Intrusion Events Research Articles

Application of deep reinforcement learning to intrusion detection for supervised problems

The application of new techniques to increase the performance of intrusion detection systems is crucial in modern data networks with a growing threat of cyber-attacks. These attacks impose a greater risk on network services that are increasingly important from a social end economical point of view. In this work we present a novel application of several deep reinforcement learning (DRL) algorithms to intrusion detection using a labeled dataset. We present how to perform supervised learning based on a DRL framework.The implementation of a reward function aligned with the detection of intrusions is extremely difficult for Intrusion Detection Systems (IDS) since there is no automatic way to identify intrusions. Usually the identification is performed manually and stored in datasets of network features associated with intrusion events. These datasets are used to train supervised machine learning algorithms for classifying intrusion events. In this paper we apply DRL using two of these datasets: NSL-KDD and AWID datasets. As a novel approach, we have made a conceptual modification of the classic DRL paradigm (based on interaction with a live environment), replacing the environment with a sampling function of recorded training intrusions. This new pseudo-environment, in addition to sampling the training dataset, generates rewards based on detection errors found during training.We present the results of applying our technique to four of the most relevant DRL models: Deep Q-Network (DQN), Double Deep Q-Network (DDQN), Policy Gradient (PG) and Actor-Critic (AC). The best results are obtained for the DDQN algorithm.We show that DRL, with our model and some parameter adjustments, can improve the results of intrusion detection in comparison with current machine learning techniques. Besides, the classifier obtained with DRL is faster than alternative models. A comprehensive comparison of the results obtained with other machine learning models is provided for the AWID and NSL-KDD datasets, together with the lessons learned from the application of several design alternatives to the four DRL models.

Air-Quality Challenges of Prescribed Fire in the Complex Terrain and Wildland Urban Interface Surrounding Bend, Oregon

Prescribed fires in forest ecosystems can negatively impact human health and safety by transporting smoke downwind into nearby communities. Smoke transport to communities is known to occur around Bend, Oregon, United States of America (USA), where burning at the wildland–urban interface in the Deschutes National Forest resulted in smoke intrusions into populated areas. The number of suitable days for prescribed fires is limited due to the necessity for moderate weather conditions, as well as wind directions that do not carry smoke into Bend. To better understand the conditions leading to these intrusions and to assess predictions of smoke dispersion from prescribed fires, we collected data from an array of weather and particulate monitors over the autumn of 2014 and spring of 2015 and historical weather data from nearby remote automated weather stations (RAWS). We characterized the observed winds to compare with meteorological and smoke dispersion models using the BlueSky smoke modeling framework. The results from this study indicated that 1–6 days per month in the spring and 2–4 days per month in the fall met the general meteorological prescription parameters for conducting prescribed fires in the National Forest. Of those, 13% of days in the spring and 5% of days in the fall had “ideal” wind patterns, when north winds occurred during the day and south winds did not occur at night. The analysis of smoke intrusions demonstrated that dispersion modeling can be useful for anticipating the timing and location of smoke impacts, but substantial errors in wind speed and direction of the meteorological models can lead to mischaracterizations of intrusion events. Additionally, for the intrusion event modeled using a higher-resolution 1-km meteorological and dispersion model, we found improved predictions of both the timing and location of smoke delivery to Bend compared with the 4-km meteorological model. The 1-km-resolution model prediction fell within 1 h of the observed event, although with underpredicted concentrations, and demonstrated promise for high-resolution modeling in areas of complex terrain.

Empirical Analysis and Validation of Security Alerts Filtering Techniques

System administrators cope with security incidents through a variety of monitors, such as intrusion detection systems, event logs, security information and event management systems. Monitors generate large volumes of alerts that overwhelm the operations team and make forensics time-consuming. Filtering is a consolidated technique to reduce the amount of alerts. In spite of the number of filtering proposals, few studies have addressed the validation of filtering results in real production datasets. This paper analyzes a number of state-of-the-art filtering techniques that are used to address security datasets. We use 14 months of alerts generated in a SaaS Cloud. Our analysis aims to measure and compare the reduction of the alerts volume obtained by the filters. The analysis highlights pros and cons of each filter and provides insights into the practical implications of filtering as affected by the characteristics of a dataset. We complement the analysis with a method to validate the output of a filter in absence of ground truth, i.e., the knowledge of the incidents occurred in the system at the time the alerts were generated. The analysis addresses blacklist, conceptual clustering and bytes techniques, and our filtering proposal based on term weighting.

Drivers of deep water renewal in Macquarie Harbour, Tasmania

Abstract Macquarie Harbour is a fjord-like estuary located on the west coast of Tasmania and is home to a growing aquaculture industry. The harbour is oriented with the mouth on its north west end and two main tributaries located on its northeast and southeast ends. Both of the system's major tributaries have hydroelectric power schemes controlling catchment discharge into the harbour. The harbour has a history of low oxygen concentrations and the bottom water is often oxygen poor. No study to date has described the underlying mechanisms of deep water renewal and oxygenation in the system. Approximately 5 years of data from monthly dissolved oxygen, salinity, and temperature profiles, located throughout the harbour, and 3 continuous logger stations was analysed with water level and meteorological data. These data were used to describe the drivers of water level and deep water oxygen renewal in the system. This study provides a first order estimate of the net mass of dissolved oxygen entering via these marine water intrusion events. Data analysis indicates that deep water renewal appears to occur episodically, with only 2 significant events recorded over a 5 year period, though a number of smaller events were also recorded on a monthly basis. The largest events were observed during winter and late autumn and are associated with strong north westerly winds and a sudden drop in atmospheric pressure. The drop in pressure results in an increase in water level that allows marine water to enter the harbour via the mouth. The north westerly winds act to push surface water to the southern end of the harbour allowing more water to flood over the sill into the Sophia basin. Analysis of oxygen, temperature and salinity logger data indicates that larger renewal events create water column instabilities which can provide a potential threat to the salmon aquaculture industry situated in the harbour. The frequency of renewals also has implications on the standing oxygen concentrations in the harbour, with fewer events likely resulting in greater periods of hypoxia in the bottom and mid water column.

A Sea Level Stratospheric Ozone Intrusion Event Induced within a Thunderstorm Gust Front

AbstractOzone from a stratospheric intrusion (SI) reached sea level in association with a thunderstorm gust front during the predawn hours of 16 April 2018. The event caused surface ozone concentration increases of 30 to more than 50 ppbv in a matter of minutes in a band from approximately Richmond, Virginia, to Philadelphia, Pennsylvania. Peak hourly ozone concentrations reached 74 ppbv in northeastern Maryland despite absent photochemistry and ongoing convective activity. An intense jet stream with velocities >80 kt (41 m s−1) less than 1 km above ground level was observed associated with a deepening cyclone. Modern-Era Retrospective Analysis for Research and Applications, version 2 (MERRA-2), showed a filament of ozone with concentrations greater than 90 ppbv extending downward from the stratosphere to the lower troposphere. This SI filament became collocated with an ongoing severe squall line, and stratospheric ozone was transported directly to sea level when entrained into the squall-line gust front. Weather radar and in situ observations confirmed surface ozone increased with the thunderstorm gust front, while a concurrent reduction in carbon monoxide confirmed air within the gust front had stratospheric origins. While rare, such coupling events are important to troposphere–stratosphere exchanges and in overall atmospheric chemistry and climate. This may be the first event of its type and magnitude documented.

Identification of Ground Intrusion inUnderground StructuresBased on Distributed Structural Vibration Detected by Ultra-Weak FBG Sensing Technology.

It is challenging for engineers to timely identify illegal ground intrusions in underground systems such as subways. In order to prevent the catastrophic collapse of subway tunnels from intrusion events, this paper investigated the capability of detecting the ground intrusion of underground structures based on dynamic measurement of distributed fiber optic sensing. For an actual subway tunnel monitored by the ultra-weak fiber optic Bragg grating (FBG) sensing fiber with a spatial resolution of five meters, a simulated experiment of the ground intrusion along the selected path was designed and implemented, in which a hydraulic excavator was chosen to exert intrusion perturbations with different strengths and modes at five selected intrusion sites. For each intrusion place, the distributed vibration responses of sensing fibers mounted on the tunnel wall and the track bed were detected to identify the occurrence and characteristics of the intrusion event simulated by the discrete and continuous pulses of the excavator under two loading postures. By checking the on-site records of critical moments in the intrusion process, the proposed detection approach based on distributed structural vibration responses for the ground intrusion can detect the occurrence of intrusion events, locate the intrusion ground area, and distinguish intrusion strength and typical perturbation modes.

The costs of cyberterrorism for the national economy: United States of America vs Egypt

Abstract In recent years cyber terrorism has become increasingly used with the globalization of technology and people’s access to high-speed internet. It takes place exclusively in the online environment, the advantage being that it offers an increased level of anonymity to users. Terrorist groups are targeting the misappropriation of social media accounts, focused on Distributed Denial of Service activities, exploiting communications services and banking services for fraudulent misappropriation of financial accounts. Cyberterrorism generates very high costs for the national economy, such as the involvement of specialists for detecting and correcting intrusion, declining productivity and income, costs of information theft, regaining the reputation of an institution or company, the costs relating to the resumption of production and the provision of services, the loss of information concerning intellectual property, financial manipulation using stolen information, the cost of securing computer networks and assuring them in the event of intrusion, costs generated by the time spent on recovering stolen data. In 2018 both the US and Egypt took action on these activities, the US modified its national cyber strategy and Egypt adopted the new law project to combat cybercrime. The main cyber threats they face are: threats of intrusion and sabotage of IT infrastructures, cyberterrorism and cyberwar, threats to digital identity and theft of private data, malware programs. The targets of the attacks were public sector entities, financial organizations, health care organizations, retail and accommodation. The reasons for why hackers attack these organizations are money-related, malware infected by emails, commercial and industrial espionage.

The Gulf Stream North Wall: Ageostrophic Circulation and Frontogenesis

AbstractEastward zonal jets are common in the ocean and atmosphere, for example, the Gulf Stream and jet stream. They are characterized by atypically strong horizontal velocity, baroclinic vertical structure with an upward flow intensification, large change in the density stratification meridionally across the jet, large-scale meanders around a central latitude, narrow troughs and broad crests, and a sharp and vertically sloping northern (poleward) “wall” defined by horizontal maxima in the lateral gradients of both velocity and density. Measurements and realistic oceanic simulations show these features in the Gulf Stream downstream from its western boundary separation point. A diagnostic theory based on the conservative balance equations is developed to calculate the 3D velocity field associated with the dynamic height field. When applied to an idealized representation of a meandering jet, it explains the spatial structure of the associated ageostrophic secondary circulation around the jet and the positive frontogenetic tendency along the northern wall in the meander sector located upstream from the trough. This provides a basis for understanding why submesoscale instabilities and cross-wall intrusion and streamer events are more prevalent along the sector downstream from the trough and at the crest where there is not such a frontogenetic tendency. An important attribute for this frontogenesis pattern is the 3D shape of the jet, whose idealization is summarized above.

Human factor security: evaluating the cybersecurity capacity of the industrial workforce

As cyber-attacks continue to grow, organisations adopting the internet-of-things (IoT) have continued to react to security concerns that threaten their businesses within the current highly competitive environment. Many recorded industrial cyber-attacks have successfully beaten technical security solutions by exploiting human-factor vulnerabilities related to security knowledge and skills and manipulating human elements into inadvertently conveying access to critical industrial assets. Knowledge and skill capabilities contribute to human analytical proficiencies for enhanced cybersecurity readiness. Thus, a human-factored security endeavour is required to investigate the capabilities of the human constituents (workforce) to appropriately recognise and respond to cyber intrusion events within the industrial control system (ICS) environment.,A quantitative approach (statistical analysis) is adopted to provide an approach to quantify the potential cybersecurity capability aptitudes of industrial human actors, identify the least security-capable workforce in the operational domain with the greatest susceptibility likelihood to cyber-attacks (i.e. weakest link) and guide the enhancement of security assurance. To support these objectives, a Human-factored Cyber Security Capability Evaluation approach is presented using conceptual analysis techniques.,Using a test scenario, the approach demonstrates the capacity to proffer an efficient evaluation of workforce security knowledge and skills capabilities and the identification of weakest link in the workforce.,The approach can enable organisations to gain better workforce security perspectives like security-consciousness, alertness and response aptitudes, thus guiding organisations into adopting strategic means of appropriating security remediation outlines, scopes and resources without undue wastes or redundancies.,This paper demonstrates originality by providing a framework and computational approach for characterising and quantify human-factor security capabilities based on security knowledge and security skills. It also supports the identification of potential security weakest links amongst an evaluated industrial workforce (human agents), some key security susceptibility areas and relevant control interventions. The model and validation results demonstrate the application of action research. This paper demonstrates originality by illustrating how action research can be applied within socio-technical dimensions to solve recurrent and dynamic problems related to industrial environment cyber security improvement. It provides value by demonstrating how theoretical security knowledge (awareness) and practical security skills can help resolve cyber security response and control uncertainties within industrial organisations.

Intrusion signal classification using stochastic configuration network with variable increments of hidden nodes

In the environmental security monitoring application, an optical fiber prewarning system (OFPS) functions not only to locate the intrusion events but also recognize them. As a nonlinear network for recognition, the stochastic configuration network (SCN) is considered a promising method because it does not require setting the network scale beforehand. However, in the specific requirements of the application of OFPS, due to the small feature distance of different intrusion signals to be classified, it is necessary to set a smaller value of error tolerance. However, the side-effect is that meeting the constraint condition faces a challenge. To overcome this, we improve the configuration method of the hidden layer nodes in the SCN network. In the proceeding of the network process, the increment of the hidden layer nodes in each loop is gradually increased, and the space of the corresponding random parameters generated is enlarged. The SCN with variable increments of hidden nodes can adjust the number of hidden nodes added in each loop for continuous construction and obtaining higher classification accuracy. This study has a great significance for the application of SCN in the classification of intrusion signals in OFPS.

Upgrade and automation of the JPL Table Mountain Facility tropospheric ozone lidar (TMTOL) for near-ground ozone profiling and satellite validation

Abstract. As part of international efforts to monitor air quality, several satellite missions such as the Tropospheric Monitoring Instrument (TROPOMI) were deployed and others, like Tropospheric Emissions: Monitoring Pollution (TEMPO), are planned for the near future. In support of the validation of these missions, major upgrades to the tropospheric ozone lidar located at the Jet Propulsion Laboratory Table Mountain Facility (TMF) were recently performed. These modifications include the full automation of the system, which now allows unattended measurements during frequent satellite overpasses, and a new receiver that extends the measurement capabilities of the system down to 100 m above surface. The automation led to the systematic operation of the lidar during daily TROPOMI overpasses, providing more than 139 reference profiles since January 2018. Ozone profiles retrieved using the new lidar receiver were compared to ozonesonde profiles obtained from a co-located tethered balloon. An agreement of about 5 % with the ozonesonde down to an altitude range of 100 m a.g.l. was observed. Furthermore, the stability of the receiver configuration was investigated. Comparisons between the lowest point retrieved by the lidar and a co-located surface ozone photometer showed no sign of drift over a 2-month test period and an agreement better than 10 %. Finally, measurements from a 24 h intensive measurement period during a stratospheric intrusion event showed good agreement with two free-flying ozonesondes. These comparisons revealed localized differences between sonde and lidar, possibly owing to the differing vertical resolutions (between 52 and 380 m for lidar and about 100 m for the sonde).

WebHound: a data-driven intrusion detection from real-world web access logs

Hackers usually discover and exploit vulnerabilities existing in the entry point before invading a corporate environment. The web server exploration and spams are two popular means used by hackers to gain access to the enterprise computer systems. In this paper, we focus on protecting a web server in dealing with such cybersecurity intrusion threat. During the discovery stage, a web vulnerability investigation scanner (e.g., SQLMap, NMap, and Kali) is used by hackers to learn the web server versions and other related vulnerabilities. Then, in the exploitation stage, hackers develop a customized intrusion method which exploits those previously learned vulnerabilities to launch a subsequent attack. Currently, the most popular defense approaches (e.g., IDS, WAF) detect web server intrusion events through domain expert rules and anomaly pattern matches. For example, ModSecurity is an open source WAF which only detects known malware signature by domain expert rules. Thus, those approaches are good to defend the first discovery stage intrusion. However, they are not effective to deal with the customized intrusion in the second exploitation stage since no rules or signatures are available for such kind of intrusion detection. In this paper, in order to resolve the above problem, we propose an unsupervised data-driven anomaly detection known as WebHound. It not only identifies hackers reconnaissance but also detects the customized intrusion means deployed by hackers by analyzing large-scale web access logs. Moreover, WebHoundalso provides intrusion evidence using storyline for recovering intrusion procedure. Among numerous experiments and case studies, we applied WebHoundto a special government case for the intrusion evidence investigation and at the same time, we compared our results with the work done by computer forensic experts. The results showed that WebHoundcould discover more intrusion evidence than human experts. We also compared WebHoundwith ModSecurity which is updated with the newest domain expert rules running in a virtualized corporate environment. The experimental results show that WebHoundhas a better accuracy rate than ModSecurity. In summary, WebHoundalleviates the heavy demand on expert knowledge and human efforts to detect cyber-attack on a web server, and it also enhances detection accuracy and recall rate. Moreover, WebHoundcould provide more evidence for forensic experts to trace the original entry points.

基于过零率的光纤周界安防系统入侵事件高效识别

基于过零率的光纤周界安防系统入侵事件高效识别

A Case Study of Stratospheric Ozone Transport to the Northern San Francisco Bay Area and Sacramento Valley during CABOTS 2016

AbstractThe California Baseline Ozone Transport Study (CABOTS) was a major air quality study that collected ozone measurements aloft between mid-May and mid-August of 2016. Aircraft measurements, ground-based lidar measurements, and balloon-borne ozonesondes collected precise upper-air ozone measurements across the central and Southern California valley. Utilizing daily ozonesonde data from Bodega Bay, California, and Modern-Era Retrospective Analysis for Research and Applications, version 2 (MERRA-2), reanalysis data for 25 July to 14 August 2016, three stratospheric intrusion events are identified over Northern California influencing air masses above Bodega Bay and Sacramento simultaneously. Calculated percent daily changes in afternoon ozonesonde observations indicate increasing ozone concentrations from the point of likely stratospheric air injection with the arrival of higher potential vorticity, confirmed by ensemble back trajectories. An analysis of the onsite surface monitoring ozone data indicates ozone increases in the observations for dates of plausible low-level stratospheric air influence. Further, a comparison of Bodega Bay surface ozone observations and 14 Sacramento Valley nonattainment zone surface sites show that the surface ozone observed at the higher-elevation surface sites in the lower Sierra Nevada foothills were positively correlated with elevated ozone captured by the ozonesondes within the lowest 0.5–1 km. The strongest correlations observed (~0.61) were between elevated Bodega Bay ozonesonde data and the Placerville (~612 m) afternoon surface ozone data, an indication that these regions separated by 200 km would be influence by the same ozone source. A comparison of daily changes in afternoon ozone show that the two locales often experience similar daily ozone increases or decreases. While this study leads to a basic quantification of stratospheric influence on surface ozone in the Sacramento nonattainment zone, a future campaign that examines ozone and winds aloft at both locales is suggested to improve the quantification of stratospheric ozone.

Variational Mode Decomposition-Based Event Recognition in Perimeter Security Monitoring With Fiber Optic Vibration Sensor

Recognition of different kinds of human intrusions from the environmental disturbance with high efficiency is still a challenging task in perimeter security monitoring with fiber optic vibration sensor, since the vibration signals induced by these events are highly similar to each other, and it can not be directly discriminated by the signals. In this paper, an intelligent event recognition scheme is proposed to improve its performance in complicated environmental applications. In this event recognition scheme, a variational mode decomposition based kurtosis feature combined with a zero crossing rate feature is used as the input feature vectors. A support vector machine is used to classify the input feature vectors into the corresponding categories. A series of field tests show that the proposed scheme can accurately and rapidly classify wind disturbance and three typical patterns of human intrusions such as waggling the fence, climbing the fence and knocking the fence. The average identification rate of 100.0% and 96.9% are achieved for the wind disturbance and human intrusion events, respectively. The recognition processing time can be controlled less than 0.4 s. Thus, the intelligent event recognition scheme can fully satisfy the online monitoring requirements for practical applications.

Variational data generative model for intrusion detection

A Network Intrusion Detection System is a system which detects intrusive, malicious activities or policy violations in a host or hosts network. The ability to access balanced and diversified data to train the system is very important for any detection system. Intrusion data rarely have these characteristics, since samples of network traffic are strongly biased to normal traffic, being difficult to access traffic associated with intrusion events. Therefore, it is important to have a method to synthesize intrusion data with a probabilistic and behavioral structure similar to the original one. In this work, we provide such a method. Intrusion data have continuous and categorical features, with a strongly unbalanced distribution of intrusion labels. That is the reason why we generate synthetic samples conditioned to the distribution of labels. That is, from a particular set of labels, we generate training samples associated with that set of labels, replicating the probabilistic structure of the original data that comes from those labels. We use a generative model based on a customized variational autoencoder, using the labels of the intrusion class as an additional input to the network. This modification provides an advantage, as we can readily generate new data using only the labels, without having to rely on training samples as canonical representatives for each label, which makes the generation process more reliable, less complex and faster. We show that the synthetic data are similar to the real data, and that the new synthesized data can be used to improve the performance scores of common machine learning classifiers.

A game theoretic approach to cooperative intrusion detection

In Mobile Ad-Hoc Networks, cooperative intrusion detection is efficient and scalable to massively parallel attacks. However, due to concerns about privacy leakage and resource costs, if without enough incentives, most users are often selfish and disinterested in helping others to detect an intrusion event, thus an efficient incentive mechanism is required. In this paper, we formulate the incentive mechanism for cooperative intrusion detection as an evolutionary game and achieve an optimal solution to help nodes decide whether to participate in detection or not. Our proposed mechanism can deal with the problems that cooperative nodes do not own complete knowledge about other nodes. We develop a game algorithm to maximize nodes’ utility. To prevent malicious nodes from abusing our incentive mechanism, a punishment-appeal mechanism is proposed to penalize malicious behavior. Simulations demonstrate that our strategy can efficiently incentivize non-malicious nodes to cooperate and decrease the false detection rate.

Events detection and recognition by the fiber vibration system based on power spectrum estimation

One of the important successes of optical fiber sensor established for the security system is the detection and the recognition of any type of events. The performance parameters (event recognition, event detection position, and time of detection) are unavoidable and describe the validity of any perimeter detection system. An event recognition is any signal detected within the protected area, and it is related to a non-intrusion event and an intrusion event. To achieve the detection and the recognition events at the real time, an effective two-level vibration recognition method and a technique are proposed and presented in this article. The signal characteristics (short-term energy and short-time over-threshold) have been used and compared to the dynamic threshold to judge the type of event. Then the extraction of the power distribution features on the frequency domain through power spectral estimation on the suspected intrusion signal samples is carried out and finally combined with the time-domain characteristics as feature vector through Support Vector Machine to determine the efficiency and effectiveness of the proposed vibration recognition method. The experimental simulation results show that the proposed method is effective and reliable. With collected data, it can detect and recognize the type of event in real time.

Rapid Coastal Forest Decline in Florida’s Big Bend

Coastal ecosystems throughout the world are increasingly vulnerable to degradation as a result of accelerating sea-level rise and saltwater intrusion, more frequent and powerful extreme weather events, and anthropogenic impacts. Hardwood swamp forests in the Big Bend region of Florida’s Gulf of Mexico coast (USA) are largely devoid of the latter, but have degraded rapidly since the turn of the 21st Century. Photographs of the forest, collected on the ground since 2009, were used to guide an analysis of a 60 km2 study area using satellite images. The images confirm that the coastal forest area declined 0.60% from 1982 to 2003, but degraded rapidly, by 7.44%, from 2010 to 2017. The forest declined most rapidly along waterways and at the coastal marsh–forest boundary. Additional time series of aerial-photographs corroborated the onset of degradation in 2010. Degradation continued through 2017 with no apparent recovery. Previous research from the area has concluded that increased tidal flooding and saltwater intrusion, of the coastal plain, represent a chronic stress driving coastal forest decline in this region, but these drivers do not explain the abrupt acceleration in forest die-off. Local tide gage data indicate that sea-level rise is 2 mm yr−1 and accelerating, while meteorological data reveal at least two short-term cold snap events, with extreme temperatures exceeding the reported temperature threshold of local vegetation (−10 °C) between January 2010 and January 2011, followed by more extremes in 2016. The Big Bend hardwood forest experienced acute cold snap stress during the 2010–2017 period, of a magnitude not experienced in the previous 20 years, that compounded the chronic stress associated with sea-level rise and saltwater intrusion. This and other coastal forests can be expected to suffer further widespread and lasting degradation as these stresses are likely to be sustained.

An Assessment of Stratospheric Intrusions in Italian Mountain Regions Using STEFLUX

The Mediterranean basin is considered a global hot-spot region for climate change and air quality, especially concerning summer-time ozone (O3). Previous investigations indicated that the Mediterranean basin is a preferred region for stratosphere-to-troposphere exchange (STE) and deep stratospheric intrusion (SI) events. The Lagrangian tool STEFLUX, based on a STE climatology that uses the ERA Interim data, was hereby used to diagnose the occurrence of deep SI events in four mountain regions over the Italian peninsula, spanning from the Alpine region to the southern Apennines. By using near-surface O3 and relative humidity (RH) observations at three high-mountain observatories, we investigated the performance of STEFLUX in detecting deep SI events. Both experimental and STEFLUX detections agreed in describing the seasonal cycle of SI occurrence. Moreover, STEFLUX showed skills in detecting “long-lasting” SI events, especially in the Alps and in the northern Apennines. By using STEFLUX, we found positive tendencies in the SI occurrence during 1979–2017. However, in contrast to similar studies carried out in the Alpine region, the negative long-term (1996–2016) trend of O3 in the northern Apennines did not appear to be related to the SI’s variability.