Search

We have discovered a triply eclipsing triple-star system, TIC 290061484, with the shortest known outer period, Pout, of only 24.5 days. This "eclipses" the previous record set by lambda Tauri at 33.02 days, which held for 68 yr. The inner binary, with an orbital period of Pin = 1.8 days, produces primary and secondary eclipses and exhibits prominent eclipse timing variations with the same periodicity as the outer orbit. The tertiary star eclipses, and is eclipsed by, the inner binary with pronounced asymmetric profiles. The inclinations of both orbits evolve on observable timescales such that the third-body eclipses exhibit dramatic depth variations in TESS data. A photodynamical model provides a complete solution for all orbital and physical parameters of the triple system, showing that the three stars have masses of 6.85, 6.11, and 7.90 MSun, radii near those corresponding to the main sequence, and Teff in the range of 21,000-23,700 K. Remarkably, the model shows that the triple is in fact a subsystem of a hierarchical 2+1+1 quadruple with a distant fourth star. The outermost star has a period of ~3200 days and a mass comparable to the stars in the inner triple. In ~20 Myr, all three components of the triple subsystem will merge, undergo a Type II supernova explosion, and leave a single remnant neutron star. At the time of writing, TIC 290061484 is the most compact triple system and one of the tighter known compact triples (i.e., Pout/Pin = 13.7)., Comment: 27 pages, 13 figures, 6 tables

The Transiting Exoplanet Survey Satellite (TESS) has enabled the discovery of numerous tidally tilted pulsators (TTPs), which are pulsating stars in close binaries where the presence of a tidal bulge has the effect of tilting the primary star's pulsation axes into the orbital plane. Recently, the modeling framework developed to analyze TTPs has been applied to the emerging class of tri-axial pulsators, which exhibit nonradial pulsations about three perpendicular axes. In this work, we report on the identification of the second-ever discovered tri-axial pulsator, with sixteen robustly-detected pulsation multiplets, of which fourteen are dipole doublets separated by 2$\nu_{\rm orb}$. We jointly fit the spectral energy distribution (SED) and TESS light curve of the star, and find that the primary is slightly evolved off the zero-age main sequence, while the less massive secondary still lies on the zero-age main sequence. Of the fourteen doublets, we associate eight with $Y_{10x}$ modes and six with novel $Y_{10y}$ modes. We exclude the existence of $Y_{11x}$ modes in this star and show that the observed pulsation modes must be $Y_{10y}$. We also present a toy model for the tri-axial pulsation framework in the context of this star. The techniques presented here can be utilized to rapidly analyze and confirm future tri-axial pulsator candidates., Comment: 19 pages, 11 figures, 4 tables. Accepted for publication in ApJ

We identify $240$ short-period ($P \lesssim 10$ days) binary systems in the TESS data, $180$ of which are heartbeat binaries (HB). The sample is mostly a mix of A and B-type stars and primarily includes eclipsing systems, where over $30\%$ of the sources with primary and secondary eclipses show a secular change in their inter-eclipse timings and relative eclipse depths over a multi-year timescale, likely due to orbital precession. The orbital parameters of the population are estimated by fitting a heartbeat model to their phase curves and Gaia magnitudes, where the model accounts for ellipsoidal variability, Doppler beaming, reflection effects, and eclipses. We construct the sample's period-eccentricity distribution and find an eccentricity cutoff (where $e \rightarrow 0$) at a period $1.7$ days. Additionally, we measure the periastron advance rate for the $12$ of the precessing sources and find that they all exhibit prograde apsidal precession, which is as high as $9^{\circ}$ yr$^{-1}$ for one of the systems. Using the inferred stellar parameters, we estimate the general relativistic precession rate of the argument of periastron for the population and expect over $30$ systems to show a precession in excess of $0.3^{\circ}$ yr$^{-1}$, Comment: Accepted for publication in ApJ

The Transiting Exoplanet Survey Satellite (TESS) mission measured light from stars in ~85% of the sky throughout its two-year primary mission, resulting in millions of TESS 30-minute cadence light curves to analyze in the search for transiting exoplanets. To search this vast dataset, we aim to provide an approach that is both computationally efficient, produces highly performant predictions, and minimizes the required human search effort. We present a convolutional neural network that we train to identify short period variables. To make a prediction for a given light curve, our network requires no prior target parameters identified using other methods. Our network performs inference on a TESS 30-minute cadence light curve in ~5ms on a single GPU, enabling large scale archival searches. We present a collection of 14156 short-period variables identified by our network. The majority of our identified variables fall into two prominent populations, one of short-period main sequence binaries and another of Delta Scuti stars. Our neural network model and related code is additionally provided as open-source code for public use and extension.

We present our second catalog of quadruple star candidates, containing 101 systems discovered in TESS Full-Frame Image data. The targets were initially detected as eclipsing binary stars with the help of supervised machine learning methods applied to sectors Sectors 1 through 54. A dedicated team of citizen scientists subsequently identified through visual inspection two sets of eclipses following two different periods. All 101 systems presented here pass comprehensive photocenter motion tests confirming that both sets of eclipses originate from the target star. Some of the systems exhibit prominent eclipse time variations suggesting dynamical interactions between the two component binary stars. One target is an eclipsing quintuple candidate with a (2+1)+2 hierarchical configuration, such that the (2+1) subsystem produces eclipses on the triple orbit as well. Another has recently been confirmed as the second shortest period quadruple reported to date. This catalog provides ephemerides, eclipse depths and durations, sample statistics, and highlights potentially interesting targets for future studies., Comment: 38 pages, 21 figures, 2 tables. Table with targets available online at MNRAS

We have found that the 2+2 quadruple star system BU CMi is currently the most compact quadruple system known, with an extremely short outer period of only 121 days. The previous record holder was TIC 219006972 (Kostov et al. 2023), with a period of 168 days. The quadruple nature of BU CMi was established by Volkov et al. (2021), but they misidentified the outer period as 6.6 years. BU CMi contains two eclipsing binaries (EBs), each with a period near 3 days, and a substantial eccentricity of about 0.22. All four stars are within about 0.1 solar mass of 2.4 solar masses. Both binaries exhibit dynamically driven apsidal motion with fairly short apsidal periods of about 30 years, thanks to the short outer orbital period. The outer period of 121 days is found both from the dynamical perturbations, with this period imprinted on the eclipse timing variations (ETV) curve of each EB by the other binary, and by modeling the complex line profiles in a collection of spectra. We find that the three orbital planes are all mutually aligned to within 1 degree, but the overall system has an inclination angle near 83.5 degrees. We utilize a complex spectro-photodynamical analysis to compute and tabulate all the interesting stellar and orbital parameters of the system. Finally, we also find an unexpected dynamical perturbation on a timescale of several years whose origin we explore. This latter effect was misinterpreted by Volkov et al. (2021) and led them to conclude that the outer period was 6.6 years rather than the 121 days that we establish here., Comment: 19 pages, 8 pages, accepted to MNRAS

The Nancy Grace Roman Space Telescope (Roman) is NASA's next astrophysics flagship mission, expected to launch in late 2026. As one of Roman's core community science surveys, the Galactic Bulge Time Domain Survey (GBTDS) will collect photometric and astrometric data for over 100 million stars in the Galactic bulge to search for microlensing planets. To assess the potential with which Roman can detect exoplanets via transit, we developed and conducted pixel-level simulations of transiting planets in the GBTDS. From these simulations, we predict that Roman will find between $\sim$60,000 and $\sim$200,000 transiting planets, over an order of magnitude more planets than are currently known. While the majority of these planets will be giants ($R_p>4R_\oplus$) on close-in orbits ($a<0.3$ au), the yield also includes between $\sim$7,000 and $\sim$12,000 small planets ($R_p<4 R_\oplus$). The yield for small planets depends sensitively on the observing cadence and season duration, with variations on the order of $\sim$10-20% for modest changes in either parameter, but is generally insensitive to the trade between surveyed area and cadence given constant slew/settle times. These predictions depend sensitively on the Milky Way's metallicity distribution function, highlighting an opportunity to significantly advance our understanding of exoplanet demographics, particularly across stellar populations and Galactic environments., Comment: Accepted to ApJS; 64 pages, 18 figures

We report the detection and validation of two planets orbiting TOI-2095 (TIC 235678745). The host star is a 3700K M1V dwarf with a high proper motion. The star lies at a distance of 42 pc in a sparsely populated portion of the sky and is bright in the infrared (K=9). With data from 24 Sectors of observation during TESS's Cycles 2 and 4, TOI-2095 exhibits two sets of transits associated with super-Earth-sized planets. The planets have orbital periods of 17.7 days and 28.2 days and radii of 1.30 and 1.39 Earth radii, respectively. Archival data, preliminary follow-up observations, and vetting analyses support the planetary interpretation of the detected transit signals. The pair of planets have estimated equilibrium temperatures of approximately 400 K, with stellar insolations of 3.23 and 1.73 times that of Earth, placing them in the Venus zone. The planets also lie in a radius regime signaling the transition between rock-dominated and volatile-rich compositions. They are thus prime targets for follow-up mass measurements to better understand the properties of warm, transition radius planets. The relatively long orbital periods of these two planets provide crucial data that can help shed light on the processes that shape the composition of small planets orbiting M dwarfs., Comment: Submitted to AAS Journals

We present the discovery of a new highly compact quadruple star system, TIC 219006972, consisting of two eclipsing binary stars with orbital periods of 8.3 days and 13.7 days, and an outer orbital period of only 168 days. This period is a full factor of 2 shorter than the quadruple with the shortest outer period reported previously, VW LMi, where the two binary components orbit each other every 355 days. The target was observed by TESS in Full-Frame Images in sectors 14-16, 21-23, 41, 48 and 49, and produced two sets of primary and secondary eclipses. These show strongly non-linear eclipse timing variations (ETVs) with an amplitude of $\sim$0.1 days, where the ETVs of the primary and secondary eclipses, and of the two binaries are all largely positively correlated. This highlights the strong dynamical interactions between the two binaries and confirms the compact quadruple configuration of TIC 219006972. The two eclipsing binaries are nearly circular whereas the quadruple system has an outer eccentricity of about 0.25. The entire system is nearly edge-on, with a mutual orbital inclination between the two eclipsing binary star systems of about 1 degree., Comment: 16 pages, 13 figures, 4 tables, MNRAS accepted

Dipper stars are a classification of young stellar objects that exhibit dimming variability in their light curves, dropping in brightness by 10-50%, likely induced by occultations due to circumstellar disk material. This variability can be periodic, quasi-periodic, or aperiodic. Dipper stars have been discovered in young stellar associations via ground-based and space-based photometric surveys. We present the detection and characterization of the largest collection of dipper stars to date: 293 dipper stars, including 234 new dipper candidates. We have produced a catalog of these targets, which also includes young stellar variables that exhibit predominately bursting-like variability and symmetric variability (equal parts bursting and dipping). The total number of catalog sources is 414. These variable sources were found in a visual survey of TESS light curves, where dipping-like variability was observed. We found a typical age among our dipper sources of <5 Myr, with the age distribution peaking at ~2 Myr, and a tail of the distribution extending to ages older than 20 Myr. Regardless of the age, our dipper candidates tend to exhibit infrared excess, which is indicative of the presence of disks. TESS is now observing the ecliptic plane, which is rich in young stellar associations, so we anticipate many more discoveries in the TESS dataset. A larger sample of dipper stars would enhance the census statistics of light curve morphologies and dipper ages., Comment: 19 pages, 11 figures, 1 table (included in latex source), accepted for publication in ApJS

We report the discovery with TESS of a remarkable quadruple star system with a 2+1+1 configuration. The two unique characteristics of this system are that (i) the inner eclipsing binary (stars Aa and Ab) eclipses the star in the outermost orbit (star C), and (ii) these outer 4th body eclipses last for $\sim$12 days, the longest of any such system known. The three orbital periods are $\sim$3.3 days, $\sim$51 days, and $\sim$2100 days. The extremely long duration of the outer eclipses is due to the fact that star B slows binary A down on the sky relative to star C. We combine TESS photometric data, ground-based photometric observations, eclipse timing points, radial velocity measurements, the composite spectral energy distribution, and stellar isochones in a spectro-photodynamical analysis to deduce all of the basic properties of the four stars (mass, radius, $T_{\rm eff}$, and age), as well as the orbital parameters for all three orbits. The four masses are $M_{\rm Aa} =0.382$M$_\odot$, $M_{\rm Ab} =0.300$M$_\odot$, $M_{\rm B} =0.540$M$_\odot$ and $M_{\rm C} =0.615$M$_\odot$, with a typical uncertainty of 0.015 M$_\odot$., Comment: Accepted for publication by The Astrophysical Journal, 10 August 2022

We present stellar rotation rates derived from Transiting Exoplanet Survey Satellite (TESS) light curves for stars in Upper Centaurus-Lupus (UCL; ~136 pc, ~16 Myr) and Lower Centaurus-Crux (LCC; ~115 pc, ~17 Myr). We find spot-modulated periods (P) for ~90% of members. The range of light curve and periodogram shapes echoes that found for other clusters with K2, but fewer multi-period stars may be an indication of different noise characteristics of TESS, or a result of the source selection methods here. The distribution of P as a function of color as a proxy for mass fits nicely in between that for both older and younger clusters observed by K2, with fast rotators found among both the highest and lowest masses probed here, and a well-organized distribution of M star rotation rates. About 13% of the stars have an infrared (IR) excess, suggesting a circumstellar disk; this is well-matched to expectations, given the age of the stars. There is an obvious pile-up of disked M stars at P~2 days, and the pile-up may move to shorter P as the mass decreases. There is also a strong concentration of disk-free M stars at P~2 days, hinting that perhaps these stars have recently freed themselves from their disks. Exploring the rotation rates of stars in UCL/LCC has the potential to help us understand the beginning of the end of the influence of disks on rotation, and the timescale on which the star responds to unlocking., Comment: accepted by AAS journals

This article presents the history of the Visual Survey Group (VSG) - a Professional-Amateur (Pro-Am) collaboration within the field of astronomy working on data from several space missions (Kepler, K2 and TESS). This paper covers the formation of the VSG, its survey-methods including the most common tools used and its discoveries made over the past decade. So far, the group has visually surveyed nearly 10 million light curves and authored 69 peer-reviewed papers which mainly focus on exoplanets and discoveries involving multistellar systems found using the transit method. The preferred manual search-method carried out by the VSG has revealed its strength by detecting numerous sub-stellar objects which were overlooked or discarded by automated search programs, uncovering some of the most rare stars in our galaxy, and leading to several serendipitous discoveries of unprecedented astrophysical phenomena. The main purpose of the VSG is to assist in the exploration of our local Universe, and we therefore advocate continued crowd-sourced examination of time-domain data sets, and invite other research teams to reach out in order to establish collaborating projects., Comment: 14 pages, 5 figures, 2 tables, accepted for publication in PASP

We present a catalog of 97 uniformly-vetted candidates for quadruple star systems. The candidates were identified in TESS Full Frame Image data from Sectors 1 through 42 through a combination of machine learning techniques and visual examination, with major contributions from a dedicated group of citizen scientists. All targets exhibit two sets of eclipses with two different periods, both of which pass photocenter tests confirming that the eclipses are on-target. This catalog outlines the statistical properties of the sample, nearly doubles the number of known multiply-eclipsing quadruple systems, and provides the basis for detailed future studies of individual systems. Several important discoveries have already resulted from this effort, including the first sextuply-eclipsing sextuple stellar system and the first transiting circumbinary planet detected from one sector of TESS data., Comment: 56 pages, 27 figures, 4 tables

The failure of the Euclidean norm to reliably distinguish between nearby and distant points in high dimensional space is well-known. This phenomenon of distance concentration manifests in a variety of data distributions, with iid or correlated features, including centrally-distributed and clustered data. Unsupervised learning based on Euclidean nearest-neighbors and more general proximity-oriented data mining tasks like clustering, might therefore be adversely affected by distance concentration for high-dimensional applications. While considerable work has been done developing clustering algorithms with reliable high-dimensional performance, the problem of cluster validation--of determining the natural number of clusters in a dataset--has not been carefully examined in high-dimensional problems. In this work we investigate how the sensitivities of common Euclidean norm-based cluster validity indices scale with dimension for a variety of synthetic data schemes, including well-separated and noisy clusters, and find that the overwhelming majority of indices have improved or stable sensitivity in high dimensions. The curse of dimensionality is therefore dispelled for this class of fairly generic data schemes., Comment: 20 pages, 10 figures

In this paper we present a catalog of 4584 eclipsing binaries observed during the first two years (26 sectors) of the TESS survey. We discuss selection criteria for eclipsing binary candidates, detection of hither-to unknown eclipsing systems, determination of the ephemerides, the validation and triage process, and the derivation of heuristic estimates for the ephemerides. Instead of keeping to the widely used discrete classes, we propose a binary star morphology classification based on a dimensionality reduction algorithm. Finally, we present statistical properties of the sample, we qualitatively estimate completeness, and discuss the results. The work presented here is organized and performed within the TESS Eclipsing Binary Working Group, an open group of professional and citizen scientists; we conclude by describing ongoing work and future goals for the group. The catalog is available from http://tessEBs.villanova.edu and from MAST., Comment: 32 pages, 21 figures, accepted to ApJ Supplement Series; comments welcome

We report the discovery of a unique object of uncertain nature -- but quite possibly a disintegrating asteroid or minor planet -- orbiting one star of the widely separated binary TIC 400799224. We initially identified the system in data from TESS Sector 10 via an abnormally-shaped fading event in the light curve (hereafter 'dips'). Follow-up speckle imaging determined that TIC 400799224 is actually two stars of similar brightness at 0.62" separation, forming a likely bound binary with projected separation of ~300 au. We cannot yet determine which star in the binary is host to the dips in flux. ASAS-SN and Evryscope archival data show that there is a strong periodicity of the dips at ~19.77 days, leading us to believe that an occulting object is orbiting the host star, though the duration, depth, and shape of the dips vary substantially. Statistical analysis of the ASAS-SN data shows that the dips only occur sporadically at a detectable threshold in approximately one out of every three to five transits, lending credence to the possibility that the occulter is a sporadically-emitted dust cloud. The cloud is also fairly optically thick, blocking up to 37% or 75% of the light from the host star, depending on the true host. Further observations may allow for greater detail to be gleaned as to the origin and composition of the occulter, as well as to a determination of which of the two stars comprising TIC 400799224 is the true host star of the dips., Comment: Accepted for publication by The Astronomical Journal, 1 October 2021

The era of multi-messenger astrophysics has arrived, leading to key new discoveries and revealing a need for coordination, collaboration, and communication between world-wide communities using ground and space-based facilities. To fill these critical needs, NASA's Goddard Space Flight Center and Marshall Space Flight Center are jointly proposing to establish a virtual Multi-Messenger Astrophysics Science Support Center that focuses entirely on community-directed services. In this article, we describe the baseline plan for the virtual Support Center which will position the community and NASA as an Agency to extract maximum science from multi-messenger events, leading to new breakthroughs and fostering increased coordination and collaboration., Comment: Astronomy & Computing, accepted

Adversarial lateral movement via compromised accounts remains difficult to discover via traditional rule-based defenses because it generally lacks explicit indicators of compromise. We propose a behavior-based, unsupervised framework comprising two methods of lateral movement detection on enterprise networks: one aimed at generic lateral movement via either exploit or authenticated connections, and one targeting the specific techniques of process injection and hijacking. The first method is based on the premise that the role of a system---the functions it performs on the network---determines the roles of the systems it should make connections with. The adversary meanwhile might move between any systems whatever, possibly seeking out systems with unusual roles that facilitate certain accesses. We use unsupervised learning to cluster systems according to role and identify connections to systems with novel roles as potentially malicious. The second method is based on the premise that the temporal patterns of inter-system processes that facilitate these connections depend on the roles of the systems involved. If a process is compromised by an attacker, these normal patterns might be disrupted in discernible ways. We apply frequent-itemset mining to process sequences to establish regular patterns of communication between systems based on role, and identify rare process sequences as signalling potentially malicious connections., Comment: 24 pages, 15 figures. Version submitted to JISA

We report the discovery of a compact, coplanar, quadruply-lined, eclipsing quadruple star system from TESS data, TIC 454140642, also known as TYC 0074-01254-1. The target was first detected in Sector 5 with 30-min cadence in Full-Frame Images and then observed in Sector 32 with 2-min cadence. The light curve exhibits two sets of primary and secondary eclipses with periods of PA = 13.624 days (binary A) and PB = 10.393 days (binary B). Analysis of archival and follow-up data shows clear eclipse-timing variations and divergent radial velocities, indicating dynamical interactions between the two binaries and confirming that they form a gravitationally-bound quadruple system with a 2+2 hierarchy. The Aa+Ab binary, Ba+Bb binary, and A-B system are aligned with respect to each other within a fraction of a degree: the respective mutual orbital inclinations are 0.25 degrees (A vs B), 0.37 degrees (A vs A-B), and 0.47 degrees (B vs A-B). The A-B system has an orbital period of 432 days - the second shortest amongst confirmed quadruple systems - and an orbital eccentricity of 0.3., Comment: 25 pages, 17 figures, 9 tables; accepted for publication in the Astrophysical Journal

We report the first discovery of a transiting circumbinary planet detected from a single sector of TESS data. During Sector 21, the planet TIC 172900988b transited the primary star and then 5 days later it transited the secondary star. The binary is itself eclipsing, with a period of P = 19.7 days and an eccentricity of e = 0.45. Archival data from ASAS-SN, Evryscope, KELT, and SuperWASP reveal a prominent apsidal motion of the binary orbit, caused by the dynamical interactions between the binary and the planet. A comprehensive photodynamical analysis of the TESS, archival and follow-up data yields stellar masses and radii of M1 = 1.2384 +/- 0.0007 MSun and R1 = 1.3827 +/- 0.0016 RSun for the primary and M2 = 1.2019 +/- 0.0007 MSun and R2 = 1.3124 +/- 0.0012 RSun for the secondary. The radius of the planet is R3 = 11.25 +/- 0.44 REarth (1.004 +/- 0.039 RJup). The planet's mass and orbital properties are not uniquely determined - there are six solutions with nearly equal likelihood. Specifically, we find that the planet's mass is in the range of 824 < M3 < 981 MEarth (2.65 < M3 < 3.09 MJup), its orbital period could be 188.8, 190.4, 194.0, 199.0, 200.4, or 204.1 days, and the eccentricity is between 0.02 and 0.09. At a V = 10.141 mag, the system is accessible for high-resolution spectroscopic observations, e.g. Rossiter-McLaughlin effect and transit spectroscopy., Comment: 57 pages, 30 figures, 25 tables; Accepted AJ

The Transiting Exoplanet Survey Satellite (TESS) mission measured light from stars in ~75% of the sky throughout its two year primary mission, resulting in millions of TESS 30-minute cadence light curves to analyze in the search for transiting exoplanets. To search this vast data trove for transit signals, we aim to provide an approach that is both computationally efficient and produces highly performant predictions. This approach minimizes the required human search effort. We present a convolutional neural network, which we train to identify planetary transit signals and dismiss false positives. To make a prediction for a given light curve, our network requires no prior transit parameters identified using other methods. Our network performs inference on a TESS 30-minute cadence light curve in ~5ms on a single GPU, enabling large scale archival searches. We present 181 new planet candidates identified by our network, which pass subsequent human vetting designed to rule out false positives. Our neural network model is additionally provided as open-source code for public use and extension., Comment: Updated to match AJ revision

We report the discovery of a sextuply-eclipsing sextuple star system from TESS data, TIC 168789840, also known as TYC 7037-89-1, the first known sextuple system consisting of three eclipsing binaries. The target was observed in Sectors 4 and 5 during Cycle 1, with lightcurves extracted from TESS Full Frame Image data. It was also previously observed by the WASP survey and ASAS-SN. The system consists of three gravitationally-bound eclipsing binaries in a hierarchical structure of an inner quadruple system with an outer binary subsystem. Follow-up observations from several different observatories were conducted as a means of determining additional parameters. The system was resolved by speckle interferometry with a 0."42 separation between the inner quadruple and outer binary, inferring an estimated outer period of ~2 kyr. It was determined that the fainter of the two resolved components is an 8.217 day eclipsing binary, which orbits the inner quadruple that contains two eclipsing binaries with periods of 1.570 days and 1.306 days. MCMC analysis of the stellar parameters has shown that the three binaries of TIC 168789840 are "triplets", as each binary is quite similar to the others in terms of mass, radius, and Teff. As a consequence of its rare composition, structure, and orientation, this object can provide important new insight into the formation, dynamics, and evolution of multiple star systems. Future observations could reveal if the intermediate and outer orbital planes are all aligned with the planes of the three inner eclipsing binaries.

We present results of a study on identifying circumbinary planet candidates that produce multiple transits during one conjunction with eclipsing binary systems. The occurrence of these transits enables us to estimate the candidates' orbital periods, which is crucial as the periods of the currently known transiting circumbinary planets are significantly longer than the typical observational baseline of TESS. Combined with the derived radii, it also provides valuable information needed for follow-up observations and subsequent confirmation of a large number of circumbinary planet candidates from TESS. Motivated by the discovery of the 1108-day circumbinary planet Kepler-1647, we show the application of this technique to four of Kepler's circumbinary planets that produce such transits. Our results indicate that in systems where the circumbinary planet is on a low-eccentricity orbit, the estimated planetary orbital period is within <10-20% of the true value. This estimate is derived from photometric observations spanning less than 5% of the planet's period, demonstrating the strong capability of the technique. Capitalizing on the current and future eclipsing binaries monitored by NASA's TESS mission, we estimate that hundreds of circumbinary planets candidates producing multiple transits during one conjunction will be detected in the TESS data. Such a large sample will enable statistical understanding of the population of planets orbiting binary stars and shed new light on their formation and evolution., Comment: 16 pages, 6 figures, 2 tables, AJ accepted

This work explores the extent to which LSB embedding can be made secure against structural steganalysis through a modification of cover image statistics prior to message embedding. Natural images possess symmetries that are expressed through approximately equal cardinalities of certain sets of $k$-tuples of consecutive pixels. LSB embedding disturbs this balance and a $k^{\rm th}$-order structural attack infers the presence of a hidden message with a length in proportion to the size of the imbalance amongst sets of $k$-tuples. To protect against $k^{\rm th}$-order structural attacks, cover modifications involve the redistribution of $k$-tuples among the different sets so that symmetries of the cover image are broken, then repaired through the act of LSB embedding so that the stego image bears the statistics of the original cover. To protect against all orders up to some order $k$, the statistics of $n$-tuples must be preserved where $n$ is the least common multiple of all orders $\leq k$. We find that this is only feasible for securing against up to $3^{\rm rd}$-order attacks (Sample Pairs and Triples analyses) since higher-order protections result in virtually zero embedding capacities. Securing up to $3^{\rm rd}$-order requires redistribution of sextuplets: rather than perform these $6^{\rm th}$-order cover modifications, which result in tiny embedding capacities, we reduce the problem to the redistribution of triplets in a manner that also preserves the statistics of pairs. This is done by embedding into only certain pixels of each sextuplet, constraining the maximum embedding rate to be $\leq 2/3$ bits per channel. Testing on a variety of image formats, we report best performance for JPEG-compressed images with a mean maximum embedding rate undetectable by $2^{\rm nd}$- and $3^{\rm rd}$-order attacks of 0.21 bits per channel., Comment: 23 pages, 6 figures. Section 3 added; revisions made to Section 6.3. Version accepted by Journal of Computer Security

Authenticated lateral movement via compromised accounts is a common adversarial maneuver that is challenging to discover with signature- or rules-based intrusion detection systems. In this work a behavior-based approach to detecting malicious logins to novel systems indicative of lateral movement is presented, in which a user's historical login activity is used to build a model of putative "normal" behavior. This historical login activity is represented as a collection of daily login graphs, which encode authentications among accessed systems. Each system, or graph vertex, is described by a set of graph centrality measures that characterize it and the local topology of its login graph. The unsupervised technique of non-negative matrix factorization is then applied to this set of features to assign each vertex to a role that summarizes how the system participates in logins. The reconstruction error quantifying how well each vertex fits into its role is then computed, and the statistics of this error can be used to identify outlier vertices that correspond to systems involved in unusual logins. We test this technique with a small cohort of privileged accounts using real login data from an operational enterprise network. The ability of the method to identify malicious logins among normal activity is tested with simulated graphs of login activity representative of adversarial lateral movement. We find that the method is generally successful at detecting a broad range of lateral movement for each user, with false positive rates significantly lower than those resulting from alerts based solely on login novelty., Comment: 10 pages, 8 figures. Major revisions, expanded analysis

A method for detecting electronic data theft from computer networks is described, capable of recognizing patterns of remote exfiltration occurring over days to weeks. Normal traffic flow data, in the form of a host's ingress and egress bytes over time, is used to train an ensemble of one-class learners. The detection ensemble is modular, with individual classifiers trained on different traffic features thought to characterize malicious data transfers. We select features that model the egress to ingress byte balance over time, periodicity, short time-scale irregularity, and density of the traffic. The features are most efficiently modeled in the frequency domain, which has the added benefit that variable duration flows are transformed to a fixed-size feature vector, and by sampling the frequency space appropriately, long-duration flows can be tested. When trained on days- or weeks-worth of traffic from individual hosts, our ensemble achieves a low false positive rate (<2%) on a range of different system types. Simulated exfiltration samples with a variety of different timing and data characteristics were generated and used to test ensemble performance on different kinds of systems: when trained on a client workstation's external traffic, the ensemble was generally successful at detecting exfiltration that is not simultaneously ingress-heavy, connection-sparse, and of short duration---a combination that is not optimal for attackers seeking to transfer large amounts of data. Remote exfiltration is more difficult to detect from egress-heavy systems, like web servers, with normal traffic exhibiting timing characteristics similar to a wide range of exfiltration types., Comment: 34 pages, 15 figures. Version submitted to ACM TOPS

An approach is developed for analyzing computer networks to identify systems and accounts that are at particular risk of compromise by an adversary seeking to move laterally through the network via authentication. The dynamics of the adversary are modeled as a contagion spreading across systems linked via authentication relationships derived from Administrator account access and active session data. The adversary is assumed to traverse the network via credential chaining, where the adversary steals credentials from one system, uses them to authenticate to another, and repeats the process. Graph topology measures are used to analyze different contagion models applied to a real Windows network for three primary exposures by identifying: accounts which, either individually or collectively, provide wide and far-reaching access to many systems across the network; accounts with notable privilege escalation liability; and "gatekeeper" systems through which the adversary must pass in order to reach critical assets. The approach can be used to test how different mitigations and countermeasures affect these exposures; for example, we find that disabling remote logins by local accounts and implementing protections that prevent the caching of credentials on remote hosts can substantially curtail lateral movement and privilege escalation., Comment: 34 pages, 18 figures. Version accepted to Journal of Cyber Security Technology