CME acceleration and non-thermal flare characteristics

Abstract: We investigate the relationship between the main acceleration phase of coronal mass ejections (CMEs) and the particle acceleration in the associated flares as evidenced in RHESSI non-thermal X-rays for a set of 37 impulsive flare-CME events. CME peak velocity and peak acceleration yield distinct correlations with various parameters characterizing the flare-accelerated electron spectra. The highest correlation coefficient is obtained for the relation of the CME peak velocity and the total energy in accelerated electrons (c = 0.85), supporting the idea that the acceleration of the CME and the particle acceleration in the associated flare draw their energy from a common source, probably magnetic reconnection in the current sheet behind the erupting structure. In general, the CME peak velocity shows somewhat higher correlations with the non-thermal flare parameters than the CME peak acceleration, except for the spectral index of the accelerated electron spectrum which yields a higher correlation with the CME peak acceleration (c = -0.6), indicating that the hardness of the flare-accelerated electron spectrum is tightly coupled to the impulsive acceleration process of the rising CME structure. We also obtained high correlations between the CME initiation height $h_0$ and the non-thermal flare parameters, with the highest correlation of $h_0$ to the spectral index of flare-accelerated electrons (c = 0.8). This means that CMEs erupting at low coronal heights, i.e.\ in regions of stronger magnetic fields, are accompanied with flares which are more efficient to accelerate electrons to high energies. In the majority of events (80%), the non-thermal flare emission starts after the CME acceleration (6 min), giving a current sheet length at the onset of magnetic reconnection of 21 \pm 7 Mm. The flare HXR peaks are well synchronized with the peak of the CME acceleration profile.

\section{Introduction}
Coronal mass ejections (CMEs) and solar flares reside among the most powerful and impressing manifestations of solar activity \citep[for overviews see, e.g.,][]{kahler1992,schwenn2006}. CMEs and flares may or may not occur together,
with the association rate strongly increasing for more energetic events \citep[][]{sheeley1983,yashiro2009}. The question, if and how the two phenomena are physically linked has been widely debated.
The commonly accepted model of a combined CME-flare event is the eruptive flare scenario \citep[e.g., review by][]{priest2002}. A flux rope embedded into a magnetic arcade starts to rise, causing the magnetic field lines that tie the coronal structure to the solar surface to become more and more stretched to finally form a vertical current sheet beneath the eruption. If the field lines in the current sheet start to reconnect, the sudden release of magnetic energy powers a solar flare. In addition, the newly reconnected field lines
add poloidal magnetic flux to the rising flux rope, and thus sustain the upward propelling force \citep[e.g.][]{vrsnak2008}. In this way, the energy released in magnetic reconnection is supposed to be distributed both to enhance the kinetic energy of the CME flux rope and to drive dynamic processes in the associated flare, such as the generation of shocks, outflow jets, plasma heating, and the acceleration of high-energetic particles.

Observational evidence for the coupling and correlation between the flare and the CME characteristics has been presented in several studies dealing with large event samples. Most commonly, such studies use proxies for the energetics of flares and CMEs that can be easily derived from observations, such as the GOES soft X-ray peak flux of the flare and the mean plane-of-sky speed of the CME \citep[e.g.][]{moon2002,burkepile2004,vrsnak2005,mahrous2009}. Recently, also studies of the full CME acceleration profile have been performed, reporting a close synchronization of the impulsive CME acceleration phase and the rise phase of the soft X-ray flux of the associated flare in at least 50\% of the events under study \citep{zhang2001,maricic2007,bein2012}.

Measurements of the CME acceleration are difficult, since the impulsive acceleration of the eruption often lasts only some tens of minutes \citep[e.g.][]{zhang2004,zhang2006} and takes place close to the Sun at distances $\lesssim 3$~$R_\odot$ \citep[e.g.][]{macqueen1983,stcyr1999,vrsnak2001}. This means that imaging of the low corona at high cadence is required. Recent studies have shown that high cadence EUV imagery in combination with white-light coronagraphs provide a good means in order to trace the onset and early stages of CME eruptions \citep[e.g.][]{gallagher2003,vrsnak2007,temmer2008}.
\cite{bein2011} report that in about 70\% of 96 impulsive CMEs that were studied in such combined EUV and white-light imagery, the CME peak acceleration occured at heights as low as $\lesssim$~0.5~$R_\odot$.

Important information on the primary energy release in solar flares can be obtained from hard X-ray (HXR) spectra.  Supra-thermal electrons accelerated during the impulsive energy release process precipitate toward the solar surface where they lose their energy in Coulomb collisions with the ambient plasma, heating it to several million degrees. The heated chromospheric plasma expands into the coronal part of the flare loop, where it causes enhanced soft X-ray emission. A tiny part $(\sim 10^{-5})$ of the kinetic energy in non-thermal electrons impinging on the chromosphere is radiated away as non-thermal bremsstrahlung in the HXR domain. This HXR radiation by itself is energetically not important but the spectral characteristics of the radiated bremsstrahlung provide important diagnostics on the energy distribution and the total energy in the flare-accelerated electrons, which contain a large fraction of the total energy released during a flare \cite[e.g.][]{hudson1991,dennis2003}.

Whereas many studies use observations of the thermal flare plasma, as observed in the soft X-ray domain (primarily by the GOES satellites), to characterize the flare evolution, there are only a few studies which consider the information on flare-accelerated electrons contained in HXR data in comparison with the associated CME dynamics. \citet{qiu2004} and \citet{jing2005} inferred magnetic reconnection rates from the apparent motion of chromospheric flare ribbons and found that the reconnection rate was temporally correlated with the CME/filament acceleration as well as with the flare HXR emission. \citet{temmer2008,temmer2010} presented detailed case studies of the impulsive acceleration in fast CMEs and the evolution of the HXR flux and spectral characteristics of the associated flare, finding a tight synchronization between the flare HXR peak and the CME acceleration peak. However, a study on the relation between the CME acceleration and the evolution of the associated flare energy release and particle acceleration for a larger event sample is still missing. Such study can provide insight not only into the temporal correlation but also into the scaling between characteristic parameters of the flare energy release and the CME acceleration.

In the present paper, we study a sample of 37 impulsive CME-flare pairs for which the CME acceleration phase could be measured and where
hard X-ray observations of the flare peak were available. The CMEs are observed at high spatial and temporal resolution
by the EUV imagers and white-light coronagraphs onboard the Solar Terrestrial Relations Observatory \citep[STEREO;][]{kaiser2008}. Using high resolution X-ray spectra provided by the Reuven Ramaty High Energy Solar Spectroscopic Imager \citep[RHESSI;][]{lin2002}, we study the characteristics of the accelerated electron spectra as well as the hot flaring plasma.

\section{Observations}\label{sec:observations}

For the study of the CME kinematics, acceleration and source region characteristics, we used coronal EUV and white light images provided by STEREO's Sun Earth Connection Coronal and Heliospheric Investigation suite \citep[SECCHI;][]{howard2008}. The SECCHI Extreme Ultraviolet Imager \citep[EUVI;][]{wuelser2004} observes the solar disk and off-limb corona up to a distance of 1.7~$R_\odot$ from sun center. EUVI delivers filtergrams in four passbands observing plasma at chromospheric and coronal temperatures.
We mainly used the 171~{\AA} passband (dominated by emission of Fe~\textsc{ix/x} ions, $T\sim 10^6$~K), and in some cases the 195~{\AA} passband (Fe~\textsc{xii} and Fe~\textsc{xiv} ions; $T\sim 1.5\times 10^6$~K). The nominal time cadence of the 171~{\AA} images is $2.5$~min but can be as high as $\sim75$~s for campaign data. Images taken in the 195~\AA\, passband have a nominal cadence of $10$~min, which has increased to 5~min in 2009. The evolution of the CME further away from the Sun was followed in data from the STEREO COR1 and COR2 coronagraphs \citep{thompson2003}. COR1 has a field-of-view (FOV) from 1.4 to 4 $R_{\odot}$ from Sun center, COR2 from 2.5 to 15~$R_{\odot}$. The observing cadence of the COR1 observations is mainly 5 minutes (but can be up to 20 minutes), the cadence of COR2
total brightness images is 30 minutes. The overlapping FOVs of the EUVI, COR1 and COR2 instruments enabled us to identify and connect the same CME structure in the observations by the different instruments with high cadence.

Flare observations were provided by the Reuven Ramaty High Energy Solar Spectroscopic Imager \citep[RHESSI;][]{lin2002} detecting X-ray and $\gamma$-ray emission from the Sun in the energy range 3~keV to 17~MeV. RHESSI is an indirect Fourier imager providing X-ray images at high angular resolution (as good as $\sim2.3''$) and spectroscopy at unsurpassed spectral resolution ($\sim$1~keV below 100~keV).

Since our aim is to compare the evolution of the energy release in solar flares to the characteristics of the associated CME dynamics, we searched for events for which the CME acceleration phase was well observed and the flare impulsive phase was covered by RHESSI observations. We took care not to include flares which were partially occulted by the solar limb.
In the time period January 2007 to May 2010 (i.e.\ covering the first 3.5 years of STEREO observations), we identified a sample of 37 CME-flare events, which fulfilled these requirements. The GOES flare class distribution of the events selected is GOES class M: 3, C: 16, B: 11, and $\leq$GOES A: 7 events.\footnote{We note that the STEREO mission was launched in solar minimum conditions, and thus the strongest events are missing in our sample.} Out of these, 14 events showed appreciable non-thermal hard X-ray emission. The remaining 23 events showed either weak non-thermal X-ray emission or solely thermally produced X-ray emission.

We note that in our sample we have a selection bias towards impulsive CMEs, i.e. CMEs that have a short main acceleration phase. Due to the distinct anticorrelation of the CME acceleration duration and the CME peak acceleration \citep{zhang2006,bein2011}, this implies also that the involved acceleration values are high.
The reason for this selection bias is twofold. On the one hand, we aimed to select CMEs where the main acceleration profile could be reconstructed. This tends to exclude events with gradual (i.e. long-duration, almost constant) acceleration. On the other hand, we aimed at comparing the CME acceleration curves with RHESSI observations of the main flare phase. Since RHESSI has a low-Earth orbit (with an orbital period of 96 min), the solar observations are regularly interrupted by eclipses of the satellite. This again tends to exclude gradual, long-duration events.

\section{Methods}\label{sec:methods}

\subsection{CME kinematics and acceleration}

The height-time curves of the selected CMEs were determined by obtaining the position of the leading edge in STEREO EUVI, COR1 and COR2 running difference image sequences. The raw image data were calibrated and processed to improve the visibility of the CME leading edge. First, the images were reduced with the \verb"secchi_prep.pro" routine available in the SSW (SolarSoftWare) tree, which provides for the subtraction of the CCD (Charge Coupled Device) bias, correction for variable exposure time and conversion to physical units. EUVI images were differentially rotated to a common reference time before running difference images were generated. In case of faint CMEs, a normalizing-radial-graded filter \citep[][]{morgan2006} was applied. For COR1 and COR2 observations, a pre-event image was subtracted and a sigma filter was applied to obtain higher contrasts of the transient faint CME structures. For the measurements of the CME evolution, running difference images were constructed by subtracting from each image the image recorded immediately before. If the time cadence of the data was very high or a CME moved very slowly, we rather created difference images out of frames taken further apart in time ($\sim$5--10~min for EUVI data, $\sim$10--20~min for COR1 data).

The CME kinematics were then derived by following the evolution of the detected CME leading edge along the main propagation direction, starting from the determined CME-flare source region. We developed an algorithm to automatically identify the CME leading edge based on the information that it appears as a bright front with a sharp intensity drop to regions outside the CME
\cite[for details see][]{bein2011}. This algorithm works fine for clear CME fronts but fails for faint ones, in which case we identified the leading edge by visual inspection.
We note that our CME height measurements are not corrected for projection effects. However, we predominantly selected events where the source region is located close to the solar limb, in order to minimize the influence of projection effects.  For 60\% of our events, the projected radial distance $r$ from Sun center is $\gtrsim 0.8\,R_\odot$, for 85\% of events  $r\gtrsim 0.6\,R_\odot$.

Based on the derived CME height-time curves, the velocity and acceleration profiles can be determined by the application of numerical differentiation to the height-time data. Since errors in the height-time curve are enhanced when taking the derivative, a smoothing and fitting method is used based on free-knot cubic splines. This fitting technique also allowed us to estimate errors in CME velocity and acceleration by propagating the uncertainties of the fitted spline coefficients to the first and second derivative. For details on the data processing, automated CME tracking, spline fitting and error analysis we refer to \citet{bein2011}. We note that the 37 CME-flare pairs under study are a subsample of the 95 CMEs that were studied in \citet{bein2011}. In Figure~\ref{fig1}, we show
the CME height-, velocity- and acceleration-time curves for a sample CME-flare event (2010 February 8) together with the GOES and RHESSI X-ray flux evolution of the associated flare.
Further examples are shown in Figs.~\ref{fig2} and \ref{fig3-1}.

The parameters obtained from the fitted height-time curves and their first and second derivatives are the CME peak velocity $v_\mathrm{max}$, the CME peak acceleration $a_\mathrm{max}$ and the times at which velocity and acceleration reached their maximum ($t_\mathrm{vmax}$ and $t_\mathrm{amax}$). We also determined the acceleration duration $t_\mathrm{acc}$ defined as the time interval $t_\mathrm{start} < t_\mathrm{amax} < t_\mathrm{end}$, where $t_\mathrm{start}$ and $t_\mathrm{end}$ are the times at which the CME accelerated/decelerated to $\sim10\%$ of its peak value. In addition, we derived characteristic height parameters, namely the height $h_0$ where the CME was first identified, the height $h_\mathrm{vmax}$ at which the CME velocity reached its maximum, and the height $h_\mathrm{amax}$ at which the CME acceleration reached its maximum.
The height $h_0$ of the first CME observation provides us with a rough measure of the CME initiation height and thus also with an upper limit for the size of the pre-eruptive structure \cite[cf.][]{bein2011}.

\subsection{Flare X-ray spectroscopy}

RHESSI X-ray spectra yield information on fast electrons accelerated during the flare process as well as on the thermal flare plasma. For each event, we derived a background-subtracted photon spectrum integrated over 20~s during the hard X-ray peak, i.e.\ the peak of the non-thermal emission, using all RHESSI front detectors except 2 and 7 \citep{smith2002}. In addition, we also derived spectra during the peak of the soft X-ray emission ($\sim$3--12 keV), to better characterize the thermal flare plasma.

In Figs.~\ref{fig1}--\ref{fig3-1}, we show the CME kinematics together with the X-ray flux of the associated flare for three CME-flare pairs.
A sample RHESSI spectrum observed at the HXR peak of the C6.2 class flare-CME event on 2010 February 8 is shown in Fig.~\ref{fig1a}. Using the OSPEX software \citep[Object Spectral Executive;][]{schwartz2002}, we applied a forward fit to the spectra using either a combined non-thermal thick-target bremsstrahlung model (at higher energies) and an isothermal model (at the low energy end), or solely an isothermal model. The resulting spectral parameters for the thermal fit comprise the emission measure EM and temperature $T$ of the hot flaring plasma, and for the thick-target model the number of accelerated electrons e$^-$, the electron power-law index $\delta$, and the low-energy cut-off $E_c$ of the accelerated electron spectrum. However, the number of electrons and the low-energy cutoff are intrinsically linked,
and $E_c$ cannot be determined with accuracy. Thus, as an additional parameter characterizing the strength of the non-thermal emission, we also determined for each power-law spectrum the (fitted) photon flux at 50~keV, $F_{50}$, and the power $P_{20}$ contained in 	electrons accelerated to kinetic energies $>$20~keV.
The obtained flare parameters were then correlated with the parameters characterizing the CME kinematics and dynamics (see Sect.~\ref{sec:vel_acc_profiles}).

In order to study the relative timing of the CME acceleration and the flare energy release as evidenced in the evolution of non-thermal HXR emission, we reconstructed RHESSI light curves at energies above the low-energy cut-off $E_c$ derived from the spectral fits. Based on these light curves we determined start, peak and end time as well as the duration of the non-thermal flare emission, which were then compared with the acceleration profile of the associated CME (see Sect.~\ref{sec:timing}).

\section{Results}\label{sec:results}

\subsection{Correlations of characteristic CME and flare parameters}\label{sec:vel_acc_profiles}

Figs.~\ref{fig2a} and~\ref{fig2b} show scatter plots of the CME peak velocity and CME peak acceleration, respectively, against the characteristic flare spectral parameters, namely the emission measure EM, temperature~$T$, number of accelerated electrons~e$^{-}$, power-law index~$\delta$ of the accelerated electron spectrum,
photon flux $F_{50}$ at 50~keV, and power $P_{20}$ in accelerated electrons with energies $>$20~keV. Note that the number of data points in the various scatter plots may differ from each other due to the different number of observables available for each CME-flare pair. Our sample covers many weak flares, and not all events show significant non-thermal emission. Thus, we only consider non-thermal fitting parameters for reasonably well observed power-law spectra which have an electron spectral index $\delta\lesssim 8$ (which applies to 14 events out of a total of 37 under study). In each scatter plot, we also show the regression line and the linear correlation coefficient $c$ for the respective quantities. Except one ($EM$ vs. $a_\mathrm{max}$), all the correlations in Figs.~\ref{fig2a} and~\ref{fig2b} are significant at a level of $95$\% or higher.

Both the CME velocity and the CME acceleration show distinct scalings with the X-ray spectral parameters characterizing the non-thermal energy release in the associated flare.
The correlation between the CME peak velocity $v_\mathrm{max}$ and the number of flare-accelerated electrons $e^-$ gives a linear correlation coefficient of $c = 0.73$, the relation $v_\mathrm{max}$ vs. $F50$ gives $c = 0.78$, and correlating $v_\mathrm{max}$ and $P20$ we obtain $c = 0.80$ (see Fig.~\ref{fig2b}). In Fig.~\ref{fig3}, we plot the CME peak velocity against the product of the non-thermal power in electrons, $P20$, and the duration of the non-thermal HXR emissions. The correlation coefficient of this product, which is a measure for the total kinetic energy contained in electrons accelerated during the flare impulsive phase, and the CME peak velocity is very high with $c= 0.85$. We obtain the same result when comparing $v_\mathrm{max}$ with the product of the non-thermal photon flux $F50$ and the HXR duration ($c = 0.85$). Thus, the best observed scaling is the flare non-thermal energy and the peak velocity attained in the CME, which is directly linked to its kinetic energy $E = mv^2/2$,
where $m$ is the total CME mass. The slope of the non-thermal power-law index $\delta$ is found to be inversely correlated with the CME peak velocity, $c = -0.52$, i.e.\ fast CMEs are preferentially associated with flares with harder power-law spectra. We also found a positive scaling of $v_\mathrm{max}$ with the observed duration of HXR emission, $c = 0.58$, i.e.\ CMEs which reach higher velocities tend to be associated with flares of prolonged electron acceleration.

The CME peak acceleration $a_\mathrm{max}$ (Fig.~\ref{fig2b}) reveals correlations with the non-thermal flare parameters comparable to that obtained for $v_\mathrm{max}$ (Fig.~\ref{fig2a}). However, in general the obtained correlation coefficients for $a_\mathrm{max}$ are slightly lower than that obtained for $v_\mathrm{max}$, except for the relation $a_\mathrm{max}$ vs. $\delta$ which is higher, $c = -0.61$. The correlation coefficient of CME peak acceleration $a_\mathrm{max}$ and the number of flare-accelerated electrons $e^-$ is $c= 0.52$. The non-thermal photon flux $F50$ and the electron power $P20$ show a distinct positive scaling with the CME peak acceleration $a_\mathrm{max}$ with correlation coefficients of $c = 0.77$ and $c = 0.72$, respectively. These results are indicative of a tight coupling between particle acceleration in flares and the associated CME dynamics. We can speculate that the fact that $a_\mathrm{max}$ scales somewhat better with the electron spectral index $\delta$ than $v_\mathrm{max}$ implies that the CME peak acceleration is stronger linked to the hardness of the flare-accelerated electron spectrum, and thus with the number of electrons accelerated to high energies, whereas the CME peak velocity is better related to the total number and energy in flare-accelerated electrons, which are dominated by the low-energy end of the particle distribution.

The CME peak velocity and peak acceleration also show a positive scaling with the thermal flare parameters, i.e.\ the emission measure EM and temperature $T$. However, the correlations are significantly smaller than that obtained for the non-thermal flare parameters. The CME peak velocity $v_\mathrm{max}$ and the flare emission measure EM derived at the HXR peak time are weakly correlated with $c = 0.32$, whereas EM and $a_\mathrm{max}$ are basically uncorrelated ($c = 0.08$). A better scaling is observed for the flare temperature $T$ and CME velocity and acceleration with a correlation coefficient of $c = 0.48$ for $v_\mathrm{max}$ vs.\ $T$ and $c= 0.45$ for $a_\mathrm{max}$ vs. $T$. However, the emission measure and temperature derived at the peak of the flare SXR emission are most probably a better indicator of the maximum thermal energy reached in the flare. Indeed, RHESSI EM and $T$ derived at the flare SXR peak show a somewhat better correlation with the CME $v_\mathrm{max}$ and $a_\mathrm{max}$, with the highest correlation coefficient of $c\approx 0.5$ for the relation $v_\mathrm{max}$ vs.\ $T$. In addition, considering the GOES 1--8~{\AA} soft X-ray peak flux as an additional indicator for the thermal energy content of the flares, we find that $v_\mathrm{max}$ correlates better with the GOES peak flux ($c= 0.62$) than with the RHESSI $T$ and EM. For the relation between CME acceleration $a_\mathrm{max}$ and the GOES peak flux, the correlation coefficient is smaller, $c= 0.41$.

We also obtained high correlations between the height $h_0$ above the solar surface at which a CME was observed for the first time, which can be interpreted as a measure of the initiation height of the pre-eruptive structure, and the non-thermal flare parameters (see Fig.~\ref{fig4}). The CME initiation height $h_0$ shows a high positive correlation with the spectral index $\delta$ of flare-accelerated electrons ($c= 0.77$) and a high inverse correlation with the non-thermal X-ray flux $F50$ ($c = -0.72$). This means that CMEs erupting at low coronal heights, i.e.\ in regions of stronger magnetic fields, are associated with flares in which a larger number of electrons is accelerated to high energies.

The other CME height parameters we measured, $h_\mathrm{vmax}$ and $h_\mathrm{amax}$, i.e.\ the heights at which the CME velocity and CME acceleration reached their maximum, respectively, showed only weak or no correlations at all with the derived flare parameters. The highest correlation coefficient was obtained for the relation $h_\mathrm{vmax}$ and HXR duration $t_\mathrm{HXR}$ ($c= 0.47$), i.e.\ long duration events reach their peak velocity further out in the corona. We also compared the CME acceleration duration $t_\mathrm{acc}$ with the RHESSI spectral fit parameters, revealing no distinct relation except a weak correlation between $t_\mathrm{acc}$ and $\delta$ with $c= 0.41$. Consequently, CMEs with longer acceleration duration (and thus preferentially smaller peak acceleration, see \cite{bein2011}) show some tendency to be accompanied by flares with softer HXR spectra.

\subsection{Relative Timing of CME dynamics and Flare Energy Release}\label{sec:timing}

The first and second derivatives of the obtained CME height-time curves provided us with the times where the CME reached its maximum velocity and its maximum acceleration, as well as with the start and end time of the main CME acceleration phase. For each event, we derived the time difference of the start of the CME acceleration and the start of the non-thermal HXR emission of the associated flare as well as the time difference between the peak of the CME acceleration and the peak of the non-thermal HXR flare emissions, which marks the instant of the strongest particle acceleration.

In Fig.~\ref{fig7}, we show the distribution of the time lags obtained between the start of the flare HXR emission and the start of the CME acceleration.
We find that in 83\% of the events the CME acceleration starts {\it before} the flare HXR emission. The distribution gives a mean of $+6.0\pm 9.0$~min and a median of $+6.0\pm 6.5$ min.

Fig.~\ref{fig8} shows the distribution of the time difference between the peak of the flare HXR emission and the peak of the CME acceleration. We find that the maximum CME acceleration $a_\mathrm{max}$ occurs well synchronized with the flare HXR peaks. The arithmetic mean of the time lag distribution gives  $-1.1\pm 5.7$~min, the median $-1.4 \pm 2.2$~min.
In all but one case the time lags lie within in an interval of $[-10,+10]$~min. In $\sim$75\% of the CME-flare events under study, the flare HXR peak and the CME acceleration peak occur within 5~min of each other -- a time range, which corresponds to the typical uncertainties in the obtained CME acceleration peak times (cf.\ the shaded areas in Figs.~\ref{fig1}--\ref{fig3-1}).
For comparison, the mean CME acceleration duration in the events under study is about 25~min.

In Fig.~\ref{fig9}, we plot the distribution of the time lags between the peak of the flare HXR emission and the time when the CME reached its maximum velocity.
We find that the CME velocities always reach their maximum {\it after} the HXR peak. The derived time difference $\Delta t$ lies in the range 2--117~min, with the
median of the distribution at $-16.3\pm 8.5$~min.

\section{Discussion and Conclusions}\label{sec:discussion}

We investigated the physical relation between coronal mass ejections and their associated flares using several approaches. On the one hand, we determined the correlation and scaling of various parameters characterizing the CME acceleration with the flare's X-ray spectral parameters, which yield information on accelerated electrons as well as on the state of the thermal flare plasma. On the other hand, we studied the temporal relation between the CME acceleration and the flare energy release as evidenced in the non-thermal HXR radiation.

Our results reveal a tight coupling between both phenomena. The CME peak velocity and peak acceleration yield distinct scalings with the flare parameters characterizing the accelerated electron spectra, in terms of the total number $e^-$ of accelerated electrons, the power in electrons $P20$, the HXR flux $F50$ at 50 keV, and the spectral index~$\delta$ of the electron spectra, with correlation coefficients in the range of 0.5 to 0.8 (all significant at least on the 95\% level). This means that CMEs with higher peak velocity and higher peak acceleration are accompanied by flares in which more electrons are accelerated, and in which a larger fraction of electrons is accelerated to higher energies (as it is revealed by the harder X-ray power-law spectra). The highest correlation coefficient in this study ($c = 0.85$) was obtained for the relation of the CME peak velocity $v_\mathrm{max}$,
which (together with its mass) determines the kinetic energy of the CME, and the product of the power in electrons above 20~keV and the duration of the  HXR emission, $P20\cdot t_\mathrm{HXR}$, which is a measure of the total energy in flare-accelerated electrons. These findings strongly support the general idea that the acceleration of the CME and the particle acceleration in the associated flare draw their energy from a common source, probably magnetic reconnection occurring in the current sheet behind the erupting structure.

In general, the CME peak velocity is somewhat better correlated with the non-thermal flare parameters than the CME peak acceleration. However, there is one exception: the hardness of the accelerated electron spectrum yields a better correlation with the CME peak acceleration ($cc \approx -0.6$) than with the CME peak velocity ($cc \approx -0.5$), indicating that the hardness of the accelerated electron spectrum injected into the flare loops is intimately coupled to the impulsive acceleration process of the rising CME structure.

We also found a distinct correlation of the CME initiation height $h_0$ and the spectral index $\delta$ of the flare-accelerated electrons ($c\approx 0.8$), as well as a distinct anti-correlation between $h_0$ and the non-thermal photon flux $F50$ ($c \approx -0.7$). We note that statistical studies of the CME main acceleration found an anticorrelation between the CME peak acceleration and the size and/or height of the pre-eruptive structure, with correlation coefficients of about $c \approx -0.5$ \citep{vrsnak2007,bein2011}. This  anticorrelation has been interpreted in terms of the Lorentz force driving the CME eruption and the variation of the coronal magnetic field strength with height: CMEs originating at low coronal heights, i.e. regions of stronger magnetic fields, have larger Lorentz forces available and can thus reach larger acceleration values than CMEs originating from high in the corona  where the magnetic field is smaller due to the (exponentially) decaying gas pressure and the related expansion of the magnetic field lines.

Thus, the correlation between the hardness~$\delta$ of the flare electron spectrum and the CME initiation height~$h_0$ might be a secondary effect caused by the anticorrelation between the CME peak acceleration $a_{\rm max}$ and its initiation height~$h_0$. However, the correlation between flare $\delta$ and CME $h_0$ ($c \approx 0.8$) is significantly higher than that between
CME $a_{\rm max}$ and CME $h_0$ \cite[$|c| \approx 0.5$;][]{bein2011}. We also stress that the initiation height $h_0$ is the CME parameter that gives the highest correlation coefficient with the hardness $\delta$ of the accelerated flare electron spectrum. These findings suggest that the height~$h_0$ of the pre-eruptive structure is a decisive parameter for the efficiency of the associated flare to accelerate electrons to high energies.

The correlation coefficients obtained between the thermal flare parameters  and the CME peak velocity and peak acceleration are significantly smaller ($c\lesssim 0.5$) than those obtained for the non-thermal parameters. The fact, that both EM and $T$ show lower correlations with the CME $v_\mathrm{max}$ and $a_\mathrm{max}$ can be interpreted as an effect of the thermal flare plasma being only a secondary product within the flare process. The hot coronal flare plasma is generally assumed to be created by chromospheric heating and evaporation induced by the flare-accelerated electrons \citep[e.g.][]{neupert1968,brown1973,veronig2005}, which are a primary product of the flare energy release process.

Several previous studies revealed a distinct relation between the CME mean velocities and the associated flares' soft X-ray peak flux measured by GOES, which characterizes the thermal energy content of flares \citep{moon2002,burkepile2004}. We note that these studies incorporated flare-CME events over a larger spread in flare importance by incorporating also X-class events. A sample of $55$ CME-flare pairs in the study of \citet{moon2002} suggest a correlation coefficient of $c\approx 0.5$ for the relation between the time integrated GOES SXR flux and the CME velocity.
\citet{burkepile2004} estimated the kinetic energy of CMEs originating from close to the solar limb and found a
higher correlation with the flare soft X-ray peak flux ($c = 0.74$).
For our event sample, the correlation coefficient for $v_\mathrm{max}$ vs.\ GOES peak flux is somewhere in the middle with $c\approx 0.6$.
We can summarize that the results obtained in the present paper for the thermal flare plasma are qualitatively in line with previous studies, and that our findings suggest that the CME peak acceleration and velocity are stronger coupled to the particle acceleration in the associated flares than to the maximum thermal energy content of the flare plasma.

The comparison of flare HXR flux evolution and the acceleration profile of the CME main acceleration shows that in $\sim 80\%$ of the events under study, the non-thermal flare emission starts {\it after} the CME acceleration, on average delayed by $\approx 6$~min.
This finding agrees with investigations of the flare SXR emission in relation to CME acceleration by \cite{maricic2007} and \cite{bein2012} who also found that for the majority of the events, the CME acceleration starts before the flare SXR emission. Such delay of the flare start with respect to the start of the main CME acceleration is well in line with the standard flare model, where the rising flux rope stretches the field lines underneath. At a certain instant, in the current sheet behind the erupting structure magnetic reconnection will set in \cite[e.g. due to tearing instability, when the height-to-width ratio exceeds a certain threshold;][]{furth1963}, causing the main flare energy release and acceleration of high-energy particles.

Under these standard flare-CME model assumptions, we can estimate the length of the current sheet at the onset of magnetic reconnection.
For 14 flare-CME pairs in our sample, it was possible to derive the current sheet length from the CME height at the onset time of the  non-thermal HXR emission (i.e.\ particle acceleration) minus the initial height of the pre-eruptive structure; the distribution is plotted in Figure~\ref{fig10}. The median of the distribution indicates a current sheet length at the onset of magnetic reconnection of $0.03 \pm 0.01 R_{\odot}$, i.e. $21 \pm 7$~Mm in the events under study.

The flare HXR peaks occur well synchronized with the peak of the CME acceleration profile. In 75\% of the cases they occur within $\pm5$~min, i.e. within the typical uncertainties in the determination of the CME accleration peak time. This means that at the time of the highest CME accleration also the rate of particle acceleration is highest. This finding agrees with the case studies by \citet{temmer2008,temmer2010} who also found a close synchronization of the flare HXR peak and the CME acceleration peak in  well observed limb events as well as fast halo CMEs. Other studies used the derivative of the flare SXR light curves to approximate the time evolution of the flare energy release, based on the Neupert effect \cite[e.g.][]{dennis1993,veronig2002}. For example, \citet{zhang2004} reported a close synchronization of the peak of the SXR flux derivative and the time of maximum acceleration in two long-duration CME-flare events. Statistically, 50--75\% of the events reveal a high degree of synchronization of the growth rate of SXR emission and CME acceleration, whereas about 25\% show strong deviations between the timing of the CME peak acceleration and the flare impulsive phase \citep{maricic2007,bein2012}.

To date, there exist no simulations of coupled CME-flare eruptions which directly incorporate particle acceleration mechanisms to
theoretically investigate the coupling of the CME dynamics and properties of accelerated flare particles.
\citet{reeves2006} and \citet{reeves2010} performed MHD simulations of a flux rope eruption that leads to the formation of a large-scale current sheet and a multi-threaded flare beneath the CME, for which they calculated the thermal energy release and the expected rate of the flare SXR emission. They found that in cases where the background magnetic field and/or the magnetic reconnection rate is high, the CME acceleration and the associated thermal flare energy release are synchronized. Slow reconnection rates cause the CME acceleration to peak earlier, whereas for fast reconnection rates the acceleration peak shifted to later times in the eruption. The set of events we studied in this paper includes predominantly impulsive CMEs, characterized by high acceleration rates over a short acceleration duration.
This selection, compared to the simulation results by \citet{reeves2010}, may explain why in our sample basically all events show a high synchronization of the peaks of the CME acceleration and the non-thermal flare emission.

\acknowledgments
This activity has been supported by the European Community Framework Programme~7, High Energy Solar Physics Data in Europe (HESPE), grant agreement no.: 263086, the Austrian Space Applications Programme (ASAP-6 project \#819664 SOLDYN), and the Austrian Science Fund
(FWF): V195-N16.

\bibliographystyle{apj}

Solar and Stellar Astrophysics (astro-ph.SR)


The Flavours of the Quark-Gluon Plasma

Abstract: Quarks of other flavours than up and down, i.e. $s$, $c$, and $b$ quarks, have been long recognized as effective probes of the structure of hot QCD matter. In this talk, I review some of the motivations for their investigation and discuss the salient results obtained so far, with a focus on the results from the Relativistic Heavy Ion Collider (RHIC). Some ideas for future studies are also mentioned.

\section{The QGP is a ``Strange'' State of Matter}

The strange quark, with  mass $m_s \approx 104\pm 30$ MeV \cite{Amsler:2008zz} comparable to the confinement scale of QCD, influences the QCD phase diagram (see Fig.~\ref{fig:1}) in many subtle, but important ways:

\begin{itemize}
\setlength{\itemsep}{0pt}
\item Lattice simulations have shown that the location of the QCD critical point is extremely sensitive to the value of the strange quark mass $m_s$.
\item By enabling the 'tHooft coupling in the effective chiral Lagrangian, strange quarks may be responsible for the existence of a second critical point on the phase boundary between hadronic and quark matter \cite{Hatsuda:2006ps} in the high-baryon density, low-temperature region.
\item The structure of neutron stars, especially the possibility of a quark matter core, is strongly dependent on $m_s$.
\item The structure of the colour superconducting phase of quark matter is critically sensitive to the value of $m_s$; the colour-flavour locked phase \cite{Alford:1998mk}, in particular, could not exist without strangeness.
\end{itemize}

\begin{figure}[hbt]
\centerline{\includegraphics[width=0.7\textwidth]{phasediag.pdf}}
\caption{Schematic phase diagram of QCD with two possible critical end-points of the first-order transition line separating the hadronic matter from quark matter.}
\label{fig:1}
\end{figure}

It thus comes as no surprise that strange quarks -- as well as the heavier flavours, charm and beauty -- are effective probes of hadronic matter. Two aspects are most important in this respect:
\begin{itemize}
\setlength{\itemsep}{0pt}
\item Strange quarks are not easily produced below the critical temperature $T_c$; they thus serve as indicators of quark deconfinement. Charm and bottom quarks are hard to produce thermally at any temperature accessible in laboratory experiments.
\item Quark flavour is conserved under the strong interactions, implying that $s$, $c$, and $b$ quarks most likely survive up to the final state once they have been produced in a reaction.
\end{itemize}
Charm and bottom are also {\em hard probes}, i.e.\ their production can be reliably calculated with methods of perturbative QCD, making them potentially valuable probes for final-state interactions.

The experimental investigation of the structure and properties of hot QCD matter, as it is produced in relativistic heavy ion collisions, requires a theoretical understanding of how experimental observables are related the physical properties of the matter from which they originate. Of particular interest are observables that have a direct connection to those properties which distinguish a quark-gluon plasma from ordinary nuclear or hadronic matter: the deconfinement of quarks and the partial restoration of chiral symmetry. Quark deconfinement at high temperature is closely linked to the phenomenon of colour screening: In the presence of thermally excited gluons and quarks, the colour flux-tube which binds quarks together in the vacuum never forms. A genuine order parameter for (de-)confinement only exists in a world without light quarks, when a vanishing fundamental SU(3) Polyakov loop indicates the absence of free quarks. On the other hand, a genuine order parameter for chiral symmetry restoration, the scalar quark condensate, only exists in a world with massless quarks. At physical quark masses, both quantities make a smooth, but steep transition across the same temperature region between $0.9\,T_c$ and $1.1\,T_c$.

\section{Quark Liberation and Strangeness Enhancement}

The chemical equilibration of strangeness in the abundances of hadrons produced in a nuclear reaction requires three conditions to be satisfied:
\begin{enumerate}
\item the liberation and thermal equilibration of gluonic degrees of freedom;
\item the reduction in the effective strange quark mass due to the partial restoration of chiral symmetry; and
\item the local deconfinement of quarks causing an increase of the flavour equilibration volume beyond typical hadronic scales.
\end{enumerate}
In a seminal article \cite{Rafelski:1982ii} published in 1982, J.~Rafelski pointed out that in a baryon-rich scenario ``we almost always have more $\bar{s}$ than $\bar{u}$ or $\bar{d}$ quarks.  When quark matter reassembles into hadrons, some of the numerous $\bar{s}$ quarks may, instead of being bound into kaons, form multiply strange antibaryons, such as $\overline{\Lambda}, \overline{\Xi}, \overline{\Omega}$.'' This prediction rested on the assumption that strange quarks are produced in chemical equilibrium with $u$ and $d$ quarks, when quark matter is formed. The question whether this would be so was answered in another article \cite{Rafelski:1982pu}, coauthored by Rafelski and myself, in which we showed that reactions among thermal gluons are the essential mechanism by which strange quark phase space can be equilibrated during the lifetime of the fireball created in a nuclear collision at relativistic energies. This work, followed by a systematic study of the manifestations of strange quark equilibration in hadron yields \cite{Koch:1986ud}, laid the foundation for major experimental programs at the BNL-AGS, CERN-SPS, and now at RHIC. It also has been one of the foundations of the {\em Strangeness in Quark Matter} conference series.

\begin{figure}[hbt]
\centerline{\includegraphics[width=0.8\textwidth]{strangebaryons.pdf}}
 \caption{Centrality dependence of the strange antibaryon enhancement observed in Au+Au at RHIC (from \cite{Takahashi:2008yt}). }
 \label{fig:2}
\end{figure}

The original predictions \cite{Koch:1986ud} made over 20 years ago have been verified to a remarkable extent. Already at the SPS, the strangeness content of the emitted baryons has been found to increase dramatically with the size of the produced fireball, culminating in an enhancement of the $Omega$ and $\overline{\Omega}$ yield in Pb+Pb collisions by a factor of about 20 \cite{Antinori:2006ij}. The same effect is obesrved at RHIC (see Fig.~\ref{fig:2}), although the enhancement is not quite as strong (only up to a factor 10 for $\Omega(\overline{\Omega})$ in central Au+Au collisions, due to the higher p+p baseline) \cite{Estienne:2004di}. The fraction of strange hadrons grows with increasing beam energy, culminating in perfect equilibration among all light flavours ($u$, $d$, and $s$) in collisions of Au nuclei at the highest RHIC energies
\cite{Speltz:2005qy,Takahashi:2008yt}. The transverse momentum spectra of multi-strange baryons are found to exhibit a steeper slope than expected by virtue of their large masses, indicating little flow effect and suggesting an early freeze-out of the multi-strange baryons from the fireball. The equilibration of strangeness is showing all the signs indicative of abundant production of strange quarks via excitation of gluonic degrees of freedom in hot QCD matter, in combination with the deconfinement of quarks beyond hadronic distance scales.

In order to investigate the role of deconfinement on the strange quark production rate, it is useful to calculate strange quark pair production in the three-flavour PNJL model \cite{Fu:2007xc,Ciminale:2007sr}. The PNJL model provides an effective model of QCD near the critical temperature by treating the dynamics of the Polyakov loop (controlling quark confinement) and the chiral quark condensate (controlling chiral symmetry breaking) on an equal footing \cite{Fukushima:2003fw}. While the PNJL model has been mostly applied only to the quark sector, it can also be used to describe the suppression of gluons in the vicinity of $T_c$. Neglecting interactions apart from the Polyakov loop, the spectrum of thermally excited gluons can be written as
\begin{equation}
f_g(k) = \frac{1}{8} \sum_{n=1}^\infty \langle {\rm tr}\, L_A^n \rangle e^{-n|k|/T}
\quad \stackrel{\langle L_A\rangle \to 1}{\longrightarrow} \quad
\left( e^{|k|/T} - 1\right)^{-1} .
\end{equation}
The expectation value of the adjoint Polyakov loop, $\langle L_A\rangle$, falls faster with decreasing temperature than the expectation of the fundamental Polyakov loop, which controls the suppression of the quark spectrum. In fact, the two expectation values scale exponentially with the eigenvalues of the Casimir operator \cite{Gupta:2007ax}:
\begin{equation}
\langle {\rm tr}\, L_A \rangle \approx \langle {\rm tr}\, L_F \rangle^{C_A/C_F} = \langle {\rm tr}\, L_F \rangle^{9/4} .
\end{equation}
A graduate student at Duke, Hung-Ming Tsai, has calculated the Polyakov-loop modified quark and gluon spectra and used them to obtain the of thermal rates of strange quark production in the quark-gluon plasma \cite{Tsai:2008je}, which include the effects of the onset of confinement and chiral symmetry breaking in the vicinity of $T_c$. His results, shown in Fig.~\ref{fig:3}, confirm the expectation that the gluonic reaction $gg\to s\bar{s}$ rapidly shuts off as the temperature of the quark-gluon plasma approaches $T_c$ from above. The gluonic rate is found to fall below the light quark rate at $T\approx 230$ MeV. Both rates are significantly smaller than expected in na\"ive perturbation theory. A rough estimate suggests that strangeness equilibration requires initial conditions in the range $T > 300$ MeV. It would be interesting to study the impact of such a scenario in a complete simulation of bulk evolution, e.g.\ multi-fluid hydrodynamics.

\begin{figure}[tb]
\centerline{\includegraphics[width=0.7\textwidth]{strangerate.pdf}}
 \caption{Temperature dependence of the thermal rates of strange quark-pair production with (green) and without (black) Polyakov loop (from \cite{Tsai:2008je}).}
 \label{fig:3}
\end{figure}

\section{Beyond Equilibrium}

The quality of the data from RHIC on yields and spectra of identified hadrons, including resonances, has reached the point where it makes sense to ask questions going beyond the assumption of a stationary equilibrium at freeze-out. This may be our best route to learning more about the hadronization process itself. For example, we may ask: What is the interplay between the dynamical process of hadronization and the inevitable chemical reactions among hadrons in the final state?

It is well known that particle number changing reactions incrementally cease as the hadron gas expands and cools, forcing the quark fugacities $\gamma_s$ and $\gamma_q$ to become larger than unity, even if $\gamma_s = \gamma_q =1$ at the moment of hadronization.  The assumption of chemical equilibrium inherent in one-fluid hydrodynamics underpredicts protons and antiprotons by factor of three at the kinetic freeze-out temperature $T_f^{(kin)}  \approx 100$ MeV. An round-about way of treating this dynamics is to use an off-equilibrium equation of state for the expanding hadron gas \cite{Hirano:2002ds}. A better approach to the problem is to treat the hadronic gas microscopically in the framework of Boltzmann transport, which allows one to propagate any initial phase-space distribution of hadrons created at hadronization up to the kinetic freeze-out \cite{Hirano:2005wx,Nonaka:2006yn}.

Well tested theoretical tools (the UrQMD or JAM cascades) exist to study the implications for final-state flavour observables of any conceivable hadronization scenario.  Systematic comparisons of different hadronization scenarios with the SPS and RHIC (and soon, LHC) data would be interesting, because it could tell us what the data actually tell us about the hadronization mechanism.

One of the surprising findings of the early RHIC experiments was an unexpected enhancement in the yield of baryons, in comparison with mesons, at transverse momenta in the few GeV/c range. We now understand that this puzzle, as well as some other unexplained experimental observations, can be resolved by the hypothesis that hadrons in an intermediate momentum range are preferentially produced by the recombination of quarks from a thermal quark-gluon plasma \cite{Fries:2003vb,Fries:2003kq,Greco:2003xt,Greco:2003mm,Hwa:2004ng}. The most remarkable prediction of this coalescence mechanism is that the collective flow anisotropy (the elliptic flow $v_2$) in semi-peripheral collisions should satisfy a {\em scaling law}, which relates the elliptic flow of a hadron to the collective flow of quarks via the number of valence quarks of the hadron. The scaling law has been experimentally shown to hold for all measured hadrons, including multi-strange hadrons. What is surprising is that the scaling law appears to hold even in the kinematic region of small transverse energies, where there is no good theoretical justification for it --- unless, that is, the quark-gluon plasma breaks up quite suddenly, with few final-state interactions occurring among the partons.

One mechanism that could lead to such a sudden break-up is a large spike in the bulk viscosity of hot QCD matter right at $T_c$. Lattice simulations \cite{Meyer:2007dy} as well as general considerations \cite{Karsch:2007jc} suggest the presence of such a spike associated with the strong violation of conformal invariance of QCD in the transition domain. A large bulk viscosity $\zeta$ can induce thermodynamic instabilities \cite{Fries:2008ts} (if the effective pressure $P_{\rm eff}=P-\zeta\nabla\cdot v$ becomes negative) or hydrodynamic instabilities, if the solution becomes unstable against density fluctuations \cite{Torrieri:2008ip}. Such scenarios, which so far have only been investigated in the framework of the Bjorken model of linear, boost-invariant expansion of the fireball, clearly need further examination.

\section{Probing Beyond the Hadronic Horizon}

Hadrons containing solely strange quarks (at the valence quark level), such as the $\Omega$ and $\phi$, or heavy quarks, such as charmonium, allow us to probe beyond the hadronization hypersurface. The STAR collaboration has studied the emission of $\Omega$-hyperons and $\phi$-mesons from Au+Au collisions in remarkable detail \cite{Abelev:2007rw}. The analysis shows that the $\phi$ behaves like a meson with respect to the valence quark scaling law for the elliptic flow predicted by quark recombination, and the $\Omega/\phi$ ratio as a function of transverse momentum follows nicely the recombination model predictions \cite{Hwa:2004ir}. The RHIC data also suggest that the collective transverse flow velocity of multi-strange hadrons is lower than that of hadrons composed of up and down quarks, indicative of an early decoupling of those particles after hadronization. Multi-strange hadrons ($\phi, \Xi, \Omega$) may thus be utilized as probes of the kinetic and kinematic characteristics of the hot matter at the moment of its conversion to hadrons.

Charm and bottom quarks have masses that are sufficiently large so that their production is essentially independent of the medium. Their final-state transport and hadronization, on the other hand is strongly affected by the medium. Evidence for the influence of the medium are the suppression factor $R_{AA}$ and elliptic flow $v_2$ of non-photonic electrons observed at RHIC \cite{Adler:2005xv,Abelev:2006db,Sakai:2007zzb}. Bound states of two heavy quarks dissolve into the medium due to colour screening and thermal ionization above $T_c$ \cite{Matsui:1986dk} --- and then form by recombination when the temperature drops below $T_c$  \cite{Thews:2000rj,Andronic:2003zv}.

A comprehensive framework for the description of the interactions of heavy quarks in a QCD medium can be formulated in heavy-quark effective theory \cite{Brambilla:2008cx}. If the colour force is screened at sufficiently short distance, the bound states of a heavy quark-antiquark pair, which exist in the vacuum, may be dissolved.  The quantitative question of the precise location of the dissociation point has been widely investigated using lattice or effective potential techniques, with varying conclusions \cite{Asakawa:2003re,Datta:2003ww,Mocsy:2007yj,Mocsy:2007jz}. Only recently has the full power of hard-thermal loop effective theory been applied to study this problem in the high-temperature limit \cite{Burnier:2007qm}. Since at least for the charmonium states the dissociation points lie close to $T_c$, where HTL effective theory is unreliable, it would be useful to extend the formulation to include nonperturbative properties of the medium, such as temperature dependent gluon condensates \cite{Morita:2007hv}. On the experimental side, the low-transverse mass spectrum of $J/\psi$ measured in Au+Au collisions at $\sqrt{s_{\rm NN}} = 200$ GeV is very close to that measured for the $\Omega$ hyperon and, again like the $\Omega$, has a significantly higher slope parameter than that measured at the lower SPS energies \cite{NuXu:Erice08}. If this is not a coincidence, it suggests that most low-$p_T$ charmonia are formed from thermalized charm quarks at or near $T_c$. The increase from SPS to top RHIC energy would then simply signal the increased transverse flow generated during the deconfined phase at RHIC. The formation of $J/\psi$ by statistical recombination of perturbatively produced, but later thermalized charm quarks also provides the most convincing explanation of the curious rapidity dependence of the nuclear suppression factor observed in Au+Au collisions at RHIC \cite{Andronic:2008gm}.

\section{Summary and Outlook}

Strange, charm, and bottom quarks are powerful probes of the properties of the hot QCD matter formed in relativistic heavy ion collisions. The existing data from RHIC can be best explained by the hypothesis that strange and charm quarks are deconfined during the early phase of the reaction, and that most multi-strange hadrons and many heavy quark bound states form near the hadronization boundary, suffering only rare interactions after production.

The future on the experimental side appears bright, by virtue of the ongoing upgrades of the STAR and PHENIX detectors at RHIC, combined with the RHIC luminosity upgrade, and the startup of the LHC heavy ion program. On the theoretical side, it will be important to identify the model independent medium properties which can be determined with the help of quark flavour probes (susceptibilities, chemical relaxation times, diffusion coefficients, correlation/screening lengths, etc.) and develop robust observables which can be measured with precision.

{\em Acknowledgements:} This work was supported in part by a grant from the U.S.\ Department of Energy (DE-FG02-05ER41367).
\medskip

\input{SQMopening_BM.bbl}

\end{document}

The Flavours of the Quark-Gluon Plasma


Process Mining Analysis of Puzzle-Based Cybersecurity Training

Abstract: The hands-on cybersecurity training quality is crucial to mitigate cyber threats and attacks effectively. However, practical cybersecurity training is strongly process-oriented, making the post-training analysis very difficult. This paper presents process-mining methods applied to the learning analytics workflow. We introduce a unified approach to reconstruct behavioral graphs from sparse event logs of cyber ranges. Furthermore, we discuss significant data features that affect their practical usability for educational process mining. Based on that, methods of dealing with the complexity of process graphs are presented, taking advantage of the puzzle-based gamification of in-class training sessions.

\section{Introduction}
\label{s:introduction}

As cybersecurity skills require higher-order thinking, the best way to develop and ameliorate these abilities is through hands-on training~\cite{mcmurtrey2008,hatzivasilis2020}.

In many learning areas, hands-on training produces a tangible output, e.g., a code that can be checked, analyzed, and evaluated. However, this is not the case of cybersecurity, where learning goals consist of process-oriented tasks related to attack or defense skills, e.g., scanning the network for vulnerable servers or protecting the server by a firewall. Modern cyber ranges, in which practical cybersecurity training is often organized~\cite{Knupfer2020,ukwandu2020,yamin2020,chouliaras2021}, provide only limited data about these tasks in the form of event logs, which makes it hard to answer questions like ``Where did the trainees get in trouble and why?'' without deep insight into their behavior.

Process mining (PM) methods have great potential in answering analytical questions in process-oriented application domains~\cite{PMbook}. Our goal is to utilize them for cybersecurity training analysis.
However, the quality and practical usability of models produced by existing PM algorithms are influenced by many factors, as schematically depicted in Figure~\ref{fig:teaser}. This paper addresses open questions that affect the usability of existing PM techniques for scalable post-training analysis of hands-on cybersecurity exercises, aiming to provide guidelines for their usage. Specifically, we formulated the following research questions.

\textbf{RQ1: Data Abstraction -- how to convert cyber training data to the format suitable for process mining?} The PM workflow is used to find a descriptive model of the process. The idea lies in transferring event logs captured during training sessions into behavioral graphs that would provide better cognitive features for understanding users' behavior than the raw data. As the data collected from hands-on training environments are highly variable, the suitable mapping to the input of PM algorithms is unclear. Our goal is to propose a unified data abstraction that can serve as a generic approach to data preprocessing in different cyber ranges with various data sources.

\textbf{RQ2: Process Discovery -- what are the key obstacles in the process discovery phase and how to overcome them?} Having the data in the format suitable for process discovery algorithms does not guarantee that generated process models are reasonable. Many input data characteristics affect the process discovery and its practical usability for educational process mining. We aim to identify key features of cyber training data and discuss the limits and obstacles of the process discovery phase.

\textbf{RQ3: Exploratory Analysis -- how to deal with the complexity of process graphs during analysis?} Even a relevant process graph obtained by process discovery can become too big and complex for practical learning analytics. Their cognitive features can decrease and become similar to searching for answers in the raw data. Therefore, we research exploratory tactics that can help to tackle the graph complexity problem. We combine specific features of the cybersecurity training data with well-established visual analysis approaches to discuss and demonstrate their usability for interactive learning analytics.

In this paper, we restrict ourselves to the in-class (i.e., supervised) \emph{Capture The Flag} (CTF) cybersecurity games~\cite{werther2011,vigna2014,davis2014,svabensky2018,oslejsek2019}. They follow puzzle-based gamification principles, where puzzles are used as a metaphor for getting students to think about how to frame and solve unstructured problems~\cite{michalewicz2008}. This training type is very popular in the education of beginners, e.g., students of cybersecurity courses.

\section{Related Work}

The idea of using process mining methods for learning analytics is not new. The term educational process mining (EPM) is often used for the application of PM to raw educational data~\cite{romero2016}. Bogarin et al.~\cite{RWBogarin2018education} provide a comprehensive overview of EPM techniques and challenges. We use their classification of event log challenges to clarify features of cybersecurity CTF games and then to address key hurdles, especially the data complexity.

PM has already been applied in numerous specific educational situations. Macak et al.~\cite{macak2021using} used process mining to understand student coding-behavior patterns from the Git log of their projects. Mukala et al.~\cite{rwMukala} use process mining to obtain and analyze students' learning habits from Coursera. It is also used to detect students' learning difficulties by Bannert et al.~\cite{rwBannert}. Multiple other approaches use process mining to gain a better understanding of the educational process from Moodle logs~\cite{rwBogar,romero2016}. Our work shares some ideas and principles with these approaches. Still, it addresses a different application domain --- puzzle-based cybersecurity training, aiming to utilize the specific data properties to deal with process mining challenges.

Some papers also directly address the utilization of process mining for the analysis of hands-on cybersecurity exercises~\cite{weiss2016,weiss2017,andreolini2020,svabensky2021}. These approaches demonstrate that directed graphs carefully constructed from command history can provide useful information about trainees' behavior. The graphs are built on restricted data samples to deal with the complexity --- only commands identified as significant are selected. Our research is more generic, covering a wider variety of training events and enabling to extent process modeling with new data types. Another difference is in the conceptual approach. The previous approaches are based on conformance checking, i.e., monitoring and checking whether the real execution of the process corresponds to the reference process model. Our solution focuses on exploratory learning analytics based on general process discovery methods where no process model of expected behavior is assumed.

Mirkovic et al.~\cite{mirkovic2020} use terminal histories and exercise milestones to enable automated assessment of hands-on cybersecurity training.
In contrast, our work aims to introduce a human into the analytical loop~\cite{oslejsek2018} when process models are reconstructed from logs automatically but then interactively analyzed by domain experts so that they are able to reveal hidden relationships in the data.

\section{RQ1: Data Abstraction} \label{sec:data-abstraction}

In this section, we classify cybersecurity training data and provide their unified mapping into the input of process discovery algorithms to address the research question \emph{RQ1}.
The proposed solution builds on our long-term experience in developing \emph{KYPO Cyber Range}\footnote{KYPO is a Czech acronym for Cybersecurity Polygon.}~\cite{vykopal2017}.
that we are operating since 2013 and which serves as a platform for regular practical training of students of our university. We also closely collaborate with domain experts (cybersecurity educators) from our university who represent target users of post-training analysis tools.

\subsection{Principles of CFT games}

Cybersecurity CTF games consist of well-described cybersecurity goals divided into consecutive tasks (puzzles). Completing each task yields a text string called the \emph{flag} that must be inserted into the system to proceed to the subsequent task. Moreover, trainees can take hints or skip the entire task. Points are awarded or deducted for these actions so that the final scores of individual trainees are mutually comparable and can be used for their basic evaluation.

Trainees perform cybersecurity tasks on remote hosts located inside isolated computer networks. Modern cyber ranges provide a virtualized implementation of such networks, where each trainee has its own copy of the network and is able to access hosts via remote command lines or desktops, likewise in the physical world.

\subsection{Data Types} \label{sec:data-description}

Cyber ranges provide telemetry data in the form of events. They are captured from multiple sources and can provide different levels of granularity~\cite{svabensky2021monitoring}. This paper discusses three distinct data categories, but other data types or levels can be included if available.

\begin{table}[t]
\centering
\caption{Game events and their meaning.}\label{tab:gameEvents}
\begin{tabular}{ |c|l|  }
\hline
\textbf{Event} & \textbf{Description: The trainee ...}  \\
\hline
TrainingRunStarted & \dots started the training.\\ \hline
TaskCompleted & \dots submitting a correct flag. \\ \hline
WrongFlagSubmitted &  \dots submitted a wrong flag. \\ \hline
HintTaken & \dots took a hint. \\ \hline
SolutionDisplayed & \dots viewed the task solution. \\ \hline
\end{tabular}
\end{table}

\textbf{Game events} are produced by the gaming interface of KYPO Cyber Range. Its goal is to provide instructions and guide trainees through the whole training session. User interaction with the interface produces events that capture the gameplay state in the training scenario. Events summarized in Table~\ref{tab:gameEvents} reflect the puzzle-based principles, and they are typical for all games regardless of the content.

\textbf{Bash commands} are produced inside computer networks in which the cybersecurity tasks are solved. Currently, commands executed on the UNIX command line (shell) are available.

\textbf{Metasploit tool} capture the usage of the Metasploit framework -- a popular command-line application used for penetration testing. These events are also captured at hosts of the computer network, likewise the bash history, but represent even a finer-grained type of data.

Each event, regardless of its type or granularity, is extended with additional pieces of information, such as the trainee's identifier, timestamp, and the task (puzzle) in which the event appeared. Moreover, individual event types can have specific mandatory or optional data. For example, the submission of the flag always includes also the flag value, and commands may include their parameters.

\subsection{Unified Data Mapping}

All process mining techniques require the presence of data with specific semantics~\cite{PMbook}: (a) Each event in the log file needs to refer to a single process instance, named \emph{case}, (b) each event needs to refer to a step in the process, named \emph{activity}, and (c) events within the case have to be ordered, either sequentially or by including \emph{timestamp}.
These minimal requirements ensure that each case represented by the sequence of activities can be treated as a \emph{trace} of user actions, enabling the process discovery algorithms to produce graph models capturing all the traces compactly.

Unfortunately, CFT data are highly variable. They can differ in abstraction and semantics, as shown by the three aforementioned data types --- game events, bash commands, and the Metasploit tool.

To deal with variability, we introduce a generic data abstraction layer that makes the mapping smooth and transparent regardless of the specific training content. The proposed classification scheme serves as a mediator between heterogeneous event logs of the cyber range and the data format required by process mining techniques. Table~\ref{tab:abstraction} provides a mapping example, where a snippet of CTF data (four events) is mapped into the abstraction layer.

\begin{table*}[htb]
\centering
\caption{Mapping of raw data onto the unified CTF data abstraction and process mining inputs.}\label{tab:abstraction}
\begin{tabular}{|l|c|c|c|c|c|}
\hline
\textbf{Process mining input:} &     & \emph{activity}  &                    & \emph{time/ordering}  & \emph{caseID}  \\ \hline
\textbf{Data abstraction: }  & \textbf{\textsc{event type}} & \textbf{\textsc{event}} & \textbf{\textsc{event parameters}} & \textbf{\textsc{timestamp}} & \textbf{\textsc{trainee}} \\\hline
\textbf{Raw data (snippet): }    & game       & HintTaken 41-1 &                    & 2020-05-14 10:16:11 & user 1  \\
                                 & game       & HintTaken 41-2 &                    & 2020-05-14 10:16:34 & user 1  \\
                                 & msf        & exploit        & -j                 & 2020-05-14 10:18:23 & user 2  \\
                                 & bash       & nmap           & -sL 10.1.26.9:5050 & 2020-05-14 10:32:16 & user 1  \\
\hline
\end{tabular}
\end{table*}

\textbf{\textsc{Event type:}} A rough classification defining different types of events. We can distinguish player actions in the game from reactions of the system on the player's actions, or assessment events, for instance~\cite{salen2004}. The exact classification used for process mining depends on available data and analytical goals. Usually, each event type has its specific structure (required or optional data), and they affect how the pieces of information are spread across the other elements of the data abstraction. This paper deals with three aforementioned event types: \texttt{game} events capturing the players' progress, \texttt{bash} commands used on network hosts, and \texttt{msf} for Metasploit commands also used on hosts. Additional types can be easily defined.

\textbf{\textsc{Event:}} Finer classification of \textsc{event types}. Events represent a primary subject of behavioral analysis. They should capture significant steps in the development of training sessions. Therefore, they represent the \emph{activities} of the process models. In CTF games, events are either game events defined in Table~\ref{tab:gameEvents} or any shell or Metasploit commands.

\textbf{\textsc{Event parameters:}} Optional data associated with \textsc{events}. Additional information that extend \textsc{events} and enable the analyst to distinguish finely between them. For example, shell or Metasploit commands can have additional arguments, or the \emph{HintTaken} game event can be equipped with a short hint description.

\textbf{\textsc{Timestamp:}} A timestamp of the \textsc{event}. This is required because of the aggregation of multiple \textsc{event types}.

\textbf{\textsc{Trainee:}} An anonymized unique identifier of the trainee who produced the \textsc{event}. Using the \textsc{trainee} identifier as the \emph{caseID} ensures that the process discovery reconstructs the walkthroughs of individual trainees. The walkthrough perspective presents a primary subject of learning analytics. It enables analysts to compare trainees' behavior mutually as well as to analyze the expected versus anomalous behavior with respect to the training definition.

\begin{figure}
    \centering
    \includegraphics[scale=0.45]{figures/Fig5smaller.pdf}
    \caption{Level of detail based on event type, shown on task~41. The red arrows highlight a flow in the gameplay caused by a bug in platform implementation.}
    \label{fig:flow}
\end{figure}

\subsection{Usability}

We conducted practical experiments with PM4Py~\cite{pm4py} library to check the utilization of CTF data mapping for process discovery. The experiments proved that the proposed workflow is able to generate meaningful process models from our raw data at runtime.

Our initial research revealed that heuristic nets especially fit the analytical goals of educators the best. Even though the goal of these experiments was not to study the impact of obtained models on learning analytics, we were able to notice several interesting facts from process graphs. For example, the game task captured in Figure~\ref{fig:flow} can be considered tough for the trainees because they all took two hints, then two gave up (they looped at the solution with the correct flag). One trainee found and submitted the correct flag on the second try.
Using the same model, we also have discovered a flaw in the implementation of KYPO Cyber Range. If trainees submitted the correct flag after displaying a task solution, they were redirected to the solution page instead of being moved to the next puzzle.

\section{RQ2: Process Discovery} \label{s:rq2}

The proposed data abstraction enables us to use cyber-training data transparently in process mining algorithms. However, the practical usability of process discovery for learning analytics is affected by many factors.

The most significant challenges that appear when using event logs for educational process mining are addressed in the previous research~\cite{RWBogarin2018education,romero2016}. Using their classification, we analyzed raw data of multiple training sessions to identify the most significant features that affect the utilization of cyber training logs in post-training process discovery. Fifteen training sessions of six different CTF games were analyzed for statistical properties like training duration or the number of log events of different types.

In what follows, we summarize our observations and lessons learned. Each data characteristic is introduced by the problem statement followed by our findings.

\subsection{Data Size}

The number of cases or events in event logs may become so high that they exceed the time or memory requirements of process discovery algorithms. Moreover, as we aim at providing interactive data exploration, the speed of PM generation should be close to real-time.

The real amount of collected data depends on the number of participants, the difficulty of the training content (i.e., the amount of potentially recorded activities), and training duration. CTF games are intended primarily for beginners and then relatively small -- consisting of 4-6 cybersecurity tasks (puzzles) solvable in roughly 120 minutes (observed minimum was 65, maximum 210, average 119). Moreover, in-class training sessions considered in this paper restrict the data even more. It is because also the number of trainees is limited. In our datasets, the number of trainees varied between 4 and 20, 10 on average.

The number of logged events (and then potential nodes of the process graphs) in our datasets varied between 370--3000 per the whole training session (average 1100, median 814) and between 53--150 per participant (average 108, median 111).

The data amount does not pose any problems to current process discovery algorithms that can treat such an amount of data very quickly~\cite{Hernandez2015}.
On the other hand, our experiments revealed that the
problem could be with the comprehensibility of produced models, even for limited in-class CTF data. Obtained graphs consisting of tens or hundreds of nodes are usually too complex to be cognitively treated by analysts. Employment of data filtering and interactive exploration is, therefore, necessary.

\subsection{Distribution of Data Sources}

Data for educational process mining may be distributed over a variety of sources, e.g., theory and practice classroom or online learning environments. These sources provide event logs with different structures and meanings, which makes their unification and aggregation for process discovery challenging.

We focus on only the data collected from cyber ranges. Considering other supporting sources of information is out of the scope of this paper. However, the problem with data distribution occurs as well because modern cyber ranges produce data from at least two data sources: (a) the gaming environment responsible for the training tasks and learning milestones and (b) sandboxes (computer networks) where the tasks are performed. Nevertheless, the data abstraction discussed in Section~\ref{sec:data-abstraction} solves this problem by unifying the way the data from multiple data sources is handled and used transparently for process discovery.

\subsection{Granularity}

Events in event logs may have a different level of detail. The data presented in Section~\ref{sec:data-abstraction} demonstrates that this problem also occurs in the cyber training logs.

Thanks to the unified data abstraction, the granularity poses no technical problem for the process discovery of cyber training logs because the data can be mapped transparently. Moreover, this unified approach brings significant advantages when data with different granularity are put together. Multiple levels of granularity can define multiple levels of abstraction that can drive data exploration strategies, as discussed in Section~\ref{s:rq3}.

\subsection{Noise in the Data}

Noise is defined as exceptional behavior which is not representative of the typical behavior of the process.

We observed that many students leave the training unfinished due to the lack of time or the loss of motivation. Normally, this kind of noise could pose troubles for educational PM analysis. However, the puzzle-based structure of CTF games provides clear milestones --- correct flags that explicitly delimit borders of training phases. Therefore, it is easy to spot this situation in process graphs and further investigate the reason. In general, the puzzle-based structure can be considered a template of expected behavior, and any difference revealed by PM models can indicate flows in the game design or the training organization worth further investigation.

\subsection{Incompleteness}

Possible data incompleteness is tightly connected to the measurement infrastructure and techniques. Although the individual cyber ranges can differ in these aspects, they are often complex, distributed with asynchronous computation, based on underlying virtualization, and then unreliable. Our long-term experience with organizing cyber training sessions of many types reveals that many things can go wrong due to failures in low-level virtualization services, network connectivity, or improper usage. These failures then cause missing data.

The experiments have shown that keeping this incomplete data in the dataset can produce biased process models. Unfortunately, it is usually very difficult to notice from process graphs that there is something wrong with the raw event logs. Data cleansing and completeness checking have to be usually done in the preprocessing phase of the analytical workflow.

\subsection{Timestamps}\label{s:timestamps}

Events need to be ordered per case to be used for process discovery. Our experiments revealed three significant issues in the collected cyber training data.

Distributed environments like cyber ranges can produce timestamps that are not sufficiently synchronized. Only a small shift in times can re-order events and then produce significantly different process models. Therefore, precise synchronization at the level of the underlying infrastructure is required.

Trainees can start the exercise at different times, even if they sit in the same classroom. This aspect becomes even more significant if the training is not organized as a fixed-time group session, but the training content is available online at any time. Fortunately, the puzzle-based structure of CTF games enables us to identify the exact start of the gameplay of individual trainees and then compute relative
times instead of using absolute times, obtaining meaningful
process models.

An even worse situation can appear if the trainees can ``pause the training''. It does not happen on session-based training courses with a tight schedule. However, loosely conceived training programs would enable participants to stop playing for a while and continue with tasks later, even the next day.
Therefore, datasets from the loosely organized training events require much more attention and expertise to be paid by the analyst, who has to take care of time corrections and interpretation of obtained models.

\section{RQ3: Exploratory Analysis} \label{s:rq3}

Despite the limited size of event logs produced by in-class CTF games, the experiments turned out that obtained process graphs can be too complex and incomprehensible for effective analysis. As the complexity of process graphs can pose a critical aspect for practical usability, we discuss possible strategies for tackling this problem in this section.

\subsection{Filtering Driven by Data Abstraction}

The granularity of training logs discussed in Section~\ref{s:rq2} can be used to control the level of detail and then the size of obtained process graphs. This kind of semantic classification can be used for efficient data filtering and implementing the well-known Shneiderman's visual information-seeking principle: Overview first, zoom and filter, then details-on-demand~\cite{shneiderman1996}.

The granularity is encoded in the \emph{Event types} data abstraction parameter that defines different semantic views of the data. CTF \emph{game events} delimit boundaries of individual puzzles in which other events appear. On the other hand, \emph{bash commands} represent a detailed view of solving tasks within a puzzle. \emph{Metasploit commands} also provide a similar view but at an even more fine-grained level of detail -- the usage of a specific hacking tool.
Based on this observation, filtering of the process model to only a specific \textsc{event type} could provide the desired level of detail and then reduce information complexity. Figure~\ref{fig:teaser} depicts the model limited to the Metasploit only, while in Figure~\ref{fig:flow}, only game events are selected, entirely omitting bash and Metasploit commands.

Another graph complexity reduction technique utilizes the distribution of the raw data between \emph{event} and \emph{event parameter}. Consider the situation when a trainee takes a hint 41-1 and then a hint 41-2. If these events are mapped into the data abstraction like in Table~\ref{tab:abstraction}, then the process discovery algorithm distinguishes between hints 41-1 and 41-2, creates separate nodes for them and produces a model like that in Figure~\ref{fig:flow}. On the contrary, if we change the mapping so that \textsc{event} = ``\emph{HintTaken}'' and hint numbers 41-1 and 41-2 are provided only as \textsc{event parameters}, then a simplified model is produced with only a single joint ``41-HintTaken'' node covering all hints taken in the task.

This filtering principle is even more important for Bash and Metasploit commands than game events because trainees have big freedom of what to type on the command line. Mapping only command names without parameters to \textsc{events} seems to be a reasonable strategy for initial analysis. On the other hand, an \texttt{ssh} command, for instance, says nothing about the remote connection that has been made. In this case, the analyst should rather map the connection argument to the \textsc{event} and then produce separate nodes like \texttt{``ssh root@172.18.1.5''} and \texttt{``ssh admin@172.18.1.5''} in the process graph. Only then, the analyst is able to explicitly see different attempts (traces) and evaluate their correctness.
Therefore, the mapping has to be used carefully and iteratively during the analytical process to balance information hiding with graph complexity.

\subsection{Puzzle-based Fragmentation and Drill Down}

While the unified data abstraction can serve as a fine-grained filtering mechanism of the entire process model across multiple puzzles, the puzzle-based structure of the training content provides a vertical fragmentation of the data usable for drill-down exploration. Process graphs can be logically split into loosely coupled coherent parts that correspond to individual puzzles, as shown in Figure~\ref{fig:fragmentation}, where the puzzles of tasks 43, 44, and an info puzzle are visually recognizable.

\begin{figure}
    \centering
    \includegraphics[scale=0.22]{figures/fragmentation.png}
    \caption{Approximate visualization of tasks difficulty (up) and corresponding process graph (bottom). Only \emph{game events} are included in the process graph. Only tasks 43, 44, and the info puzzle are shown in this example to save space.}
    \label{fig:fragmentation}
\end{figure}

Based on this observation, we can tackle the complexity of multi-puzzle graphs by allocating puzzles' boundaries and using obtained graph fragments for coarse-grained filtering and data aggregation. Statistical data of each fragment (puzzle) can be distilled into an overview of the whole training session, while smaller detail process graphs of individual puzzles can be used for detail-on-demand exploration.

Figure~\ref{fig:fragmentation} illustrates this multi-layer approach. A high-level overview of the training session consists of a series of circles whose size and color can encode interesting metrics. For example, spheres' size can be calculated from the number of activities -- nodes of the puzzle's process graph. In this case, the size of task 44 would indicate that it is the most complicated part of the training with a lot of recorded activities (note that Bash and Metasploit commands are omitted from the graph view in Figure~\ref{fig:fragmentation}, but they can be calculated in the complexity metric and reflected in the sphere's size). Then the analyst can interactively drill down into selected puzzles to analyze the reason that could be either the task complexity (it requires many commands to be used) or difficulty (trainees struggled with the task completion and then generated many events).

The number of activities discussed in the previous example is not the only possible metric. Alternate metrics can provide a different perspective on the training results. For example, the number of displayed solutions can indicate how many trainees gave up the puzzle due to the task's difficulty, demotivation, or lack of time.

\section{Discussion and Future Work}

This section summarizes our results, putting emphasis on simplifications that we put on the training data.

\subsection{Limitations}

Results of this study are limited by two key constraints put on hands-on training: puzzle-based gamification and in-class education.

Considering only well-structured puzzle-based CTF games enables us to better classify data and fragment complex process models for drill-down exploration. We omit other training concepts, e.g., complex Cyber Defense Exercises~\cite{patriciu2009} that are intended for experienced professionals. They use wide network topologies, provide freedom in the exercise scenarios to simulate reality, and participants collaborate in teams, which may produce higher amounts of less-structured data and then violate prerequisites of our observations.

In-class training is limited to time and number of participants, which helps us keep data size within reasonable limits. However, cybersecurity training programs can also have the form of online courses accessible at any time by an unlimited number of participants. These courses can produce a significantly larger amount of data and pose some troubles with time dependencies that are crucial for correct process discovery, as discussed in Section~\ref{s:timestamps}. Therefore, extending our approach beyond in-class teaching requires further research.

We are also aware that data sets used in this paper were collected from CTF games organized by a single team in a single cyber range, which could affect our observations and limit generalization. On the other hand, to the best of our knowledge, other modern cyber ranges supporting CTF training style, e.g., Cyris, CyTrONE, or Ares~\cite{pham2016,beuran2018, Ares}, share the same concepts and principles that are discussed in this paper. Therefore, the training content and collected data may differ in detail, but the key aspects like size or types of events are very similar.

\subsection{Implications for Teaching Practice}

It is tough to identify flows in training design or analyze trainees' behavior without transforming events into models with better cognitive features. The proposed unified data abstraction can be directly used to map the data from cyber ranges into the input of exiting process mining tools and algorithms.

On the other hand, the practical usability of these generic tools can be limited. Their usability depends on the support of discussed data filtering and exploration techniques that are often domain-specific. Therefore, we are currently working on integrating these techniques into the analytical interface of KYPO Cyber Range so that the process mining analysis becomes an integral part of the training life cycle.

\iffalse
\subsection{Alternate Views to Process Graphs}

Using puzzle-based fragmentation together with the filtering driven by data abstraction can provide a powerful combination enabling analysts to maintain the complexity of process graphs interactively. However, the graph representation of process models is not the only one possible. Process models can be considered so-called \emph{multivariate graphs} that appear in many application domains.

Dealing with the complexity of multivariate graphs by complementary visualizations is a broadly researched field within the visual analytics discipline~\cite{kriglstein2016}. According to the classification~\cite{nobre2019}, process graphs of CTF games are of medium or large size, k-partite, they have heterogeneous nodes with few attributes and homogeneous edges. Based on these observations, the best alternate visualization techniques should combine an \emph{attribute-driven faceting} with \emph{quilts} and \emph{integrated} or \emph{juxtaposed} view operations. However, the design of concrete analytical visualizations remains a challenging task requiring further research.

\fi

\section{Conclusion}

This paper explores the practical usability of existing process mining algorithms to analyze cybersecurity training sessions and provides observations that support this direction.

Despite the variability of data collected from cyber ranges, we proposed a unified data abstraction for using the data as the input required by process mining algorithms. We tested the usability with data captured in a cyber range that we operate. The practical experiments proved the usefulness of our approach for answering questions related to learning analytics and evaluating corresponding hypotheses but also revealed limits caused by concrete features of the raw data.

We analyzed data from 15 training sessions to reveal significant features that affect the practical usability of process discovery algorithms. The main problem we faced was the complexity of the obtained graphs. Therefore, we introduced several strategies of data filtering and interactive data exploration that are built on the features of puzzle-based in-class form of exercises.

\begin{acks}
This research was supported by the Security Research Programme of the Czech Republic 2015–2022 (BV III/1–VS) granted by the Ministry of the Interior of the Czech Republic under No. VI20202022158 – Research of New Technologies to Increase the Capabilities of Cybersecurity Experts.
\end{acks}

\bibliographystyle{ACM-Reference-Format}

Cryptography and Security (cs.CR); Information Retrieval (cs.IR)