# JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to
Malicious Website Detection

Chika Komiya  Osaka University, Japan
<EMAIL_ADDRESS>Naoto Yanai  Osaka University, Japan
<EMAIL_ADDRESS>Kyosuke Yamashita  Shingo Okamura  Osaka University,
Japan
<EMAIL_ADDRESS>National Institute of Technology, Nara College,
Japan
<EMAIL_ADDRESS>
###### Abstract

Machine learning is often used for malicious website detection, but an
approach incorporating WebAssembly as a feature has not been explored due to a
limited number of samples, to the best of our knowledge. In this paper, we
propose JABBERWOCK (JAvascript-Based Binary EncodeR by WebAssembly
Optimization paCKer), a tool to generate WebAssembly datasets in a pseudo
fashion via JavaScript. Loosely speaking, JABBERWOCK automatically gathers
JavaScript code in the real world, convert them into WebAssembly, and then
outputs vectors of the WebAssembly as samples for malicious website detection.
We also conduct experimental evaluations of JABBERWOCK in terms of the
processing time for dataset generation, comparison of the generated samples
with actual WebAssembly samples gathered from the Internet, and an application
for malicious website detection. Regarding the processing time, we show that
JABBERWOCK can construct a dataset in 4.5 seconds per sample for any number of
samples. Next, comparing 10,000 samples output by JABBERWOCK with 168 gathered
WebAssembly samples, we believe that the generated samples by JABBERWOCK are
similar to those in the real world. We then show that JABBERWOCK can provide
malicious website detection with 99% F1-score because JABBERWOCK makes a gap
between benign and malicious samples as the reason for the above high score.
We also confirm that JABBERWOCK can be combined with an existing malicious
website detection tool to improve F1-scores. JABBERWOCK is publicly available
via GitHub (https://github.com/c-chocolate/Jabberwock).

###### Index Terms:

malicious website detection, WebAssembly, JavaScript, dataset generation

##  I Introduction

Malicious websites have caused various cyber crimes, such as phishing and
cryptojacking. While malicious websites can be detected by blacklisting
websites conventionally, machine learning has been introduced in recent years
due to the high occurrence of new malicious websites. It can detect even new
kinds of malicious websites by training a model with their features.

Although various features have been introduced until now, we focus on
WebAssembly in this paper. Loosely speaking, WebAssembly is a language
designed for running on a virtual machine and has been implemented on four
major browsers, i.e., Firefox, Chrome, Safari, and Microsoft Edge, nowadays.
According to Battagline [1], the execution of WebAssembly codes is at most
eight times faster than that of JavaScript codes, and there are websites that
potentially accept WebAssembly codes. Websites with WebAssembly will increase
in the future [2]. Thus, it is considered that the use of WebAssembly as a
feature is desirable for malicious website detection.

In this paper, we answer the following question about malicious website
detection: is malicious website detection based on WebAssembly possible? The
above question is non-trivial due to the following problems. First, to the
best of our knowledge, there is no publicly available dataset of WebAssembly.
We note that the design of a WebAssembly dataset is challenging because the
number of websites with WebAssembly is limited at present. In general,
malicious website detection needs to collect and learn samples of WebAssembly
for benign and malicious websites. Second, even if they are collected, we will
need to identify whether malicious website detection based on WebAssembly can
provide high accuracy through experimental evaluations.

To tackle the above problems where no WebAssembly dataset is available, we
first propose a novel tool, JABBERWOCK (JAvascript-Based Binary EncodeR by
WebAssembly Optimization paCKer), to generate WebAssembly datasets for
malicious website detection. In a nutshell, JABBERWOCK collects JavaScript
codes from existing websites and then converts them to WebAssembly. Afterward,
JABBERWOCK returns a dataset by vectoring WebAssembly with natural language
processing. Hence, JABBERWOCK generates WebAssembly datasets for malicious
website detection in a pseudo fashion because it can collect and convert
JavaScript codes from benign and malicious websites. JABBERWOCK is publicly
available via GitHub (https://github.com/c-chocolate/Jabberwock).

We then conduct experiments to evaluate WebAssembly datasets generated by
JABBERWOCK and their resultant malicious website detection. Specifically, we
gathered 10,000 samples through the existing crawling websites, and then show
that JABBERWOCK can generate a dataset in 4.5 seconds per sample. We also
demonstrate that samples in the generated dataset by JABBERWOCK are
statistically similar to WebAssembly codes in the real world. Next, when we
evaluate the malicious website detection with the dataset generated by
JABBERWOCK, malicious websites can be detected with 99% F1-score. We also
found that JABBERWOCK makes a gap between benign and malicious samples as the
reason for such a high score. We confirm that an existing malicious website
detection tool [3] can be improved with the WebAssembly samples generated by
JABBERWOCK in comparison with the latest work of malicious website detection
[4]. Our promising results show that malicious website detection is possible.

To sum up, we make the following contributions in this paper:

  * •

We propose JABBERWOCK, a publicly available tool to generate WebAssembly
datasets from JavaScript code for malicious website detection.

  * •

JABBERWOCK can generate a dataset in 4.5 seconds per sample.

  * •

The dataset generated by JABBERWOCK is similar to WebAssembly codes in the
real world.

  * •

Malicious websites can be detected with 99% F1-score according to experimental
evaluations with JABBERWOCK.

  * •

The reason for the above high score is that JABBERWOCK makes a gap between
malicious and benign samples.

  * •

An existing malicious website detection tool can be improved with the
WebAssembly samples generated with JABBERWOCK.

This paper is the full version of our previous work published [5] which will
be presented at DCDS 2023. In the previous work, we designed the dataset
generation tool, JABBERWOCK, and then showed that WebAssembly datasets
generated by JABBERWOCK are similar to WebAssembly codes in the real world. In
this paper, we further evaluate malicious website detection based on the
WebAssembly datasets and then demonstrate that malicious websites can be
detected with a high F1-score. We also combine JABBERWOCK with an existing
tool for malicious website detection and then show that F1-score can be
improved. They were future works mentioned in the previous work. We believe
that these future works were solved in this paper.

##  II Backgrounds

This section describes the backgrounds of WebAssembly and malicious website
detection. We also describe related works.

###  II-A WebAssembly

WebAssembly is a virtual instruction set architecture for stack machines.
Generally, instruction set architecture is a binary format that aims to run on
some specific machines. Namely, WebAssembly runs on virtual machines, and thus
it runs on variants of computer hardware and devices. Further, when deploying
WebAssembly as part of Web applications, the download time will be short due
to the small size of a binary file.

To use WebAssembly on websites, we should put WebAeemlby Text (WAT) on a web
server, where WAT is a WebAssembly file compiled from a pseudo-Assembly
language. We can use WebAssembly by calling it via a JavaScript code.

We remark that WebAssembly has variants of advantages. It does not depend on
platforms, and has been implemented on four major browsers [2]. Further, the
execution of WebAssembly codes is at most eight times faster than that of
JavaScript codes [1]. There are libraries that convert other languages to
WebAssembly, such as wasm-pack111https://github.com/rustwasm/wasm-pack for
Rust, and Emscripten222htps://emscripten.org for C/C+. Thus, we believe that
WebAssembly will be widely used on web pages.

###  II-B Malicious Website Detection

There are two main approaches to detecting malicious websites, i.e.,
knowledge-based and machine learning-based methods [6]. The knowledge-based
approach is heuristics and distinguishes benign and malicious websites by an
expert’s knowledge. Due to the continuous development of new malicious
websites, it often fails. On the other hand, the machine learning-based
approach infers unseen websites as benign or malicious [7] through training a
model with labeled websites. Hence, we focus on malicious website detection
based on machine learning.

Informally, malicious website detection based on machine learning involves
training a model to learn the features of websites and their labels, which
represent whether the websites are benign or malicious. During the inference
phase, the model takes features of a target website as input and then infers
its label as either benign or malicious.

###  II-C Related Work

####  II-C1 Design of WebAssembly Datasets

The closest works are Wobfuscator [8] and the empirical study by Hilbig et al.
[9]. Wobfuscator is a tool to obfuscate JavaScript malwares to WebAssembly,
and is motivated by malware analysis. On the other hand, the empirical study
by Hilbig [9] collected WebAssembly from live websites. However, the above
datasets do not contain correctly labeled samples of WebAssembly collected
from live websites as benign or malicious, which are important for machine
learning-based malicious website detection. Many existing works are based on
empirical analysis for vulnerabilities [10] and malwares [11]. They are
different from our work. The recent work [12] aims to analyze types of
functions and hence there is no publicly available dataset for malicious
website detection. Our goal is to design a dataset for malicious website
detection.

####  II-C2 Features of Malicious Website Detection

In malicious website detection, models that use only domain names have been
widely used, although it requires high computational power [13, 14, 15, 16].
In addition to domain names which are just text data, other information can be
used such as DNS information [17, 18, 19, 20, 21] and web contents [22, 23,
24, 25, 26]. In this work, we suggest utilizing WebAssembly as a new feature
for malicious website detection. We primarily focus only on WebAssembly. We
also combine it with other existing features.

####  II-C3 Further Related Work

Recently, malicious website detections have been extended to browser-based
applications [27]. For instance, several plug-ins [28, 29] have been developed
for phishing website detection. However, they utilize white-/blacklists of
domains as a part of detection. The first work for a browser-based application
utilizing only machine learning is MADMAX [3], including feature selection. In
recent years, MADDONA [4] was proposed as an extension of MADMAD to optimize
feature selection and neural network architectures further in accordance with
the latest feature engineering [30]. We combine our dataset with MADMAX and
then show that its resultant performance outperforms MADDONA. We leave it as
an open problem to design a browser-based application with WebAssembly.

##  III Design of JABBERWOCK

Now we propose JABBERWOCK. We first overview JABBERWOCK, and then describe it
in detail. We finally explain the problem setting.

###  III-A Overview

JABBERWOCK generates a dataset for machine learning-based malicious website
detection which uses WebAssembly as a feature. As mentioned in Section I, the
number of samples of WebAssembly is limited at present. Therefore, we
construct a pseudo dataset by converting JavaScript code, which is a major
language for websites, into WebAssembly and then vectorizing WebAssembly as a
sample for the dataset. In doing so, JABBERWOCK takes a list of URLs as input
and returns vectors of WebAssembly as output.

Specifically, JABBERWOCK consists of the following three processes: (1)
collect JavaScript codes from a given URL list; (2) convert them into
WebAssembly; (3) vectorize WebAssembly through training a natural language
processing model. Fig. 1 shows the overview of JABBERWOCK.

JABBERWOCK accepts both labeled and unlabeled URL lists as inputs. Namely,
when an URL is labeled (either benign or malicious), it outputs a vector with
the same label. We remark that an URL list can consist of both benign and
malicious websites. We follow the existing work [3] to label the samples: for
instance, samples generated from URLs in main popularity ranking websites are
benign and those from URLs in existing blacklists are malicious.

Figure 1: Overview of JABBERWOCK

###  III-B Detailed Description

####  III-B1 Collection of JavaScript

JABBERWOCK first collects JavaScript codes from a given URL list, which can be
obtained from a popularity ranking such as Tranco [31]. In the collection of
JavaScript, JABBERWOCK finds pages of websites from the given URL lists,
including benign and malicious websites, and then extracts a single file of
JavaScript code for each page. Whereas it can extract multiple files of
JavaScript code, the current specification extracts only a single file to
suppress data bias. We implemented this function with requests library version
2.27.1 in Python.

####  III-B2 Conversion into WebAssembly

We use Wobfuscator [8] to convert the collected JavaScript codes into
WebAssembly. It is a tool to partially translate JavaScript code, which is
potentially expressed by WebAssembly, into Base64 strings.333The original
motivation of Wobfuscator is to convert into WebAssembly, but the current tool
outputs Base64 strings. These strings can be decoded to .wasm files, and then
are converted into WAT files with the wasm2wat
package444https://www.npmjs.com/package/wasm2wat. This will convert them to a
format suitable for natural language processing in the next section.

####  III-B3 Vectorization with Natural Language Processing

We use Doc2Vec555https://radimrehurek.com/gensim/models/doc2vec.html as a
natural language processing model to vectorize WebAssembly. Doc2Vec is a model
to vectorize any given text. It is trained with the converted files of WAT by
splitting into each line, and returns vectors as samples of a dataset. It can
also be extended into any paragraph vector model.

###  III-C Problem Setting

The issues discussed in this paper are twofold. We identify how vectors in a
dataset output by JABBERWOCK are close to those of actual WebAssembly in the
real world. Hereafter, we denote by J2W the data obtained by JABBERWOCK with
JavaScript and by OWA the (unlabeled) original samples of WebAssembly. We also
denote by J2W-based model and by OWA-based model as models trained with J2W
and OWA, respectively. Our goal is to confirm whether a J2W-based model can
infer websites similarly to an OWA-based model. Furthermore, we will check
whether malicious website detection is actually possible with the JABBERWOCK
dataset.

##  IV Experiments

In this section, we conduct experiments with JABBERWOCK. First, we describe
the purpose and experimental setting, followed by an evaluation of JABBERWOCK
in terms of processing time and difference from samples in the real world.
Next, we show the accuracy of the detection of malicious websites as an
application of this method.

###  IV-A Purpose of Experiments

The purpose of the experiments is to evaluate JABBERWOCK in terms of the
following three standpoints: (1) how long is the processing time to generate a
dataset?; (2) is the distribution of the generated dataset close to the
distribution of a real dataset?; (3) are datasets generated by JABBERWOCK
potentially effective for malicious website detection? We conduct three
experiments based on the standpoints above.

First, the processing time is measured with respect to the number of data
samples in terms of the collection of JavaScript codes, the conversion into
WebAssembly, and the vectorization with natural language processing. Hence, we
evaluate the processing time required for the dataset generation.

Second, to evaluate the distribution of the generated dataset, the
relationship between the J2W-based model and the OWA-based model is identified
and we confirm whether JABBERWOCK can generate samples close to those in the
real world. Namely, we focus on the difference between the cosine similarities
of the generated samples. While cosine similarity is a typical metric to
evaluate the similarity between vectors output by a model, it is considered
that the above two models can vectorize inputs equivalently between them as
long as the difference between cosine similarities of the vectors is close to
zero. That is, even if each model outputs vectors in different directions, it
can still identify whether the relationship between these vectors is similar,
as shown in Fig. 2. We also assume that both J2W-based and OWA-based models
are unlabeled in this experiment to evaluate the difference between cosine
similarities.

Figure 2: Intuition of evaluation metric for the distribution of datasets: The
variables, $\mathrm{J}_{1},\cdots,\mathrm{J}_{n}$, are defined in Section
IV-B2.

Third, we confirm the accuracy of datasets generated by JABBERWOCK by
detecting malicious websites. This confirms that WebAssebly based malicious
website detection through JABBERWOCK is effective.

###  IV-B Experimental Setting

We describe data collection and metrics in the experimental setting below. We
implemented JABERWOCK with Python version 3.7.10 on the AWS EC2 Ubuntu
t3a.xlarge instance.

####  IV-B1 Data Collection

For the first experiment, we obtained an URL list from
PublicWWW666https://publicwww.com. It contains 10,000 samples of JavaScript
for J2W and 168 samples of WebAssembly for OWA. We remark that the URL list is
not labeled in this experiment. This is because there are few (less than 10%)
malicious WebAssembly samples among the genuine samples. We measured the
processing time (Section IV-C1), and compared J2W and OWA (Section IV-C1).

For the second experiment, i.e. malicious website detection, we prepared an
input to JABBERWOCK as follows. Benign websites were obtained from Tranco
[31], and malicious websites were obtained from existing malicious website
lists such as URLhaus777https://urlhaus.abuse.ch, Malware Domain
List888https://www.malwaredomainlist.com/mdl.php, CyberCrime
Tracker999https://cybercrime-tracker.net, and
PhishTank101010https://phishtank.org. These data were classified into 80% of
training data and 20% of test data, respectively. We gave JABBERWOCK 1783
benign websites and 1783 malicious websites to obtain a labeled dataset. We
trained machine-learning models based on the labeled dataset. Finally, we
confirmed that the models can be used for malicious website detection by
giving the test data to the trained models. For more details, see Section
IV-C2.

####  IV-B2 Evaluation Metrics

As evaluation metrics, we focus on the dataset generation by JABBERWOCK and
the detection accuracy for the malicious website detection are described
below.

##### Performance of JABBERWOCK

We evaluate the performance of dataset generation by JABBERWOCK with respect
to the processing time and the distribution of the generated dataset. We
describe the latter in detail below.

For the evaluation of the distribution of the generated dataset, we introduce
a new metrics that extends the existing evaluation metrics, the cosine
similarity. We define some variables to describe the metrics. Let
$\mathrm{J}_{1},\cdots,\mathrm{J}_{n}$ (resp.,
$\mathrm{O}_{1},\cdots,\mathrm{O}_{m}$) be WATs that are obtained from test
data of J2W (resp., OWA). In what follows, we do not mention
$\mathrm{O}_{i}$’s, because they are treated in the same manner as
$\mathrm{J}_{i}$’s. For each $i=1,\cdots,n$, the vector obtained by processing
$\mathrm{J}_{i}$ by J2W-based model is called $\mathrm{J}_{i}$_J2W. We define
$\mathrm{J}_{i}$_OWA in the same way.

To evaluate the dataset generated by JABBERWOCK, we first compute cosine
similarities for each combination of $\mathrm{J}_{i}$ and $\mathrm{J}_{j}$. We
denote the cosine similarity between $\mathrm{J}_{i}$ and $\mathrm{J}_{j}$ by
J2W-based model (resp., by OWA-based model) by
$\mathrm{J}_{i}\mathrm{J}_{j}$_J2W (resp.,
$\mathrm{J}_{i}\mathrm{J}_{j}$_OWA). Recall that we aim to evaluate
similarities between vectors of JABBERWOCK and the actual WebAssembly samples.
We then evaluate the difference between cosine similarities as
$|(\mathrm{J}_{i}\mathrm{J}_{j}\mathrm{\\_J2W})-(\mathrm{J}_{i}\mathrm{J}_{j}\mathrm{\\_OWA})|$.
We compute the differences for each combination of $i\neq j$, and evaluate
them through a box-and-whisker plot. Intuitively, the smaller the difference
is, the better the result is.

##### Accuracy of Malicious Website Detection

We explain the evaluation metrics in malicious website detection. We first
describe the four terms, i.e., true positive (TP), true negative (TN), false
positive (FP), and false negative (FN), to evaluate the detection performance.
TP is the number of malicious websites that are correctly detected as
malicious. TN is the number of benign websites that are correctly detected as
benign. FP is the number of benign websites that are wrongly detected as
malicious, and FN is the number of malicious websites that are wrongly
detected as benign. We then define the following evaluation metrics based on
the above four terms.

  * •

Accuracy: It is the ratio of correctly detected websites to the total number
of websites.

  * •

Precision: It is the ratio of the number of correctly detected websites as
malicious to the total number of detected websites as malicious.

  * •

Recall: It is the ratio of the number of correctly detected websites as
malicious to the total number of malicious websites.

  * •

F1 score: It is the harmonic mean of the precision and the recall.

####  IV-B3 Hyperparameters

When vectorization is performed by Doc2Vec, the hyperparameters are set as
follows. The vector size of Doc2Vec is set to be $2,4,6,8,10,20,40,60,80$, and
$100$. We choose either PVDM or PVDBOW as a model of Dco2Vec. In the default
setting, the vector size is 100, the number of epochs is 10 and the model is
PVDM. For malicious website detection, we also used support vector machines
with radial basis functions, polynomial functions, and linear functions as
kernel (SVM_rbf, SVM_poly, SVM_linear), Random Forest (RF), Naive Bayes (NB),
XGBoost (xgboost), and LightGBM (lightgbm) were used.

###  IV-C Results

Experimental results based on the evaluation metrics described in the previous
section are described below.

####  IV-C1 Performance of JABBERWOCK

The processing time and the distribution evaluation of the datasets generated
by JABBERWOCK are described below.

##### Processing Time

Fig. 3 demonstrates the processing time of JABBERWOCK for each number of URLs
of malicious websites. Increasing the number of URLs to be converted by 2000,
experimenting from 2000 to 10000. Compared with the vectorization process
(vectorize), the whole processing time of JABBERWOCK is occupied by the
collection of JavaScripts (collect js) and translating to WAT (change js to
wat). These times increase in proportion to the number of URLs. This show that
JABBERWOCK can construct a dataset in 4.5 seconds per sample. This process is
once for all task, so this time is not long.

In processing time, vectorization can vary with hyperparameters, so we focus
on the processing time of vectorization. Specifically, we investigated the
case when the vector size is small in detail, as it might affect the
processing time. Thus, we demonstrate two figures; Fig. 4 illustrates the
processing time when the vector size is $2,4,6,8$ and $10$, and Fig. 5
illustrates when $20,40,60,80$ and $100$. Fig. 4 shows the processing time for
the vectorization. The processing time tends to increase gentry in proportion
to the vector size. We remark that this tendency continues even when the
vector size is varied up to 100 from Fig. 5. Furthermore, processing in PVDBOW
takes a longer time than processing in PVDM.

Figure 3: The processing time of JABBERWOCK: Each bar contains three processes
of JABBERWOCK. The vectorization process is quite short compared to the other
two processes. Figure 4: The processing time for the vectorization process
when the vector size is small: The orange line represents PVDM and the blue
line represents PVDBOW as Doc2Vec, respectively. Figure 5: The processing time
for the vectorization process when the vector size is large: The orange line
represents PVDM and the blue line represents PVDBOW as Doc2Vec, respectively.

##### Distribution of Generated Dataset

Figure 6: Difference between cosine similarities when the vector size is
small. Figure 7: Difference between cosine similarities when the vector size
is large.

Fig. 6 shows the difference in cosine similarities between the J2W-based and
OWA-based models for evaluation of the distribution of the generated dataset.
Recall that the default model is PVDM. Similar to the processing time
evaluation, we investigated the case when the vector size is small in detail.
When the vector size is 2, the variance becomes large, and hence the generated
samples are unstable compared to samples in the real world. However, as the
size of the vectors increases, the differences in cosine similarities become
stably smaller. Intuitively, the vectors generated by JABBERWOCK tend to be
more stably smaller than those extracted from WebAssembly in the real world.
The above phenomenon is also seen even when the vector size is larger than 10
from Fig. 7.

Figure 8: Difference between cosine similarities when the model is PVDM and
PVDBOW, respectively.

Fig. 8 demonstrates the difference between cosine similarities when the model
is PVDBOW and PVDM, respectively. Compared with the case of PVDBOW, the
variance is smaller in the case of PVDM. It indicates that the generated
samples by JABBERWOCK are more similar to WebAssembly codes in the real world
for PVDM. Hence, JABBERWOCK can potentially generate samples similar to
WebAssembly codes in the real world.

####  IV-C2 Accuracy of Malicious Website Detection

Fig. 9 shows the results of the evaluation of the accuracy of detecting
malicious websites. In the following results, initial values are used as
hyperparameters of Doc2Vec. The accuracy did not change much depending on the
parameters.

First, Fig. 9 shows that support vector machines with radial basis functions,
Random Forest, XGBoost, and LightGBM have the highest F1 score, reaching
99.6%. Similar trends are observed in the accuracy, precision, and recall from
Fig. 9$\sim$9. On the other hand, for the support vector machine with
polynomial functions and Naive Bayes, all the values are significantly lower
than those of the other models. The reasons for the accuracy of each graph are
discussed in the next section, but the overall trend of each graph indicates
that malicious website detection is successful.

(a) F1 score |  (b) Accuracy
---|---
(c) Precision |  (d) Recall
Figure 9: Detection accuracy by model

##  V Discussion

Based on the results of the previous section, we discuss the reason for the
high detection accuracy of malicious website detection with the dataset
generated by JABBERWOCK. First, we analyze the reason for detection accuracy
described in the previous section. Next, we also discuss integration with an
existing tool [3] and the impact of the hyperparameters of JABBERWOCK for
malicious website detection. We finally discuss the cybersecurity ethics and
limitations of this paper.

###  V-A Analysis of Results

In this section, we discuss the reasons for the overall high detection
accuracy of malicious websites described in Section IV-C2, and the reasons for
the significantly low Naive Bayes accuracy.

First, we discuss the reasons for the high accuracy of the support vector
machine with radial basis functions, Random Forest, XGBoost, and LightGBM. In
particular, we analyze the distribution of vectors obtained by JABBERWOCK. As
the beginning of the analysis, we conduct principal component analysis on the
vectors, we compress the vectors, which initially have 100 dimensions, to two
dimensions using the scikit-learn library. The results are visualized by
plotting them on a figure with the seaborn library. Fig. 10 is the result of
scatterplot. This figure shows the distribution of the data, and we would like
readers to pay attention to the plotted state of each sample rather than the
numerical values on the axes.

Fig. 10 shows that the distributions of benign and malicious websites are far
apart. Therefore, we can consider that the accuracy of detecting malicious
websites is significantly improved.

(a) Samples generated by JABBERWOCK |  (b) Original JavaScript code
---|---
Figure 10: Distribution of samples: We measure distributions of samples, where
the principal component analysis is utilized to compress dimensions of the
samples. The left figure represents the samples generated by JABBERWOCK and
the right figure represents their original JavaScript codes.

A similar analysis was performed for the original JavaScript, and an
interesting phenomenon was confirmed. Fig. 10 shows the distribution of the
original JavaScript. Comparing Fig. 10 and Fig. 10, we can see that the vector
distribution obtained by JABBERWOCK shows a larger discrepancy in the distance
between benign websites and malicious websites than the vector distribution of
the original JavaScript. This suggests that the rend of benign and malicious
features has become clear through the conversion to WebAssembly by JABBERWOCK.
We think that the reason for the large discrepancy in distribution is that the
Wobfuscator conversion splits the code into two parts: the part that can be
converted to WebAssembly and the part that remains in JavaScript. We believe
that when the split is made, the code that is the key dynamic part of the web
page will be included in WebAssembly.

The reason for the low detection accuracy of Naive Bayes is considered to be
due to the characteristics of Naive Bayes. While Naive Bayes can reduce the
number of parameters, it cannot reflect the correlation between features in
the results, and it assumes that each feature is independent [32]. For this
reason, especially when the size of vectors is increased in Doc2Vec, it is
considered that learning was not properly performed. For use cases of
JABBERWOCK, it is better to use XGBoost or LightGBM.

###  V-B Integration with Existing Tools

To confirm the effectiveness of the WebAssembly dataset generated by
JABBERWOCK against actual malicious website detection techniques, we compare
and evaluate JABBERWOCK with the latest malicious website detection technique,
MADONNNA [4], which does not learn WebAssembly codes. First, 1338 benign
websites and 1338 malicious websites were obtained for each of the features
described in the literature [3], using the data collection method used in
Section IV-A. Here, websites for which a WebAssembly sample was not generated
by JABBERWOCK were excluded as missing values. The benign cases were selected
from the top of the list.

We measured the accuracy of malicious website detection using WebAssembly
generated by JABBERWOCK in combination with features from the literature [3]
and obtained the results shown in Table I. The table shows that incorporating
WebAssembly improved the F1 score by more than 9 points. This is expected to
improve the accuracy when JABBERWOCK is combined with existing malicious
website detection techniques.

TABLE I: Comparison with existing work for F1-score: We simply refer to the scores shown in [4].  Models | Our results | MADONNA [4]
---|---|---
RF | 0.99 | 0.87
XGBoost | 0.99 | 0.90
LightGBM | 0.99 | 0.89

###  V-C Impact of Hyperparameters

We discuss how the JABBERWOCK hyperparameters affect the generated vectors
from the results of Section IV-C1 and Section IV-C1. From each result, we can
make the following two statements. First, the processing time increases in
proportion to the size of the vector, while the distribution of the
differences among the cosine similarities is almost the same when the size of
the vector is larger than 10, as mentioned above. Therefore, the appropriate
size of the vector is 10. Next, when PVDM is selected for Doc2Vec, the
processing time increases due to the training of PVDM, but as mentioned above,
the resulting differences among the cosine similarities tend to be stable with
smaller variance. For this reason, it is preferable to use PVDM rather than
PVDBOW.

###  V-D Cybersecurity Ethics

We discuss cybersecurity ethics in this paper. When we collected actual
JavaScript code, we utilized only popular ranking websites which are publicly
available. The collection was performed in our local environment. Then, we
affect neither the underlying services of these websites nor their contents.
In doing so, the contents were collected by the standard access to websites,
i.e., HTTP POST and GET methods. Namely, we were able to collect data that are
identical to the ones obtained by their standard usage from the websites.
Consequently, we can ensure that no personal data is collected and the user’s
privacy is guaranteed.

###  V-E Limitations

JABBERWOCK has three limitations, i.e., missing values, an application for
real-time detection, and labeling samples.

First, we did not care about the missing values. When no JavaScript codes are
found or translated into WebAssembly codes, a dataset will no longer be
generated. In the current experiments, we ignore the missing values and still
have the possibility whereby the performance of JABBERWOCK can be improved by
dealing with them in a better fashion. Second, an application with JABBERWOCK
for real-time detection seems to be difficult. As shown in Section IV-C1, we
need to take 4.5 seconds to convert JavaScript to WebAssembly codes. It is
longer than a real-time detection application such as MADMAX [3]. Third,
labeling samples straightforwardly follow the setting of the existing work
[3]. We also need to confirm the validity of this setting for labeling
samples.

Further studies, which take the above limitations into account, will need to
be undertaken.

##  VI Conclusion

In this paper, we designed JABBERWOCK, a tool for generating a WebAssembly
dataset, and then conducted experiments for malicious website detection with
the dataset generated by JABBERWOCK. The main procedure of JABBERWOCK is to
gather JavaScript codes from malicious websites and then convert them into
WebAssembly. We then evaluated JABBERWOCK with respect to processing time and
the difference between models trained with the generated dataset. We showed
that JABBERWOCK could generate any number of samples with 4.5 seconds per
sample. We also demonstrated that samples generated by JABBERWOCK are close to
WebAssembly samples in the real world. Furthermore, we evaluated the
performance of malicious website detection with the dataset generated by
JABBERWOCK and then showed that malicious websites could be detected with 99%
F1-score. When we analyzed the reason for such a high score, we found the fact
that JABBERWOCK makes a gap between benign and malicious samples larger than
that of the original JavaScript codes. We also evaluated the integration with
the existing tool [4] and then confirmed that the F1-score can be improved. We
thus confirmed that JABBERWOCK is effective, i.e., malicious website detection
based on WebAssembly is possible. In the future, we plan to improve the
processing time for the conversion of JavaScript into WebAssembly in order to
provide a browser-based real-time application for malicious website detection,
such as MADMAX [3].

Reproducibility: The code of JABBERWOCK is available via GitHub
(https://github.com/c-chocolate/Jabberwock) except for Wobfuscator [8].
(Obtain the code of Wobfuscator from Dr. Alan Romano, the corresponding author
of Wobfuscator.)

Acknowledgement: JST CREST, the grant number JPMJCR21M5, supports a part of
this work. We would also appreciate Dr. Alan Romano for providing his code of
Wobfuscator.

## References

  * [1] Battagline, R.: The Art of WebAssembly, p. 2, No Starch Press (2021).
  * [2] Musch, M., Wressnegger, C., Johns, M. and Rieck, K.: New Kid on the Web: A Study on the Prevalence of WebAssembly in the Wild, Proc. of DIMVA 2019, Springer, pp. 23–42 (2019).
  * [3] Iwahana, K., Takemura, T., Cheng, J. C., Ashizawa, N., Umeda, N., Sato, K., Kawakami, R., Shimizu, R., Chinen, Y. and Yanai, N.: MADMAX: Browser-Based Malicious Domain Detection Through Extreme Learning Machine, IEEE Access, Vol. 9, pp. 78293–78314 (2021).
  * [4] Senanayake, J., Rajapaksha, S., Yanai, N., Komiya, C. and Kalutarage, H.: MADONNA: Browser-Based MAlicious Domain Detection through Optimized Neural Network with Feature Analysis, Proc. of IFIP SEC 2023 (2023).
  * [5] Komiya, C., Yamashita, K., Yanai, N. and Okamura, S.: JABBERWOCK: A Tool for Generation of WebAssembly Dataset, Proc. of DCDS 2023, IEEE (2023).
  * [6] Zhauniarovich, Y., Khalil, I., Yu, T. and Dacier, M.: A Survey on Malicious Domains Detection through DNS Data Analysis, ACM Computing Surveys, Vol. 51, No. 4, pp. 1–36 (2018).
  * [7] Palaniappan, G., S, S., Rajendran, B., Sanjay, Goyal, S. and B S, B.: Malicious Domain Detection Using Machine Learning On Domain Name Features, Host-Based Features and Web-Based Features, Procedia Computer Science, Vol. 171, pp. 654–661 (2020).
  * [8] Romano, A., Lehmann, D., Pradel, M. and Wang, W.: Wobfuscator: Obfuscating JavaScript Malware via Opportunistic Translation to WebAssembly, Proc. of IEEE S&P 2022, IEEE, pp. 1574–1589 (2022).
  * [9] Hilbig, A., Lehmann, D. and Pradel, M.: An Empirical Study of Real-World WebAssembly Binaries: Security, Languages, Use Cases, Proc. of WWW 2021, ACM, pp. 2696–2708 (2021).
  * [10] Lehmann, D., Kinder, J. and Pradel, M.: Everything Old is New Again: Binary Security of WebAssembly, Proc. of USENIX Security 2020, USENIX Association, pp. 217–234 (2020).
  * [11] Naseem, F. N., Aris, A., Babun, L., Tekiner, E. and Uluagac, A. S.: MINOS: A Lightweight Real-Time Cryptojacking Detection System, Proc. of NDSS 2021, The Internet Society, pp. 1–15 (2021).
  * [12] Lehmann, D. and Pradel, M.: Finding the Dwarf: Recovering Pecise Types from WebAssembly Binaries, Proc. of PLDI 2022, ACM, pp. 410–425 (2022).
  * [13] Yu, B., Pan, J., Hu, J., Nascimento, A. and De Cock, M.: Character level based detection of DGA domain names, Proc. of IJCNN 2018, IEEE, pp. 1–8 (2018).
  * [14] Berman, D. S.: DGA CapsNet: 1D application of capsule networks to DGA detection, Information, Vol. 10, No. 5, p. 157 (2019).
  * [15] Yang, L., Liu, G., Dai, Y., Wang, J. and Zhai, J.: Detecting stealthy domain generation algorithms using heterogeneous deep neural network framework, IEEE Access, Vol. 8, pp. 82876–82889 (2020).
  * [16] Khalil, I. M., Guan, B., Nabeel, M. and Yu, T.: A Domain is Only as Good as Its Buddies: Detecting Stealthy Malicious Domains via Graph Inference, Proc. of CODASPY 2018, ACM, pp. 330–341 (2018).
  * [17] Rahbarinia, B., Perdisci, R. and Antonakakis, M.: Segugio: Efficient Behavior-Based Tracking of Malware-Control Domains in Large ISP Networks, Proc. of DSN 2015, IEEE, pp. 403–414 (2015).
  * [18] Rahbarinia, B., Perdisci, R. and Antonakakis, M.: Efficient and Accurate Behavior-Based Tracking of Malware-Control Domains in Large ISP Networks, ACM Transactions on Privacy and Security, Vol. 19, No. 2, pp. 1–31 (2016).
  * [19] Sun, X., Yang, J., Wang, Z. and Liu, H.: HGDom: Heterogeneous Graph Convolutional Networks for Malicious Domain Detection, Proc. of NOMS 2020, IEEE, pp. 1–9 (2020).
  * [20] Khalil, I., Yu, T. and Guan, B.: Discovering Malicious Domains through Passive DNS Data Graph Analysis, Proc. of ASIACCS 2016, ACM, pp. 663–674 (2016).
  * [21] Sun, X., Tong, M., Yang, J., Xinran, L. and Heng, L.: HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification, Proc. of RAID 2019, USENIX Association, pp. 399–412 (2019).
  * [22] Bozkir, A. S. and Sezer, E. A.: Use of HOG descriptors in phishing detection, Proc. of ISDFS 2016, IEEE, pp. 148–153 (2016).
  * [23] Malisa, L., Kostiainen, K. and Capkun, S.: Detecting Mobile Application Spoofing Attacks by Leveraging User Visual Similarity Perception, Proc. of CODASPY 2017, ACM, pp. 289–300 (2017).
  * [24] Abdelnabi, S., Krombholz, K. and Fritz, M.: VisualPhishNet: Zero-Day Phishing Website Detection by Visual Similarity, Proc. of CCS 2020, ACM, pp. 1681–1698 (2020).
  * [25] Ariyadasa, S., Fernando, S. and Fernando, S.: Combining Long-Term Recurrent Convolutional and Graph Convolutional Networks to Detect Phishing Sites Using URL and HTML, IEEE Access, Vol. 10, pp. 82355–82375 (2022).
  * [26] Senanayake, J., Kalutarage, H. and Al-Kadri, M. O.: Android Mobile Malware Detection Using Machine Learning: A Systematic Review, Electronics, Vol. 10, No. 13, p. 1606 (online), https://www.mdpi.com/2079-9292/10/13/1606 (2021).
  * [27] Tang, L. and Mahmoud, Q. H.: A Survey of Machine Learning-Based Solutions for Phishing Website Detection, Machine Learning and Knowledge Extraction, Vol. 3, No. 3, pp. 672–694 (2021).
  * [28] Armano, G., Marchal, S. and Asokan, N.: Real-Time Client-Side Phishing Prevention Add-On, Proc. of ICDCS 2016, IEEE, pp. 777–778 (2016).
  * [29] Marchal, S., Armano, G., Gröndahl, T., Saari, K., Singh, N. and Asokan, N.: Off-the-Hook: An Efficient and Usable Client-Side Phishing Prevention Application, IEEE Transactions on Computers, Vol. 66, No. 10, pp. 1717–1733 (2017).
  * [30] Alhogail, A. A. and Al-Turaiki, I.: Improved Detection of Malicious Domain Names Using Gradient Boosted Machines and Feature Engineering, Information Technology and Control, Vol. 51, No. 2, pp. 313–331 (2022).
  * [31] Pochat, V. L., van Goethem, T., Tajalizadehkhoob, S., Korczynski, M. and Joosen, W.: Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation, Proc. of NDSS 2019, The Internet Society (2019).
  * [32] Foster, D.: Generative Deep Learning, p. 17, O’Reilly (2010).


# Mixed states for neutral current neutrino oscillation

M. M. Ettefaghi<EMAIL_ADDRESS>Department of Physics, University of
Qom, Ghadir Blvd., Qom 371614-6611, I.R. Iran  Z. Askari pour Ravari
Department of Physics, Islamic Azad University, North Tehran Branch Tehran,
I.R. Iran

###### Abstract

The theory of neutrino oscillation predicts that if both neutrino and
antineutrino coming from $Z_{0}$ decay are detected, one can observe an
oscillation pattern between the corresponding detectors. This prediction is
based on two properties; the neutrino-antineutrino pairs are produced
coherently and they are detected with definite flavor in detectors. In this
paper, we reanalyze this problem with considering some massive neutrinos which
are mixed with the light neutrinos but they either participate incoherently or
are decoupled in the production and detection processes. In fact, neutrinos
whose masses are larger than the upper bound on the mass uncertainty to be
compatible with the coherence conditions (we will see it is about 1 keV) must
be treated incoherently. Very heavy neutrinos whose masses are much larger
than the neutrino energy in the neutrino production process are decoupled.
Under these conditions, the created neutrino-antineutrino state as well as the
states of detected neutrino and antineutrino is mixed. We see that the
oscillation pattern cannot be observed for incoherent neutrinos and the
standard oscillation pattern is recovered if the light neutrino masses are
ignored in the production and detection processes. Moreover, since the $Z_{0}$
decay process is performed blindly with respect to flavors, the oscillating
contributions in the event rates are independent of the $Z_{0}$ decay width.

Neutral current neutrino-antineutrino production, Neutrino oscillation, Mixed
and pure state, Coherent and incoherent process.

##  I Introduction

Neutrino oscillation is one of the most interesting phenomena in quantum
mechanics which has been experimentally established 1 . The quantum approaches
to neutrino oscillation are based on the existence of nonzero and non-
degenerate neutrino masses. However, the differences are so smaller than the
energy uncertainty in the creation and detection processes that the neutrino
mass eigenstate cannot be distinguished. This point is used in the quantum
mechanics approach; the states of the created and detected neutrinos (well
known as flavor eigenstates) are written as a coherent superposition of mass
eigenstates 2 . Of course, the states of neutrinos participating in weak
interactions are not exactly identical to the flavor eigenstates 3 ; 2007 .
But if the mass of neutrinos can be ignored, their weak interaction states can
be considered as a flavor eigenstate. Moreover, flavor neutrinos produced or
detected in processes which involve more than one neutrino cannot be
separately described by pure states, but require a density matrix description
4 . However, they can be approximated with a density matrix of a pure state
only when the differences of the neutrino masses are neglected in the
interaction process. In most studies, light active neutrinos (standard model
neutrino) have been considered. Therefore, their states are pure and the
oscillation probabilities can be obtained in the framework of either quantum
mechanics or quantum field theory 44 . Meanwhile, the effects of mixing of the
three standard light neutrinos with heavy neutrinos, which are either
decoupled because their masses are much larger than the maximum neutrino
energy in the production and detection processes or produced and detected
incoherently because their mass differences are larger than the related energy
uncertainties, have been investigated in Ref. 4 . In fact, the standard
neutrino oscillation probability is recovered provided that the masses of
light neutrino are ignored in the production and detection processes.

The neutrino and anti-neutrino state coming from a real or virtual $Z_{0}$
decay is a coherent superposition of either the flavor eigenstates or mass
eigenstates. In fact, every flavor eigenstate as well as every mass eigenstate
is created with the same probability. Therefore, one can write, in general,
the state of the created neutrino-antineutrino as follows:

$|\nu_{Z}\rangle=\dfrac{1}{\sqrt{N_{l}}}\sum_{i=1}^{N_{l}}\left|\nu_{i}\right\rangle\left|\bar{\nu}_{i}\right\rangle=\frac{1}{\sqrt{N_{l}}}\sum_{\alpha=e,\mu,\tau,...}^{N_{l}}|\nu_{\alpha}\rangle|\bar{\nu}_{\alpha}\rangle,$
(1)

“…” denotes all other flavor states until the $N_{l}$’th one which all of them
are created coherently during the $Z_{0}$ decay process. The second equality
is satisfied provided that the mixing matrix is unitary. If we considered any
other neutrinos either being created incoherently or being decoupled of
electroweak interactions, the mixing matrix including only light coherent
neutrinos would not be unitary. Furthermore, in the usual condition that only
either neutrino or antineutrino in $|\nu_{Z}\rangle$ can be detected, the
other one must be traced out. Therefore, the related density matrix is
completely classical and it is impossible to observe usual neutrino
oscillation in this condition. However, if both neutrino and anti-neutrino are
detected in a coherent manner, a oscillation pattern can be observed between
detectors 5 . This problem has been restudied by considering the localization
properties in Refs. 6 ; 7 . Two proper conditions play fundamental roles in
obtaining the oscillation pattern; $|\nu_{Z}\rangle$ is a coherent mixture of
neutrino-antineutrino pairs $\nu_{i}{\bar{\nu}}_{i}$ and they are detected
with definite flavor. Let us consider neutrinos-antineutrinos whose masses are
smaller than their energy but larger than the coherence upper bound on
neutrino mass uncertainty, which is about 1 keV as we will see in the next
section. In this case, their state must be added incoherently to the density
matrix given in Eq. (1). Moreover, we assume that there exist heavy neutrino-
antineutrinos whose masses are much larger than the neutrino-antineutrino
energies coming from $Z_{0}$ decay. This situation occurs, for example, in
see-saw models seasaw1 ; seasaw2 ; seasaw3 ; seasaw4 . These neutrinos and
antineutrinos are decoupled but they might affect the oscillation pattern by
mixing with active neutrinos. So, under these conditions, we face a new
situation compared to the theoretical framework considered in Refs. 5 ; 6 ; 7
and it is the scope of this paper.

In the next section, we give an appropriate quantum state describing both
coherently and incoherently created neutrino-antineutrino due to the $Z_{0}$
decay process and take into account the corresponding time evolution. In the
section III, we consider two mechanisms for neutrino and antineutrino
detection via charged current interactions; both of them are detected by
scattering off nucleons and neutrino is scattered off electron and
antineutrino is done like before. Accordingly, an appropriate state is written
for every case and we discuss on the corresponding oscillation probability.
Finally, in the section IV, we summarize our results.

##  II Neutrino-antineutrino states due to $Z_{0}$ decay

According to Eq. (1), a pair of neutrino and anti-neutrino which are entangled
and blind with respect to the flavor might be produced during a $Z_{0}$ decay
process. In fact, we disregard the neutrino mass differences and use the
unitarity of mixing matrix in Eq. (1). Let us consider that the masses of
neutrinos are so large that they cannot be ignored. Therefore, the neutrino
state must be given by:

$|\nu_{Z}\rangle=\frac{1}{\sqrt{R_{l}^{P}}}\sum_{k\leq
N_{l}}M_{kk}^{P}|\nu_{k}\rangle|\bar{\nu}_{k}\rangle,$ (2)

where $R_{l}^{P}=\sum_{i\leq N_{l}}|M_{ii}^{P}|^{2}$ and $M_{ii}^{P}$ denote
the amplitude of $Z_{0}$ decay into a neutrino-antineutrino pair with mass
$m_{i}$. It is clear that if we ignore the mass difference of neutrinos, we
reach Eq. (1) that is the standard expression.

Now, if we consider in addition to $N_{l}$ neutrinos being produced
coherently, there exist $N_{h}$ heavy neutrinos which are produced
incoherently, the initial state is mixed and must be described by the
following density matrix:

$\rho=\frac{1}{R_{l}}\sum_{k,k^{\prime}\leq
N_{l}}M_{kk}^{P}{M^{P}}^{*}_{k^{\prime}k^{\prime}}|\nu_{k},\bar{\nu}_{k}\rangle\langle\nu_{k^{\prime}},\bar{\nu}_{k^{\prime}}|+\frac{1}{R_{h}^{P}}\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|M_{kk}^{P}|^{2}|\nu_{k},\bar{\nu}_{k}\rangle\langle\nu_{k},\bar{\nu}_{k}|,$
(3)

in which

$R_{h}^{P}=\sum_{i=N_{l}+1}^{N_{l}+N_{h}}|M_{ii}^{P}|^{2}.$ (4)

The first sentence of Eq. (3) describes the state of neutrino-antineutrino
produced coherently (it contains off-diagonal elements). The second sentence
is related to heavy neutrino-antineutrinos whose mass differences are larger
than the quantum-mechanical energy uncertainty and being produced
incoherently. Indeed, from the relativistic energy momentum dispersion
relation, the mass uncertainty of neutrino (antineutrino) can be estimated by
$\sigma_{m^{2}}\simeq 2\sqrt{2}E\sigma_{E}$, where $E$ and $\sigma_{E}$ are
energy and the energy uncertainty, respectively charge . Given that the
$Z_{0}$ interaction with environment is neglected, $\sigma_{E}$ is given by
the $Z_{0}$ decay width. For instance, in the $Z_{0}$ rest frame we have
$\sigma_{m^{2}}\sim(7\text{GeV})^{2}$. Therefore neutrino (antineutrino) mass
eigenstates $\nu_{i}$ ($\bar{\nu}_{i}$) and $\nu_{j}$ ($\bar{\nu}_{j}$) are
created incoherently provided that $|m_{i}^{2}-m_{j}^{2}|>(7\text{GeV})^{2}$.
However, to observe the oscillation phenomenon, the neutrino-antineutrino
state must preserve its coherence until the detection processes. To explain
the loss of coherence, we need to consider the localization properties of
neutrinos and antineutrinos. Accordingly, they must be described by localized
wave packets of width $\sigma_{x}$, which propagate with group velocities
$v_{g}$ given by $v_{g}=\frac{\partial E}{\partial p}=\frac{p}{E}$. The
coherence loss takes place during the time $t_{\text{coh}}$ when the overlaps
of the wave packets of various mass eigenstate are diminished i.e.

$t_{\text{coh}}\simeq\frac{\sigma_{x}}{\Delta v_{g}},$ (5)

where $\Delta v_{g}$ is the group velocity difference of two mass eigenstates
with masses $m_{i}$ and $m_{j}$:

$\Delta v_{g}=|\frac{p_{i}}{E_{i}}-\frac{p_{j}}{E_{j}}|\simeq
2\frac{|m_{i}^{2}-m_{j}^{2}|}{m_{Z_{0}}^{2}}.$ (6)

Here, in the last step, we consider the $Z_{0}$ rest frame and use
$\frac{m_{i(j)}^{2}}{m_{Z_{0}}^{2}}\ll 1$ which is reasonable according to the
above discussion. Therefore, the coherence length in the $Z_{0}$ rest frame is
defined by

$x_{\text{coh}}\simeq v_{g}\frac{\sigma_{x}}{\Delta
v_{g}}\simeq\frac{m_{Z_{0}}^{2}}{2\Gamma_{Z_{0}\rightarrow\nu\bar{\nu}}|m_{i}^{2}-m_{j}^{2}|},$
(7)

in which we use
$\sigma_{x}\simeq\sigma_{p}^{-1}\simeq(\frac{E}{p}\sigma_{E})^{-1}\simeq(\frac{E}{p}\Gamma_{Z_{0}\rightarrow\nu\bar{\nu}})^{-1}$.
Now, let us suppose the distance between two detectors to be about 1m.
Therefore, the coherence of neutrino-antineutrino state is preserved up to
this distance provided that $|m_{i}^{2}-m_{j}^{2}|<(1\text{keV})^{2}$. But in
real conditions, the detector distance is much larger than this value, so the
above bound is much more restricting. However, if we consider the $Z_{0}$
boson in flight, this restricting bound is relaxed a bit. In this case, the
coherence length scales as
$x_{\text{coh}}\rightarrow\gamma^{3}x_{\text{coh}}$, where $\gamma$ is the
Lorentz factor charge . For instance, if the $Z_{0}$ energy is about 1TeV,
$x_{\text{coh}}$ becomes about 1km.

If we ignore the mass differences for the light neutrinos, the density matrix
in Eq. (3) is simplified as follows:

$\rho=\frac{1}{N_{l}}\sum_{k,k^{\prime}\leq
N_{l}}|\nu_{k},\bar{\nu}_{k}\rangle\langle\nu_{k^{\prime}},\bar{\nu}_{k^{\prime}}|+\frac{1}{R_{h}^{P}}\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|M_{kk}^{P}|^{2}|\nu_{k},\bar{\nu}_{k}\rangle\langle\nu_{k},\bar{\nu}_{k}|.$
(8)

After propagation in plane wave approximation, the density matrix given in Eq.
(3) is transformed as follows:

$\rho(t,L;\bar{t},\bar{L})=\frac{1}{N_{l}}\sum_{k,k^{\prime}\leq
N_{l}}e^{-i(E_{k}-E_{k^{\prime}})(t+\bar{t})+i(p_{k}-p_{k^{\prime}})(L+\bar{L})}|\nu_{k},\bar{\nu}_{k}\rangle\langle\nu_{k^{\prime}},\bar{\nu}_{k^{\prime}}|+\frac{1}{R_{h}^{P}}\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|M_{kk}^{P}|^{2}|\nu_{k},\bar{\nu}_{k}\rangle\langle\nu_{k},\bar{\nu}_{k}|,$
(9)

where $t$ and $\bar{t}$ are the neutrino and anti-neutrino travel time from
the source to the corresponding detectors in the distances $L$ and $\bar{L}$,
respectively. Here, we chose the $Z_{0}$ rest frame and $E_{k}$ and $p_{k}$
denote the energy and momentum of the $k$’th mass eigenstate. With a realistic
assumption, one can suppose that the light neutrinos are extremely
relativistic. Therefore, their mass eigenstate energy and momentum are
approximated by the following relations 2000qm :

$E_{k}\approx E+\xi\frac{m_{k}^{2}}{2E},$ (10) $p_{k}\approx
E-(1-\xi)\frac{m_{k}^{2}}{2E},$ (11)

where $E$ is the neutrino energy in the limit of zero mass and $\xi$ is a
dimensionless quantity that can be estimated from energy-momentum conservation
in the production processes. In the case of $Z_{0}$ decay in the rest frame,
$E$ and $\xi$ are $m_{Z_{0}}/2$ and 0, respectively. Thus, without losing the
generality of the problem, one can write Eq. (9) as follows:

$\rho(L,\bar{L})=\frac{1}{N_{l}}\sum_{k,k^{\prime}\leq N_{l}}e^{-i\frac{\Delta
m^{2}_{kk^{\prime}}}{2E}(L+\bar{L})}|\nu_{k},\bar{\nu}_{k}\rangle\langle\nu_{k^{\prime}},\bar{\nu}_{k^{\prime}}|+\frac{1}{R_{h}^{P}}\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|M_{kk}^{P}|^{2}|\nu_{k},\bar{\nu}_{k}\rangle\langle\nu_{k},\bar{\nu}_{k}|.$
(12)

Here, we see that only the state corresponding to the coherent production has
evolved during the propagation.

##  III Detection processes

As was said, both neutrino and antineutrino coming from a $Z_{0}$ decay
process must be detected in order to observe intuitively oscillation pattern
between detectors. Detection processes can usually be performed by an
interaction involving one or two neutrinos. When the detection process is done
through neutrino scattering off nucleus via the charged current interaction,
one neutrino is involved in the detection processes

$\nu_{\alpha}+D_{I}\rightarrow D_{F}+l_{\alpha}^{-},$ (13)
$\bar{\nu}_{\beta}+\bar{D}_{I}\rightarrow\bar{D}_{F}+l_{\beta}^{+}.$ (14)

As an example of two neutrinos participating in the detection process, let us
consider neutrinos are detected via the following charged current process:

$\nu_{\alpha}+e^{-}\rightarrow\nu_{e}+l_{\alpha}^{-},$ (15)

Of course, for non-electron neutrinos, this process is not used in practice
for neutrino oscillation experiments, because the neutrino energy threshold is
high (about 10.92 GeV) and the cross section is about one thousand times
smaller than that of the corresponding charged current scattering on neutron.
In the case of the neutral current neutrino oscillation, where both neutrino
and anti-neutrino are to be detected, the probability of oscillation, in the
context of density matrix theory is given by

$P_{\alpha\beta}(L,\bar{L})=tr[\rho(L,\bar{L})\rho^{D}_{\alpha}\otimes\bar{\rho}^{\bar{D}}_{\beta}],$
(16)

where $\rho^{D}_{\alpha}$ and $\bar{\rho}^{\bar{D}}_{\beta}$ are the density
matrices of a detected neutrino with flavor $\alpha$ and a detected
antineutrino with flavor $\beta$, respectively. Similar to the production
process, we assume that in addition to $N_{l}$ light neutrinos (antineutrinos)
coherently involving in the detection processes, $N_{h}-N_{l}$ heavy neutrinos
(antineutrinos) also participate incoherently in detection processes. Also, it
may be possible a mixing between light neutrinos and very heavy neutrinos
which are decoupled because their masses are much larger than the maximum
energy in the corresponding process.

We consider two conceivable situations for combining two detection processes:

  * •

We assume that the both detection processes are done through interaction with
the nucleus (see Eqs. (13) and (14)). Hence, the density matrix of the
detected neutrino and antineutrino will be as follows:

$\rho^{D}_{\alpha}=\frac{|M_{\alpha}^{0}(E)|^{2}}{{R_{l\alpha}^{D}}}\sum_{j,j^{\prime}\leq
N_{l}}U_{\alpha j}^{*}U_{\alpha
j^{\prime}}|\nu_{j}\rangle\langle\nu_{j^{\prime}}|+\frac{1}{{R_{h\alpha}^{D}}}\sum_{j=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha
j}|^{2}|M_{j}^{D}|^{2}|\nu_{j}\rangle\langle\nu_{j}|,$ (17)

and

$\bar{\rho}^{\bar{D}}_{\alpha}=\frac{|\bar{M}_{\alpha}^{0}(E)|^{2}}{{\bar{R}_{l\alpha}^{\bar{D}}}}\sum_{j,j^{\prime}\leq
N_{l}}U_{\alpha j}U_{\alpha
j^{\prime}}^{*}|\bar{\nu}_{j}\rangle\langle\bar{\nu}_{j^{\prime}}|+\frac{1}{{\bar{R}_{h\alpha}^{\bar{D}}}}\sum_{j=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha
j}|^{2}|\bar{M}_{j}^{\bar{D}}|^{2}|\bar{\nu}_{j}\rangle\langle\bar{\nu}_{j}|,$
(18)

respectively. Here, we have ignored the mass difference for light neutrinos,
so

${R_{l\alpha}^{D}}=|M_{\alpha}^{0}(E)|^{2}\sum_{j\leq N_{l}}|U_{\alpha
j}|^{2}$ (19)
${\bar{R}_{l\alpha}^{\bar{D}}}=|\bar{M}_{\alpha}^{0}(E)|^{2}\sum_{j\leq
N_{l}}|U_{\alpha j}|^{2}$ (20)

and for incoherently involving heavy neutrinos and anti-neutrinos, we have

${R_{h\alpha}^{D}}=\sum_{j=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha
j}|^{2}|M_{j}^{D}|^{2},$ (21)
${\bar{R}_{h\alpha}^{\bar{D}}}=\sum_{j=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha
j}|^{2}|\bar{M}_{j}^{\bar{D}}|^{2}.$ (22)

In Eqs. (17) and (18), we see that if the incoherent neutrinos are not
considered the detected states are pure even though we do not ignore the
neutrino masses. Inserting the density matrix operators given in Eqs. (12),
(17) and (18) in Eq. (16), one can obtain the oscillation probability as
follows:

$\displaystyle P_{\alpha\beta}(L,\bar{L})$ $\displaystyle=$
$\displaystyle\frac{|M_{\alpha}^{0}(E)|^{2}|\bar{M}_{\beta}^{0}(E)|^{2}}{N_{l}{R_{l\alpha}^{D}}{\bar{R}_{l\beta}^{\bar{D}}}}\sum_{k,k^{\prime}\leq
N_{l}}U^{*}_{\alpha k}U_{\beta k}U_{\alpha k^{\prime}}U^{*}_{\beta
k^{\prime}}e^{-i\frac{\Delta m^{2}_{kk^{\prime}}}{2E}(L+\bar{L})}$ (23)
$\displaystyle+$
$\displaystyle\frac{1}{R_{h}^{P}{R_{l\alpha}^{D}}{\bar{R}_{h\beta}^{\bar{D}}}}\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha
k}|^{2}|U_{\beta
k}|^{2}|M_{kk}^{P}|^{2}|M_{k}^{D}|^{2}|\bar{M}_{k}^{\bar{D}}|^{2}.$

The first sentence in this equation does not show the standard oscillation
probability between flavors $\alpha$ and $\beta$ because the new mixing matrix
elements are $U_{\alpha k}/\sqrt{\sum_{j\leq N_{l}}|U_{\alpha j}|^{2}}$ which
do not constitute an unitary matrix. The second term is related to neutrinos
that do not represent oscillation behavior since their production and
detection are performed incoherently. Meanwhile, the rate of oscillation
observation can be written as follows:

${\cal R}_{\alpha\beta}(L,\bar{L},E)\propto\int
d\text{PS}\,\,(R^{D}_{\alpha})(\bar{R}^{\bar{D}}_{\beta})\,P_{\alpha\beta}(L,\bar{L}),$
(24)

where the integration over $d\text{PS}$ denotes schematically the integration
over the phase space. $R^{D}_{\alpha}$ and $\bar{R}^{\bar{D}}_{\beta}$ are the
probability of detection processes for neutrino and antineutrino,
respectively. Thus, they are given by:

$R^{D}_{\alpha}=\sum_{k}|U_{\alpha k}|^{2}|M_{k}^{D}|^{2},$ (25)

and

$\bar{R}^{\bar{D}}_{\beta}=\sum_{k}|U_{\beta
k}|^{2}|\bar{M}_{k}^{\bar{D}}|^{2},$ (26)

Ignoring the mass differences for light neutrinos, one can write:

$R^{D}_{\alpha}=|M_{\alpha}^{0}(E)|^{2}\sum_{k\leq N_{l}}|U_{\alpha
k}|^{2}+\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha
k}|^{2}|M_{k}^{D}|^{2}={R_{l\alpha}^{D}}+{R_{h\alpha}^{D}},$ (27)

and

$\bar{R}^{\bar{D}}_{\beta}=|\bar{M}_{\beta}^{0}(E)|^{2}\sum_{k\leq
N_{l}}|U_{\beta k}|^{2}+\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|U_{\beta
k}|^{2}|\bar{M}_{k}^{\bar{D}}|^{2}={{\bar{R}}_{l\beta}^{\bar{D}}}+{{\bar{R}}_{h\beta}^{\bar{D}}},$
(28)

where $M_{\alpha}^{0}(E)$ and $\bar{M}_{\beta}^{0}(E)$ are the amplitudes of
the detection processes for massless neutrino and antineutrino. Therefore,
using the probability of transition given in Eq. (23) and above issues, one
can write the event rate as follows:

$\displaystyle{\cal R}_{\alpha\beta}(L,\bar{L},E)$ $\displaystyle\propto$
$\displaystyle\sigma_{\alpha}^{0}(E)P_{\alpha\beta}^{\text{eff}}(L,\bar{L})\bar{\sigma}^{0}_{\beta}(E)+\frac{\sum_{k,k^{\prime}=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha
k}|^{2}|U_{\beta
k^{\prime}}|^{2}\sigma^{k}_{\alpha}\bar{\sigma}^{k^{\prime}}_{\beta}}{(\sum_{j\leq
N_{l}}|U_{\alpha j}|^{2})(\sum_{j\leq N_{l}}|U_{\beta
j}|^{2})}P_{\alpha\beta}^{\text{eff}}(L,\bar{L})$ (29) $\displaystyle+$
$\displaystyle\sum_{k=N_{l}+1}^{N_{l}+N_{h}}\left(\frac{|U_{\alpha
k}|^{2}|\sigma^{k}_{\alpha}\bar{\sigma}^{0}_{\beta}}{\sum_{j\leq
N_{l}}|U_{\alpha j}|^{2}}+\frac{|U_{\beta
k}|^{2}\sigma^{0}_{\alpha}\bar{\sigma}^{k}_{\beta}}{{\sum_{j\leq
N_{l}}|U_{\beta j}|^{2}}}\right)P_{\alpha\beta}^{\text{eff}}(L,\bar{L})\dots$

where $\sigma_{\alpha}^{0}(E)$ ($\bar{\sigma}_{\alpha}^{0}(E)$) and
$\sigma_{\beta}^{k}(E)$ ($\bar{\sigma}_{\beta}^{k}(E)$) are the detection
cross sections for neutrino (antineutrino) with masses zero and $m_{k}$,
respectively. Here, “…” denotes all no oscillating terms which are related to
the incoherent neutrinos. $P_{\alpha\beta}^{\text{eff}}$ is similar to the
usual oscillation formula (without considering heavy neutrinos) which is given
by

$P_{\alpha\beta}^{\text{eff}}=\frac{1}{N_{l}}\sum_{k,k^{\prime}\leq
N_{l}}U^{*}_{\alpha k}U_{\beta k}U_{\alpha k^{\prime}}U^{*}_{\beta
k^{\prime}}e^{-i\frac{\Delta m^{2}_{kk^{\prime}}}{2E}(L+\bar{L})}.$ (30)

Eq. (29) is reduced to the usual expected oscillation pattern if the
incoherent neutrinos are not considered. Moreover, the scattering of
incoherent neutrinos and antineutrinos in detectors contribute in the
observation rate of oscillation pattern. Given that the transition probability
given by Eq. (23), only the no oscillating terms, which are not written
explicitly in Eq. (29), are dependent on the incoherent neutrino-antineutrinos
producing through the $Z_{0}$ decay process.

  * •

As another possibility, we assume that neutrinos and anti-neutrinos are
detected by processes (15) and (14), respectively. In the neutrino detection
process, an electron neutrino is produced though the interaction of incoming
neutrino with an electron. Given that no coherent superposition of outgoing
neutrino mass eigenstate is detected, the cross section of the process (15) is
the incoherent sum of the cross sections with the different massive neutrinos
in the final state

$\sigma(\nu_{\alpha}+e^{-}\rightarrow\nu_{e}+l_{\alpha}^{-})=\sum_{i}\sigma(\nu_{\alpha}+e^{-}\rightarrow\nu_{i}+l_{\alpha}^{-}),$
(31)

Therefore, we consider the creation of a neutrino with mass $m_{j}$ as a
finial state and construct the corresponding density matrix operator similar
to Eq. (17)

$\rho^{D}_{j}=\frac{|{M^{D}}_{0,j}|^{2}}{{{R_{e}}_{l}^{D}}_{\alpha
j}}\sum_{k,k^{\prime}\leq N_{l}}U_{\alpha k}^{*}U_{\alpha
k^{\prime}}|\nu_{k}\rangle\langle\nu_{k^{\prime}}|+\frac{1}{{{R_{e}}_{h}^{D}}_{\alpha
j}}\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha
k}|^{2}|{M^{D}}_{kj}|^{2}|\nu_{k}\rangle\langle\nu_{k}|,$ (32)

where

${{R_{e}}_{l}^{D}}_{\alpha j}=|{M^{D}}_{0,j}|^{2}\sum_{k\leq N_{l}}|U_{\alpha
k}|^{2},$ (33)

and

${{R_{e}}_{h}^{D}}_{\alpha j}=\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha
k}{M^{D}}_{k,j}|^{2}.$ (34)

Now, we should sum over mass eigenstates of the outgoing neutrino with
coefficients $U_{e,j}$ in order to write the detection density matrix operator
appropriate for the process Eq. (15). So we have

$\displaystyle\rho^{D}$ $\displaystyle=$
$\displaystyle\sum_{j=1}^{N_{l}+N_{h}}|U_{ej}|^{2}\rho^{D}_{j}$ (35)
$\displaystyle=$
$\displaystyle\sum_{j=1}^{N_{l}+N_{h}}\frac{|U_{ej}|^{2}}{\sum_{j\leq
N_{l}}|U_{\alpha j}|^{2}}\sum_{k,k^{\prime}\leq N_{l}}U_{\alpha
k}^{*}U_{\alpha
k^{\prime}}|\nu_{k}\rangle\langle\nu_{k^{\prime}}|+\sum_{j=1}^{N_{l}+N_{h}}\frac{|U_{ej}|^{2}}{{{R_{e}}_{h}^{D}}_{\alpha
j}}\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha
k}|^{2}|{M^{D}}_{kj}|^{2}|\nu_{k}\rangle\langle\nu_{k}|,$

where the mass differences are ignored for light neutrinos. It should be noted
here that even if we do not consider incoherent neutrinos, the neutrino state
detected through the charged current leptonic process is mixed provided that
the difference in the mass of coherent neutrinos is not ignored. Since we
consider that anti-neutrinos are detected by the mechanism given by Eq. (14),
the state of detected antineutrinos is given by the density matrix operator
given in Eq. (18). Therefore, according to Eq. (16), the transition
probability is obtained as follows:

$\displaystyle P_{\alpha\beta}(L,\bar{L})=$ $\displaystyle\frac{1}{\sum_{j\leq
N_{l}}|U_{\beta
j}|^{2}}\sum_{j=1}^{N_{l}+N_{h}}\frac{|U_{ej}|^{2}}{\sum_{i\leq
N_{l}}|U_{\alpha i}|^{2}}\sum_{k,k^{\prime}\leq N_{l}}U^{*}_{\alpha k}U_{\beta
k}U_{\alpha k^{\prime}}U^{*}_{\beta k^{\prime}}e^{-i\frac{\Delta
m^{2}_{kk^{\prime}}}{2E}(L+\bar{L})}$ (36)
$\displaystyle+\frac{1}{R_{h}^{P}{\bar{R}_{h\beta}^{\bar{D}}}}\sum_{j=1}^{N_{l}+N_{h}}\frac{|U_{ej}|^{2}}{{{R_{e}}_{h}^{D}}_{\alpha
j}}\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|U_{\alpha k}|^{2}|U_{\beta
k}|^{2}|{M^{D}}_{kj}|^{2}|M_{kk}^{P}|^{2}|M_{k}^{\bar{D}}|^{2}.$

The probability of process in neutrino detector is given by

$R^{D}_{\alpha e}=\sum_{k,k^{\prime}}|U_{\alpha
k}|^{2}|U_{ek^{\prime}}|^{2}|M^{D}_{k,k^{\prime}}|^{2}.$ (37)

Therefore, according to Eq. (24), the event transition rate can be written

$\displaystyle{\cal R}_{\alpha\beta}(L,\bar{L},E)\propto$
$\displaystyle\sum_{j=1}^{N_{l}+N_{h}}|U_{ej}|^{2}\Bigg{(}\sum_{k\leq
N_{l}}|U_{ek}|^{2}\sigma^{0,0}_{\alpha}+\sum_{k=N_{l}+1}^{N_{l}+N_{h}}|U_{ek}|^{2}\sigma^{0,k}_{\alpha}+\frac{\sum_{i\leq
N_{l}}|U_{ei}|^{2}}{\sum_{i\leq N_{l}}|U_{\alpha
i}|^{2}}\sum_{k=N_{l}+1}^{N_{l}+Nh}|U_{\alpha k}|^{2}\sigma^{k,0}_{\alpha}$
(38) $\displaystyle\hskip 62.59596pt+\frac{1}{\sum_{i\leq N_{l}}|U_{\alpha
i}|^{2}}\sum_{k=N_{l}+1}^{N_{l}+Nh}\sum_{k^{\prime}=N_{l}+1}^{N_{l}+Nh}|U_{\alpha
k}|^{2}|U_{ek^{\prime}}|^{2}\sigma^{k,k^{\prime}}_{\alpha}\Bigg{)}$
$\displaystyle\hskip
51.21504pt\times\left(\bar{\sigma}^{0}_{\beta}+\sum_{i=N_{l}+1}^{N_{l}+Nh}\frac{|U_{\beta
i}|^{2}\bar{\sigma}^{i}_{\beta}}{\sum_{i^{\prime}\leq N_{l}}|U_{\beta
i^{\prime}}|^{2}}\right)P_{\alpha\beta}^{\text{eff}}+\dots,$

where “…” denotes all no oscillating terms which are related to the incoherent
neutrinos. This relation is very similar to Eq. (29). The differences are
related to the existence an outgoing neutrino in the neutrino detector. In
fact, we have treated a mixed state as detected neutrino even though the
incoherent neutrinos are not considered. The sum over the outgoing neutrino
mass eigenstates has appeared for this reason.

##  IV summary and conclusion

Although the neutrinos created in neutral interactions do not have a specific
flavor, due to the entanglement between the neutrino and antineutrino, the
pattern of neutrino oscillation between two detectors is expected to occur if
both of them are detected 5 . This expectation is based on the assumption that
neutrinos-antineutrinos are produced coherently in these processes and that
they are detected in flavor states. In this paper, we challenge both of these
assumptions by considering heavy neutrino-antineutrinos that are either
incoherently created and detected or, despite mixing with active ones, their
mass exceeds the available energy and they do not participate in the creation
and detection processes. The existence of such neutrinos is predicted in some
models such as the seesaw model seasaw1 ; seasaw2 ; seasaw3 ; seasaw4 . It is
clear that the incoherent part of the created neutrino-antineutrino state does
not evolve with time. Using the plane wave approach, we reanalyzed the issue
of neutral current neutrino oscillation and obtained the most general
expression for the event rate for two combination of detectors; both neutrino
and antineutrino are detected by charge current nucleon scattering without
neutrino in final states and neutrinos are detected by charged current
leptonic process involving outgoing neutrino but antineutrinos are detected as
the previous case (please see Eqs. (29) and (38), respectively). For both
cases, the detected states are mixed because we consider the massive neutrinos
and antineutrinos involving incoherently in the corresponding detection
processes. However, in case of the later, since there is an outgoing neutrino
which does not detected, the detected state is a mixed state even though the
incoherent neutrinos do not considered. But this state transforms to a pure
state provided that we ignore neutrino masses in the scattering process. In
general, the standard oscillation pattern is recovered provided that the
neutrino masses are ignored in the production and detection processes. As a
main result, this study shows again that the oscillation pattern is predicted
between neutrinos and antineutrinos with definite flavor states. So the
$Z_{0}$ decay width which is blind with respect to flavor does not appear in
the oscillating terms in the event rates.

## References

  * (1) T. Schwetz, M. Tortola, J.W. Valle, New J. Phys. 10, 113011 (2008)
  * (2) E.K. Akhmedov, A.Y. Smirnov, Phys. At. Nucl. 72, 1363 (2009)
  * (3) C. Giunti, C. W. Kim, and U. W. Lee, Phys. Rev. D45, 2414 (1992).
  * (4) C. Giunti, J. Phys. G: Nucl. Part. Phys. 34, R93 (2007).
  * (5) G. Cozzella, and C. Giunti, Physical Review D98, 096010 (2018).
  * (6) M. Beuthe, Phys. Rep. bf 375, 105 (2003).
  * (7) A. Yu. Smirnov and G. T. Zatsepin, Mod. Phys. Lett. A7 (1992) 1272.
  * (8) M.M. Ettefaghi, and Z. Askaripour Ravari, Phys. Lett. B 747, 59 (2015).
  * (9) M M Ettefaghi and Z Askari Ravari, Phys. Scr. 95, 035301(2020).
  * (10) P. Minkowski, Phys. Lett. B67, 421 (1977).
  * (11) T. Yanagida, Conf.Proc. C7902131, 95 (1979).
  * (12) M. Gell-Mann, P. Ramond, and R. Slansky, Conf.Proc. C790927, 315 (1979), arXiv:1306.4669.
  * (13) R. N. Mohapatra and G. Senjanovic, Phys. Rev. Lett. 44, 912 (1980).
  * (14) Carlo Giunti, and Chung W. Kim, Foundations of Physics Letters 14, 213 (2001).
  * (15) E. K. Akhmedov, Journal of High Energy Physics 09, 116 (2007).


# Incomplete sets in ${\mathbf{P}}$ for logspace reduction

Reiner Czerwinski
TU Berlin (Alumnus)
<EMAIL_ADDRESS>
###### Abstract

In this article, we investigate the behaviour of TMs with time limit and tape
space limit. This problem is in ${\mathbf{P}}$ when the time limit is unary
coded. When both limits go to infinity, it is undecidable which limit is
exceeded first. Thus logspace incomplete sets can be constructed in
${\mathbf{P}}$. This implies ${\mathbf{L}}{}\not={\mathbf{P}}$.

##  1 Introduction

It is known that the set

$A=\\{(M,x,1^{t})\mid\text{ TM }M\text{ accepts }x\text{ within }t\text{
steps}\\}$

is logspace-complete for ${\mathbf{P}}$ [HS11, page 176, Th. 7.24].
This means $\forall X:X\leq^{m}_{\log}A$.

In this paper, we look for logspace-incomplete sets in ${\mathbf{P}}$. We
observe the following sets:

$\displaystyle U(f):=\\{(M,x,1^{t},1^{s})\mid$ $\displaystyle\text{ TM
}M\text{ accepts }x\text{ within }t\text{ steps and}$ $\displaystyle\text{
within }f(s)\text{ tape space}\\}$

For this reason, we use the sets:

$B(f):=\\{(M,x,1^{s})\mid\text{ TM }M\text{ accepts }x\text{ within
}f(s)\text{ tape space}\\}$

The sets $U(f)$ are in ${\mathbf{P}}$, but the sets $B(f)$ are easier to
analyse. All these sets are connected:

######  Lemma 1.

$U(f)\leq_{T}^{\log}B(f)$ and $U(f)\leq_{m}^{\log}A$

###### Proof.

immediately ∎

If $f$ is a time- and space-constructible function then

${\mathbf{DTIME}}(f)\subseteq{\mathbf{DSPACE}}(f)\subseteq{\mathbf{DTIME}}(f*2^{O(f)})\;\cite[cite]{[\@@bibref{}{hopcroft1975time}{}{}]}$

Let $f:\mathbb{N}\to\mathbb{R}_{+}$ a sublinear function with
$f\in\Omega(\log)$. In section 2 we will show that it is undecidable for a TM
$M$ if $s_{M}\in O(f(t_{M}))$ when $s_{M}$ is the used tape space of $M$ and
$t_{M}$ is the computation time. See also [Cze21].

In section 3 we will use these results to show that the sets $U(f)$, where $f$
is sub-linear and $f\in\Omega(\log)$, are incomplete in ${\mathbf{P}}$.

Baker, Gill, and Solovay have proved the relativization barrier for P versus
NP[BGS75]. Like the P versus NP problem, the L versus P problem cannot be
solved with diagonalization alone. Nor can it be solved by computability
methods alone. One also needs methods from complexity theory. In this paper,
we combine these concepts. In section 4, we explain why we can circumvent the
relativization barrier.

##  2 Tape Space of polynomial time TMs and the Arithmetical Hierarchy

Let $K_{0}:=\\{M\mid\text{ TM }M\text{ terminates on empty input }\\}$ and
$\overline{K_{0}}:=\\{M\mid\text{ TM }M\not\in K_{0}\\}$. Both sets are not
computable, due to the halting problem[Tur36]. It is known, that $K_{0}$ is
$\Sigma_{1}$-complete and $\overline{K_{0}}$ is $\Pi_{1}$-complete[Soa87].

For a TM $M$ we define:

$\displaystyle\tilde{S}_{M}(t)$ $\displaystyle:=\text{tape space used by $M$
to compute on empty input within }t\text{ steps}$

and

$\tilde{P}(f):=\\{M\mid\forall t\;\tilde{S}_{M}(t)<f(t)\\}$

######  Lemma 2.

$K_{0}\leq_{1}\tilde{P}(f)$ if $f\in o(t)$ and $f\in\Omega(\log(t))$

###### Proof.

There is a one-one reduction that transforms $M$ to a multi-taped TM $h(M)$
with one tape more than $M$. $h(M)$ does not terminate and $S_{h(M)}$ grows
linearly if $M$ does not terminate, otherwise it is logarithmic.

Algorithm 1 $h(M):$

0: multi-taped TM $M$ with empty input

0: algorithm runs on a TM that has one more tape than $M$

while $M$ is not terminated do

calculate one step on $M$

write ’$1$’ on the last tape

move the head of last the tape one position to the left

end while

if $M$ has terminated then

apply binary counter to the last tape

end if

If $M$ does not terminate, the tape space of $h(M)$ grows linearly with time,
so that

$M\in K_{0}\Leftrightarrow h(M)\in\tilde{P}(f)$

∎

######  Lemma 3.

$\overline{K_{0}}\leq_{1}\tilde{P}(f)$ if $f\in o(t)$ and
$f\in\Omega(\log(t))$

###### Proof.

Similar to lemma 2, we will construct a one-one reduction, that transforms the
TM $M$ to a non-terminating multi-taped TM $g(M)$. In contrast to lemma 2,
$S_{g(M)}$ grows logarithmically when $M$ is non-terminating, and linearly
otherwise.

Algorithm 2 $g(M):$

0: multi-taped TM $M$ with empty input

0: algorithm runs on a TM that has one more tape than $M$

while $M$ not terminated do

calculate one step on $M$

Reserve as much space on the last tape as is used by $M$

Overwrite reserved space with ’$0$”s

repeat

apply binary counter on the last tape

until reserved space is filled with ’$1$”s

end while

if $M$ has terminated then

loop

write ’$1$’ on the last tape

move the head of the last tape one position to the left

end loop

end if

If $M$ does not terminate, the tape space of $g(M)$ grows with the logarithm
of time, so that

$M\not\in K_{0}\Leftrightarrow g(M)\in\tilde{P}(f)$

∎

######  Corollary 1.

$K_{0}<_{1}\tilde{P}(f)$ if $f\in o(t)$ and $f\in\Omega(\log(t))$

###### Proof.

$K_{0}\leq_{1}\tilde{P}(f)$ and $\overline{K_{0}}\leq_{1}\tilde{P}(f)$. But
$\tilde{P}(f)$ is neither in $\Sigma_{1}$ nor in $\Pi_{1}$, due to the
Hierarchy Theorem [Soa87, page 65]. So $K_{0}<_{1}\tilde{P}(f)$ and
$\overline{K_{0}}<_{1}\tilde{P}(f)$. ∎

######  Theorem 1.

$\tilde{P}(f)\in\Sigma_{2}$

###### Proof.

$M\in\tilde{P}(f)\Rightarrow\exists k\forall t:\tilde{S}_{M}(t)<k*l(t)$ ∎

##  3 Space Hierarchy within ${\mathbf{P}}$

In this section we use Turing-reduction instead of many-one-reduction because
for any sets $X\not\leq_{T}^{\log}Y\;\Rightarrow\;X\not\leq_{m}^{\log}Y$.

######  Theorem 2.

If $h$ and $l$ are space-constructible functions with $l\in o(h)$ and
$l\in\Omega(\log)$ then $B(h)\not\leq_{T}^{\log}B(l)$

###### Proof.

Due to the space hierarchy theorem[SHI65], there is a set
$X\in{\mathbf{DSPACE}}(h)$ with $X\not\in{\mathbf{DSPACE}}(l)$. Thus
$X\leq_{T}^{\log}B(h)$ and $X\not\leq_{T}^{\log}B(l)$ are valid. This implies
$B(h)\not\leq_{T}^{\log}B(l)$. ∎

######  Lemma 4.

If $h$ and $l$ are space-constructible functions with $l\in o(h)$ and
$l(n)\in\Omega(\log(n))$ and $h(n)\in o(n)$ then $U(h)\not\leq_{T}^{\log}B(l)$

###### Proof.

Let $M$ be a TM and $k>0$, both arbitrary but fixed. There is a function
$t:\mathbb{N}\mapsto\mathbb{N}$ with $M$ accepting $x$ within $t(s)$ steps and
within $h(s)$ tape space and $|x|<k$. This means

$\forall s\in\mathbb{N}\;\forall|x|<k:(M,x,1^{t(s)},1^{s})\in
U(h)\Rightarrow(M,x,1^{s})\in B(h)$

. In this case, there is no reduction function $f$ with the space complexity
$\log(s)$ such that $(M,x,1^{t(s)},1^{s})\in U(h)\Leftrightarrow
f\bigl{(}(M,x,1^{t(s)},1^{s})\bigr{)}\in B(l)$, because
$B(l)<_{T}^{\log(s)}B(h)$. Due to corollary 1 it is undecidable whether there
exists a function $t$ with $\forall s\;\forall|x|<k:(M,x,1^{t(s)},1^{s})\in
U(h)\Rightarrow(M,x,1^{s})\in B(h)$ and $t\in O(s)$. So
$U(h)\not\leq^{\log}_{T}B(l)$. ∎

######  Theorem 3.

If $h$ and $l$ are space-constructible functions with $l\in o(h)$ and
$ln(n)\in\Omega(\log(n))$ and $h(n)\in o(n)$ then
$U(h)\not\leq_{T}^{\log}U(l)$

###### Proof.

$U(h)\not\leq_{T}^{\log}B(l)$, but $U(l)\leq_{T}^{\log}B(l)$ ∎

######  Corollary 2.

If $k<n$ then $U(\log^{k})<_{m}^{\log}U(\log^{n})$

###### Proof.

$U(\log^{k})<_{T}^{\log}U(\log^{n})\;\Rightarrow\;U(\log^{k})<_{m}^{\log}U(\log^{n})$
∎

This means $\forall n:U(\log^{n})<_{m}^{\log}A$, so $U(\log^{n})$ is
incomplete in ${\mathbf{P}}$. From the existence of incomplete sets follows:

######  Corollary 3.

${\mathbf{L}}\not={\mathbf{P}}$

##  4 Notes on the Relativization Barrier

To separate ${\mathbf{L}}$ and ${\mathbf{P}}$, the relativization barrier
applies as for ${\mathbf{P}}$ versus ${\mathbf{NP}}$ [BGS75]. Therefore, here
we have mentioned the reason why the proof in this paper does not violate this
barrier such as diagonalization. Trivially, $U(\log)^{P}=A^{P}$, so
${\mathbf{L}}^{P}=P^{P}$. But from theorem 2 follows
$U(\log)<^{\log}_{T}U(\log^{2})$, so
$U(\log)^{\mathbf{L}}\not=A^{\mathbf{L}}$.

## Acknowledgments

Special thanks go to Lance Fortnow. He found several errors in the previous
version of the paper[Cze21], especially in section 2. Thanks to Sonja Kutscher
and Wolfgang Mulzer for improving some wordings. Thanks to the proof reader.

## References

  * [BGS75] Theodore Baker, John Gill, and Robert Solovay.  Relativizations of the p=?np question.  SIAM Journal on computing, 4(4):431–442, 1975.
  * [Cze21] Reiner Czerwinski.  Separation of PSPACE and EXP.  https://arxiv.org/pdf/2104.14316.pdf, 2021.
  * [HPV75] John Hopcroft, Wolfgang Paul, and Leslie Valiant.  On time versus space and related problems.  In 16th Annual Symposium on Foundations of Computer Science (sfcs 1975), pages 57–64. IEEE, 1975.
  * [HS11] Steven Homer and Alan L. Selman.  Computability and Complexity Theory, Second Edition.  Texts in Computer Science. Springer, 2011.
  * [SHI65] Richard Edwin Stearns, Juris Hartmanis, and Philip M. Lewis II.  Hierarchies of memory limited computations.  In 6th Annual Symposium on Switching Circuit Theory and Logical Design, Ann Arbor, Michigan, USA, October 6-8, 1965, pages 179–190. IEEE Computer Society, 1965.
  * [Soa87] R.I. Soare.  Recursively Enumerable Sets and Degrees: A Study of Computable Functions and Computably Generated Sets.  Perspectives in mathematical logic. Springer-Verlag, 1987.
  * [Tur36] Alan Mathison Turing.  On computable numbers, with an application to the entscheidungsproblem.  J. of Math, 58(345-363):5, 1936.