text:
# New proposal for numerical simulations of systems with a 𝜃-vacuum termTalk given by Vicente Azcoiti.

## Abstract

A new approach to perform numerical simulations of systems with a $`\theta `$-vacuum term is proposed, tested, and applied to $`\text{CP}^3`$. The main new ingredient of this approach is the method used to compute the probability distribution function of the topological charge at $`\theta =0`$. We comment also on the possibility of applying this approach to $`QCD`$ at finite baryon density.

The purpose of this contribution is to report a new approach, recently proposed by us in , to simulate numerically systems with a $`\theta `$-vacuum term. To fix the ideas let us consider the partition function $`𝒵_V(\theta )`$ of any $`\theta `$-vacuum like model in a finite space-time lattice volume $`V`$. This action can be written, up to a normalization constant, as the discrete Fourier transform of the probability distribution function (p.d.f.) of the topological charge at $`\theta =0`$:

$$𝒵_V(\theta )=\underset{n}{}p_V(n)\mathrm{e}^{\mathrm{i}\theta n},$$
(1)
where $`p_V(n)`$ is the probability of the topological sector $`n`$. In almost all practical cases the sum in (1) has a number of terms of order $`V`$ since the maximum value of the topological charge at finite volume is of this order.

The only a priori reliable numerical scheme to analyze the thermodynamics of $`\theta `$-vacuum like models goes through the determination of the p.d.f. of the topological charge, $`p_V(n)`$, and the evaluation of (1). But this is a difficult task due to the following two technical reasons: i) any numerical determination of $`p_V(n)`$ suffers from statistical fluctuations , and small errors in $`p_V(n)`$ can induce enormous relative errors in the determination of a quantity as $`𝒵_V(\theta )`$ which is an extremely small number of order $`e^V`$, ii) even if we were able to evaluate $`p_V(n)`$ with infinite precision, the sum in (1) contains terms running from 1 to $`e^V`$ .

In few specific cases one can overcome the sign problem . However previous attempts by other groups to simulate $`\theta `$-vacuum like systems , were based on the numerical determination of the p.d.f. of the topological charge straightforwardly, by standard simulations, or by more sophisticated methods based on the use of multi-binning and re-weighting techniques. In all these attempts, artificial phase transitions at a $`\theta _c`$ decreasing with the lattice volume were observed for the two-dimensional U(1) gauge theory at strong coupling as well as $`\text{CP}^N`$ models. The origin of this artificial behavior, which follows from a flattening behavior of the free energy for $`\theta `$-values larger than a certain $`\theta _c`$, was analyzed in . Both groups agreed that the observed behavior was produced by the small statistical errors in the determination of the p.d.f. of the topological charge, the effect of which became more and more relevant as the lattice volume was increased. In Ref.  it was also noticed that by smoothing the p.d.f. flattening disappears.

Our approach is based on a new method to compute the p.d.f. of the topological charge and the use of a multi-precision algorithm in order to compute the sum in (1) with a precision as high as desired. Let us write the partition function (1) as a sum over the density of topological charge $`x_n=n/V`$ and set $`p_V(n)=\mathrm{exp}[Vf_V(x_n)]`$, where $`f_V(x)`$ is a smooth interpolation of $`1/V\mathrm{ln}p_V(x_n)`$:

$$𝒵_V(\theta )=\underset{x_n}{}e^{Vf_V(x_n)}\mathrm{e}^{\mathrm{i}\theta Vx_n}.$$
(2)
We will assume that CP is realized in the vacuum at $`\theta =0`$ since otherwise the theory would be ill-defined at $`\theta 0`$ . This implies that $`\mathrm{exp}[Vf_V(x_n)]`$ will approach a delta distribution centered at the origin in the infinite volume limit.

Let us consider the partition function (2) on the imaginary axis $`\theta =ih`$, and let $`f(x)`$ be the infinite volume limit of $`f_V(x_n)`$. In the infinite volume limit the free energy is given by the saddle point. Assuming that $`f(x)`$ has first derivative for any $`x`$ except at most in isolated points, we can write the saddle point equation:

$$f^{}(x)=h.$$
(3)
Our proposal to compute the function $`f(x)`$ is based in the following three steps:

* To perform standard numerical simulations of our system at imaginary $`\theta =ih`$ and to measure the mean value of the density of topological charge as a function of $`h`$ with high accuracy (typically a fraction of percent). This is feasible since the system we have to simulate has a real action. Then, Eq. (3) is used to get a numerical evaluation of $`f^{}(x)`$.
* To get $`f(x)`$ we have to integrate $`f^{}(x)`$. Between the possible ways to do this integral, we decided to fit $`f^{}(x)`$ by the ratio of two polynomials, whose order is chosen to obtain a high quality fit, and then to perform analytically the integral of the fitting function. In this way we get a very precise determination of $`f(x)`$, which allows us to compute the p.d.f. in a range varying several thousands orders of magnitude. This is the main advantage of our approach when compared with other methods based on a direct computation of $`p_V(n)`$.
* To use a multi-precision algorithm to compute the partition function (2) using as input the function $`f(x)`$ previously determined.

The function $`f(x)`$ obtained in step ii) suffers from statistical and systematic errors, the last coming from the fact that the saddle point equation (3) has finite volume corrections. An analysis of these errors for the models and sizes we have studied, shows that systematic errors due to finite volume effects are smaller than the statistical ones in the whole relevant range of $`x`$. This is the reason why we will replace $`f_V(x_n)`$ in equation (2) by its asymptotic value $`f(x_n)`$ in what follows. This substitution has no effect in the infinite volume limit at imaginary $`\theta `$ and we are assuming that the same holds for real $`\theta `$.

The x-interval used in the fits is an interesting point since it allows to improve our approach. From the definition of the partition function it is obvious that we do not need to know $`f_V(x)`$ for all the possible values of the topological charge density $`x`$: in the large volume limit only the values of $`x`$ such that $`f_V(x)g_V(\pi )`$ (where $`g_V(\theta )`$ is the exact free energy density normalized to zero at $`\theta =0`$) are relevant for the computation of the free energy density. This allows in practice to fit only the relevant part of the data having very good fits with a suitably chosen low parameters function.

To test these ideas we have analyzed three models: the one-dimensional antiferromagnetic Ising model within an external imaginary magnetic field, the two-dimensional compact U(1) model with topological charge, and $`\text{CP}^3`$ in two dimensions.

From a numerical point of view the determination of the free energy density and order parameter through equation (1) in the Ising model has the same level of complexity of more sophisticated models. Furthermore, in contrast to two-dimensional $`U(1)`$ gauge theory, where the p.d.f. of the topological charge is nearly gaussian, the non-gaussian behavior of the p.d.f. of the mean magnetization in the antiferromagnetic Ising model makes this model a good laboratory to check the reliability of our approach. We refer the interested reader to  for details of the simulations, but would like to notice that the p.d.f. of the order parameter for such a system takes values in a range of around 2000 orders of magnitude. Notwithstanding that, we were able to reproduce the order parameter in the whole $`\theta `$ interval within a few percent . The agreement between analytical and numerical results in compact $`U(1)`$ was even better (within a few per thousand). Furthermore the flattening found in  for the free energy density in relatively small lattices was absent in our simulations even in the 80$`\times `$80 lattice .

The last model we have analyzed is $`\text{CP}^3`$. It is the standard wisdom that this model shares many qualitative features with QCD. Even if it has not been analytically solved we believe it is worthwhile to compare our results with previous existing numerical simulations. Also in this model, the previous numerical simulations gave artificial phase transitions with a flattening behavior for the free energy density at a $`\theta _c`$ decreasing with the lattice volume . Our results for the order parameter at $`\beta =0.6`$ on a $`100^2`$ lattice  have no trace of the fictitious phase transition found in . Furthermore the order parameter is clearly different from zero at $`\theta =\pi `$, hence CP is spontaneously broken at this $`\beta `$ value. An open question is how CP is realized in the continuum limit .

Finally we want to comment on the possibility of applying this approach to the analysis of QCD at finite baryon density. Indeed the partition function of QCD within an imaginary chemical potential belongs to the general class of partition functions described by (2), where $`x_n`$ now stands for the density of baryonic charge and $`\mathrm{exp}[Vf_V(x_n)]`$ is the probability distribution function of the baryon density at vanishing chemical potential. The determination of this p.d.f. would allow us to solve QCD at finite baryon density. In this case we are involved with what we could call the inverse problem i.e., from numerical simulation of QCD at imaginary chemical potential one can measure the mean value of the density of baryonic charge and from it we can get the free energy density and the partition function of QCD at imaginary chemical potential (left hand side of (2)). The last step of this procedure would be to compute, with the help of the multiprecision algorithm, the inverse Fourier transform of (2) in order to get the p.d.f. of the density of baryonic charge. At the moment it is not obvious if this procedure would allow us to see the phase structure of QCD at finite chemical potential since, as follows from the discussion on the relevant x-interval in the determination of the topological charge as a function of $`\theta `$, the range of density of baryonic charge at which the p.d.f. can be measured depends crucially on the maximum value of the free energy density at imaginary chemical potential. However the field is so interesting that it is worthwhile to be investigated.

Similar ideas to those presented in this contribution have been proposed and promisingly applied to a random matrix model of finite density QCD in .

This work has been partially supported by an INFN-CICyT collaboration and MCYT (Spain), grant FPA2000-1352. Victor Laliena has been supported by Ministerio de Ciencia y Tecnología (Spain) under the Ramón y Cajal program.


format: text

text:
# Searches for gauge mediated SUSY breaking at LEP

## 1 Introduction

The fact that supersymmetry (SUSY) is a broken symmetry makes searches for the predicted super-partners very rich phenomenologically. If SUSY is broken spontaneously at some very high energy scale, several models exist that predict how this breaking is communicated to the MSSM particles. If gravitational interactions are responsible for the MSSM spectrum, the neutralino is most probably the lightest supersymmetric particle (LSP) and these models are usually referred to as SUGRA . Another possibility is that some new very heavy particles, called messengers, couple radiatively to the MSSM particles via gauge interactions. This model is the subject of the present note and is called gauge mediated supersymmetry breaking or GMSB . The main difference between gravity and gauge mediated SUSY breaking models arises from the higher energy scale of SUSY breaking in the former. This will 1) introduce possible flavour changing neutral currents (FCNC), severely constrained at the electroweak scale; and 2) make the gravitino, the massive spin-$`\frac{3}{2}`$ partner of the graviton consequence of the super-Higgs mechanism, as heavy as the rest of SUSY particles with a mass of at least some $`𝒪(100)\text{ GeV}/c^2`$. In gravity mediated SUSY breaking models the MSSM masses are linked directly with the Planck mass $`\mathrm{M}_\mathrm{P}10^{19}\text{ GeV}/c^2`$, where gravity is assumed to become strong. Alternatively, if a new messenger sector is introduced like in GMSB models with common mass $`\mathrm{M}_\mathrm{m}`$ as low as $`10^4\text{ GeV}/c^2`$ and clearly much lower than $`\mathrm{M}_\mathrm{P}`$, then:

1. FCNC effects are naturally suppressed because the SM Yukawa couplings are already present when MSSM mass generation takes place and gauge interactions are flavour blind. Thus squark and slepton mass differences are very small.
2. The gravitino becomes very light: $`m_{\stackrel{~}{\mathrm{G}}}𝒪(1)\text{ keV}/c^2`$ , and is the LSP. But it will not only couple with gravitational strength to other SUSY particles. Its longitudinal components allow it to interact with the next-to-lightest supersymmetric particle (NLSP) via the SM gauge couplings.

Six new parameters, in addition to those of the SM, are needed to completely specify the MSSM spectrum and phenomenology of minimal GMSB models. These are: $`\sqrt{\mathrm{F}}`$, the energy scale of SUSY breaking in the hidden sector; $`\mathrm{M}_\mathrm{m}`$, the common mass of the messenger particles; $`\mathrm{N}_5`$, the number of SU(5) families of messenger supermultiplets; $`\mathrm{\Lambda }`$, the mass scale parameter responsible for the MSSM masses at $`\mathrm{M}_\mathrm{m}`$; $`\mathrm{tan}\beta `$, the ratio of the vacuum expectation values of the two Higgs doublets; and sign($`\mu `$), where $`\mu `$ is the Higgs mixing-mass parameter.

GMSB signatures at colliders crucially depend on the nature of the NLSP. In general, for $`\mathrm{N}_5=1`$ the neutralino is the NLSP and decays to $`\gamma \stackrel{~}{\mathrm{G}}`$, while for $`\mathrm{N}_52`$ the lightest stau is predominantly the NLSP and decays into $`\tau \stackrel{~}{\mathrm{G}}`$. In GMSB models, the selectron and smuon masses are equal and the stau may become lighter due to the possible large mixing in the third family. But depending on the scale of SUSY breaking $`\sqrt{\mathrm{F}}`$, or equivalently on the gravitino mass $`m_{\stackrel{~}{\mathrm{G}}}`$, the NLSP may be long-lived:

$$\lambda _{\mathrm{NLSP}}=c\tau _{\mathrm{NLSP}}\gamma \beta =\frac{0.01}{\kappa _\gamma }\left(\frac{100\text{ GeV}/c^2}{m_{\mathrm{NLSP}}}\right)^5\left(\frac{m_{\stackrel{~}{\mathrm{G}}}}{2.4\text{ eV}/c^2}\right)^2\sqrt{\frac{E^2}{m_{\mathrm{NLSP}}^2}1}\mathrm{cm}$$

where $`\kappa _\gamma `$ is the photino content of the neutralino or one for a slepton NLSP. Since the gravitino mass can range from $``$$`10^2`$ to $`10^5\text{ eV}/c^2`$ this implies that the NLSP may decay immediately after production at LEP, somewhere inside the detector or be stable for searches purposes. There are thus many different topologies to be considered as a function of the NLSP type and its possible decay length.

This report is organised as follows: topologies arising from neutralino pair production in the neutralino NLSP scenario are described first. The results from slepton NLSP direct pair-production searches are reported next in Sec. 3. Cascade decays of neutralino to slepton NLSPs and other multilepton final states are described in Sec. 4. In each case, the different searches devised to cover all possible lifetimes of the NLSP will be detailed. Finally, the interpretation of the results and outlook will be presented in Secs. 5 and 6 respectively. All limits are given at 95% confidence level.

## 2 Photon(s) and $`\overline{)}𝑬`$ signatures

Signatures consisting of two energetic photons and missing energy may arise in the neutralino NLSP scenario if a pair of neutralinos are pair-produced and decay promptly into $`\stackrel{~}{\chi }_1^0\gamma \stackrel{~}{\mathrm{G}}`$. The main background source for this topology is $`\text{e}\text{+}\text{e}\text{-}\nu \overline{\nu }`$, from diagrams with $`s`$-channel Z exchange or $`t`$-channel W exchange and one or two initial state radiation (ISR) photons. By imposing a threshold cut on the energy of the least energetic photon the SM background can be effectively reduced. A preliminary combination of the results from the ALEPH, DELPHI and OPAL collaborations exists with data from 192 to 208 GeV and yields no excess with respect to the SM expectation . The individual results can be found in Refs. . Figure 1 shows the interpretation of these results assuming a purely bino neutralino and mass degeneracy between $`\stackrel{~}{\mathrm{e}}_\mathrm{L}`$ and $`\stackrel{~}{\mathrm{e}}_\mathrm{R}`$. Neutralino pair-production cross sections above 0.02 pb are excluded at 95% C.L. Since the cross section depends on the mass of the exchanged selectron, the lower limit on the neutralino mass can be conservatively estimated to be $`97\text{ GeV}/c^2`$ if $`m_{\stackrel{~}{\mathrm{e}}}=2m_{\stackrel{~}{\chi }_1^0}`$, improving for larger $`\stackrel{~}{\chi }_1^0\stackrel{~}{\mathrm{e}}`$ mass differences.

If the gravitino mass lies in the range between a few  eV$`/c^2`$ and a few hundred  eV$`/c^2`$, the neutralino NLSP will decay somewhere inside the detector. The probability for only one of the pair-produced neutralinos to decay before the electromagnetic calorimeter is greater than for both of them , thus the expected final topology consists in a single non-pointing photon. ALEPH  and DELPHI  have searched for single photons with a minimum impact parameter of 40 cm and have found 2/1.0 and 5/3.0 candidates/background, respectively in their $`\sqrt{s}=189209`$ and $`\sqrt{s}=202209`$ data sets. The efficiency for this search reaches a maximum of around 10% for decay lengths of 8 m. This yields an approximate upper limit of 0.4 pb in the production cross section.

## 3 Two leptons and $`\overline{)}𝑬`$ signatures

We discuss next the pair-production of sleptons in the slepton NLSP scenario. In general the $`\stackrel{~}{\tau }_1`$ will be the lighter slepton, but a degenerate case is possible in which the three $`\stackrel{~}{\tau }_1`$, $`\stackrel{~}{\mathrm{e}}_\mathrm{R}`$ and $`\stackrel{~}{\mu }_\mathrm{R}`$ act as co-NLSP’s. Thus searches for pairs of sleptons decaying into their SM counterpart and a gravitino were developed by all four collaborations taking into account the possible lifetime of the slepton.

### 3.1 Acoplanar leptons

In the case of zero slepton lifetime two acoplanar leptons and missing energy are expected. This is the same final state as the one arising in SUGRA models if we take a massless neutralino. The existing limits at 95% C.L. on the slepton masses derived from the combination  for $`m_{\stackrel{~}{\chi }_1^0}=0`$ are: $`m_{\stackrel{~}{\mathrm{e}}}>99.6,m_{\stackrel{~}{\mu }}>94.9`$ and $`m_{\stackrel{~}{\tau }}>85.0\text{ GeV}/c^2`$.

### 3.2 Kinks and large impact parameters

When sleptons decay in the tracking chambers of the detectors they are expected to produce kinks formed by their own track and the emerging lepton. If they do not reach the tracking devices, events will present tracks with large impact parameters. In these searches the most important sources of background are hadronic interactions in the material of the detector from K$`{}_{}{}^{0}{}_{\mathrm{s}}{}^{}`$ for the large impact parameter topology and K± or $`\pi ^\pm `$ decays in the kinks search. Both can be reduced by cuts on the opening angle between the two segments and with energy vetos. ALEPH reports 1/1.1 candidates/background, DELPHI 9/7.4 and OPAL 1/1.1 for selectrons and smuons and 7/4.4 for staus in their $`\sqrt{s}=189209\text{ GeV}`$ data.

### 3.3 Heavy stable charged particles

For large gravitino masses, above a few hundred  eV$`/c^2`$, the sleptons decay outside the detector. This topology is characterised by two back-to-back highly ionising tracks which if produced at threshold may completely saturate the chamber electronics by their high d$`E`$/d$`x`$. Very high efficiencies can be attained in this search and no collaboration has found any discrepancy with the expected background. The combination of results from the four collaborations yields a lower limit on $`m_{\stackrel{~}{\mu }}`$ of $`97.5\text{ GeV}/c^2`$ for NLSP lifetimes greater than $`10^6`$ s.

## 4 Multi-lepton and $`\overline{)}𝑬`$ signatures

If neutralinos are accessible at LEP in the slepton NLSP scenario, they provide a clear advantadge over slepton direct production: a higher cross section. Indeed, their production cross section may be even twice that of sleptons, specially for very light selectrons. Searches have been developed by ALEPH , DELPHI  and OPAL  for four leptons (two of them could be soft) and missing energy in the final state. Only ALEPH and OPAL have also explored the possibility of two of the tracks exhibiting large impact parameters or kinks. The results are again negative. In the case of zero lifetime this search helps to exclude an area in parameter space that searches for direct slepton production do not reach. In addition to neutralino production in the slepton NLSP scenario, OPAL and DELPHI have looked for charginos $`\stackrel{~}{\chi }_1^+\stackrel{~}{\mathrm{}}_\mathrm{R}^+\nu `$ and OPAL and ALEPH for selectrons or smuons in the stau NLSP case: $`l_\mathrm{R}^+l^+\stackrel{~}{\chi }_1^0l^+\tau \stackrel{~}{\tau }_1`$, where $`l`$ = e, $`\mu `$. No evidence for any of the above has been found and limits have been set on the mass of charginos (100 GeV$`/c^2`$ for any lifetime by DELPHI) and sleptons (94 GeV$`/c^2`$ for selectrons and zero lifetime by ALEPH) in the $`\stackrel{~}{\tau }_1`$ NLSP scenario.

## 5 Interpretation in mGMSB

By using the upper limits on the cross sections, the searches results contrain the available parameter space in minimal GMSB models. ALEPH, DELPHI and OPAL have performed scans over the six variables that determine GMSB phenomenology, $`\sqrt{\mathrm{F}}`$, $`\mathrm{M}_\mathrm{m}`$, $`\mathrm{\Lambda }`$, $`\mathrm{N}_5`$, $`\mathrm{tan}\beta `$ and sign($`\mu `$) to asses the impact of the different searches and set limits on these parameters. An example from ALEPH is shown in Fig. 3, where the ($`\mathrm{\Lambda },\mathrm{tan}\beta `$) plane is shown with the excluded areas. This analysis places a lower limit on the mass scale parameter $`\mathrm{\Lambda }`$ of 10 TeV$`/c^2`$ for any lifetime and $`\mathrm{N}_55`$, which is increased to 16 TeV$`/c^2`$ if Higgs boson searches are included, as can be seen in Fig. 3. OPAL results (without Higgs limits) are able exclude $`\mathrm{\Lambda }>40,27,21,17,15\text{ TeV}/c^2`$ for $`\mathrm{N}_5=1,2,3,4,5`$ respectively, taking all NLSP lifetimes into account in a similar scan to the one by ALEPH. DELPHI reports a limit of $`\mathrm{\Lambda }>17.5\text{ TeV}/c^2`$ for $`\mathrm{N}_54`$ and negligible NLSP lifetimes.

## 6 GMSB after LEP

To conclude, the LEP SUSY working group has performed the combination of available results in the most important searches within the GMSB framework. They have been presented here, including some other results that the collaborations have performed to completely cover most of the GMSB parameter space. No hint for any of these topologies has been found. Neutralino and stau masses have been excluded up to 54 and 87 GeV$`/c^2`$ in the neutralino and stau NLSP scenarios respectively and independently of lifetime. This can be translated into a lower limit on the mass scale parameter $`\mathrm{\Lambda }>10\text{ TeV}/c^2`$ for $`\mathrm{N}_55`$. The quest for SUSY is now open to the Tevatron RunII. Chargino masses up to 290 (160) GeV$`/c^2`$ could be discovered by 2004 with 2 fb-1 in the $`\stackrel{~}{\chi }_1^0`$ ($`\stackrel{~}{\tau }_1`$) NLSP scenario with short (long) lifetimes, as described in Ref. . ALEPH alone for example has excluded chargino masses of 160 (100) GeV$`/c^2`$ for short (long) NLSP lifetimes.

## Acknowledgements

I am very grateful to Christoph Rembser and Rob McPherson for providing their help (and results!) for this talk.


text:
# Population inversion through charge measurement using a superconducting single-electron transistor biased in the subgap regime

## The Model

Consider a small superconducting SET island coupled via low transparency tunnel barriers to two external superconducting leads, and coupled capacitively to a control gate and to the SCB, see Fig.1. The voltage noise on the SET island is calculated neglecting the coupling to the SCB. This approach is appropriate in the considered limit of weak SET-box coupling ($`C_cC_LC_RC_b`$).

We follow the outline of Ref. van den Brink et al. (1991) and model the SSET by the Hamiltonian

$$H=H_L+H_R+H_I+H_C+K+H_J+H_T=H_0+H_T,$$
(1)
where $`H_r=_{kn}ϵ_{kn}^ra_{krn}^{}a_{krn}`$ and $`H_I=_{ln}ϵ_{ln}c_{ln}^{}c_{ln}`$ describe the noninteracting quasiparticles in the $`r\{L,R\}`$ leads and on the island. Introducing the operators $`\widehat{n}_{L/R}`$ for the number of charges passed from left to right in the $`L/R`$ junction we write the Coulomb term $`H_C=E_C(\widehat{N}n_x)^2`$ where $`E_C=e^2/2C_\mathrm{\Sigma }`$ is the charging energy and $`\widehat{N}=\widehat{n}_L\widehat{n}_R`$ is the operator for the excess number of charges on the island. $`C_\mathrm{\Sigma }C_L+C_R`$ is the island capacitance neglecting the small gate and coupling capacitances, and $`n_x`$ is the fractional number of electrons induced by the gate voltage $`C_gV_g/e`$. The work done by the biasing circuit is $`K=eV_{ds}(C_R\widehat{n}_L+C_L\widehat{n}_R)/C_\mathrm{\Sigma }`$ and the Josephson coupling is $`H_J=_rE_J^r\mathrm{cos}2\mathrm{\Phi }_r`$, where $`e^{i\mathrm{\Phi }_r}`$ increases $`n_r`$ by one. Then we work in the eigenbasis of $`H_0`$, and treat the quasiparticle tunneling $`H_T`$ as the perturbation. We use a real-time diagrammatic Keldysh techniqueSchoeller and Schön (1994); Johansson et al. (2002) to calculate the DC current and the spectral density of the SET island voltage fluctuations,

$$S_V(\omega )=\frac{e^2}{C_\mathrm{\Sigma }^2}_{\mathrm{}}^{\mathrm{}}𝑑\tau e^{+i\omega \tau }Tr\{\rho _{st}(t_0)\widehat{N}(\tau )\widehat{N}(0)\},$$
(2)
which determine the back-action. We consider lowest non-vanishing order in $`H_T`$, i.e. we neglect co-tunneling and higher order effects. Due to the low junction transparency we also neglect logarithmic renormalization effects Schoeller and Schön (1994). In this approximation the rates for the quasiparticle processes involved are given by the usual current-voltage characteristics for tunneling between two superconductorsTinkham (1996), where the effective voltage is given by the energy gain in the process.

Assuming that the SSET is the strongest noise source coupled to the two-level system (TLS) the rate for relaxing/exciting the TLS is given byMakhlin et al. (2001); Devoret and Schoelkopf (2000); Aguado and Kouwenhoven (2000):

$$\mathrm{\Gamma }_/=\alpha \frac{e^2}{\mathrm{}^2}S_V(\pm \mathrm{\Delta }E/\mathrm{})$$
(3)
where $`\alpha `$ is a dimensionless coupling constant and $`\mathrm{\Delta }E`$ is the energy splitting between the two states in the TLS. For the SCB $`\alpha =\frac{C_c^2}{C_b^2}\frac{E_J^2}{\mathrm{\Delta }E^2}`$. To describe population inversion we calculate the polarization of the TLS in the steady state, i.e. $`\mathrm{\Delta }P=P_1^{TLS}P_0^{TLS}=(\mathrm{\Gamma }_{}\mathrm{\Gamma }_{})/(\mathrm{\Gamma }_{}+\mathrm{\Gamma }_{})`$. The total back-action induced mixing rate $`\mathrm{\Gamma }_{}+\mathrm{\Gamma }_{}`$ is proportional to the symmetrized noise $`S_V^{sym}(\mathrm{\Delta }E/\mathrm{})=S_V(\mathrm{\Delta }E/\mathrm{})+S_V(\mathrm{\Delta }E/\mathrm{})`$. If this rate is small, then other noise sources may determine the steady-state of the two-level system. To see where the back-action is strong we also study $`S_V^{sym}(\mathrm{\Delta }E/\mathrm{})`$.

## Results

To be specific we now consider a symmetric SSET with the same parameters as in reference Clerk et al. (2002), i.e. with charging energy equal to half of the superconducting energy gap, $`E_C=\mathrm{\Delta }_S25\mathrm{m}\mathrm{e}\mathrm{V}`$, $`C_L=C_R`$, and $`R_T=R_L50\mathrm{k}\mathrm{\Omega }`$, using the Ambegaokar-Baratoff value for the Josephson energy, $`E_J^L=E_J^R16\mu \mathrm{eV}`$. We choose a level splitting of the TLS of $`\mathrm{\Delta }E=0.1\mathrm{\Delta }_S`$. To describe the main features in the current through the SSET and the noise in this regime it is enough to take the five lowest-energy charge states into account. Numerically we check that including 7 states does not change the result. In Fig. 2 we show the numerical results for the DC current through the SSET, the symmetrized noise $`S_V^{sym}(\mathrm{\Delta }E/\mathrm{})`$ and the polarization of the TLS $`\mathrm{\Delta }P`$, as a function of SSET gate voltage and driving bias.

## Analytical Results

At specific bias points in the subgap regime, where specific JQP processes are known to dominate, one may calculate $`S_V(\omega )`$ analytically. The main approximation is to consider all involved quasiparticle transition rates equal and frequency independent. For frequencies not too high compared to the superconducting energy gap ($`\mathrm{}\omega <\mathrm{\Delta }_S`$) this is a reasonable approximation. Keeping track of the density matrix of up to 5 charge states, and the coherence in two resonant pairs, leads to inverting matrices of dimension up to $`9\times 9`$. Using Mathematica we obtain analytical results, which are presented below at appropriate places. For the DJQP cycle, in the proper limit, this procedure reproduces the formulas for $`S_V(\omega )`$ derived by Clerk et alClerk et al. (2002).

## Simple JQP resonances

The Coulomb energy of the charge state with $`N`$ extra electrons on the island is $`E_N=E_C(Nn_x)^2`$. Along the lines $`eV_{ds}=E_{\pm 2}E_0=4(1n_x)E_C`$ in Fig. 2 the charge states $`N=0`$ and $`N=\pm 2`$ have equal energy, including the work $`2(eV_{ds}/2)`$ done by the bias voltage across the L/R junction. (Since $`C_L=C_R`$ the voltage divides equally over the junctions.) Due to the Josephson coupling Cooper pairs tunnel resonantlyAverin and Aleshkin (1989) back and forth across the L/R junction. For $`eV_{ds}>3E_C`$ the resonantly tunneled Cooper pair may decay into two quasiparticles tunneling across the opposite (R/L) junction, thus completing the simplest JQP cycleFulton and Dolan (1987), which effectively transports two electrons through the SSET, see Fig. 3a.

Approximating the two involved quasiparticle rates with a single frequency-independent rate $`\mathrm{\Gamma }/\mathrm{}`$ and defining the energy gain for the Cooper-pair tunneling as $`\delta _\pm =eV_{ds}4(1n_x)E_C`$, the population polarization close to a single resonance, but not close to both is

$$\mathrm{\Delta }P=\frac{8\delta _\pm \mathrm{\Delta }E}{\mathrm{\Gamma }^2+4(\delta _\pm ^2+\mathrm{\Delta }E^2)},$$
(4)
with maximum $`\mathrm{max}\{\mathrm{\Delta }P^{JQP}\}=2\mathrm{\Delta }E/\sqrt{\mathrm{\Gamma }^2+4\mathrm{\Delta }E^2}`$ located at $`\delta _\pm =\sqrt{(\mathrm{\Gamma }/2)^2+\mathrm{\Delta }E^2}`$. We see that for positive $`\delta _\pm `$ the population is inverted, and that the maximum inversion grows with increased TLS level splitting $`\mathrm{\Delta }E`$.

## Qualitative explanation of the PI

Without interaction with the TLS the effective Cooper-pair tunneling rate has a maximum at zero energy gain $`(\delta _\pm =0)`$Averin and Aleshkin (1989); Clerk et al. (2002). In a JQP cycle which excites the TLS the effective energy gain is lowered to $`\delta _\pm \mathrm{\Delta }E`$, see Fig. 4. For positive $`\delta _\pm `$ this is closer to resonance (zero) than $`\delta _\pm +\mathrm{\Delta }E`$, which is the gain for the relaxing cycle. Thus the exciting cycle runs faster than the relaxing one, causing a PI of the TLS. As for the quasiparticle tunneling rates they monotonously increase with increasing energy gain (see Fig. 4d). Thus PI will never occur above the threshold voltage, where the current is carried only by quasiparticles. There the relaxing (pure quasiparticle) cycle will always run faster than the exciting one.

## Two JQP cycles in parallel

Close to $`eV_{ds}=4E_C`$ and $`n_x=0`$, Cooper-pair tunneling across both the left and right junctions are resonant simultaneously. Here the two JQP cycles run in parallel, see Fig. 3a, sharing the charge state $`N=0`$. From the numerical results we deduce that the maximum population inversion is not larger at this crossing compared to the single resonances. Again approximating all involved quasiparticle rates with a single $`\mathrm{\Gamma }`$, and now also taking the relevant limit $`E_J\mathrm{\Gamma }`$, we find along the vertical symmetry line $`\delta _+=\delta _{}=\delta =eV_{ds}4E_C`$ and $`n_x=0`$, that the population is indeed given by Eq. (4). Along the horizontal line $`eV_{ds}=4E_C`$ we have $`\delta _+=\delta _{}`$ giving $`\mathrm{\Delta }P=0`$.

## The Double JQP cycle

Around $`eV_{ds}=2E_C`$ and $`n_x=0.5`$, Cooper-pair tunneling between the charge states $`N=1`$ and $`N=1`$ across the right junction and between $`N=0`$ and $`N=2`$ across the left junction are both resonant processes. This is where the Double JQP processClerk et al. (2002) occurs, transporting 3e in each cycle, see Fig 3b. The population polarization here is remarkably similar to the one around the simple JQP crossing, except that here it has a real maximum along the symmetry line $`n_x=0.5`$. For $`E_J\mathrm{\Gamma }`$ the maximum is again located at $`\delta =\sqrt{(\mathrm{\Gamma }/2)^2+\mathrm{\Delta }E^2}`$, where now $`\delta =eV2E_C`$, and the value is

$$\mathrm{\Delta }P_{max}^{DJQP}=\frac{4\mathrm{\Delta }E\sqrt{\mathrm{\Gamma }^2+4\mathrm{\Delta }E^2}}{\mathrm{\Gamma }^2+8\mathrm{\Delta }E^2}.$$
(5)
## Strong Relaxation - No Current

For the SSET back-action to be important compared to other noise sources the total noise $`S_V^{sym}(\mathrm{\Delta }E/\mathrm{})`$ should be large. In the middle panel of Fig. 2 we see that the noise is large where there is substantial current, with one exception: The noise is also large below the lines $`eV_{ds}/2=E_{\pm 1}E_0=(1\pm 2n_x)E_C`$, where the width of the region is set by the TLS level splitting $`\mathrm{\Delta }E`$. Here a strong relaxation of the TLS occurs, although there is negligible current. In this bias regime the Cooper-pair tunneling is off resonance, but it still slowly takes the SSET from the lowest energy charge state $`N=0`$ to higher energy states. Above these lines the SSET relaxes through quasiparticle tunneling. Thus the SSET mainly occupies its lowest energy charge state $`N=0`$. Below these lines this relaxation of the SSET is not energetically allowed, and the SSET ends up with a population of the excited states $`N=\pm 1`$ of order unity. In the region with strong noise the quasiparticle transition $`N=\pm 1`$ to $`N=0`$ is possible through absorption of the TLS energy, thus causing strong TLS relaxation although there is negligible current flowing through the SSET. In short, the slow off-resonance Cooper-pair tunneling pumps the SSET to an excited state which may only relax through a simultaneous relaxation of the TLS.

## Conclusion

Using a real-time diagrammatic Keldysh approach we have calculated the back-action noise of a superconducting single-electron transistor, biased in the subgap regime. We find that population inversion of the measured two-level system is possible when the JQP cycle which gives energy to the TLS is closer to resonance than the JQP cycle which takes energy from the TLS. We also find regions where the relaxation of the TLS is strong, although there is negligible current flowing through the SSET, see Fig. 5.

###### Acknowledgements.

The author acknowledges fruitful discussions with Yuriy Makhlin, Alexander Shnirman, Per Delsing, Tim Duty, and Andreas Käck. This work was supported by the Humboldt Foundation, the BMBF and the ZIP programme of the German government, and by the European Union under the SQUBIT project.


text:
# A Strongly Nonlinear Alfvénic Pulse in a Transversely Inhomogeneous Medium

## 1 Introduction

The Alfvén waves are usual candidates for energy transport from the lower layers of the solar atmosphere to the corona, e.g. (Goossens 1994; Roberts 2000). However, efficient deposition of the momentum and energy require interaction of linearly incompressible Alfvén waves with compressible magnetoacoustic waves, e.g. (Ofman & Davila 1997, 1998; Ofman et al. 2000). Also, the compressible waves, in contrast to the Alfvén waves, can transport energy and momentum across the magnetic field, spreading out the heated region. In addition, observational detection of Alfvén waves in open structures of the corona can be based upon measurement of the compressible fluctuations, e.g. (Ofman et al. 1997, 1998, 2000). These are generated in the lower corona by the Alfvén waves through linear or nonlinear mechanisms, e.g. (Nakariakov et al. 2000). This method can be complimentary to the observation of coronal Alfvén waves through non-thermal broadening of emission lines, e.g. (Banerjee et al. 1998).

In the inner heliospheric solar wind, Alfvén waves are observed in situ and represent the main component in MHD turbulence (Tu & Marsch 1995; Tsurutani & Ho 1999). This suggests another interesting problem: why the incompressible turbulence dominates in the solar wind, and why compressible fluctuations are not observed, despite the theoretical possibility for these two kinds of MHD fluctuations to be coupled because of the medium inhomogeneity and nonlinearity. Thus, the study of coupling of compressible and incompressible fluctuations is important to the physics of the solar corona and the solar wind. There are several possible mechanisms for the coupling.

The decay instability of Alfvén waves is one of the possible examples of interaction between the MHD wave modes. This mechanism involves resonant three-wave interaction of Alfvén and magnetoacoustic waves (e.g. Sagdeev & Galeev (1969) and references therein). The efficiency of this interaction is governed by the amplitudes of the interacting waves. However, this mechanism works only for quasi-periodic (perhaps wide-spectrum, Malara et al. (2000)) waves, and is not efficient for the wave pulses that could be generated by some transient events on the Sun such as solar flares and coronal mass ejections, e.g. (Roussev et al. 2001).

In contrast, the efficiency of non-resonant mechanisms of the compressible fluctuation excitation by the Alfvén waves does not depend on the coherentness of Alfvén perturbation and consequently work even for single wave, wide-spectrum, pulses.

Nonlinear excitation of magnetoacoustic perturbations by nonlinear elliptically polarized Alfvén waves via the longitudinal gradients of the total pressure perturbations is one of the possible examples of the non-resonant MHD wave interaction. In this mechanism the generation of compressible perturbations results in the self-interaction and subsequent steepening of the Alfvén wave front, which is described by the Cohen-Kulsrud equation, e.g. (Cohen & Kulsrud 1974; Verwichte et al. 1999; Nakariakov et al. 2000). In the following, we refer to this mechanism as “longitudinal”, to distinguish it from the “transverse mechanism”, which generates compressible perturbations via the transverse gradients of the total pressure perturbations in nonlinear Alfvén waves. More detailed discussion of these two mechanisms is presented in Nakariakov et al. (1997, 1998); Botha et al. (2000); Tsiklauri et al. (2001).

The transverse mechanism is dramatically modified in the case when MHD waves interact with transverse stationary inhomogeneity of the plasma. If the Alfvén speed is inhomogeneous across the magnetic field, initially plane, linearly polarized Alfvén waves become oblique and sharp gradients in the direction across the field are secularly generated. This constitutes a basis of the well known Alfvén wave phase mixing phenomenon which has been extensively investigated in connection with the solar coronal heating with MHD waves (Heyvaerts & Priest 1983). Various aspects of this phenomenon have been intensively studied using full MHD numerical simulations (Malara et al. 1996; Ofman & Davila 1995, 1997; Poedts et al. 1997; Grappin et al. 2000; De Moortel et al. 2000). As demonstrated by Nakariakov et al. (1997, 1998); Botha et al. (2000); Tsiklauri et al. (2001), phase mixing of Alfvén waves in the compressible plasma, in the weakly nonlinear regime leads to the generation of fast magnetoacoustic waves, and various regimes of this process, relevant to solar coronal and heliospheric applications have been studied. In particular, it has been found that the inhomogeneity of the plasma across the magnetic field, associated with various types of structuring (e.g. plumes in the coronal holes, boundaries between the slow and the fast solar winds, flow tubes, etc.), plays the crucial role in the interaction of compressible and incompressible weakly-nonlinear MHD modes.

Problems connected with the interpretation of MHD fluctuations observed in the solar wind and the propagation of intensive MHD wave pulses in the solar corona (e.g., flare and CME-associated waves) require detailed study of the interaction of the MHD pulses with plasma inhomogeneities in the strongly nonlinear regime. Our interest to this regime is motivated by the necessity to account for effects of higher order nonlinearities and the back-reaction of nonlinearly generated compressible perturbations on the source Alfvén pulse. Also, as the efficiency of the “transverse” mechanism is connected to the longitudinal wave number (together with the transverse wave number and the amplitude), and as the “longitudinal” mechanism increases, through wave steepening, the longitudinal wave numbers, we expect that the simultaneous action of these two mechanisms can enhance the efficiency of the transverse mechanism. In this work, we study, by direct numerical simulations, the generation of compressible fluctuations by a strongly nonlinear Alfvénic pulse interacting with a transverse plasma inhomogeneity.

The paper is organized as follows: in Section 2 we describe our model and the numerical method applied, in Section 3 the results of the simulations are discussed separately in the high and low $`\beta `$ cases (subsections 3.1 and 3.2 respectively), sub-section 3.3 deals with the investigation of parametric space, and finally, the conclusions are presented in Section 4.

## 2 The model

The model studied here is similar to one discussed in Tsiklauri et al. (2001): we use the equations of ideal MHD

$$\rho \frac{V}{t}+\rho (V)V=p\frac{1}{4\pi }B\times \mathrm{curl}B,$$
$`(1)`$
$$\frac{B}{t}=\mathrm{curl}(V\times B),$$
$`(2)`$
$$\frac{p}{t}+Vp+\gamma pV=0,$$
$`(3)`$
$$\frac{\rho }{t}+\mathrm{div}(\rho V)=0,$$
$`(4)`$
where $`B`$ is the magnetic field, $`V`$ is plasma velocity, $`\rho `$ is plasma mass density, and $`p`$ is plasma thermal pressure for which the adiabatic variation law is assumed.

We solve equations (1)–(4) in Cartesian coordinates ($`x,y,z`$) and under the assumption that there is no variation of the physical values in the $`y`$-direction, i.e. ($`/y=0`$, 2.5D approximation) with the use of Lare2d (Arber et al. 2001). Lare2d is a numerical code which operates by taking a Lagrangian predictor-corrector time step and after each Lagrangian step all variables are conservatively re-mapped back onto the original Eulerian grid using Van Leer gradient limiters. This code was also used to produce the results in Refs. Botha et al. (2000); Tsiklauri et al. (2001). As in Botha et al. (2000); Tsiklauri et al. (2001), the equilibrium state is taken to be a uniform magnetic field $`B_0`$ in the $`z`$-direction and an inhomogeneous plasma of density $`\rho _0(x)`$,

$$\rho _0(x)=\rho _{}\left(32\mathrm{tanh}(\lambda x)\right).$$
$`(5)`$
Here, $`\lambda `$ is a free parameter which controls the steepness of the density profile gradient. The latter is localized around $`x=0`$. The temperature profile $`T_0(x)`$ is set up to allow for the total pressure to be constant everywhere. In our normalization, which is the same as that of Botha et al. (2000); Tsiklauri et al. (2001), $`B=B_0\overline{B}`$, $`r=a_{}\overline{r}`$, $`C_A(x)=B_0/\sqrt{4\pi \rho _0(x)}=\left[B_0/\sqrt{4\pi \rho _{}}\right]/\sqrt{32\mathrm{tanh}(\lambda x)}=C_A^{}/\sqrt{32\mathrm{tanh}(\lambda x)}=C_A^{}\overline{C}_A(x)`$, $`t=(a_{}/C_A^{})\overline{t}`$, $`V=C_A^{}\overline{V}`$, the dimensionless local Alfvén speed is $`\overline{C}_A(x)=1/\sqrt{32\mathrm{tanh}(\lambda x)}`$. $`a_{}`$ and $`\rho _{}`$ are the units of length and density respectively. In what follows we omit bars on all dimensionless physical quantities.

## 3 Numerical Results

We set up the code in such a way that initially longitudinal ($`V_z`$) and transverse ($`V_x`$,$`B_x`$,$`B_z`$) perturbations and the density perturbation, $`\rho `$, (perturbed by both longitudinal and transverse modes) are absent and the initial amplitude of the Alfvén pulse is strongly non-linear, i.e. typically A=0.5. At $`t=0`$, the Alfvén perturbation is a plane (with respect to $`x`$-coordinate) pulse, which has a Gaussian structure in the $`z`$-coordinate,

$$B_y(z)=A\mathrm{exp}\left(\frac{z^2}{\delta }\right),V_y(x,z)=C_A(x)B_y(z).$$
$`(6)`$
Here, $`\delta `$ is a free parameter which controls the width of the initial pulse. In all our numerical runs $`\delta =0.1`$.

As it is discussed in Introduction (cf. Nakariakov et al. (1997) for details) in the considered geometry, Alfvén waves represented by $`V_y`$ and $`B_y`$, are incompressible up to the cubic nonlinearity. The longitudinal (represented by $`V_z`$) and the transverse (represented by $`V_x`$,$`B_x`$,$`B_z`$) compressible perturbations (of course, both perturbing $`\rho `$) are generated nonlinearly by the longitudinal and transverse gradients of the total pressure. The efficiency of the generation depends upon the amplitude of the Alfvén waves, in other words, the incompressible and compressible perturbations are linearly decoupled. The latter guarantees that with the choice of our initial conditions the compressible perturbations are indeed initially absent from the system, which a priori is not clear if the linear coupling is present (cf. Tsiklauri & Nakariakov (2002)). In addition, the transverse compressible perturbations are generated by plane Alfvén waves only in the presence of the transverse profile of the local Alfvén speed.

The simulation box size is set by the limits $`15.0<x<15.0`$ and $`15.0<z<15.0`$. The pulse starts to move from point $`z=12.5`$ towards the positive $`z`$’s. Both the scale of density inhomogeneity and width of the Alfvénic pulse are much smaller than the size of the calculation domain.

We have performed calculations on various resolutions in an attempt to achieve convergence of the results. The graphical results presented here are for the spatial resolution $`2500\times 2500`$, which refers to number of grid points in $`z`$ and $`x`$ directions respectively. We have used a non-uniform grid in our simulations, namely, in $`x`$ direction 75% of the grid points where concentrated between $`5.0x5.0`$ where the spatial inhomogeneity has strongest gradients. We have also performed calculation on the spatial resolution $`3500\times 3500`$ and found that the maximal generation levels (maximum of an absolute value over the whole simulation domain) for all physical quantities as a function of time are the same as in the case of $`2500\times 2500`$ resolution. Thus, the results presented here are, indeed, converged.

Our main numerical runs are split in two parts, treating separate cases when plasma $`\beta `$, which is the ratio of speed of sound to the Alfvén velocity squared, is less and greater than unity. This split is motivated by weakly nonlinear results, showing that the particular scenario of the interaction of MHD waves is determined by the ratio $`(C_s/C_A)`$ being less or greater then unity, e.g. (Cohen & Kulsrud 1974).

### 3.1 Case when $`\beta >1`$

In this subsection we present solution of the Eqs. (1)-(4) with the above described equilibrium and the initial conditions for the case when plasma-$`\beta `$ is 2.0. Here, $`\lambda `$-parameter was fixed at 0.75.

Figures 1–3 show snapshots of the initially absent transverse ($`V_x`$) and longitudinal ($`V_z`$) components of the velocity (representing the “transverse” and “longitudinal” compressible waves, respectively) and density perturbation, at time $`t=15`$.

The transverse compressible perturbations ($`V_x`$) are generated by the transverse gradients of the total pressure perturbations. In turn, these perturbations are generated by the Alfvén wave phase mixing, and are located near $`x=0`$ where the density gradients are the largest. Then they propagate across the field (see Fig. 1). The longitudinal compressive perturbations, $`V_z`$ are generated even in the absence of the plasma density inhomogeneity (Fig. 2). In the contour plot (Fig. 2, bottom panel) it can be seen that there are two wave fronts: one moving at a local Alfvén speed, and another (compressive one) that moves faster than the local Alfvén speed because $`\beta =2`$. Fig. 3 shows the relative density perturbation associated with the compressible waves that have been generated.

In Fig. 4, the top panel presents spatial variation (across the $`x`$-coordinate) and the dynamics of the transverse and longitudinal compressible waves, and relative density perturbations produced by them. In what follows $`max`$ and $`min`$ refer to the maximum and minimum over the whole simulation box (i.e. space) of a dimensionless physical quantity at a given time instance, respectively. These are fairly good and simple (scalar) quantities describing the generation and/or decay of a 2.5D physical quantity, dynamics of which is otherwise not so straightforward to comprehend. There are five interesting observations: (i) the decay of the $`max(|V_y|/C_A(x))`$ (on expense of which the transverse ($`V_x`$) and longitudinal ($`V_z`$) compressive waves and associated density perturbation are generated) occurs in the middle – where the plasma inhomogeneity is the strongest. This demonstrates the importance of the inhomogeneity. (ii) the right wing ($`x>0`$) decays faster than the left ($`x<0`$) one. For the value of plasma $`\beta `$ used, it is expected that shock dissipation would be greater where the local Alfvén velocity is greater (in this case the right wing). Note that when referring to shock dissipation we mean artificial dissipation that guarantees proper shock capturing, while at all times we remain in the framework of an ideal MHD (no bulk dissipation included). Thus, the shock viscosity ensures that we recover the weak solution to ideal MHD. (iii) the relative density perturbation and longitudinal compressive wave $`max(|V_z|/C_A(x))`$ are generated in the homogeneous parts of the domain ($`x5`$, $`x5`$) too. However, in the middle of the domain, where the inhomogeneity is strong we see that inhomogeneity of plasma density enhances the generation of these quantities by about a factor of 2. (iv) transverse compressive wave $`max(|V_x|/C_A(x))`$, which is not generated in the absence of density inhomogeneity, is generated in the middle of the domain. (v) $`max(|V_y|/C_A(x))`$, on expense of which the transverse ($`max(|V_x|/C_A(x))`$) and longitudinal ($`max(|V_z|/C_A(x))`$) compressive waves are generated, has two dips in those places where the other physical quantities have two bumps, which clearly demonstrates the correct energy balance as well as the importance of the inhomogeneity (where actually the bumps occur).

In Fig. 4, the bottom panel presents temporal variation of transverse and longitudinal compressible wave amplitudes. In the presence of the inhomogeneity ($`\lambda =0.75`$), the Alfvén perturbation ($`min(|V_y(x,z,t)|/C_A(x))`$) decays much faster than in the homogeneous case ($`\lambda =0`$). In the inhomogeneous case, the energy initially stored in the Alfvén wave in addition to shock dissipation goes into the generation of the compressive waves. The maximum amplitudes of longitudinal $`max(|V_z(x,z,t)|)`$ and transverse $`max(|V_x(x,z,t)|)`$ compressible waves attain a substantial fraction of the initial Alfvén wave amplitude. In the inhomogeneous case ($`\lambda =0.75`$), the longitudinal wave attains about twice the maximal value than in the homogeneous plasma case. Obviously, when $`\lambda =0`$ there is no generation of the transverse compressive wave and $`max(|V_x(x,z,t)|)`$ is identically zero for all times.

### 3.2 Case when $`\beta <1`$

In this subsection we present solution of the Eqs. (1)-(4) with the above described equilibrium and the initial conditions for the case when plasma-$`\beta `$ is 0.5.

As in the previous subsection, $`\lambda `$-parameter was fixed at 0.75.

Again, the initially absent transverse ($`V_x`$) and longitudinal ($`V_z`$) compressive waves and density perturbations are efficiently generated (Figures 5–7) and reach a substantial fraction of the initial Alfvén wave amplitude.

In the contour plots in Figs. 6 and 7 it can be seen that there are two wave fronts: one moving at a local Alfvén speed, and another (compressive one) that moves slower than the local Alfvén speed because $`\beta =0.5`$ (compare with Figs. 2 and 3). Therefore, since the velocity difference between the first and second parts of the solution is not as great as in the $`\beta =2`$ case, these two parts seem be blended into each other.

Figure 8 presents the evolution of transverse and longitudinal compressive wave amplitudes in time. This graph is quite similar to Fig. 4. The noteworthy difference is as follows: for the value of plasma $`\beta `$ used here ($`\beta =0.5`$), the non-linear term in the scalar Cohen-Kulsrud equation is larger than in the former case of $`\beta =2`$ (Fig. 4). Therefore in Fig. 8, top panel, we observe that the shock dissipation of the Alfvén wave is greater (the thin solid line goes further down than in Fig. 4, also the top panel), and, in turn, the non-linear generation of the transverse and longitudinal compressive is further enhanced.

### 3.3 Parametric study

In this subsection we explore the parametric space of the problem. In particular, we investigate how the maximal value of the generated transverse compressive wave depends on the plasma density inhomogeneity parameter, $`\lambda `$, plasma $`\beta `$, and initial amplitude of the Alfvén wave, $`A`$.

In Fig. 9A we plot the dependence of the maximum of the absolute value of the transverse compressive perturbation, $`max(|V_x(x,z,t)|)/A`$, versus $`\lambda `$ for $`\beta =2`$ (solid curve) and $`\beta =0.5`$ (dashed curve). There are two noteworthy features in this graph, first, the maximal value of the generated transverse compressive wave depends on the plasma density inhomogeneity parameter rather weakly (once $`\lambda 0.4`$), and second, efficiency of the generation of $`V_x`$ is somewhat larger in the $`\beta =0.5`$ case than in the case of $`\beta =2`$. There are no data points between $`0\lambda 0.4`$ because in order to accommodate the inhomogeneity in the simulation domain we would have to increase its size, which was not possible with available computational resources. Also, we made 5 runs of Lare2d code for the different values of $`\beta `$. The results are presented in Fig. 9B. We gather from the graph that the maximal value of the generated transverse compressive wave depends on the plasma $`\beta `$ rather weakly.

Yet another valuable insight can be obtained by studying the dependence of the maximal value of generated transverse compressive wave on the initial amplitude of the Alfvén wave as our problem is essentially non-linear. In Fig. 9C we plot results of numerical runs for different values of $`A`$, while $`\lambda `$ and $`\beta `$ where fixed at 0.5 and 1.25 respectively. We gather from Fig. 9C that quite unexpectedly the ratio $`max(|V_x(x,z,t)|)/A`$ is insensitive to the variation of the initial amplitude of the Alfvén wave.

We also investigated the parametric space with regard to the relative density perturbation. Namely, we investigate dependence of $`max(|(\rho \rho _0)/\rho _0|)`$ as function of $`\lambda `$, $`\beta `$ and $`A`$. We gather from Fig. 9D that for $`\beta =2`$ the generated relative density perturbation saturates at about 20 %, while for $`\beta =0.5`$ the saturation level doubles. Fig. 9E illustrates the fact that the maximum generated relative density perturbation depends quite strongly on plasma $`\beta `$. In Fig. 9F we show the dependence of $`max(|(\rho \rho _0)/\rho _0|)`$ versus the initial amplitude $`A`$. We observe that since the density perturbation is generated by the non-linear effects, $`max(|(\rho \rho _0)/\rho _0|)`$ indeed grows with the increase of $`A`$, and the dependence is almost linear.

## 4 Conclusions

This study is an extension of the previous works to the case of strongly nonlinear amplitudes. The main results can be summarized as follows:

* Phase mixing of a strongly nonlinear Alfvén pulse is accompanied by an enhanced generation of compressible waves. This is true irrespective of plasma $`\beta `$ being less or greater than unity.
* Plasma density inhomogeneity (while providing, as in the weakly nonlinear case, a source region for the non-linear generation of transverse compressive waves by a plane Alfvén wave) substantially enhances (by about a factor of 2) the generation of longitudinal compressive waves.
* Attained maximal values of the generated transverse compressive perturbations are insensitive to the strength of the plasma density inhomogeneity, plasma $`\beta `$ and the initial amplitude of the Alfvén wave. Typically, they reach about 40% of the initial Alfvén wave amplitude.
* Attained maximal values of the generated relative density perturbations are within 20-40% for $`0.5\beta 2.0`$. They depend upon plasma $`\beta `$ strongly; and scale (increase) almost linearly with the initial Alfvén wave amplitude.

Commenting upon the maximal values attained by the transverse compressive waves in relation to the previous, weakly nonlinear, results (Botha et al. 2000; Tsiklauri et al. 2001) we would like to state the following: In the weakly nonlinear case the transverse compressive waves do not grow to a substantial fraction of the initial Alfvén wave amplitude due to the destructive wave interference effect (typically, $`max(|V_x(x,z,t)|)/A10^3`$). However, in the strongly nonlinear case, studied here, although the destructive wave interference is still in action, $`max(|V_x(x,z,t)|)/A`$ is now significantly larger, about $`0.4`$ (cf. Figs. 9A, 9B, 9C). Therefore, we conclude that the strong nonlinearity substantially enhances the attained maximal values of the transverse compressive waves.

The physical phenomenon studied here is an elementary process responsible for non-resonant coupling of compressible and incompressible MHD modes. In particular, it may play a role in MHD turbulence of space and astrophysical plasmas. The presence of a pressure-balanced inhomogeneity should significantly affect the saturated MHD turbulent state (c.f. a similar claim but based upon different reasonings in Bhattacharjee et al. (1998)).

###### Acknowledgements.

D.T. acknowledges financial support from PPARC. Numerical calculations of this work were performed using the PPARC funded Compaq MHD Cluster at St Andrews and Astro-Sun cluster at Warwick.


text:
# Encoding a Taxonomy of Web Attacks with Different-Length Vectors

## 1 Introduction

With the increasing use of Internet as a commercial channel, there is a growing number of web sites deployed to share information, offer on-line services, sell all sorts of goods, digital or physical, distribute news and articles, etc. On the other hand, the number of attacks is increasing in parallel: theft of private information, defacing of homepages, denial of service, worm spreading, and fraud, are but a few of the most common and frequent attacks in cyberspace .

When the attacks suffered by web servers through the years are analyzed, it is observed that most of them are recurrent attacks. In fact, they correspond to a limited number of types of attacks. Thus, it is generally agreed that classification can help designers and programmers to better understand attacks and build more secure applications.

In an effort to create a common reference language for security analysts, a number of classifications and taxonomies of computer attacks and vulnerabilities have appeared in recent years . However, these taxonomies are general and do not specifically cover web attacks.

In this paper we propose a taxonomy of web attacks, taken into account a number of important features of each attack category. The role of these features as well as their importance for each of the attack categories is discussed. By *web attacks*, we understand attacks exclusively using the HTTP protocol.

The proposed taxonomy represents an effort to cover known attacks and also some attacks that might appear in the future. Once the taxonomy has been defined and the role and importance of its categories have been explained, we use different-length vectors to encode all relevant information contained in web attacks. These vectors can be useful in a number of applications, such as intrusion detection systems (see Sec. 5.1) or application firewalls (see Sec. 5.2).

The paper is organized as follows. Section 2 proposes the taxonomy of web attacks. Section 3 explains how and why to encode the attacks into different-length vectors. Section 4 gives some examples of attacks encodings. Section 5 provides some ideas about which applications might benefit from this encoding and Section 6 concludes the paper.

## 2 Web attack properties

A *taxonomy* is a classification scheme that partitions a body of knowledge and defines the relationship of the objects. *Classification* is the process of using a taxonomy for separating and ordering . According to , satisfactory taxonomies have classification categories with the following characteristics:

1. Mutually exclusive: the categories do not overlap.
2. Exhaustive: taken together, the categories include all the possibilities.
3. Unambiguous: clear and precise so that classification is not uncertain, regardless of who is classifying.
4. Repeatable: repeated applications result in the same classification, regardless of who is classifying.
5. Accepted: logical and intuitive so that categories could become generally approved.
6. Useful: could be used to gain insight into the field of inquiry.

First, we introduce a novel model of web attacks based on the concept of *attack life cycle*. By attack life cycle we understand a succession of steps followed by an attacker to carry out some malicious activity on the web server, as depicted in Figure 1. The attacker gets through an entry point, searching for a vulnerability in the web server or web application which causes a threat to the web server’s assets. The vulnerability is exploited (and the threat realized) by an action, using an HTTP element of certain length, directed against a given target and with a given scope. The attacker might obtain some privileges that depend on the type of attack. Our taxonomy of web attacks is based on the attack life cycle defined in this way.

At every stage of the life cycle we define the following classification criteria or classifiers:

1. Entry point: where the attack gets through.
2. Vulnerability: a weakness in a system allowing unauthorized action.
3. Threat: risk against vulnerable assets.
4. Action: actual attack realizing the threat against the web server caused by the vulnerability.
5. Length: the length of the arguments passed to the HTTP request.
6. HTTP element: Verbs and headers needed to perform the attack.
7. Target: the aim of the attack.
8. Scope: impact of the attack on the web server.
9. Privileges: privileges obtained by the attacker after the successful completion of the attack.

In the next subsections each of these criteria are covered in detail and their relevance explained.

### 2.1 Entry point

The fact that a web application is successfully attacked usually means that there is a vulnerability causing a threat that is exploited by the attacker. This vulnerability might be found in the web server software or in the web application code itself. Thus, according to the *entry point* of the attack, we distinguish between *web server software* attacks and *web application* attacks.

#### 2.1.1 Web server software attacks

All web server software, regardless of platform or manufacturer, unintentionally hides a number of vulnerabilities which allow the application to be used in a different way than intended. Many of these vulnerabilities are disclosed to the public, for example publishing in security forums and bulletins. Upon notification of the vulnerability, the manufacturer usually releases a patch or service pack which should correct the error. In the meantime, since the patch is released until all servers are correctly patched, an opportunity window to exploit the current vulnerability might exist.

#### 2.1.2 Web application attacks

Web application-level attacks refer to the vulnerabilities inherent in the code of a web application itself, regardless of the technology in which it is implemented or the security of the web server/back end database on which it is built .

The origin of these vulnerabilities are errors in HTML forms, client-side scripts, server-side scripts (.asp, .jsp, .php, .pl, etc.), business logic objects (COM, COM+, CORBA, etc.), SQL sentences processing, etc.

### 2.2 Vulnerability

In order to reach the desired result, an attacker must take advantage of a computer or network vulnerability. A *vulnerability* is a weakness in a system allowing unauthorized action. We define the following vulnerabilities in web applications.

#### 2.2.1 Code Injection

Code injection vulnerabilities allow for injecting arbitrary user-chosen code into a page. The main categories of code injection are:

* Script injection: Outside or third-party input data received by a web application result in a client-side script executing within the users web environment, achieving the same level of access and privileges as the hosted domain . Cross-Site Scripting is the most common form of script injection.
* SQL injection: An attacker creates or alters existing SQL commands to gain access to unintended data or even the ability to execute system level commands on the host. See for example .
* XPath injection: XPath is a language for addressing parts of an XML document. An attacker can modify search strings to access unauthorized data in XML documents.

These vulnerabilities arise from nonexistent or poorly designed input validation routines on the server-side.

#### 2.2.2 Canonicalization

Canonicalization vulnerabilities occur when an application makes a security decision based on a name (a filename, a folder name, a web address), without having in mind the fact that the name may be expressed in more than one way .

The most common way of exploiting canonicalization issues is in the form of *path traversal* attacks, which allow a malicious user to execute commands or view data outside of the intended target path. Path traversal vulnerabilities arise normally from unchecked URL input parameters, cookies, and HTTP request headers. In most cases, a path traversal attack inherits the permissions of the application being executed which may then access any file allowable using those permissions.

#### 2.2.3 HTML manipulation

HTML manipulation is a vulnerability which allows a malicious user to modify data sent between the client (web browser) and server (web application), to which the user was not intended to have direct access. Parameter manipulation is often accomplished through:

* URL Query Strings
* Form Fields
* Cookies

Parameter manipulation can be prevented with good input validation techniques on the server side, although it is neglected too often.

#### 2.2.4 Overflows

Buffer overflows have been causing serious security problems for decades . The main cause of buffer overflow problems is that in some programming languages, such as for example C/C++, there are no bounds checks on array and pointer references, meaning a developer has to check the bounds, an activity that is often ignored. When a program writes past the bounds of a buffer, this is called a buffer overflow. Reading or writing past the end of a buffer can cause a number of diverse behaviors: programs can act in strange ways or fail completely.

At best, a buffer overflow can stop a server or service where it happens. At worst, it can allow for arbitrary code execution with the same privileges as the program where it is present.

#### 2.2.5 Misconfiguration

Sometimes, when a web server is started using the default configuration, it runs with a number of potentially dangerous directories, sample applications, user accounts, and other similar elements. Many vulnerabilities have been discovered and exploited in these elements over time. It is highly advisable to uninstall or disable everything which is not explicitly used by the web application.

Moreover, if the platform and web server are not correctly configured (carefully assigning file permissions, using non-default paths, etc.) many other vulnerabilities can arise.

### 2.3 Threat

There is a widely accepted set of services or requisites that all systems must satisfy in order to be considered secure . These services include authentication, confidentiality, integrity, availability, access control, and auditing.

According to the security property under *threat*, we distinguish between the following attacks.

#### 2.3.1 Authentication

The goal of authentication is to determine whether someone or something is, in fact, who or what it is declared to be. Authentication is commonly performed through the use of passwords. Knowledge of the password is assumed to guarantee that the user is authentic.

In a Web context, authentication attacks bypass identification controls by using a number of different techniques, such as session hijacking, session replay, identity spoofing, valid credentials theft, authentication module subversion, and brute-forcing. As a consequence, an illegitimate user will be identified as a legitimate one.

#### 2.3.2 Authorization

The goal of authorization is to permit authenticated users to do or have something. In multi-user computer systems, a system administrator defines for the system which users are allowed access to the system and what privileges of use (such as access to which file directories, hours of access, amount of allocated storage space, and so forth).

Most common authorization attacks bypass access control by means of buffer overflows (see Sec. 2.2.4), server platform errors, and SQL injection techniques (see Sec. 2.2.1). Their goal is to execute database or operating system commands and access resources not allowed to the unprivileged user. Eventually, a well-implemented privilege escalation attack will result in the unauthorized increase in the domain of access, even ensuring the attacker administrator or root privileges.

#### 2.3.3 Confidentiality

The goal of confidentiality is to protect the information from being disclosed or revealed to entities not authorized to have that information.

Confidentiality attacks show private information contained in files (source code, other users’ information, etc.), or in database tables (credit card numbers, personal information, etc.). Depending on the nature of the information disclosed, the attacker can penetrate further into the attacked system or get private information about the targeted company or its customers.

#### 2.3.4 Integrity

Data integrity services act as safeguards against accidental or malicious tampering or modification of data. Changing the value of a data item includes inserting additional data or deleting, modifying, or reordering parts of the existing data.

Common attacks against data integrity include database records manipulation, cookie poisoning, web page alteration (defacing), and forms field modification.

#### 2.3.5 Availability

The goal of service availability is to ensure that users are not unduly denied access to information and resources.

Denial of service (DoS) is the most frequent attack against availability (see Sec. 2.4.8). DoS attacks can be conducted against the machine hosting the web server or against the web server itself. In the first case, the attack will use techniques equally valid for all machines connected to the Internet. In the second case, the attack will exploit vulnerabilities in the web server or the web application to stop normal service.

#### 2.3.6 Auditing

The auditing services provide the system administrator with the means to record security-relevant information, which can be analyzed to detect potential and actual violations of the system security policy. Auditing, or accountability, has three functions: event detection, information collection, and information processing.

Some attacks manage to pass undetected by preventing their being logged by the auditing system.

### 2.4 Action

Most real-world attacks suffered by web servers are variants or concatenations of a few basic actions or *attack classes*. In this section we try to reference those primary attack classes which account for mostly all everyday attacks.

We distinguish among actions aimed at three different objectives: server data, user authentication, and web server. Actions directed against data include *read*, *modify*, *delete*, and *fabricate*. Actions directed against authentication include *impersonate*, *bypass*, and *search*. Actions directed against the web server include *interrupt*, *probe*, and *unknown*.

#### 2.4.1 Read

Read is an action to obtain the content of the data contained within a file, database record, or other data medium stored in the web server. Reading does not alter the integrity of the data read. Examples include viewing source code files, and illicitly copying database tables.

#### 2.4.2 Modify

Modify is an action to alter data. We limit our definition to tampering with data on the server side. Examples include changing a database record, or changing the contents of a file. Modifying data on the client side, such as the value of the URL, a cookie, or a hidden field in a form, does not fall under this category because the vast majority of web attacks imply this manipulation in some way or another. The data continue to be available, but in altered form.

#### 2.4.3 Delete

Delete is an action to remove or render an asset in the server irretrievable by other legitimate users. Examples include deleting database objects and server files.

#### 2.4.4 Fabricate

Fabricate is an action to insert counterfeit objects into the system. Examples include adding hacker toolkits to the server filesystem, creating new user accounts, or inserting records into a database table.

#### 2.4.5 Impersonate

Impersonate is an action to masquerade an illegal user as a legitimate one. Examples include authentication tickets reuse or theft.

#### 2.4.6 Bypass

Bypass is an action to avoid a process by using an alternative method to access a target. Examples include directly accessing protected web resources, such as multimedia files, by simply following a link.

#### 2.4.7 Search

Search is an action to find valid user authentication information. Examples include brute-force attacks which try different combinations of login/password pairs, or repeatedly forging possible authentication tickets or session ID’s to simulate an already validated user.

#### 2.4.8 Interrupt

Interrupt is an action to cause networked computers to disconnect from the network or just outright crash. Interruption of service attacks are popularly known as denial of service (DoS) attacks. Their primary goal is to deny the legitimate users access to a particular resource or service.

#### 2.4.9 Probe

Probe is an action used to determine the characteristics of a specific target. Attackers usually begin by gathering information about the target, before stepping into more invasive activities. For instance, the use of uncommon HTTP headers, such as HEAD, or web site mirroring tools, such as Teleport Pro  or wget , are indicators that an attack might be under way. More aggressive tools, such as Whisker  or Nikto  are more than probing tools, since they scan the web server in search of vulnerabilities.

#### 2.4.10 Unknown

When an attacker executes code, but it is impossible to ascertain what the command executed is, we consider the action carried as *unknown*. Examples include a buffer overflow with a command execution payload or .bat or .cmd files executed via URL name. Usually, these unknown actions are considered a threat against authorization, because although the outcome of such execution cannot be known, we assume it is unauthorized.

### 2.5 Length

Buffer overflows are the most common form of security vulnerability today, not only in web applications but also in all Internet applications and services. They are the easiest to exploit with the most devastating consequences, usually resulting in complete takeover of the attacked host.

Buffer overflows often need a very long data input to work. Hence, based on the *length* of the attack string, we distinguish between *common-length* and *unusually long* attacks.

#### 2.5.1 Common length

Attacks which are not based on exploiting a buffer overflow seldom submit arguments of a length greater than a certain threshold that can be experimentally defined for a particular web server. Thus, most attacks fall under this category.

#### 2.5.2 Unusually long

Buffer overflows require passing arguments of sufficient length to fill a memory buffer allocated to a particular input, along with some additional data that are written into memory outside the buffer. When these additional data are missing, the buffer overflow usually results in a Denial of Service (DoS) attack (see Sec. 2.4.8), whereas when it is present and accurately crafted, might result in a system command execution.

Unexpectedly long input arguments very likely imply a buffer overflow attack attempt.

### 2.6 HTTP element

As a prerequisite of our definition of web attacks, the HTTP protocol must be used in order to carry out attacks against web servers. An HTTP request consists of a verb and a group of headers. Different attacks use different verbs and/or headers. It is obvious that this category is not mutually exclusive, but actually is unambiguous and we consider it valid to be included in our global taxonomy, since it provides useful information. Thus, according to the *HTTP element* used, we distinguish the following attacks.

#### 2.6.1 GET/POST

Most common HTTP requests (and attacks) use the GET or POST verbs.

#### 2.6.2 Host

Most common HTTP requests use the Host header which represents the naming authority of the origin server or gateway given by the original URL.

#### 2.6.3 Cookie

Most web applications use cookies to improve the user experience. When a web browser requests a page from a server, it routinely sends the cookies it received from that domain. These cookies are sent by means of the Cookie header. Cookies can be tampered with manually, changing their value.

#### 2.6.4 Referer

The Referer\[sic\] header field allows the client to specify the address (URI) of the resource from which the Request URI was obtained. Although the browser must fill this header, manual manipulation of this field cannot be prevented.

#### 2.6.5 Translate

”Translate: f” is a header used by WebDAV. Adding this to HTTP GET signals WebDAV components to really return source code of files and bypass processing. It is used in FrontPage 2000 and any WebDAV compatible client to get files for editing. It has to be accompanied by some other information which should not let anyone access the sources.

#### 2.6.6 SEARCH

As a part of the extra functionality provided by the WebDAV components, Microsoft has introduced the SEARCH request verb to enable searching for files based upon certain criteria.

#### 2.6.7 PROPFIND

The WebDAV PROPFIND verb retrieves properties for a resource identified by the request URI. The PROPFIND method can be used on collection and property resources.

### 2.7 Target

Not all web attacks aim at the same target. Some attackers might be interested in taking control over the web server machine and extending their attack further into the server’s network. Others might be interested only in obtaining database records, modifying some pages or misleading other users. Based on the *target* of the attack, we distinguish between *application* and *platform* attacks.

#### 2.7.1 Web application

Web application attacks are directed against the web application running on top of the server platform. If the attack succeeds, only the application data and functionality will be affected, but not the operating system resources. These attacks are typically aimed at web pages (obtaining and/or modifying source code) and database records (viewing, changing and/or deleting information).

#### 2.7.2 Platform

Under this attack, the target is beyond the web application, aimed at the platform. The attacker usually seeks after arbitrary command execution, manipulation of machine accounts, tampering with the host’s services, obtaining network information, etc. The web server is used as a mere portal to gain access to the internal network.

### 2.8 Scope

Different attacks affect the web server in different ways. Many attacks only affect one user or a group of users, whereas others have an impact on all users of the service.

Regarding the *scope* of the attack, we can distinguish between *local* and *universal* attacks.

#### 2.8.1 Local

In these attacks, only one user or a small group of users is affected. If the individual attack can be automated and extended to any other user, then it pertains to the category of *universal* attacks. An example are data harvesting attacks.

#### 2.8.2 Universal

All users will be affected by the attack. Typically, universal attacks include web defacing, database record manipulation, and code injection.

### 2.9 Privileges

When an attacker compromises a web server, the ultimate goal is to gain administrator/root privileges. Most web attacks do not allow the attacker to escalate privileges. They run under a restricted account in the server or database. However, misconfiguration of the operating system access control lists, web server permissions, and database users could enable an attacker to reach administrative privileges. There are three categories of users involved in an attack:

* The web application user.
* The database user.
* The operating system level user.

Hence, with regard to the *privilege* obtained by the attack, we can distinguish between *unprivileged* and *administrative* attacks. This category is only applicable when the objective of the attack is obtaining access as a certain user, i.e., authentication attacks (see Sec. 2.3.1).

#### 2.9.1 Unprivileged user

Attacks are run under the identity of a web user, a database user, and/or a system-level user. The attacker can access resources only accessible to that user and thus the impact of the attack is limited.

#### 2.9.2 Administrator/root

If the attacker succeeds in gaining administrative access, the machine is completely compromised. This is the highest level of attack realization.

## 3 Encoding of the attacks

Now that we have already characterized attacks by their fundamental properties, we face the problem of how to encode the attack information in a compact and useful way. Provided that the number of attacks suffered by a web site with medium traffic can grow very quickly, it is not advisable to record unnecessary information to prevent running out of storage space prematurely. In fact, the main goal of this taxonomy is to capture the relevant information about attacks, allowing to perform an analysis in order to decide on the severity of the attack.

To reduce the amount of the information recorded on the media, the data can be compressed, using some of the source coding techniques. But the use of general compression techniques and algorithms in this case has serious drawbacks. These drawbacks depend on the class of the method. Here we enumerate some of them.

For static defined word schemes to be implemented (e.g. , , , ,  ) the knowledge of the probabilities of message classes is needed in advance. The problem is that if we treat the descriptions of the attacks as messages, the probability of their appearance varies with time, as new attacks are invented and the remedies are published. Other definitions of messages in this case would be too general and would not lead to a sufficient compression ratio.

To adapt to the changes of the message probabilities, the adaptive Huffman coding can be used (e.g. the FGK algorithm  or the Vitter algorithm ). But there is no guarantee that the compression ratio achieved by these methods is satisfactory, since these encodings are often outperformed by the static methods .

The main drawback of the free-parse methods, such as Ziv-Lempel  is that they perform very badly when short messages are encoded. As in the case of the static word schemes, other definitions of messages would not lead to an efficient compression.

Having in mind the specific type of local redundancy in the descriptions of the attacks (i.e. the descriptions of some of the attacks include some of the attack properties, whereas the descriptions of the others do not), we propose a semantic dependent data compression method that makes use of different-length vectors. The vectors have different lengths because only the information significant to the particular attack is retained. Besides its advantage over the general data compression schemes considering the efficiency of the short messages encoding, the use of this type of semantic dependent encoding makes possible the direct use of classification and clustering techniques that are often needed in the implementations, since the classification and clustering can be performed without decompressing .

To encode the descriptions of the attacks using the semantic dependent method introduced above, a range of positive integers is assigned to each of the attack properties discussed, in the following way.

1. Entry point (1 bit of information)

0 - Web server software (ISAPI filters, Perl modules, etc.)

1 - Web application (HTML, server-side and client-side scripts, server components, SQL sentences, etc.)
2. Vulnerability (3 bits of information)

0 - Code Injection (SQL, JScript, cross-site scripting, etc.)

1 - Canonicalization

2 - HTML manipulation

3 - Overflows

4 - Misconfiguration (default directories, sample applications, guest accounts, etc.)

X - Not applicable
3. Threat (3 bits of information)

0 - Authentication

1 - Authorization

2 - Confidentiality

3 - Integrity

4 - Availability

5 - Auditing
4. Action (4 bits of information)

0 - Read

1 - Modify

2 - Delete

3 - Fabricate

4 - Impersonate

5 - Bypass

6 - Search

7 - Interrupt

8 - Probe

9 - Unknown
5. Length (1 bit of information)

0 - Expected

1 - Unexpected (unusually long)

X - Not applicable
6. HTTP element (7 bits of information)

01 - GET/POST

02 - HOST

04 - COOKIE

08 - REFERER

10 - TRANSLATE

20 - SEARCH

40 - PROPFIND
7. Target (1 bit of information)

0 - Web application (source files, customers’ data, etc.)

1 - Platform (OS command execution, system accounts, network, etc.)
8. Scope (1 bit of information)

0 - Local (one user affected)

1 - Universal (all users affected)

X - Not applicable
9. Privileges (1 bit of information)

0 - Unprivileged user

1 - Administrator/root

X - Not applicable

Each property requires a certain number of bits to encode its information. When only one bit is required, it means that the property can take one of two possible values, but not both. However, when the property can take some different values simultaneously, as many bits as the number of possible values are required.

## 4 Encoding examples

Let us consider the following common attacks directed against different types of web servers and platforms. When applicable, all references refer to the Common Vulnerabilities and Exposures (CVE), a list of standardized names for vulnerabilities and other information security exposures . The vectors corresponding to the attacks are encoded in hexadecimal.

1. `GET /ows-bin/*.bat?&\\attacker\getadmin.bat`

Batch files in the Oracle web listener for NT ows-bin directory allow remote attackers to execute commands via a malformed URL that includes “?&”.

Vector: {0, X, 1, 9, 0, 01, 1, X, 0}

Reference: CVE-2000-0169
2. `GET /servlet//..//../o.jsp`

Directory traversal vulnerability in Oracle JSP 1.0.x through 1.1.1 and Oracle 8.1.7 iAS Release 1.0.2 can allow a remote attacker to read or execute arbitrary .jsp files via a ‘..’ (dot dot) attack.

Vector: {0, 1, 2, 0, 0, 01, 0, X, X}

Reference: CVE-2001-0591
3. `GET /test.jsp?[buffer]`

Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension.

Vector: {0, 3, 1, 9, 1, 01, 1, X, X}

Reference: CVE-2000-0681
4. `GET /ConsoleHelp/login.jsp`

BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServlet.

Vector: {0, X, 2, 0, 0, 01, 0, X, X}

Reference: CVE-2000-0682
5. ```
GET / HTTP/1.0
Host: /

```

split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / (slash) in the Host: header.

Vector: {0, X, 3, 1, 0, 03, 1, X, X}

Reference: CVE-2001-0730
6. `GET [non-protected resource][special request]`

PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.

Vector: {0, X, 0, 5, 0, 01, 0, X, 0}

Reference: CVE-2001-0108
7. `GET [bufer].shtml`

Buffer overflow in the SHTML logging functionality of iPlanet Web Server 4.x allows remote attackers to execute arbitrary commands via a long filename with a .shtml extension.

Vector: {0, 3, 1, 9, 1, 01, 1, X, X}

Reference: CVE-2000-1077
8. `GET /ca/\../\../\../\file.ext`

Directory traversal vulnerability in iPlanet Certificate Management System 4.2 and Directory Server 4.12 allows remote attackers to read arbitrary files via a .. (dot dot) attack in the Agent, End Entity, or Administrator services.

Vector: {0, 1, 2, 0, 0, 01, 0, X, X}

Reference: CVE-2000-1075
9. `GET /default.ida?[Ax240]=x`

Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red .

Vector: {0, 3, 4, 7, 1, 01, 0, 1, X}

Reference: CVE-2001-0500
10. ```
GET /login.aspx?username=fred\&password=aaaaa\&mode=Enter
GET /login.aspx?username=fred\&password=aaaab\&mode=Enter
GET /login.aspx?username=fred\&password=aaaac\&mode=Enter
GET /login.aspx?username=fred\&password=aaaad\&mode=Enter

```

The absence of validation of the number of login retries allows remote attackers to try different combinations of the password several thousand times to crack the password.

Vector: {1, X, 0, 6, 0, 01, 0, 0, 0}
11. `GET /pub/product.pl?id=1; DROP TABLE Products --`

Poor input validation allows remote attackers to inject arbitrary SQL commands.

Vector: {1, 0, 3, 2, 0, 01, 0, 1, X}
12. `GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir+c:\`

IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, also known as the “Web Server Folder Traversal” vulnerability.

Vector: {0, 1, 2, 0, 0, 01, 1, X, 0}

Reference: CVE-2000-0884
13. ```
POST /pub/login.cgi
login=’+or+’’=’\&password=’+or+’’=’\&Mode=Enter

```

Poor input validation allows remote attackers to tamper with SQL sentences to authenticate successfully without having a valid user account.

Vector: {1, 0, 0, 4, 0, 01, 0, 0, 0}
14. `GET /global.asa\%3f+.htr`

IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending “%3F+.htr” to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, also known as a variant of the “File Fragment Reading via .HTR” vulnerability.

Vector: {0, X, 2, 0, 0, 01, 0, X, X}

Reference: CVE-2001-0004
15. `GET /members/_vti_cnf/`

For every directory in a web application, FrontPage extensions create a directory ‘\_vti\_cnf’ which stores a copy of all files, with the extension .base added. As a consequence, source code of these files can be viewed by a browser. This attack checks if that directory exists.

Vector: {1, 4, 2, 0, 0, 01, 8, X, X}
16. `GET /product.jsp?id=10&title=<script>alert()</script>`

The page displays as title the argument to a parameter passed in the URL. JavaScript code can be injected, opening the opportunity for a Cross Site Scripting attack. This is simply a probe, since it does not perform malicious activity.

Vector: {0, 0, 1, 8, 0, 01, , 0, X}
17. `PROPFIND /`

The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary diretories via the PROPFIND HTTP request method.

Vector: {0, X, 2, 0, 0, 40, 0, X, X}

Reference: CVE-2000-0869
18. ```
SEARCH /
long valid request

```

IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests.

Vector: {0, 3, 4, 7, 20, 0, 1, X}

Reference: CVE-2001-0151
19. `GET /dir/[../](repeated approx 1344 times)`

iPlanet Enterprise Server 4.1 allows remote attackers to cause a denial of service via a long HTTP GET request that contains many “/../” (dot dot) sequences.

Vector: {0, 3, 4, 7, 1, 01, 0, 1, X}

Reference: CVE-2001-0252
20. ```
GET /prod.asp?id=1;exec xp_cmdshell’net user bob h6q2 /add’--

```

The web application allows SQL injection. The attacker exploits this vulnerability by executing a SQL Server extended procedure which executes any command passed as argument. In this example, the attacker adds himself to the OS users.

Vector: {1, 0, 1, 3, 0, 01, 1, X, 0}

## 5 Possible applications

This taxonomy and the corresponding attack encoding vectors are useful in a number of applications, especially in intrusion detection systems and application-level firewalls.

### 5.1 Intrusion Detection Systems (IDS)

An intrusion detection system (IDS) detects and reports attempts to break into or misuse networked computer systems in real time . A traditional, nonheuristically based IDS consists of three functional components:

* A monitoring component, such as a packet capturer, which collects traffic data.
* An inference component, which analyzes the captured data to determine whether it corresponds to normal activity or malicious activity.
* An alerting component, which generates a response when an attack has been detected. This response can be passive (such as writing an entry in an event log) or active (such as changing configuration rules in the firewall to block the attacker’s IP address).

Coding web attacks into different-length vectors could aid in the postprocessing of IDS alerts, to decide on the severity of the detected attacks.

### 5.2 Application-level firewall

A major problem with IDS is that they are oblivious to SSL traffic. As a consequence, whenever a web site supports SSL encryption, all the attacker has to do in order to evade IDS detection is to submit all attack requests using an SSL channel.

Another approach to web attack detection and prevention consists of using an application-level firewall or, more specifically, web application firewalls . A traditional firewall provides protection only at the network level, with minimal or no application awareness . On the other hand, application-level firewalls are capable of processing data at the application level as well as decrypting SSL connections. An application-layer solution works within the application that it is protecting, inspecting requests as they come in from the network level. If at any point a possible attack is detected, it can take over and prevent unauthorized access and/or damage to the web server.

Encoding web attacks into different-length vectors could help the application-level firewall to decide about the action to be taken when an attack is detected.

## 6 Conclusion

In this paper, a taxonomy of web attacks is proposed that intends to represent a forward step towards a more precise reference framework. An attack life cycle is defined as its base, to make it structured and logical. The properties of the most common web attacks are described. A new semantic-dependent encoding scheme for these attacks is defined that uses different-length vectors. The most important advantage of this scheme over general purpose data compression methods is that the decompression is not needed in the applications. Real world examples of attacks against different platforms, web servers, and applications are given to illustrate how this taxonomy can be applied. Finally, possible applications are described, which might benefit from this taxonomy and encoding scheme, such as intrusion detection systems and application firewalls.


text:
# Frustration and Melting of Colloidal Molecular Crystals

## References