  |  |  1 |  |  1 |  1 |  |  1 |  1 |  |  1 |  1 |  |  |  1 |  1 |  1 |  |  |  |  |  |  1 |
NB |  |  |  |  |  |  |  |  |  1 |  |  1 |  |  1 |  1 |  |  |  |  |  |  |  |  |  |  |  |  |
Other |  |  1 |  1 |  1 |  1 |  |  1 |  |  |  1 |  |  |  |  |  |  1 |  1 |  |  |  |  1 |  1 |  1 |  1 |  1 |  |

###  III-B Evaluation of NLP and ML Techniques

Based on the results of the systematic literature study we selected the most
common NLP and ML techniques to evaluate their use for the extraction of TTPs
from unstructured texts. In doing so, different processing pipelines have been
built based on all possible combinations of the identified NLP and most widely
used ML techniques (see Section IV-B). In order to implement the NLP
techniques we used NLTK333https://www.nltk.org/ (Accessed: August 2nd, 2021)
and gensim444https://pypi.org/project/gensim/ (Accessed: August 2nd, 2021).
For the the ML classification task we used scikit-learn555https://scikit-
learn.org/ (Accessed: August 2nd, 2021). A training set was automatically
created based on the ATT&CK framework [15] (see Section IV-B). In order to
evaluate the whole processing pipeline we used performance measures and five-
fold cross-validation (see Section IV-C. In doing so we used measures like
micro- and macro-averaging scores of precision, recall and $F_{0.5}$-score as
well as Hamming loss of the different models.

##  IV Results

In this section we provide a comprehensive overview of approaches combining
NLP and ML techniques to extract security information from unstructured text
(see Section IV-A), present a processing pipeline combining the most common
NLP and ML techniques identified in literature (see Section IV-B) and its
evaluation (see Section IV-C).

###  IV-A Techniques to extract security information from unstructured text

Firstly, our analysis reveals that a plethora of NLP approaches were used in
the identified literature. As depicted in table I the following NLP techniques
were used in the analyzed papers: Tokenization (16), Part-of-Speech (POS)
Tagging (15), Named-Entity-Recognition (NER) (14), Stemming (5) and
Lemmatization (2). Moreover, we identified additional approaches like lower-
casing [22], customized extraction algorithms (e.g. [17]) or the creation of a
context-free grammar [30]. These results indicate that NLP approaches are used
frequently, yet not all steps are reported in the papers. For example POS by
implication is always preceded by Tokenization, yet this stage wasn’t
mentioned in [44].

Secondly, during our analysis, we grouped ML approaches according to the
frequency of their use in the identified literature. Accordingly, we elicted
the following categories: Support Vector Machine (SVM) (12), Naive Bayes (NB)
(4) and others. Among the latter were approaches like Neural Network (NN)
based Approaches, Conditional Random Fields (CRF), Logistic Regression and
Random Forest. The reason why SVMs are the first choice might be trace back to
their easy-to-use nature and aptitude for classification problems.

###  IV-B Processing Pipeline to extract attackers’ TTPs

Based on the identified NLP and ML techniques, we defined an evaluation
processing pipeline to extract attackers’ tactics and techniques from
unstructured text and transform them to a standardized data format. It is
worth mentioning that we did not consider attackers’ procedures since our
training set doesn’t provide labeled data on them. As depicted in Figure 1 our
evaluation processing pipeline consists of four processes - TTP Labeling,
Processing, Classification and STIX Exporting.

Figure 1: Processing pipeline to extract attackers’ tactics and techniques

As mentioned in Section IV-A, all identified approaches used a form of
supervised learning. Therefore, we implemented a TTP Labeling process that
generates a labeled data set as input for the Classification and final cross-
validation. However, our analyzed papers and related work indicated a lack of
publicly available training set for classifying TTPs. Therefore, we decided to
rely on the ATT&CK [15] framework to automatically create the needed training
set. Within the ATT&CK Knowledge base, reports and threat descriptions are
already part of the descriptions of specific tactics and techniques.
Accordingly, their labels are implicitly given and manual labeling is not
needed. Therefore we extracted the data from the ATT&CK GitHub Repository,
extracted the content of each document, filtered them and stored them for
further processing. In doing so we processed 534 documents, including 417 HTML
and 117 PDF documents from 139 different sources.

The next step includes the Pre-processing, Normalization, Vectorization and
Transformation of the security and ATT&CK based training set. The aim of this
Processing step is the preparation of the data for Classification. In order to
use appropriate techniques, the most common NLP techniques in the analyzed
literature (cf. Section III-A) were used. For the Pre-processing we use
Tokenization, POS Tagging and IoC Replacement. Accordingly, after each IoC in
the paragraphs was replaced by the appropriate natural language term,
tokenization was performed and each token was tagged by its part-of-speech
(POS). This process was performed for each paragraph in the security and
training data set. On the obtained results Normalization was applied, which
can be achieved by Stemming or Lemmatization. In order to improve
Normalization, additional functionalities, like lower-casing, stopwords
removal, single-charcater and non-word token removal were implemented. After
Normalization we performed Vectorization by implementing several alternative
Vectorization techniques. During our systematic literature review several
Vectorization techniques were identified, namely Bag-of-word features, TF-IDF
and Word Embeddings. Since Bag-of-words usually refer to word frequencies, but
none of the analyzed papers mentioned the used technique explicitly, we
decided to implement One-hot-endocing, Term Frequency and TF-IDF. Moreover,
since Word Embeddings were discussed quite often in the literature we decided
to implement Doc2Vec as well. Accordingly, we implemented four possibilities
to perform Vectorization.

As shown by our systematic literature study (cf Section III-A, for
Classification current research primarily focus on Support Vector Machines
(SVM) and Naive Bayes (NB). Therefore, we decided to include all of the SVM
and NB classifiers provided by the scikit-learn library considering that they
are compatible with our previous Vectorization techniques and the multi-label
classification problem. In order to fulfill this, we implemented a
Transformation process for the Vectorization results. In doing so we
implemented the Transformation to the following representations: Binary
Relevance, Classifier Chain and Distributed Representation. For each of the
representations, we used the following classifiers for evaluation:
MutlinominialNB, ComplementNB, GaussianNB, SVC, LinearSVC and SGDClassifier.
In doing so, the Classification consists of Model training based on the
vectorized and labeled ATT&CK training set and the Prediction of TTPs from
unstructured security data based on the Trained Classifier.

Finally, we transformed the Prediction Results to STIX format using the STIX
Exporting process. In doing so, each of the resulting predictions was
annotated with respective labels for tactics and techniques. These labels were
then used to query the ATT&CK Repository for the corresponding STIX Objects to
those labels.

###  IV-C Proposed processing pipeline to extract attackers’ tactics

In order to find the most suitable processing pipeline for the extraction of
tactics and techniques, the processing and classification was closely
scrutinized. In the course of this, all possible combinations of processing
and classifications techniques were evaluated and compared. The following
expression describes all possible combinations that were considered for the
evaluation: Preprocessing AND (Steamming XOR Lemmatization) AND (One-hot
encoding XOR Term-Frequency XOR TF-IDF OR Doc2Vec) AND (Binary Relevance XOR
Classifier-Chain XOR Distributed-Representations) AND (MutlinominialNB XOR
ComplementNB XOR GaussianNB XOR SVC XOR LinearSVC XOR SGDClassifier). In this
context it is worth mentioning that all combinations were possible, except
MultinominialNB and ComplementNB were not compatible with Doc2Vec. Overall,
these combinations resulted in 156 different pipelines for evaluation. As
described in Section IV-C, we used performance measures and five-fold cross-
validation to evaluate these pipelines and find the best performing
combination of NLP and ML techniques for the extraction of tactics and
techniques.

Finally, our evaluations showed that Lemmatization, One-hot encoding combined
with Binary Relevance for tactics and techniques classification are best
suited for the proposed processing pipeline. For the classification of tactics
it turned out that SGDClassifier performed best, with a prescision of 71.09%,
recall of 62.55%, $F_{0.5}$ score of 69.06% and hamming-loss of 26.70%. For
the classification of techniques the most appropriate classifier was LinearSVC
with a precision of 53.43%, recall of 14.88%, $F_{0.5}$ of 33.68% and hamming-
loss of 5.55%.

##  V Discussion

In this section we discuss our key findings (see Section V-A) and limitations
of our research (see Section V-B).

###  V-A Key Findings

Our research has shown that the most powerful processing pipeline that
combines NLP and ML techniques to extract attackers’ techniques and tactics
from unstructured text uses the following techniques: (1) Tokenization, (2)
POS Tagging, (3) IoC Replacement, (4) Lemmatization, (5) One-hot encoding
Vectorization, (6) Binary Relevance Transformation and (7) Support Vector
Machine Classification. For the latter it turned out that for tactics the
SGDClassifier and for techniques the LinearSVC performed best. Unfortunately,
it was not possible to classify attackers’ procedures due to a lack of
corresponding training data. Moreover the classification of attackers’ tactics
and techniques was complicated by an imbalanced training set. However, these
issues might be traced back to the fact that we used the ATT&CK framework as
basis for our automatically generated training set. Nonetheless, the lack of a
publicly available training data set and the need for publicly available
labeled and balanced training data sets was highlighted by other security
researchers as well [16].

In addition, during the evaluation of our processing pipelines, it became
apparent that there is no real baseline or publicly available source code of
comparable approaches. Therefore, the evaluation of our 156 different
processing pipelines was complicated, and we decided to use the dummy
classifier of the skicit-learn666https://scikit-learn.org/ (Accessed: August
2nd, 2021) as baseline. This baseline worked well for classifying tactics, but
unfortunately was not able to classify techniques properly. The latter might
be due to the already discussed problem of an imbalanced training set.

Finally, we tried to compare our approach with related work. Unfortunately, as
mentioned above, this was only possible to a limited extent due to the lack of
a general baseline and different training data sets. For example, a comparison
of the TRAM tool777https://github.com/mitre-attack/tram (Accessed: August 2nd,
2021) with our approach showed that they only focus in the classification of
techniques based in the ATT&CK framework. In addition, we analyzed at the
rcaTT tool [46], which also classifies tactics and techniques. Unfortunately,
it was very difficult to compare our approach the rcaTT tool, as it builds on
an older version of ATT&CK and integrates a lot of noise through their
automatic method of generating the training data set by considering external
references as well. These comparative trials and the problems associated with
them, once again highlight the need for publicly available labeled training
data sets and baselines.

###  V-B Limitations

The research at hand might be limited by a (i) selection bias and (ii) wrong
classification of relevant publications dealing with NLP and ML techniques
used for security information extraction. Moreover, it might be (iii) limited
training set primarily focusing on tactics and techniques based on the ATT&CK
framework and a (iv) missing baseline to compare the performance of ML
techniques for TTP classification. In order to counteract (i) and guarantee a
complete list of relevant papers focusing in NLP and ML techniques we
conducted a systematic literature study based on [47] combined with the
snowballing method [48]. In order to counteract (ii) a concept matrix was
created, as described in [47], to systematically extract information on the
used NLP and ML techniques and a review protocol was kept. Two of the authors
of this publication did the classification of each paper. In a final step the
concept matrices and the review protocols were compared. If a conflict
occurred, consensus based on a re-reading of the publication and a subsequent
discussion was reached. Limitation (iii) was deliberately chosen because the
automatic generation of a labeled training set based on the ATT&CK framework
was the only efficient solution and the generation of a manual labeled data
set was too time-consuming. In order to counteract (iv) we compared our
processing pipeline to related work. A detailed comparison was made difficult
because comparable contributions only made their evaluation data available to
a limited extent.

##  VI Conclusion & Outlook

In this paper we investigated, how current NLP and ML approaches can be
combined to extract attackers’ TTPs from unstructured text. Therefore, we
analyzed the state of the art regarding the combination of NLP with ML
techniques to extract security-related information from unstructured text. We
evaluated and compared the different techniques described in 26 publications.
In doing so we evaluated all possible combinations of the identified NLP and
ML techniques with 156 processing pipelines and an automatically generated
training set based on the ATT&CK framework. It turned out that a combination
of Tokenization, POS Tagging, IoC Replacement, Lemmatization, One-hot
encoding, Binary Relevance and Support Vector Machine performed best for the
classification of techniques and tactics. However, due to a lack of training
date we were not able to classify attackers’ procedures. Finally, our
investigations highlighted the need for publicly available labeled training
set and a baseline for evaluation. Future work will include a comprehensive
evaluation of further machine learning techniques and the creation of a
publicly available training data set to classify attackers’ TTPs. Moreover, we
will focus on a processing pipeline and labeled training data set to extract
attacker’s procedures.

## References

  * [1] S. Mohurle and M. Patil, “A brief study of wannacry threat: Ransomware attack 2017,” International Journal of Advanced Research in Computer Science, vol. 8, no. 5, 2017.
  * [2] M. Lipp, M. Schwarz, D. Gruss, T. Prescher, W. Haas, A. Fogh, J. Horn, S. Mangard, P. Kocher, D. Genkin, et al., “Meltdown: Reading kernel memory from user space,” in 27th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 18), pp. 973–990, 2018.
  * [3] P. Kocher, J. Horn, A. Fogh, D. Genkin, D. Gruss, W. Haas, M. Hamburg, M. Lipp, S. Mangard, T. Prescher, et al., “Spectre attacks: Exploiting speculative execution,” in 2019 IEEE Symposium on Security and Privacy (SP), pp. 1–19, IEEE, 2019.
  * [4] J. Jang-Jaccard and S. Nepal, “A survey of emerging threats in cybersecurity,” Journal of Computer and System Sciences, vol. 80, no. 5, pp. 973–993, 2014.
  * [5] C. Sauerwein, I. Pekaric, M. Felderer, and R. Breu, “An analysis and classification of public information security data sources used in research and practice,” Computers & security, vol. 82, pp. 140–155, 2019.
  * [6] C. Sauerwein, C. Sillaber, A. Mussmann, and R. Breu, “Threat intelligence sharing platforms: An exploratory study of software vendors and research perspectives,” in Proceedings of the 13th International Conference on Wirtschaftsinformatik, 2017.
  * [7] W. Tounsi and H. Rais, “A survey on technical threat intelligence in the age of sophisticated cyber attacks,” Computers & security, vol. 72, pp. 212–233, 2018.
  * [8] C. Wagner, A. Dulaunoy, G. Wagener, and A. Iklody, “Misp: The design and implementation of a collaborative threat intelligence sharing platform,” in Proceedings of the 2016 ACM on Workshop on Information Sharing and Collaborative Security, pp. 49–56, ACM, 2016.
  * [9] C. Johnson, L. Badger, D. Waltermire, J. Snyder, and C. Skorupka, “Guide to cyber threat information sharing,” NIST special publication, vol. 800, no. 150, 2016.
  * [10] N. MacDonald, “Information security is becoming a big data analytics problem,” Gartner,(23 March 2012), DOI= http://www. gartner. com/id, vol. 1960615, 2012.
  * [11] M. Dempsey, “Joint intelligence,” Joint Publication, pp. 2–0, 2013.
  * [12] S. Bauer, D. Fischer, C. Sauerwein, S. Latzel, D. Stelzer, and R. Breu, “Towards an evaluation framework for threat intelligence sharing platforms,” in Proceedings of the 53rd Hawaii International Conference on System Sciences, 2020.
  * [13] A. de Melo e Silva, J. J. Costa Gondim, R. de Oliveira Albuquerque, and L. J. García Villalba, “A methodology to evaluate standards and platforms within cyber threat intelligence,” Future Internet, p. 108, 2020.
  * [14] J. Pastor-Galindo, P. Nespoli, F. G. Mármol, and G. M. Pérez, “The not yet exploited goldmine of osint: Opportunities, open challenges and future trends,” IEEE Access, vol. 8, pp. 10282–10304, 2020.
  * [15] B. E. Strom, A. Applebaum, D. P. Miller, K. C. Nickels, A. G. Pennington, and C. B. Thomas, “Mitre att&ck: Design and philosophy,” Technical report, 2018.
  * [16] M. R. Rahman, R. Mahdavi-Hezaveh, and L. Williams, “A literature review on mining cyberthreat intelligence from unstructured texts,” in 2020 International Conference on Data Mining Workshops (ICDMW), pp. 516–525, IEEE, 2020.
  * [17] X. Liao, K. Yuan, X. Wang, Z. Li, L. Xing, and R. Beyah, “Acing the ioc game: Toward automatic discovery and analysis of open-source cyber threat intelligence,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 755–766, 2016.
  * [18] J. Zhao, Q. Yan, J. Li, M. Shao, Z. He, and B. Li, “Timiner: Automatically extracting and analyzing categorized cyber threat intelligence from social data,” Computers & Security, vol. 95, p. 101867, 2020.
  * [19] C. Sauerwein, C. Sillaber, M. M. Huber, A. Mussmann, and R. Breu, “The tweet advantage: An empirical analysis of 0-day vulnerability information shared on twitter,” in IFIP International Conference on ICT Systems Security and Privacy Protection, pp. 201–215, Springer, 2018.
  * [20] V. Mulwad, W. Li, A. Joshi, T. Finin, and K. Viswanathan, “Extracting information about security vulnerabilities from web text,” in 2011 IEEE/WIC/ACM International Conferences on Web Intelligence and Intelligent Agent Technology, vol. 3, pp. 257–260, IEEE, 2011.
  * [21] C. Liu, J. Li, and X. Chen, “Network vulnerability analysis using text mining,” in Asian Conference on Intelligent Information and Database Systems, pp. 274–283, Springer, 2012.
  * [22] M. Gawron, F. Cheng, and C. Meinel, “Automatic vulnerability classification using machine learning,” in International Conference on Risks and Security of Internet and Systems, pp. 3–17, Springer, 2017.
  * [23] Z. Han, X. Li, Z. Xing, H. Liu, and Z. Feng, “Learning to predict severity of software vulnerability using only vulnerability description,” in 2017 IEEE International conference on software maintenance and evolution (ICSME), pp. 125–136, IEEE, 2017.
  * [24] A. Ritter, E. Wright, W. Casey, and T. Mitchell, “Weakly supervised extraction of computer security events from twitter,” in Proceedings of the 24th International Conference on World Wide Web, pp. 896–905, 2015.
  * [25] C. Sabottke, O. Suciu, and T. Dumitraș, “Vulnerability disclosure in the age of social media: Exploiting twitter for predicting real-world exploits,” in 24th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 15), pp. 1041–1056, 2015.
  * [26] A. Joshi, R. Lal, T. Finin, and A. Joshi, “Extracting cybersecurity related linked data from text,” in 2013 IEEE Seventh International Conference on Semantic Computing, pp. 252–259, IEEE, 2013.
  * [27] S. Mittal, P. K. Das, V. Mulwad, A. Joshi, and T. Finin, “Cybertwitter: Using twitter to generate alerts for cybersecurity threats and vulnerabilities,” in 2016 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM), pp. 860–867, IEEE, 2016.
  * [28] S. Gharge and M. Chavan, “An integrated approach for malicious tweets detection using nlp,” in 2017 International Conference on Inventive Communication and Computational Technologies (ICICCT), pp. 435–438, IEEE, 2017\.
  * [29] S. R. Vadapalli, G. Hsieh, and K. S. Nauer, “Twitterosint: automated cybersecurity threat intelligence collection and analysis using twitter data,” in Proceedings of the International Conference on Security and Management (SAM), pp. 220–226, The Steering Committee of The World Congress in Computer Science, Computer …, 2018.
  * [30] A. Niakanlahiji, J. Wei, and B.-T. Chu, “A natural language processing based trend analysis of advanced persistent threat techniques,” in 2018 IEEE International Conference on Big Data (Big Data), pp. 2995–3000, IEEE, 2018.
  * [31] C. Suh-Lee, J.-Y. Jo, and Y. Kim, “Text mining for security threat detection discovering hidden information in unstructured log messages,” in 2016 IEEE Conference on Communications and Network Security (CNS), pp. 252–260, IEEE, 2016.
  * [32] T. Peng, I. Harris, and Y. Sawa, “Detecting phishing attacks using natural language processing and machine learning,” in 2018 ieee 12th international conference on semantic computing (icsc), pp. 300–301, IEEE, 2018\.
  * [33] M. Macdonald, R. Frank, J. Mei, and B. Monk, “Identifying digital threats in a hacker web forum,” in Proceedings of the 2015 IEEE/ACM international conference on advances in social networks analysis and mining 2015, pp. 926–933, 2015.
  * [34] V. Benjamin, W. Li, T. Holt, and H. Chen, “Exploring threats and vulnerabilities in hacker web: Forums, irc and carding shops,” in 2015 IEEE international conference on intelligence and security informatics (ISI), pp. 85–90, IEEE, 2015.
  * [35] E. Nunes, A. Diab, A. Gunn, E. Marin, V. Mishra, V. Paliath, J. Robertson, J. Shakarian, A. Thart, and P. Shakarian, “Darknet and deepnet mining for proactive cybersecurity threat intelligence,” in 2016 IEEE Conference on Intelligence and Security Informatics (ISI), pp. 7–12, IEEE, 2016.
  * [36] S. Samtani, K. Chinn, C. Larson, and H. Chen, “Azsecure hacker assets portal: Cyber threat intelligence and malware analysis,” in 2016 IEEE conference on intelligence and security informatics (ISI), pp. 19–24, Ieee, 2016\.
  * [37] I. Deliu, C. Leichter, and K. Franke, “Extracting cyber threat intelligence from hacker forums: Support vector machines versus convolutional neural networks,” in 2017 IEEE International Conference on Big Data (Big Data), pp. 3648–3656, IEEE, 2017.
  * [38] N. Tavabi, P. Goyal, M. Almukaynizi, P. Shakarian, and K. Lerman, “Darkembed: Exploit prediction with neural language models,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 32, 2018.
  * [39] R. Williams, S. Samtani, M. Patton, and H. Chen, “Incremental hacker forum exploit collection and classification for proactive cyber threat intelligence: An exploratory study,” in 2018 IEEE International Conference on Intelligence and Security Informatics (ISI), pp. 94–99, IEEE, 2018\.
  * [40] T. Buldakova and A. S. Dzhalolov, “Development of an information security data-mining system for a situation center,” Automatic Documentation and Mathematical Linguistics, vol. 48, no. 2, pp. 71–77, 2014.
  * [41] C. L. Jones, R. A. Bridges, K. M. Huffer, and J. R. Goodall, “Towards a relation extraction framework for cyber-security concepts,” in Proceedings of the 10th Annual Cyber and Information Security Research Conference, pp. 1–4, 2015.
  * [42] K. Li, H. Wen, H. Li, H. Zhu, and L. Sun, “Security osif: Toward automatic discovery and analysis of event based cyber threat intelligence,” in 2018 IEEE SmartWorld, Ubiquitous Intelligence & Computing, Advanced & Trusted Computing, Scalable Computing & Communications, Cloud & Big Data Computing, Internet of People and Smart City Innovation (SmartWorld/SCALCOM/UIC/ATC/CBDCom/IOP/SCI), pp. 741–747, IEEE, 2018.
  * [43] L. Neil, S. Mittal, and A. Joshi, “Mining threat intelligence about open-source projects and libraries from code repository issues and bug reports,” in 2018 IEEE International Conference on Intelligence and Security Informatics (ISI), pp. 7–12, IEEE, 2018.
  * [44] G. Husari, E. Al-Shaer, M. Ahmed, B. Chu, and X. Niu, “Ttpdrill: Automatic and accurate extraction of threat actions from unstructured text of cti sources,” in Proceedings of the 33rd Annual Computer Security Applications Conference, pp. 103–115, 2017.
  * [45] G. Husari, X. Niu, B. Chu, and E. Al-Shaer, “Using entropy and mutual information to extract threat actions from cyber threat intelligence,” in 2018 IEEE International Conference on Intelligence and Security Informatics (ISI), pp. 1–6, IEEE, 2018.
  * [46] V. Legoy, M. Caselli, C. Seifert, and A. Peter, “Automated retrieval of att&ck tactics and techniques for cyber threat reports,” arXiv preprint arXiv:2004.14322, 2020.
  * [47] B. Kitchenham, “Procedures for performing systematic reviews,” Keele, UK, Keele University, vol. 33, no. 2004, pp. 1–26, 2004.
  * [48] C. Wohlin, “Guidelines for snowballing in systematic literature studies and a replication in software engineering,” in Proceedings of the 18th international conference on evaluation and assessment in software engineering, pp. 1–10, 2014.
  * [49] M. D. Purba, B. Chu, and E. Al-Shaer, “From word embedding to cyber-phrase embedding: Comparison of processing cybersecurity texts,” in 2020 IEEE International Conference on Intelligence and Security Informatics (ISI), pp. 1–6, IEEE, 2020.
  * [50] S. Xun, X. Li, and Y. Gao, “Aiti: An automatic identification model of threat intelligence based on convolutional neural network,” in Proceedings of the 2020 the 4th International Conference on Innovation in Artificial Intelligence, pp. 20–24, 2020.
  * [51] Y. Ghazi, Z. Anwar, R. Mumtaz, S. Saleem, and A. Tahir, “A supervised machine learning based approach for automatically extracting high-level threat intelligence from unstructured sources,” in 2018 International Conference on Frontiers of Information Technology (FIT), pp. 129–134, IEEE, 2018\.
  * [52] D. Iorga, D. Corlătescu, O. Grigorescu, C. Săndescu, M. Dascălu, and R. Rughiniş, “Early detection of vulnerabilities from news websites using machine learning models,” in 2020 19th RoEduNet Conference: Networking in Education and Research (RoEduNet), pp. 1–6, IEEE, 2020.
  * [53] T. Satyapanich, F. Ferraro, and T. Finin, “Casie: Extracting cybersecurity event information from text,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, pp. 8749–8757, 2020.
  * [54] A. Niakanlahiji, L. Safarnejad, R. Harper, and B.-T. Chu, “Iocminer: Automatic extraction of indicators of compromise from twitter,” in 2019 IEEE International Conference on Big Data (Big Data), pp. 4747–4754, IEEE, 2019.


# Multiple Spectrally Null Constrained Complete Complementary Codes of Various
Lengths Over Small Alphabet

Rajen Kumar, Palash Sarkar, Prashant Kumar Srivastava, Sudhan Majhi Rajen
Kumar is with the Department of Mathematics, Indian Institute of Technology
Patna, India<EMAIL_ADDRESS>Sarkar is with the
Department of Informatics, Selmer Center, University of Bergen, Norway,
<EMAIL_ADDRESS>Kumar Srivastava is with the Department of
Mathematics, Indian Institute of Technology Patna, India,
<EMAIL_ADDRESS>Majhi is with the Department of Electrical
Communication and Engineering, Indian Institute of Science Bangalore, India,
<EMAIL_ADDRESS>
###### Abstract

Complete complementary codes (CCCs) are highly valuable in the fields of
information security, radar and communication. The spectrally null constrained
(SNC) problem arises in radar and modern communication systems due to the
reservation or prohibition of specific spectrums from transmission. The
literature on SNC-CCCs is somewhat limited in comparison to the literature on
traditional CCCs. The main objective of this paper is to discover several
configurations of SNC-CCCs that possess more flexibility in their parameters.
The proposed construction utilised the existing CCCs and mutually orthogonal
sequences. The proposed construction can cover almost all lengths with the
smallest alphabets $\\{-1,0,1\\}$. Further, the idea of SNC-CCC is extended to
multiple SNC-CCC with an inter-set zero cross-correlation zone (ZCCZ). Based
on our construction, we can also control the correlation value outside the
ZCCZ. The beauty of the obtained codes have aperiodic and periodic inter-set
ZCCZ and low cross-correlation side-lobs.

A Golay complementary pair (GCP) indicates a pair of sequences whose sum of
aperiodic auto-correlation functions (AACFs) results in zero at nonzero time
shifts. Golay uncovered a sequence pair that can be used during the research
of multislit spectroscopy [1, 2]. GCPs are comprehensively utilised in
engineering applications, particularly in radar systems and communication
systems. These applications include channel estimation [3, 4], design of the
physical uplink control channel [5], non-orthogonal multiple access [6], radar
waveform design [7], control of peak-to-average power ratio for multi-carrier
communication systems [8], and more. Tseng and Liu presented the idea of a
Golay complementary set (GCS) comprising more than two sequences. The sum of
the AACFs for all sequences is zero except at zero time shift [9]. Due to
their similar characteristics to GCPs, GCSs are also utilised in several
communication and radar systems [10, 11]. Furthermore, GCS has the added
benefit of a greater code rate compared to GCP, in addition to its variable
length advantage [12, 13, 14].

A mutually orthogonal Golay complementary set (MOGCS) is a collection of $K$
GCSs. Each GCS in the MOGCS has $M$ sequences, each of length $L$.
Additionally, the cross-correlation function between distinct GCSs is zero. A
MOGCS is referred to as a complete complementary code (CCC) when $K$ is equal
to $M$ [15]. For implementing multi-antenna or multi-user systems, it is
important to consider the cross-correlation characteristics across sets of
sequences. This is particularly relevant for systems such as CCC based code
division multiple access (CDMA) and multi-input multi-output (MIMO) radar [16,
17, 18, 19]. The idea of CCC extended to multiple CCC with inter-set zero
cross-correlation zone (ZCCZ) [20, 21], which is similar to $Z$ complementary
code set (ZCCS). The idea of CCC also extended to multiple CCC with inter-set
low cross-correlation, which is similar to the Quasi complementary code set
(QCCS).

In systems that use orthogonal frequency division multiplexing (OFDM), some
sub-carriers are designated as reserved and are not allowed to transmit
signals [22]. For instance, the direct current sub-carrier is specifically
allocated, known as spectrally null constrained (SNC), to prevent any
discrepancies in the D/A and A/D converters during radio frequency
transmission [23]. The increasing need for OFDM or multi-carrier CDMA
sequences with spectrum null constraints, also known as non-contiguous
sequences, is primarily motivated by their potential applications in cognitive
radio (CR) communications [24]. In OFDM-based CR transmissions, secondary
users are constrained by transmitting on sub-carriers that are not being used
by primary users. The Third-Generation Partnership Project Long-Term Evolution
enhanced licenced-assisted access and the New Radio in Unlicenced (NR-U)
implemented interlaced transmission, with the null locations of the SNC
sequences being regularly distributed (although the nulls in NR-U are unevenly
spaced). Furthermore, when employing the CCC as omnidirectional precoding for
a non-uniform rectangular array, it is necessary to consider the spectral null
constraint [25, 5]. In the IEEE P802.15.4z standard, the average power
permitted in ultra-wide-band is very low. Therefore, the sequence design will
consider the inclusion of null to decrease the average power. To summarise,
several situations in sequence design require the use of null constraints.

Only a few of the conventional GCSs and CCCs take into account this
limitation, which has been addressed in [26, 5, 23, 27, 28, 29, 30]. Sahin and
Yang extended the conventional GCPs to address the SNC problem, as described
in [5] and [27]. In [23], Zhou et al. sequentially built the SNC-MOGCSs/SNC-
GCSs using an iterative approach. They used two sequences extracted from a GCP
as the initial seed sequence, then introduced a certain amount of zeros into
these two sequences. As a result, new sequences were obtained with a zero
correlation zone. Hence, a challenging issue arises regarding the methodology
for constructing SNC-CCCs. Shen et al. proposed a method for constructing SNC-
CCC using extended Boolean functions and graphs [29]. However, the parameters
are only in the power of $p$ when elements of code are considered from the
$q$th root of unity and zero, for $p\mid q$ and $p\geq 2$. In machine-type
communication, alphabet size plays a major role and must be minimum [31].
However, there are gaps in the SNC-CCC proposed in [29] in terms of lengths
and alphabet sizes. For example, when the alphabets are $-1,1,0$, set size,
code size and length are limited to the power of two. We are strongly
motivated to include a greater range of parameters for SNC-CCC in comparison
to existing literature. The proposed construction not only provides SNC-CCCs
with new parameters but also provides flexibility in the alphabet and the
length of the constituent sequences.It may be noted that codes are referred to
as CCC, ZCCS, QCCS when they are traditional codes, and codes with nulls are
referred to as SNC-CCC, SNC-ZCCS, SNC-QCCS.

In the proposed construction, we use existing CCCs and mutually orthogonal
sequences (MOSs) as seeds. By performing the concatenation operation in a
specific way, as described in Section 2, we obtain multiple SNC-CCCs over a
small alphabet. It may be noted that our smallest alphabet is $\\{-1,0,1\\}$,
on which the proposed construction is capable of generating almost all
possible lengths. The proposed multiple SNC-CCCs also have a ZCCZ property
with respect to both periodic and aperiodic correlation. With these
properties, the obtained code set is useful for multi-cell MC-CDMA systems,
where the users inside a cell enjoy interference-free communication due to the
ideal correlation property of a SNC-CCC and the users from two different cells
also enjoy interference-free communication within the ZCCZ. Our study also
found that non-zero inter-set cross-correlation values outside the ZCCZ can be
controlled. We consider this as an opportunity to minimise the upper bound for
inter-set cross-correlation values of the proposed multiple SNC-CCCs.

The subsequent sections of the paper are structured in the following form:
Section 1 establishes appropriate notations and definitions. Section 2
introduces new constructions for SNC-CCC, multiple SNC-CCC and provides an
example to illustrate this. Further, we explain the ZCCZ width of the multiple
SNC-CCC and conclude with the low inter-set cross-correlation value. In
Section 3, a comparison has been given with existing literature. In Section 4,
we provide two open problems for future research. The paper is concluded in
Section 5.

##  1 Preliminaries

Before anything starts, let us specify the notation and definitions that will
be utilised consistently throughout this paper.

######  Definition 1.

Let $\mathbf{a}=\\{a_{1},a_{2},\ldots,a_{L}\\}$ be any complex-valued sequence
and $N=\\{x\in\mathbb{N}:a_{x}=0\\}$ is non-empty set, $\mathbf{a}$ is called
a SNC sequence. A CCC is called an SNC-CCC if there is at least one SNC
sequence in the CCC [29].

######  Definition 2.

Let $\mathbf{a}=(a_{1},a_{2},\ldots,a_{L})$ and
$\mathbf{b}=(b_{1},b_{2},\ldots,b_{L})$ be two complex-valued sequences of
length $L$ and $\tau$ be an integer. Define

$\mathcal{C}(\mathbf{a},\mathbf{b})(\tau)=\left\\{\begin{array}[]{ll}\sum_{i=1}^{L-\tau}a_{i+\tau}b_{i}^{*},&0\leq\tau<L,\\\
\sum_{i=1}^{L+\tau}a_{i}b_{i-\tau}^{*},&-L<\tau<0,\\\ 0,&\text{ otherwise,
}\end{array}\right.$ (1)

is called ACCF of $\mathbf{a}$ and $\mathbf{b}$ at time shift $\tau$, where
$(\cdot)^{*}$ represents complex conjugation. When $\mathbf{a}=\mathbf{b}$,
$\mathcal{C}(\mathbf{a},\mathbf{b})(\tau)$ is called AACF of $\mathbf{a}$ and
is denoted by $\mathcal{C}(\mathbf{a})(\tau)$. Further, periodic cross-
correlation function of $\mathbf{a}$ and $\mathbf{b}$ at time shift $\tau$ is
defined as

$\Theta(\mathbf{a},\mathbf{b})(\tau)=\mathcal{C}(\mathbf{a},\mathbf{b})(\tau)+\mathcal{C}(\mathbf{a},\mathbf{b})(\tau-N)$
(2)

######  Definition 3.

Let $\mathbf{C}=\left\\{{C}_{k}:1\leq k\leq M\right\\}$ be a set of $M$
matrices (codes), each having order $M\times L$. And $C_{k}$ is defined as

$C_{k}=\left[\begin{array}[]{c}\mathbf{c}_{1}^{k}\\\ \mathbf{c}_{2}^{k}\\\
\vdots\\\ \mathbf{c}_{M}^{k}\end{array}\right]_{M\times L},$ (3)

where $\mathbf{c}_{j}^{k}(1\leq j\leq M,1\leq k\leq K)$ is the $j$-th row
sequence of $C_{k}$.Then ACCF between $C_{k_{1}}$ and $C_{k_{2}}$ is defined
by

$\mathcal{C}\left({C}_{k_{1}},{C}_{k_{2}}\right)(\tau)=\sum_{\nu=1}^{M}\mathcal{C}\left(\mathbf{c}_{\nu}^{k_{1}},\mathbf{c}_{\nu}^{k_{2}}\right)(\tau).$
(4)

When ${C}_{k_{1}}={C}_{k_{2}}$, $\mathcal{C}(C_{k_{1}},C_{k_{2}})(\tau)$ is
called AACF of ${C}_{k_{1}}$ and is denoted by $\mathcal{C}(C_{k_{1}})(\tau)$.

######  Definition 4.

Let $\mathbf{C}=\left\\{{C}_{k}:1\leq k\leq M\right\\}$ be a set of $M$ codes
of order $M\times L$ and it follows

$\mathcal{C}(C_{k_{1}},C_{k_{2}})(\tau)=\left\\{\begin{array}[]{cc}ML-\epsilon&k_{1}=k_{2},\tau=0\\\
0&\text{otherwise,}\end{array}\right.$ (5)

where, $\epsilon$ is number of zeros in a code. When $\epsilon=0$ it is
referred as traditional CCC and for $\epsilon\geq 1$, we have SNC-CCC.

######  Definition 5.

Let $\mathbf{C}=\\{\mathbf{C}^{j}:1\leq j\leq P\\}$ be a collection of $P$
many $(M,N)$-CCC, i.e., $\mathbf{C}^{j}=\left\\{{C}^{j}_{k}:1\leq k\leq
M\right\\}$, where $1\leq j\leq P,P\geq 2$. If any two codes from different
CCCs $\mathbf{C}^{j_{1}}$ and $\mathbf{C}^{j_{1}}$ with $1\leq j_{1}\neq
j_{2}\leq P$ follows

$\mathcal{C}(\mathbf{C}^{j_{1}}_{k_{1}},\mathbf{C}^{j_{2}}_{k_{2}})(\tau)=0,~{}\lvert\tau\rvert<Z,$
(6)

where $1\leq k_{1},k_{2}\leq M$, we say that $\mathbf{C}$ is a collection of
multiple CCCs with inter-set ZCCZ and $Z$ is the ZCCZ width [21].

######  Definition 6.

Let $\mathbf{C}=\left\\{{C}_{k}:1\leq k\leq K\right\\}$ be a set of $K$ codes
of order $M\times L$ and it follows

$\mathcal{C}(C_{k_{1}},C_{k_{2}})(\tau)=\left\\{\begin{array}[]{cc}ML-\epsilon&k_{1}=k_{2},\;\tau=0,\\\
0&k_{1}=k_{2},\;1\leq\lvert\tau\rvert\leq Z-1,\\\ 0&k_{1}\neq
k_{2},\;0\leq\lvert\tau\rvert\leq Z-1,\end{array}\right.$ (7)

where, $\epsilon$ is number of zeros in a code. Then $\mathbf{C}$ is called
aperiodic $(K,M,N,Z)$-ZCCS. And the set is referred as periodic ZCCS if it
follows

$\Theta(C_{k_{1}},C_{k_{2}})(\tau)=\left\\{\begin{array}[]{cc}ML-\epsilon&k_{1}=k_{2},\;\tau=0,\\\
0&k_{1}=k_{2},\;1\leq\lvert\tau\rvert\leq Z-1,\\\ 0&k_{1}\neq
k_{2},\;0\leq\lvert\tau\rvert\leq Z-1.\end{array}\right.$ (8)

For traditional ZCCS $\epsilon=0$ and for SNC-ZCCS $\epsilon\geq 1$.

######  Definition 7.

Let $\mathbf{C}=\left\\{{C}_{k}:1\leq k\leq K\right\\}$ be a set of $K$ codes
of order $M\times L$ and it follows

$\displaystyle\delta_{A}=$
$\displaystyle\left\\{\lvert\mathcal{C}(C_{k})(\tau)\rvert:1\leq k\leq
K,1\leq\lvert\tau\rvert\leq L-1\right\\},$ (9) $\displaystyle\delta_{C}=$
$\displaystyle\left\\{\lvert\mathcal{C}(C_{k_{1}},C_{k_{2}})(\tau)\rvert:1\leq
k_{1}\neq k_{2}\leq K,0\leq\lvert\tau\rvert\leq L-1\right\\}.$

Then maximum magnitude of aperiodic correlation is
$\delta=\max\\{\delta_{A},\delta_{C}\\}$. The code set $\mathbf{C}$ is called
aperiodic $(K,M,L,\delta)$-QCCS. And if it follows

$\displaystyle\delta_{A}=$
$\displaystyle\left\\{\lvert\Theta(C_{k})(\tau)\rvert:1\leq k\leq
K,1\leq\lvert\tau\rvert\leq L-1\right\\},$ (10) $\displaystyle\delta_{C}=$
$\displaystyle\left\\{\lvert\Theta(C_{k_{1}},C_{k_{2}})(\tau)\rvert:1\leq
k_{1}\neq k_{2}\leq K,0\leq\lvert\tau\rvert\leq L-1\right\\}.$

Then maximum magnitude of periodic correlation is
$\delta=\max\\{\delta_{A},\delta_{C}\\}$. The code set $\mathbf{C}$ is called
periodic $(K,M,L,\delta)$-QCCS.

Let $\mathbf{a}$ and $\mathbf{b}$ be two complex sequences of identical length
and said to be orthogonal if the dot product $(\mathbf{a}\cdot\mathbf{b}^{*})$
is equal to $0$. When the number of sequences is more than two and the dot
product of any two sequences is zero, the set of sequences is referred to as
MOSs. A construction of $P$ many MOSs with length $P$ is suggested in [32].

##  2 Proposed Construction

In this section, we describe our main method of construction. First, we
provide a new method, which involves the concatenation of zeros and matrices
with some scalar multiplications. And scalars need to be chosen carefully so
that they do not affect the alphabets of matrices after multiplication.

######  Construction 8.

Let $C_{1},C_{2},\ldots,C_{P}$ be a set of $M\times L$ matrices and
$\mathbf{b}=(b_{1},b_{2},\ldots,b_{P})$ be a sequence of length $P$. For
$K>P$, then we define

$\mathcal{R}^{\mathcal{P}(n)}(C_{1},C_{2},\ldots,C_{P};\mathbf{b})=\left[\mathbf{0}^{n_{1}}\mathbin{\|}b_{1}C_{1}\mathbin{\|}\mathbf{0}^{n_{2}}\mathbin{\|}b_{2}C_{2}\mathbin{\|}\mathbf{0}^{n_{3}}\mathbin{\|}\cdots\mathbin{\|}\mathbf{0}^{n_{P}}\mathbin{\|}b_{P}C_{P}\mathbin{\|}\mathbf{0}^{n_{P}+1}\right],$
(11)

where, $\mathcal{P}(n)=(n_{1},n_{2},\ldots,n_{P+1})$ (partition of $n$ with
$P+1$ non-negative integers) $n=n_{1}+n_{2}+\cdots+n_{P+1}$,
$\mathbf{0}^{n_{1}}$ represents a zero matrix of size $M\times n_{1}$ and
$\mathbin{\|}$ represents concatenation of two matrices.

First we consider a $(M,L)$-CCC, $P\leq M$, such that $P\mid M$ and MOSs of
length $P$. Now, for any positive integers $n$, we take a partition with $P+1$
non-negative integers. The partition of $n$ decides the position and numbers
of nulls in the proposed codes.

######  Theorem 9.

Let $\mathbf{C}$ be a $(M,L)$-CCC, $P\mid M$,
$\mathbf{b}^{1},\mathbf{b}^{2},\ldots,\mathbf{b}^{P}$ be MOSs of length $P$.
Now, define

$B_{\nu P+\mu}=\mathcal{R}^{\mathcal{P}(n)}(C_{\nu P+1},C_{\nu
P+2},\ldots,C_{(\nu+1)P};\mathbf{b}^{\mu}),$ (12)

for $0\leq\nu<\frac{M}{P},~{}1\leq\mu\leq P$. Then
$\mathbf{B}=\\{B_{1},B_{2},\ldots,B_{M}\\}$ is a $(M,PL+n)$ SNC-CCC.

Since the alphabets of CCC and MOSs are identical, the resulting SNC-CCCs
likewise possess the same alphabets, with an additional zeros. The position of
nulls can be determined by the partition of $n$, which is employed in the
construction.

######  Example 10.

Let

$\displaystyle C_{1}=$ $\displaystyle\begin{bmatrix}+++\\\ ++-\\\ -+-\\\
-+-\end{bmatrix},C_{2}=\begin{bmatrix}+-+\\\ ++-\\\ \--+\\\
+++\end{bmatrix},C_{3}=\begin{bmatrix}+--\\\ +++\\\ -+-\\\
+--\end{bmatrix}\text{and }C_{4}=\begin{bmatrix}+--\\\ +-+\\\ +++\\\
-++\end{bmatrix},$

be a $(4,3)$-CCC from [33], where $+$ and $-$ represent $1$ and $-1$,
respectively. Now, assume $P=2$, $\mathbf{b}^{1}=(1,1)$,
$\mathbf{b}^{2}=(1,-1)$, $n_{1}=0,n_{2}=3$ and $n_{3}=0$. Then from Theorem 9,

$\displaystyle B_{1}$ $\displaystyle=\begin{bmatrix}+++000+-+\\\ ++-000++-\\\
++-000--+\\\ -+-000+++\end{bmatrix},$ $\displaystyle
B_{2}=\begin{bmatrix}+++000-+-\\\ ++-000--+\\\ ++-000++-\\\
-+-000---\end{bmatrix},$ (13) $\displaystyle B_{3}$
$\displaystyle=\begin{bmatrix}+--000+--\\\ +++000+-+\\\ -+-000+++\\\
+--000-++\end{bmatrix},\text{ and }$ $\displaystyle
B_{4}=\begin{bmatrix}+--000-++\\\ +++000-+-\\\ -+-000---\\\
+--000+--\end{bmatrix},$

is a $(4,9)$ SNC-CCC.

######  Remark 11.

In the Example 10, there is the freedom to decide on various values
$n_{1},n_{2}$ and $n_{3}$.

Let $\pi_{1},\pi_{2},\ldots$ be permutations of $\\{1,2,\ldots,M\\}$ such that

$\pi_{j_{1}}(i_{1}P+\mu)\neq\pi_{j_{2}}(i_{2}P+\mu)$ (14)

for $j_{1}\neq j_{2}$, $0\leq i_{1},i_{2}<\frac{M}{P}$ and $1\leq\mu<P$, we
have $P$ many such permutations.

######  Theorem 12.

Let $\mathbf{C}$ be a $(M,L)$-CCC, $P\mid M$,
$\mathbf{b}^{1},\mathbf{b}^{2},\ldots,\mathbf{b}^{P}$ be MOSs of length $P$
and $\pi_{0},\pi_{1},\ldots,\pi_{P-1}$ be permutations as defined in (14).
Now, define

$B_{jM+\nu P+\mu}=\mathcal{R}^{\mathcal{P}(n)}(C_{\pi_{j}(\nu
P+1)},C_{\pi_{j}(\nu P+2)},\ldots,C_{\pi_{j}((\nu+1)P)};\mathbf{b}^{\mu}),$
(15)

for $0\leq\nu<\frac{M}{P},~{}1\leq\mu\leq P$ and $0\leq j\leq P-1$. Then, each
$\mathbf{B}^{j}=\\{B_{jM+1},B_{jM+2},\ldots,$ $B_{(j+1)M}\\}$ is a $(M,PL+n)$
SNC-CCC and by combining all SNC-CCC it become a multiple CCC with inter-set
ZCCZ.

######  Remark 13.

Multiple SNC-CCC has ZCCZ width and that can be obtained by the elements in
the partition of $n$. The periodic and aperiodic ZCCZ will be $\lambda+L$,
where

$\lambda=\min_{2\leq i\leq P}\\{n_{i}\\}.$ (16)

Now, we provide the method to reduce the side-lobs.

######  Corollary 14.

Let $\mathcal{P}(n)$ be partition of $n$ i.e., $n=n_{1}+n_{2}+\ldots+n_{P+2}$
such that $n_{i_{1}}\neq n_{i_{2}}$ for $2\leq i_{1},i_{2}\leq P$ then maximum
aperiodic side-lobs value become $LM$. Further if $n_{i_{1}}\neq
n_{i_{2}}\mod{L}$ for $2\leq i_{1},i_{2}\leq P$ then maximum PCCF side-lobs
value become $LM$. This type of $n$ is possible when $n\geq\frac{P(P-1)}{2}$.

Let $\pi_{1},\pi_{2},\ldots,\pi_{P}$ be permutation of $\\{1,2,\ldots,M\\}$ as
define in (14), further for any two permutation $\pi_{j_{1}}$ and
$\pi_{j_{2}}$, when

$\displaystyle\pi_{j_{1}}(i_{1}P+\mu_{1})=$
$\displaystyle\pi_{j_{2}}(i_{2}P+\mu_{2}),\text{then}$ (17)
$\displaystyle\pi_{j_{1}}(i_{1}P+\mu_{1}+\alpha)\neq$
$\displaystyle\pi_{j_{2}}(i_{2}P+\mu_{2}+\alpha),$

for $1\leq\mu_{1}+\alpha,\mu_{2}+\alpha\leq P$.

######  Corollary 15.

Theorem 12 provides a multiple SNC-CCC such that side-lob is non-zero at only
one time shift and the value is equal to $LM$, when permutations satisfies
(17). Therefore, for the aperiodic and periodic the maximum side-lobs value
become $LM$.

For low side-lobs value, the choice of a set of permutations plays a role. To
ensure such permutation exists, we are providing an example. Let $M=4$, $P=4$
then $\pi_{1}=(1,2,3,4),\;\pi_{2}=(2,3,4,1),\;\pi_{3}=(3,4,1,2)$ and
$\pi_{4}=(4,1,2,3)$, satisfy (14) but not (17). But
$\pi_{1}=(1,2,3,4),\;\pi_{2}=(4,3,2,1),\;\pi_{3}=(3,1,4,2)$ and
$\pi_{3}=(2,4,1,3)$ satisfies (17).

##  3 Comparison

###  3.1 Comparison with [27] and [34]

[27] and [34] generated SNC-GCS via generalised Boolean functions and
generated parameters closely multiple of $2$. Furthermore, their findings are
restricted to SNC-GCSs and do not extend to SNC-CCCs. However, in the proposed
construction, every code are SNC-GCSs, which are not restricted to a multiple
of $2$ only.

###  3.2 Comparision with [23]

The method in [23] implements an iterative strategy using an existing CCC to
generate SNC-MOGCSs. Meanwhile, the proposed construction provides SNC-CCCs.

###  3.3 Comparision with [29]

SNC-CCCs has been constructed using an extended Boolean function in [29] with
diversified parameters. Notably, these parameters consistently involve powers
of $p$ for $p\geq 2$, where the elements are obtained from the $q$th root of
unity and zero for $(p\mid q)$. The given example demonstrates that the
proposed construction offers more flexibility.

##  4 Future directions

Based on our contribution in this paper, we would like to introduce the
following future works:

  1. 1.

In the current literature, we do not have sufficient information on the
optimal collection of multiple SNC-CCCs in relation to their maximum magnitude
of inter-set cross-correlation value. This limitation leads to a future
direction on deriving a correlation lower bound for multiple collections of
SNC-CCCs.

  2. 2.

Besides, as we can see in our proposed construction of multiple SNC-CCCs, we
also have a ZCCZ, which leads us to the natural question, “What will be the
relationship between the ZCCZ width and the other parameters of our multiple
collection of SNC-CCCs?”

##  5 Conclusion

In this paper, with the help of MOSs, we developed a method to construct a
SNC-CCC, with flexible parameters. The beauty of the proposed construction is
that it can cover almost all lengths with very small alphabet set
$\\{-1,0,1\\}$. Further, the construction extended to construct multiple SNC-
CCC with inter-set ZCCZ. An example has been given to demonstrate that the
proposed construction covers more parameters in terms of length and alphabet
size. In addition, an idea to limit the maximum correlation value is also
proposed, ensuring that the resulting multiple CCC not only has a zero
correlation zone through each set, but also has a low correlation value across
sets.

##  6 Proof of Theorems

In this section we complete the proof of Theorem 9 and Theorem 12.

###### Proof of Theorem 9.

We complete the proof in two parts, one is for AACF and second is for ACCF
values.

Case 1. Let $1\leq t_{1}=\nu_{1}P+\mu_{1}\leq M$ and $\tau\neq 0$, then
$\mathcal{C}(B_{t_{1}})(\tau)$ is written as linear sum of AACF of a code at
non-zero time shift and ACCF between two different codes from
$\\{C_{\nu_{1}+1},C_{\nu_{1}+2},\ldots,C_{\nu_{1}+P}\\}$, which results
$\mathcal{C}(B_{t_{1}})(\tau)=0$ for any $\tau$ except at $\tau=0$.

Case 2. Consider two distinct integer $n_{1}=\nu_{1}P+\mu_{1}$ and
$n_{2}=\nu_{2}P+\mu_{2}$ such that
$1\leq\nu_{1}P+\mu_{1}\neq\nu_{2}P+\mu_{2}\leq M$, for
$0\leq\nu<\frac{M}{P},~{}1\leq\mu\leq P$. Again, we consider two subcases on
the basis of $\nu_{1},\nu_{2}$ to complete the proof.

Subcase (i): $\nu_{1}=\nu_{2}$. Since $\mathbf{b}^{\nu_{1}}$ is orthogonal to
$\mathbf{b}^{\nu_{2}}$, it implies that
$\mathbf{b}^{\nu_{1}}\cdot\mathbf{b}^{\nu_{2}*}=0$. Therefore,

$\mathcal{C}(B_{t_{1}},B_{t_{2}})(0)=\mathbf{b}^{\nu_{1}}\cdot\mathbf{b}^{\nu_{2}}\sum_{i=1}^{P}\mathcal{C}(C_{\nu_{1}+i})(0)=0.$
(18)

Now, assume $\tau\neq 0$, then $\mathcal{C}(B_{t_{1}},B_{t_{2}})(\tau)$ is a
linear sum of ACCF between two different codes from
$\\{C_{\nu_{1}+1},C_{\nu_{1}+2},\ldots,C_{\nu_{1}+P}\\}$, which results
$\mathcal{C}(B_{t_{1}},B_{t_{2}})(\tau)=0$.

Subcase (ii): $\nu_{2}\neq\nu_{2}$, then
$\mathcal{C}(B_{t_{1}},B_{t_{2}})(\tau)$ is written as linear sum of AACF of a
code at non-zero time shift and ACCF between two different codes from
$\\{C_{\nu_{1}+1},C_{\nu_{1}+2},\ldots,C_{\nu_{1}+P},$
$C_{\nu_{2}+1},C_{\nu_{2}+2},\ldots,C_{\nu_{2}+P}\\}$, which results
$\mathcal{C}(B_{t_{1}},B_{t_{2}})(\tau)=0$ for any $\tau$.

From the above cases the proof is complete. ∎

###### Proof of Theorem 12.

Each $\mathbf{B}^{j}$ is a $(M,PL+n)$ SNC-CCC, for $1\leq j\leq P-1$. Now,
consider $B^{j_{1}}_{t_{1}}\in\mathbf{B}^{j_{1}}$ and
$B^{j_{2}}_{t_{2}}\in\mathbf{B}^{j_{2}}$. The value of
$\mathcal{C}(B^{j_{1}}_{t_{1}},B^{j_{2}}_{t_{2}})(\tau)$ become non-zero when
it include AACF of any code from $\\{C_{1},C_{2},\ldots,C_{M}\\}$, that
happens only for $\tau=L+n_{i}$ for some $2\geq i\geq P$. There for
$\mathcal{C}(B^{j_{1}}_{t_{1}},B^{j_{2}}_{t_{2}})(\tau)=0$ for
$\lvert\tau\rvert<L+\lambda$, where $\lambda=\min\\{n_{i}:2\geq i\geq P\\}$.
This completes the proof. ∎

## References

  * [1] Marcel J. E. Golay.  Static multislit spectrometry and its application to the panoramic display of infrared spectra$\ast$.  J. Opt. Soc. Am., 41(7):468–472, Jul 1951.
  * [2] M. Golay.  Complementary series.  IRE Transactions on Information Theory, 7(2):82–87, 1961.
  * [3] P. Spasojevic and C.N. Georghiades.  Complementary sequences for ISI channel estimation.  IEEE Trans. Inf. Theory, 47(3):1145–1152, 2001.
  * [4] H.M. Wang, X.Q. Gao, B. Jiang, X.H. You, and W. Hong.  Efficient MIMO channel estimation using complementary sequences.  IET Communications, 1:962–969(7), October 2007.
  * [5] Alphan Șahin and Rui Yang.  An uplink control channel design with complementary sequences for unlicensed bands.  IEEE Trans. Wireless Commun., 19(10):6858–6870, 2020.
  * [6] Nam Yul Yu.  Binary Golay spreading sequences and Reed-Muller codes for uplink grant-free NOMA.  IEEE Trans. Commun., 69(1):276–290, 2021.
  * [7] Ali Pezeshki, A. Robert Calderbank, William Moran, and Stephen D. Howard.  Doppler resilient Golay complementary waveforms.  IEEE Trans. Inf. Theory, 54(9):4254–4266, 2008.
  * [8] J.A. Davis and J. Jedwab.  Peak-to-mean power control in OFDM, Golay complementary sequences, and Reed-Muller codes.  IEEE Trans. Inf. Theory, 45(7):2397–2417, 1999.
  * [9] Chin-Chong Tseng and C. Liu.  Complementary sets of sequences.  IEEE Trans. Inf. Theory, 18(5):644–652, 1972.
  * [10] H. D. Nguyêñ and G. E. Coxson.  Doppler tolerance, complementary code sets, and generalised thue–morse sequences.  IET Radar, Sonar &Amp; Navigation, 10:1603–1610, 2016.
  * [11] JoaquíN Aparicio and Takuya Shimura.  Asynchronous detection and identification of multiple users by multi-carrier modulated complementary set of sequences.  IEEE Access, 6:22054–22069, 2018.
  * [12] K.G. Paterson.  Generalized Reed-Muller codes and power control in OFDM modulation.  IEEE Trans. Inf. Theory, 46(1):104–120, 2000.
  * [13] Kai-Uwe Schmidt.  Complementary sets, generalized Reed–Muller codes, and power control for OFDM.  IEEE Trans. Inf. Theory, 53(2):808–814, 2007.
  * [14] Palash Sarkar, Sudhan Majhi, and Zilong Liu.  A direct and generalized construction of polyphase complementary sets with low PMEPR and high code-rate for OFDM system.  IEEE Trans. Commun., 68(10):6245–6262, 2020.
  * [15] N. Suehiro and M. Hatori.  N-shift cross-orthogonal sequences.  IEEE Trans. Inf. Theory, 34(1):143–146, 1988.
  * [16] Xiqing Liu, Yvonne Huang, Chih-Yu Chang, and Hsiao-Hwa Chen.  Generalized complementary coded scrambling multiple access for MIMO communications.  IEEE Trans. Veh. Technol., 70(12):13047–13061, 2021.
  * [17] Si-Yue Sun, Hsiao-Hwa Chen, and Wei-Xiao Meng.  A survey on complementary-coded MIMO CDMA wireless communications.  IEEE Communications Surveys & Tutorials, 17(1):52–69, 2015.
  * [18] Jun Tang, Ning Zhang, Zhikun Ma, and Bo Tang.  Construction of doppler resilient complete complementary code in MIMO radar.  IEEE Trans. Signal Process., 62(18):4704–4712, 2014.
  * [19] Si-Yue Sun, Hsiao-Hwa Chen, and Wei-Xiao Meng.  A framework to construct three-dimensional complementary codes for multiuser MIMO systems.  IEEE Trans. Veh. Technol., 64(7):2861–2874, 2015.
  * [20] Xinyu Men and Yubo Li.  New construction of multiple complete complementary codes with inter-set zero cross-correlation zone.  IEEE Signal Process. Lett., 29:1958–1962, 2022.
  * [21] Liying Tian, Yubo Li, and Chengqian Xu.  Multiple complete complementary codes with inter-set zero cross-correlation zone.  IEEE Trans. Commun., 68(3):1925–1936, 2020.
  * [22] IEEE standard for wireless lan medium access control (MAC) and physical layer (PHY) specifications.  IEEE Std 802.11-1997, pages 1–445, 1997.
  * [23] Yajing Zhou, Yang Yang, Zhengchun Zhou, Kushal Anand, Su Hu, and Yong Liang Guan.  New complementary sets with low PAPR property under spectral null constraints.  IEEE Trans. Inf. Theory, 66(11):7022–7032, 2020.
  * [24] Benjamin R. Hamilton, Xiaoli Ma, John E. Kleider, and Robert J. Baxley.  OFDM pilot design for channel estimation with null edge subcarriers.  IEEE Trans. Wireless Commun., 10(10):3145–3150, 2011.
  * [25] Dongliang Su, Yi Jiang, Xin Wang, and Xiqi Gao.  Omnidirectional precoding for massive MIMO with uniform rectangular array—part I: Complementary codes-based schemes.  IEEE Trans. Signal Process., 67(18):4761–4771, 2019.
  * [26] A. Gavish and A. Lempel.  On ternary complementary sequences.  IEEE Trans. Inf. Theory, 40(2):522–526, 1994.
  * [27] Alphan Şahin and Rui Yang.  A generic complementary sequence construction and associated encoder/decoder design.  IEEE Trans. Commun., 69(11):7691–7705, 2021.
  * [28] Roman N. Ipanov, Alexandr I. Baskakov, Nikolay Olyunin, and Min-Ho Ka.  Radar signals with ZACZ based on pairs of D-code sequences and their compression algorithm.  IEEE Signal Process. Lett., 25(10):1560–1564, 2018.
  * [29] Bingsheng Shen, Yang Yang, Zhengchun Zhou, and Sihem Mesnager.  Constructions of spectrally null constrained complete complementary codes via the graph of extended boolean functions.  IEEE Trans. Inf. Theory, 69(9):6028–6039, 2023.
  * [30] Nishant Kumar, Palash Sarkar, and Sudhan Majhi.  Construction of spectrally-null-constrained zero-correlation zone sequences with flexible support, 2023.
  * [31] Palash Sarkar, Chunlei Li, Sudhan Majhi, and Zilong Liu.  New correlation bound and construction of Quasi-complementary sequence sets.  IEEE Trans. Inf. Theory, 70(3):2201–2223, 2024.
  * [32] Rajen Kumar, Prashant Kumar Srivastava, and Sudhan Majhi.  A direct construction of type-II Z complementary code set with arbitrarily large codes, 2023.
  * [33] Yu Tao, Adhikari Avik, Ranjan, Wang Yanyan, and Yang Yang.  New class of optimal Z-complementary code sets.  IEEE Signal Processing Letters, pages 1–1, 2022.
  * [34] Bingsheng Shen, Yang Yang, Pingzhi Fan, and Zhengchun Zhou.  Constructions of non-contiguous complementary sequence sets and their applications.  IEEE Trans. Wireless Commun., 21(7):4871–4882, 2022.