abstract: Web security has become an important subject; many companies and organizations are becoming more security conscious as they build web applications to render online services and increase web presence. Unfortunately, many of these web applications are still susceptible to threats as they lack strong immunity to malicious attacks. This poses potential danger to the users of the sites and could also affect operations of the organizations or companies concerned. Educational institutions are not left out, their portals and websites hold vital information whose integrity is of utmost importance. Taking Carnegie Mellon University Africa's internship portal as case study, we carried out penetration tests to investigate web vulnerabilities and proffered possible remedies to the discovered vulnerabilities. Our result will inform educational institutions on better website security practices, especially in the African domain.
author:
title: Web Security Investigation through Penetration Tests: A Case study of an Educational Institution Portal

# Introduction

About 24 million malware incidents targeting Africa were observed in 2016 . As the internet community expands, web threats are on the rise and it is difficult to provide patches that aid in solving all security vulnerabilities. A vulnerability is a flaw or weakness in a system's design, implementation or operation that could be exploited to violate the system's security. A vulnerability is also a combination of three elements which involve the system flaw, attacker accessibility to the flaw and attacker efficiency to exploit the flaw . Studies have shown that firewalls and anti-virus programs are not sufficient to provide effective system security . There are attacks such as cross site scripting and many others which affect websites. Cross site scripting refers to the injection of malicious scripts into a legitimate website \[3\]. We investigate vulnerabilities and the safety level of students and companies' data on the internship portal of Carnegie Mellon University Africa (CMUA). [^1] The internship portal was purposely built to grant access to companies to upload internship vacancies available. Students can access the portal and are able to view company details, see vacancies available and get information on the application procedures. Students upload confidential information on the website. Thus, this site represents a modestly complex site with multiple types of data and different stakeholders. Understanding vulnerabilities will inform the CMUA Information Technology team, website administrators in other educational institutions, and anyone with knowledge on security policies and systems with the kind of security measures to put in place in their systems to avoid users' data compromise.

In this work, penetration tests were carried out on the website to identify vulnerability of the website. However, attack recovery mechanisms were not investigated in this work.

Penetration testing examines the behavior of systems under extreme conditions to identify their weaknesses and vulnerabilities. Penetration testing can highlight issues in security using a variety of tools which are able to analyze the system, while others attack the system to exploit vulnerabilities. Penetration testing involves gathering information about the target system before the test (reconnaissance), identifying possible entry points, attempting to break in and reporting the findings . Types of penetration tests include; external test, internal test, blind test and double-blind test. The choice depends on the environment where the test will be run. In this paper, we focus on external. External test aims to examine if illegitimate people can gain unauthorized access and what level of access can be gained while internal test simulates an attack from the inside behind the firewall by an authorized user with standard access privileges.

# Importance and Prior Work

In related papers, authors mentioned how malicious attackers can edit customers' information, how to perform tests to discover vulnerabilities and how to protect against attacks.

## Why secure web applications?

discussed web application security and the different techniques that can be used to establish potential vulnerabilities a web application might have. From the authors research, they found that the growth and evolution of the internet have impacted the way we generate and communicate many sensitive information. The authors mentioned that e-commerce sites which produce data can be stolen or altered if they do not have the necessary safety measures for handling their use. The fact that computers worldwide are susceptible to attack by hackers or crackers able to compromise computer systems and steal valuable or delete a large part of the computer's information is an issue which needs to be investigated. Some common attacks on web application mentioned by the authors include semantic URL; where the attacker modifies the URL to perform actions that are not originally planned to be handled properly by the server, cross-site scripting; which allows code injection by malicious web users, where false requests are sent using special tools and cross-site request forgery; which allows the attacker to send HTTP requests at will from the victim's machine. This situation is essential to know if these systems and data networks are protected from any kind of intrusion. It is important that web applications are not only designed for the objectives for which they were created but they must also be designed to take care of the data and information generated in them.

## What kind of tests should be performed on websites?

presented different aspects of penetration testing including tools, attack methodologies and defense strategies. Different penetration tests were performed using a private network, devices and virtualized systems and tools. The authors performed attacks such as smartphone penetration testing, hacking phones Bluetooth, traffic sniffing, man-in-the-middle attack, spying and hacking remote PC via IP and open ports using advanced port scanner. The authors' purpose was to explain the use of penetration testing and share concepts for understanding the test. Tools within the Kali Linux suite were used. The result showed a success rate of 14.29% for a man-in-the-middle attack, and a remote PC hacking. The researchers also corroborated the fact that anti-viruses and anti-malware are not sufficient anymore to ensure security. They also expressed how important systems like weather systems could be easily violated through penetration testing tools.

presented an efficient integrated penetration testing tool to detect five of the top ten web application vulnerabilities to date. They also pointed out issues accompanied with some penetration testing tools. Issues such as generation of high rates of false positives/negatives, efficiency, performance and reliability of the results are concerns while using systems like Acunetix, ZAP and w3af for penetration testing. From their research, they gathered that lightweight penetration testing approaches which generate extremely low false positive/negative rates are required. Their Web Guardia (an integrated penetration testing system to detect web application vulnerabilities) is able to crawl through a given target web application and detect vulnerabilities such as SQLI, XSS, Unvalidated Redirects and Forwards, Insecure Direct Object References and Security Misconfigurations. Their tool uses a simple architecture which involves crawling, attacking analyzing and reporting modules. From their research, it was discovered that the use of Web Guardia can keep the generation of false positives and negatives at a minimum level because it is technically unfeasible to completely avoid generation of false positives and false negatives.

## How to mitigate Web Security Attacks?

Protecting shared assets from unauthorized users has become more than necessity. demonstrated that firewalls, antivirus software, Windows Defender and other prevention techniques will not suffice in preventing attacks. The authors examined different aspects of penetration testing to determine vulnerable applications and hosts using the Nmap and Metasploit frameworks. A virtualized system was used that included different versions of Windows and Linux OS. The results showed that tools such as Nmap and the Metasploit framework are effective tools for the discovery of open holes in a defense system or network. The test results indicated that vulnerable programs are the main source of the problem. Also, creating patches is not a good fix because same types of vulnerabilities are exploited daily through code injection, remote access, and denial of service.

identified web defacement as one of the most common attacks on websites. The authors explained that there has been a gentle decline in the number of web defacement from 2013 to 2017. They proposed a Web Defacement and Intrusion Monitoring Tool (WDIMT) that could rapidly identify altered or deleted web pages. The proposed tool will also be used to regenerate the original content of a website after the website has been defaced, this is one of the strongest points of WDIMT. The tool uses four major commands to perform tasks, which are: Initialize, verify, force, and delete. Upon executing these commands, the WDIMT detects any defacement that may have occurred or is currently in progress. If defacement is noticed it re-uploads the original content of that web page. This tool may help to reduce the numbers and effects of web defacement attacks.

# Methodology

Fig.1 above shows the conceptual view of the approach adopted. In getting a clue to how safe user data in Carnegie Mellon University Africa's internship portal is, the answers to the following questions will be helpful. Is CMUA internship system secure? Are there vulnerabilities, and how severe are the vulnerabilities? How easy (in terms of time and resources committed) is it for an attacker to penetrate and compromise the system? The answers will be made clear in our results. The educational institutions as the targeted audience in this research will stand to benefit from the outcome of the research and may take actions where necessary to ensure maximum security.

The work involved the use of BurpSuite for penetration testing of the selected website to investigate the degree of security of data in the website. Vulnerabilities discovered after the scan were classified by level of severity and certainty. In details we discuss the chosen tool, scope of the work, and approach.

## Tool Employed

After analyzing the pros and the cons of existing penetration testing tools, BurpSuite was identified as the most suitable tool in the context of this research. BurpSuite is a cross-platform java application with several Web Application Security or penetration testing tools bundled into it to make a single suite. Reasons for choosing BurpSuite is that it is easier to use, and basic tests do not require the writing of scripts. BurpSuite makes processes like intercept behavior configurations, application walk through, automated scanning and initial pilfering easier. Also, Kali Linux operating system comes with BurpSuite's free edition installed.

## Scope

We limit this work to external penetration test operations which involve, scanning the website for SQL injection, cross-site scripting and other common vulnerabilities.

## Approach

To investigate security through penetration testing on the internship portal, an approach that involved the use of BurpSuite for website scanning was used. The BurpSuite application can run on both Linux and Windows operating system. It provides functionalities for easy setup and automated scan. Below are some of the features contained in BurpSuite as provided from BurpSuite's documentation. Some of these tools will be employed in this research.

-   Spider: This can be used for automatically crawling an application, to discover its content and functionality.

-   Scanner: This is used to automatically scan HTTP requests to find security vulnerabilities.

-   Intruder: This allows you to perform customized automated attacks, to carry out all kinds of testing tasks.

-   Repeater: This is used to manually modify and reissue individual HTTP requests over and over.

-   Sequencer: This is used to analyze the quality of randomness in an application's session tokens.

-   Decoder: This lets you transform bits of application data using common encoding and decoding schemes.

-   Comparer: This is used to perform a visual comparison of bits of application data to find interesting differences. The spider, scanner where explicitly used in our test operations, other features where employed implicitly during the run process.

    Fig. 2 shows details of the steps (step 1 to step 7) we followed in using BurpSuite for the vulnerability analysis of the portal.

# Penetration Testing Result and Discussion

After scanning with BurpSuite, 16 certain low severity issues were discovered as shown in Table 1 below.

|                                                                     |
|:--------------------------------------------------------------------|
| <img src="result.png" style="width:8.3cm;height:4cm" alt="image" /> |

Issues with severity and confidence level.

The confidence level indicates BurpSuite's certainty of the issues discovered. The severity level indicates the impact a vulnerability has on the system if exploited. Vulnerabilities are hereby listed with corresponding remediation where necessary.

## Input returned in response (reflected)

There were two instances of this issue. It affected the Home and Contacts page of the website. This issue could lead to client-side vulnerabilities such as cross site scripting, open redirection, content spoofing and response header injection. In a case such as this, server-side vulnerabilities like SQL injection is easier. This vulnerability could be further classified as Improper Input Validation which leads to unintended inputs and Improper Encoding or Escaping of output which leads to the structure of the message not been preserved.

**Remediation:** Input should not be echoed at the application's response.

## Cross-domain Referrer leakage

There were three instances of this issue which occurred at the Contacts, Home and root page. The vulnerability was classified as Information Exposure vulnerability in the Common Vulnerabilities and Exposure (CVE) list.

**Remediation:** Applications should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referrer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.

## Cross-domain script include

This occurs when an application includes scripts from an external domain. The script is executed by the browser within the security context of the invoking application and can function as the application's own script and has access rights to the application data and perform actions within the context of the current user. The vulnerability was classified as Inclusion of functionality from untrusted control sphere vulnerability in the CVE list.

**Remediation:** Scripts should not be included from untrusted domains. Applications that consider the use of third-party scripts should copy the contents of the scripts to their own domain else re-implement the script's functionality within the application code.

## Password with autocomplete enabled

There were two instances of this issue on the site. It occurred on the root page and the careers page. This function can be configured by the user and by applications that employ user credentials. This functionality allows the storage of user credentials on the local computer and is retrieved on future visits to the same application. The stored credentials can be captured by an attacker who gains control over the user's computer. The vulnerability was classified as Inclusion of functionality from untrusted control sphere vulnerability in the CVE list.

**Remediation:** Include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).

## Browser cross-site scripting filter disabled

Some browsers, including Internet Explorer, contain built-in filters designed to protect against cross-site scripting (XSS) attacks. Applications can instruct browsers to disable this filter by setting the following response header: X-XSS-Protection: 0. This behavior does not in itself constitute a vulnerability; in some cases, XSS filters may themselves be leveraged to perform attacks against application users. However, in typical situations, XSS filters do provide basic protection for application users against some XSS vulnerabilities in applications. The presence of this header should be reviewed to establish whether it affects the application's security posture.

**Remediation:** Review whether the application needs to disable XSS filters. In most cases you can gain the protection provided by XSS filters without the associated risks by using the following response header: X-XSS-Protection: 1; mode=block

## Client-side HTTP parameter pollution (reflected)

Client-side HTTP parameter pollution (HPP) vulnerabilities arise when an application embeds user input in URLs in an unsafe manner. An attacker can use this vulnerability to construct a URL that, if visited by another application user, will modify URLs within the response by inserting additional query string parameters and sometimes overriding existing ones. This may result in links and forms having unexpected side effects. For example, it may be possible to modify an invitation form using HPP so that the invitation is delivered to an unexpected recipient.

**Remediation:** Ensure that user input is URL-encoded before it is embedded in a URL.

## Email addresses disclosed

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

**Remediation:** Consider removing any email addresses that are unnecessary. Provide a form that generates the email server-side, protected by a CAPTCHA if necessary.

## Cacheable HTTPS response

**Remediation:** Applications should return caching directives instructing browsers not to store local copies of any sensitive data. Often, this can be achieved by configuring the web server to prevent caching for relevant paths within the web root.

# Conclusion

On investigating web security on educational institution web portal, Carnegie Mellon Africa's internship portal was analyzed externally for vulnerabilities to determine the safety of user data on the site. The result from this analysis explains that the level of security of user data on the website is not sufficient. Although in context, the issues discovered are of low severity, the combination of such low severity issues become serious and demand attention. Remedies have been proffered for the vulnerabilities discovered. This stands to inform educational institutions on measures to assure secure websites and portals. Future work involves exploitation of XSS vulnerabilities by launching XSS attacks on a similar portal.

[^1]: https://cmu-r.secure.force.com/Careers/InternshipHomePage


abstract: MUSE, a 2nd generation VLT instrument, will become the world's largest integral field spectrograph. It will be an AO assisted instrument which, in a single exposure, covers the wavelength range from 465 to 930 nm with an average resolution of 3000 over a field of view of 1'$\times$`<!-- -->`{=html}1' with 0.2" spatial sampling. Both the complexity and the rate of the data are a challenge for the data processing of this instrument.
  We will give an overview of the data processing scheme that has been designed for MUSE. Specifically, we will use only a single resampling step from the raw data to the reduced data product. This allows us to improve data quality, accurately propagate variance, and minimize spreading of artifacts and correlated noise. This approach necessitates changes to the standard way in which reduction steps like wavelength calibration and sky subtraction are carried out, but can be expanded to include combination of multiple exposures.
author: Peter M. Weilbacher, Joris Gerssen, Martin M. Roth, Petra Böhm; Arlette Pécontal-Rousset; and the MUSE team
title: Advanced Data Reduction Techniques for MUSE

# The Instrument

MUSE is planned to be a giant integral field spectrograph and going to be commissioned as a second generation VLT instrument starting in 2012. Its 1$\times$`<!-- -->`{=html}1field of view is sampled at 0 resolution in wide-field mode. In the adaptive-optics supported mode, observing in a narrow-field mode with sampling at 0 is possible. Each exposure delivers about 90000 spectra, using 24 slicer integral field units (IFUs), each equipped with a separate 4k$^2$ CCD. The full wavelength range from 465 to 930 nm is covered with resolution between 2000 and 4000.

The light at the VLT focal plane is divided into 24 sub-fields, each of which has a size of 60$\times$`<!-- -->`{=html}2 on the sky. Within each IFU, the sub-field is then further decomposed into 48 slices. Each slice has a size of 15$\times$$\sim$`<!-- -->`{=html}0 on the sky. The spectrograph in each IFU disperses the light and focuses the spectral pattern on a 4k$\times$`<!-- -->`{=html}4k CCD. This means that the data appears on the CCDs as 48 strips of spectra which are 75 px wide and 4096 px high. In between these strips of data, dark regions of $\sim$`<!-- -->`{=html}6 px width can be used to identify stray-light.

Each raw exposure has a size of roughly 800 MB; by using the full capabilities of the Euro3D format, a processed exposure can require about 4.5 GB of storage. Typical observing nights will have 50 GB of raw data per night (calibrations plus science exposures), but the data rate may be as high as 150 GB per night. Each exposure will contain approximately 350 million illuminated pixels.

# The Data Processing Pipeline

The main goals of the MUSE data processing pipeline are to fully reduce all exposures into ready-to-use datacubes (Euro3D format or FITS with NAXIS=3) without creating a backlog (a requirement on scope of the reduction and the speed), to track bad pixels, propagate error information, and to minimize the rebinning steps. Especially the last two goals are connected and not yet commonly implemented in existing data reduction systems. We therefore discuss the details in the following sections.

## Noise Propagation

We take the approach of Gössl & Riffeiser (2002) and estimate the variance from the raw data: $$\sigma^2_\mathrm{initial} = \sigma^2_\mathrm{bias}
                          + \frac{\sigma^2_\mathrm{bias}}{n_\mathrm{bias}}
                          + \frac{\mathrm{counts} - \mathrm{bias}}{\mathrm{gain}}$$ The terms describe the read-out noise, the error of the read-out noise estimate, and the photon noise of each pixel.

This variance is then tracked through all processing steps using Gaussian error propagation. This approach assumes that the CCD pixels are uncorrelated which should be true to first order. During data analysis, the variance, together with the data value itself, makes it possible to directly read off the S/N estimate at each position in the output datacube.

## One-step Resampling

If we followed the classical approach to determine a calibration function for one type of distortion and applied it (requiring resampling), before determining the next one, MUSE data would have to be resampled four to five times. Every resampling step always adds noise to a dataset. To be able to display and analyze data one always needs a rectangular format, so at least one resampling step has to be carried out. Resampling more than once complicates the noise propagation, passing it through five steps is near impossible.

The approach we use for the one-step resampling is centered around what we call a "pixel table" (Davies 2007 describes a very similar approach that was developed for the KMOS instrument). This table contains a list of all illuminated pixels (the data value, the bad pixel status, and the variance) of one exposure together with the coordinates ($x$, $y$, and $\lambda$). As soon as first estimates of the three coordinates are known, i. e. following tracing and wavelength calibration, the CCD-based data is transfered into such a pixel table.

Once the data are listed in the pixel table, each transformation that would classically require an interpolation step can then be carried out just by changing the coordinates of each table entry. Shifting the data (such as done when combining multiple exposures) just adds a constant to the column representing the spatial axis; tilting it (as needed to correct for differential atmospheric refraction) applies a function to both spatial axes. Astrometric calibration can be carried out by replacing pixel values in the two spatial axes with values of RA and DEC (using a function describing an astrometric solution).

To determine the function that needs to be applied to the dataset for a given transformation one in most cases needs to resample the data already into a datacube. An example is the flux calibration where the standard star exposure needs to be concerted to a datacube before one can measure the flux for each wavelength to derive the response function. But as the intermediate datacubes are generated of auxiliary data and are not used after the measurement, this does not affect the data quality of the science data. Additionally, for some operations it is possible to generate the temporary datacube with coarse resolution, and should therefore not have a large impact on the speed of the operation when compared to the classical approach.

## Final Resampling

The final resampling involves the transformation from the pixel table to the datacube. The problem here is that due to instrumental distortions the data are irregularly spaced. It is difficult to find neighboring pixels needed to interpolate.

A naive approach to this problem is to search through the table to find the closest point(s) to be interpolated onto the output grid point. This means to search millions of pixels repeatedly, to compute the distances to the output grid point. For the data of only one MUSE IFU ($\sim$`<!-- -->`{=html}15 million pixels) this process takes more than a week. This method can be sped up to only take hours when using knowledge of the instrument geometry and a system of hierarchical lookup tables so that one can restrict the search to a few thousands of pixels for each output point.

Research of other existing algorithms that resample irregular data on an output grid shows that all of them use nested loops and so work efficiently only for sets of small size. Hence, we developed our own algorithm that only uses "flat" loops. In this scheme, which we call "grid cell" approach, we first sort all pixels into a three-dimensional array that represents the output grid. Each input pixel is assigned to the nearest output grid point. This means that while in some cases none or more than one pixel are located in each grid point, it is still easy and fast to find neighboring pixels. And if the grid is well chosen for the input data, every grid cell will on average contain one input pixel.

We plan to implement a few interpolation algorithms. The simplest one, nearest neighbor, is almost trivial to implement, and the fastest possible scheme. The whole conversion from the pixel table to the output datacube takes only about 30 s per MUSE IFU. Another interpolation to be implemented is a distance-based weighting method. For this, we will use a modified inverse square law for interpolation: $f_w = \left( \frac{r_c-r}{r_c r} \right)^2$. This function is taken from Renka (1988) and vanishes at a cutoff radius $r_c$, so that interpolation can be restricted to the nearest 6 ($r_c=1.25$) or 26 ($r_c=1.75$) grid cells. Finally, Kriging (Krige 1951) and sinc interpolation are candidates for further resampling techniques, but at this point it is not clear if they are usable with MUSE data.

# Pipeline Implementation

The MUSE data processing system will be implemented in the ESO context, as plugin ("recipes") to esorex, Gasgano, or Reflex (Hook et al., 2008). The code will be written in C and use the Common Pipeline Library (CPL) provided by ESO.

The pipeline will consist of a basic level of data reduction (bias, dark, and flat-field combination, wavelength calibration, application of calibration to science data), handling data on the basis of each integral field unit, i.e. per CCD, separately. The second level is required to derive scientifically usable data and will work on data from all units (across all sub-fields) simultaneously. This part consists of a complex procedure to determine the relative position of each slice within the field of view (the "geometry"), and on-sky calibration procedures like standard star reduction, handling of separate sky and astrometric exposures, as well as combination of multiple exposures into the final output datacube.
The basic level of reduction can be trivially parallelized, running multiple reduction processes at the same time. The second level is designed to use OpenMP to run several processing threads in parallel while processing the data across all 24 sub-fields.

# Summary

The combination of high data rate and the very complex structure makes it difficult and possibly very time consuming to handle MUSE data.

The "one-step resampling" approach presented here is conceptually simple. In this scheme it is necessary to carry out additional steps to be able to perform the same tasks as in the classical reduction approach. CPU and memory requirements are therefore higher, but the improved data quality and the knowledge of variance make this a suitable method for MUSE data processing.

The final design review of the MUSE instrument is going to take place in March 2009. Following this date, the data reduction system will be implemented to be ready for commissioning starting end of 2012.

PMW acknowledges support by the German Verbundforschung through the MUSE/D3Dnet project (grant 05A08BA1). Discussions with Richard Davies and Jarle Brinchmann were important to develop and improve the resampling algorithm.


abstract: Individual neighborhoods within large cities can benefit from independent analysis of public data in the context of ongoing efforts to improve the community. Yet existing tools for public data analysis and visualization are often mismatched to community needs, for reasons including geographic granularity that does not correspond to community boundaries, siloed data sets, inaccurate assumptions about data literacy, and limited user input in design and implementation phases. In Atlanta this need is being addressed through a Data Dashboard developed under the auspices of the Westside Communities Alliance (WCA), a partnership between Georgia Tech and community stakeholders. In this paper we present an interactive analytic and visualization tool for public safety data within the WCA Data Dashboard. We describe a human-centered approach to understand the needs of users and to build accessible mapping tools for visualization and analysis. The tools include a variety of overlays that allow users to spatially correlate features of the built environment, such as vacant properties with criminal activity as well as crime prevention efforts. We are in the final stages of developing the first version of the tool, with plans for a public release in fall of 2016.
author:
Katie O'Connell
Yeji Lee
Firaz Peer

Shawn M. Staudaher

; Alex Godwin
Mackenzie Madden
Ellen Zegura

bibliography: references.bib
title: Making Public Safety Data Accessible
  in the Westside Atlanta Data Dashboard

# Introduction

Individual neighborhoods within large cities can benefit from independent analysis of public data in the context of ongoing efforts to improve the community. For example, communities in the Westside of Atlanta have been changing their neighborhoods for the better by organizing amongst themselves and collaborating with organizations that have a local presence. Georgia Tech has partnered with Westside communities via the Westside Community Alliance (WCA), a communications network started in 2011 by the Ivan Allen College of Liberal Arts in collaboration with the College of Design and the Office of Government and Community Relations. The WCA works to build and sustain relationships among constituencies located in West Atlanta to strengthen partnerships around issues of common concern.

Since its inception in 2011, the WCA recognized the importance of data dissemination as a tool for community development. In February 2016 the WCA launched the WCA Data Dashboard. This on-line website is designed to be a one-stop data shop with information presented in locally recognized and meaningful geographies. Rather than census tracts or zip codes, data is presented by neighborhood or Neighborhood Planning Unit (NPU). In the Atlanta area, neighborhoods and NPUs represent the unit of local community organization as well as local identity and pride. The Dashboard developers have gathered previously siloed data sets and integrated them into one platform to support examining data relationships. Central to the Dashboard's design is regular engagement with local organizations and community groups both for design feedback and for data literacy training. The Data Dashboard is organized into portals that correspond to community concerns. Currently there are five portals—community profile, education, historic data, historic timeline, and resource library—with several more in the pipeline [^1].

In Summer 2016, the WCA served as a client and partner in the Atlanta Data Science for Social Good (DSSG-ATL) summer internship program. DSSG-ATL is modeled after the DSSG summer fellowship program started at the University of Chicago in 2013; students work full-time in teams on projects that come from local partners, with a focus on supporting understanding and decision-making based on data, in domains of social importance. DSSG-ATL started in 2014 [^2].

In this paper, we describe our participatory approach to building the public safety module of the WCA's Data Dashboard, with some key insights into how one can approach similar projects in the future. We conducted interviews with key community stakeholders and participated in local government meetings to understand the needs of our users. These needs include the ability to locate where crimes have occurred, a metric to quantitatively evaluate the efficiency of their public safety programs, and a means to learn how other factors such as education, age, transportation, housing, and more are related to crime. To satisfy these needs, we introduce a mapping tool with the capability to locate current and historic hotspots of criminal activity. This tool includes a variety of overlays that allow users to spatially correlate features of the built environment, such as code violations with criminal activity as well as crime prevention efforts. We also present a statistical model that highlights correlations between crime and other socio-economic factors specific to particular neighborhoods in Atlanta.

Parts of the public safety module have been built with Tableau and web-based mapping libraries like CartoDB and Leaflet.js to help maintain consistency with the existing Data Dashboard. We are in the final stages of developing the first version of the tool, with plans for a public release in the fall of 2016.

This paper is organized as follows. In Section  we review related work on public mapping systems, participatory design, and public data use, along with design goals of the WCA Data Dashboard to highlight how these goals are not fully met by existing work. We then describe our approach to gathering user input and understanding user needs. The public safety portal design is described in Section 4 and includes a description of the data sets used to populate the portal. Section 5 contains a discussion of issues that arose during portal development and that suggest the need for additional work in the public data community. We conclude in Section 6.

# Related Work and Design Goals

We divide related work into three categories: public geographical information systems; participatory design; and community-based mapping tools specific to crime. We then list the design goals of the Data Dashboard in general and the Public Safety portal in particular.

## Public Geographical Information

Community participation in urban planning is an area of growing interest for urban developers and researchers in geographical information science (GIS) . Visualization tools in GIS encompass a wide scale, ranging from traditional pen-based sketching approaches to advanced computerized mapping toolkits . While it is easy to imagine that advancements in GIS alone can serve to empower community members due to more powerful and easier-to-use spatial analysis systems, the role that GIS software plays in community development can vary dramatically. For example, when GIS is used only to inform members of the community of new policy without inviting participation, it can serve to further disenfranchise grassroots organizations and local stakeholders. This one-sided definition of participation can be classified as educational at its most optimistic or manipulative at its most cynical .

In contrast, public participation geographic information systems (PPGIS) attempt to make GIS tools more widely available and facilitate interaction with all stakeholders  . Approaches such as Bottom-up GIS  allow members of the community to participate in the planning of urban growth by incorporating their perception of the neighborhood into analysis of spatial data (e.g., areas where a large number of crimes are perceived to be reported but never recorded in the official public data). In our research, we have attempted to incorporate community member perception into the design of a tool that correlates traditional measures of public safety (e.g., crime reports) with what local residents see as the most important assets affecting public safety through community development and outreach programs (e.g., churches, schools). Tools using this approach can themselves become inroads to improving the participation of young people in neighborhood planning by capturing the more qualitative aspects of youth perception of a neighborhood and facilitating the design of subsequent outreach programs .

## Participatory Design

The idea of talking to users to elicit their needs is not a new one, and has been formalized into a general set of principles under Human/User Centered Design, User Driven Development, and Participatory Design . While the specific methods employed depend on the domain and the kinds of users, the general idea is to talk with community members early in the design process to determine their needs via focus groups, interviews, or site visits. User-centered design is well-suited for PPGIS, and provides a framework for establishing the needs of community members in learning about and utilizing GIS within the context of neighborhood planning . The WCA has been working with the Westside community for years, and is well versed with the needs of the community. Our weekly meetings with them helped us better understand the people and data we were working with and also prioritize the features we hoped to include.

## Crime Mapping Tools

Community-based mapping tools often include straightforward depictions of crime locations on a map so that police departments can provide greater transparency of public safety (e.g., the Socrata platform ). Online news sources, such as the Chicago Tribune [^3], have published crime data and maps broken up by neighborhood and crime type. The Atlanta Journal Constitution [^4] has used publicly available crime data from the Atlanta Police Department to produce a site that maps trends in crime since 2009 by police zones and beats. This type of transparency and open data can yield to more in-depth analysis, such as the Million Dollar Blocks project, in which the location and cost of the NYC incarcerated is correlated with the location that they originate from rather than the location in which the crime occurred . In a more widespread fashion, the MIT Media Lab's Data USA tool provides general demographic data and public safety information across the country by combining multiple open sources into a single location-based form . While these and other tools offer overviews of crime and public safety in a city or neighborhood, we could not find existing participatory systems that would help residents visualize the impact of public safety efforts or programs in their neighborhoods, which was a concern that frequently came up in our discussions with community members and the WCA.

## Design Goals

Because the Data Dashboard was developed within the WCA, it shares design goals and values with the overarching organization. In particular, the WCA is a partnership between a university (Georgia Tech) and local communities. The structure and priorities of the WCA are arrived at via community engagement. Staff in the WCA live in these communities and are regular participants in community meetings and events. Long-standing relationships with the community are created and sustained through regular and myriad interactions. The Data Dashboard was designed to be accessible to citizens in ways that fit how citizens think about their communities, useful for citizen information gathering and advocacy, and integrated so that citizens do not need to navigate and synthesize data from disparate sources.

For example, would it be possible for churches to input the different youth programs they run, into a tool to determine how it has impacted juvenile crime in their neighborhoods? As part of Operation Shield, the Police Foundation, with the help of a \$1.2 million grant from Invest Atlanta, has recently installed about 80 cameras in different parts of the neighborhood that are considered hotspots for drug related crimes. Can we overlay these camera locations on a map to see what impact they may have had on these hotspots? The Westside also has a high number of vacant properties, which many residents believe is the cause for high crime in their neighborhoods. Can we numerically determine the relationship between crime and code violations, so residents can make a case with the city to demolish specific properties that have a high correlation with crime? These questions are representative of the kinds we hope we can answer through our tool. But before we could build any of it, our first task was to understand the people we were working with, to make sure that the tool we build is the one they need. Community feedback and design participation—described in more detail in the next section—are key to achieving accessibility and usefulness.

# Approach

In addition to weekly meetings between the WCA the DSSG team, we also participated in NPU meetings. These are public planning meetings attended by residents and other interested stakeholders within the community. The meetings provide a place for residents to interact with community and city leadership. These tend to be highly contested spaces, as committee members share updates, residents hear about and vote on specific changes they would like to see implemented, and organizations/researchers get buy-in for various initiatives they have in the pipeline. Attending these NPU meetings gave us a good sense of the issues residents were currently grappling with as well as a first-hand exposure to the dynamics of community governance.

Some high priority issues have their own committees and meeting schedules; public safety has recently emerged as an area worthy of committee instantiation. The Vine City Public Safety Committee meets on a regular basis to discuss the status of the many public safety programs, and their meetings are attended by police officers and residents alike. We attended one instance of this meeting, where we described our preliminary tool, along with some screenshots of the kinds of visualizations we had in mind, to seek feedback.

The attendees at the public safety meeting seemed excited about the prospect of having free and open access, along with the ability to analyze crime and code violations data within their neighborhoods. We spoke with one of the code enforcement officers present at the meeting, who was interested in talking with us further about ways his department could use our data visualizations in their day-to-day operations. This was significant, as public safety officers were one of the user groups we were hoping to design for. He introduced us to one of the senior analysts at the Code Enforcement division of the Atlanta Police Department, who gave us an overview of exactly how his team goes about collecting and reacting to code violation complaints in their jurisdiction. This meeting also helped clarify many questions we had about the code violations dataset we were working with.

# Public Safety Portal

## Data Sets

The crime data contains all reported crime in the City of Atlanta from 2008–2015 and was provided to the WCA via a Freedom of Information Act Request. This data set contains 875,491 records, with relevant columns including report date, occurrence date, postal address, the Uniform Crime Reporting Code (the type of crime committed), latitude, and longitude. Of these records, 9,712 did not contain latitude and longitude, and were geocoded using the arcGIS geocoding API with the provided postal address. Also, these data were spatially joined with the boundaries of NPUs and the neighborhoods of Atlanta.

The code violation data was provided to the WCA through a request to the Atlanta Police Department Office of Code Enforcement. This data set contains all code violation cases in the City of Atlanta from 2011 to early 2016, totaling 42,102 cases. Relevant columns include report date, latest inspection date, postal address, the status of the case, and details about the property including if the house is open and vacant, the presence of overgrowth, active utilities, and more. These data did not contain latitude and longitude, but these were added with the arcGIS geocoding API.

The 2010 Census data was taken from the Neighborhood Nexus, a data portal for the City of Atlanta. These data are broken down by neighborhood and NPU, with a wide variety of parameters including demographics, education, housing, economic information, and more.

It was important both to the WCA and to neighborhood advocacy groups that the public safety portal not just highlight the negative aspects of the community so the page includes a number of assets like schools, religious institutions, parks, and transit stops. This data was downloaded from the Atlanta Regional Commission's Open Data portal and included latitude and longitude information.

## Portal Design

Based on our discussions with WCA and our observations from NPU meetings, the public safety dashboard contains three sections: an aggregate page, a correlations page, and a mapping tool.

The aggregate module and the correlations module are designed to support two broad use cases. The first is to either confirm or dispel previously held beliefs about public safety. The second is to provide a tool to help the residents develop their own community-led public safety programs by understanding the contexts and trends of crime and code violations.

The aggregate module contains general overview information about public safety in Atlanta and allows the users to compare Atlanta against their specific NPU of interest. The first component on the aggregate page is a time view (see Figure ). The user is able to select a time frame (years, quarters, months, weeks, weekdays, or days) and compare the trends in crime and code violations for Atlanta and a selected NPU. One of the options for the NPU Selector is "Westside" which includes NPUs K, L, and T. They can choose to see only crime, only code violations, or both. This time view was frequently requested by the community and from city officials including the Atlanta Police Department Office of Code Enforcement. Common questions include how specific timespans (e.g., football season) or days of the week affect the numbers of crimes or code violations. Organized neighborhood watch groups can utilize this information to plan and strategize accordingly.

The second component is an interactive bar graph with several options for general public safety profile (Figure ). The user is able to select between crimes and code violations and may control for population. The three NPUs that comprise the Westside are highlighted in green for an easy comparison to the other NPUs of Atlanta in purple. The month-year filter allows the users choose a time frame. This component is a broader report meant for city officials such as the Atlanta Police Department require an easy to understand monthly breakdown of crimes and code violations per type and per NPU.

The final component of the aggregate module highlights differences between a particular neighborhood and the rest of the City of Atlanta (see Figure ). This is done by dividing crime, or code violations, into types and then calculating the percentage of the total for each type. A user such as a resident, business owner, or community partner may learn that which types of crime are less prevalent in their neighborhood in comparison to the rest of Atlanta.

The second correlations module highlights relationships between various factors from from the 2010 census (see Section ) and various crimes taken across each neighborhood in the City of Atlanta. In Figure  the crime measures selected are the percentage of violent crime (robbery, murder, rape, and aggravated assault) with a comparison between the Westside and the City of Atlanta. This page allows users to answer questions such as, "Is the percentage of senior citizens in a neighborhood correlated with crime? What specific types of crime are correlated?" or "Are vacant houses correlated with crime?" Although correlation does not necessarily imply causation, this module provides a starting point to answer long-held questions.

The third module in the dashboard is the spatial visualization of the crime data, code violations, and community assets. The primary goal of these visualizations is to provide users with a means to precisely pin-point where crimes occur, and to give them the ability to learn how these locations change by crime-type and over time. Additionally, the map allows users to focus on specific geographic areas to examine the relationship between crime, code violations, and community assets.

The crime data is visualized with a hex-based heat map (Figure ). This map is constructed by counting the number of crimes within each hex and assigning one of five colors based on a logarithmic scale (i.e. the first color represents a single crime per hex, the second color represents 2-10 crimes per hex, the third color is 11-100 crimes per hex, and so on). This logarithmic aggregation of crime into colored hexes naturally highlights hot-spots, where small regions have significantly higher numbers of crime than average. In addition, crimes may be selected by their Uniform Crime Reporting Code (see see Section ), or into larger categories of crime including drugs and alcohol, sex crime, theft, or violent crime. Furthermore, a specific time period may be selected by specifying a date and time span (all data, a year, or a month).

The code violation data is sparser than the crime data (see Section ), and a heat map would not be an appropriate visualization. Instead, these data are shown as circular pins on the map, with clusters of points represented by a larger pin with the number of points in the cluster inscribed. These data may also be selected by time in the same manner as the crime data. Community assets are visualized with pins as well, but without clustering as these data are sparse enough to not require aggregation. In addition, further information specific to the asset type is displayed on mouseover.

The goal of this map is not to highlight areas of high crime in a negative manner, but to be a tool the community may use to coordinate their crime prevention strategies. For instance, an NPU public safety chair may be leading a drug prevention campaign. They may use the heat map to locate areas of drug use in their neighborhoods, and then overlay drug prevention programs from other sources on the map. They may then choose to concentrate their efforts on an area with drug usage and without another active drug prevention program. In another case, a public safety chair may use the map to examine historic data. They may zoom to a location where they have been active in the past and learn how crime has changed over time in the specific area that they work.

The aggregated data and correlation modules are generated with the Tableau data visualization software. The map is created with CartoDB, a database and geospatial visualization portal. The data are hosted with CartoDB's PostgreSQL server, and the visualization and navigational tools are created with the JQuery and CartoDB JavaScript libraries. All three modules will be hosted on the WCA data-dashboard with a release date in early August.

# Discussion

**Incorporating citizen data**
Our conversations with community residents have revealed an interest in a tool that would support citizen reports of crime. The underlying interest in such a tool appears to stem from community mistrust in the completeness and accuracy of public crime data. Including citizen data has the potential to empower local residents in ways that may be similar to citizen science efforts and the now-common social media documentation of crimes. However, including citizen data is fraught with its own issues of accuracy. At present, the Data Dashboard has no notion of users or access control. If citizen data were included, would that model need to change? What benefits and detriments would accrue if barriers to participation were included on portions of the web site? If citizens report crimes not included in public data sets, there is no clear way to substantiate the accuracy of the reports. How can citizen data be reflected in ways that respect the information yet do not endorse the accuracy? Does citizen crime reporting work with or against local law enforcement efforts? How can tools encourage positive community-police interactions, when and if that is appropriate?

**Data literacy**
The success of tools like the Data Dashboard, and especially the Public Safety Portal, depend on data literacy. In nearly every discussion we had with stakeholders, the confusion between correlation and causation was abundantly clear. (Indeed, even we and other members of our Georgia Tech community easily confuse the two when looking at graphical data.) We see a need for teaching methods and tools that help explain and reinforce the difference between causation and correlation. Without this, community members risk taking away inaccurate information from data sets and limit their own ability to be successful advocates. Given how much confusion exists even among people with frequent exposure to data, we posit this is a key challenge for community and citizen based data efforts that will likely require creativity, local knowledge, data ambassadors, etc.

**Asset-based approaches to data**
Community engagement experts often take an asset-based approach to development, where community knowledge, resources, aspirations and skills are emphasized over community deficits such as crime and poverty . The asset-based approach is challenging in settings such as the Data Dashboard project. The "Public Safety" Portal is so named as a step in an asset-based direction, rather than, for example, calling it the "Crime" Portal. Yet the data sets of key relevance to public safety are largely negative – code violations, crime reports, demographic data such as education levels or income. We made several additional attempts to take an asset-based approach. We invited the community to suggest place-based assets that we could include on the map, in addition to schools and places of worship that we could easily identify. When we talk to community members, we include use cases that result in positive developments for the community, not just reduction in negative events. For example we show how data might be used to understand which community-based youth programs correlate with changes in crime. We do not yet know how effective our methods have been in conveying an asset-based approach, nor how those efforts interact with advocacy.

# Conclusion and Future Work

Once the first iteration of the Public Safety portal is complete, the WCA will lead a focus group with members of various groups including NPU public safety chairs, Atlanta police, juvenile justice activist, religious leaders, code enforcement and Department of Justice liaisons. This will be an opportunity for the WCA to hear how well the site meets the needs of the various organizations and what aspects need to be improved upon. The WCA will use the comments to update the site before a full public launch in Fall 2016. After the launch, the WCA will organize and lead several trainings to help guide community members on using the site. These trainings will be open to the public and will be designed for a broad range of technical literacy.

As the assets currently listed on the portal come from an agency perspective, the WCA plans in the future to work with community leaders to map neighborhood described assets. These may be physical locations like basketball courts but also events like after school programs. Mapping crime and assets together will give organizations an opportunity to track the impact of their programs and make the case for expanding programs that have documented success. Expanding the list will also give a more robust description of the community and allow us to better understand how well we are incorporating an asset-based mindset, while also making accurate and important (negative) data available to the community.

# Acknowledgments

We gratefully acknowledge the financial support provided to the Data Science for Social Good 2016 program from Oracle Academy and Georgia Tech. This work would not be possible without the participation of citizens in the Westside communities. We also thank Dr. Carl DiSalvo for his valuable comments.

[^1]: http://wcadatadashboard.iac.gatech.edu

[^2]: http://www.dssg-atl.io

[^3]: http://crime.chicagotribune.com/

[^4]: http://crime.myajc.com/


author: P. Petit ; B. Dintrans ; A. Morgenthaler ; V. Van Grootel ; J. Morin ; J. Lanoux ; M. Aurière ; R. Konstantinova-Antova
date: Received ??; accepted ??
title: A polarity reversal in the large-scale magnetic field of the rapidly rotating sun HD 190771

We investigate the long-term evolution of the large-scale photospheric magnetic field geometry of the solar-type star HD 190771. With fundamental parameters very close to those of the Sun except for a shorter rotation period of 8.8 d, HD 190771 provides us with a first insight into the specific impact of the rotation rate in the dynamo generation of magnetic fields in 1  stars. We use circularly polarized, high-resolution spectra obtained with the NARVAL spectropolarimeter (Observatoire du Pic du Midi, France) and compute cross-correlation line profiles with high signal-to-noise ratio to detect polarized Zeeman signatures. From three phase-resolved data sets collected during the summers of 2007, 2008, and 2009, we model the large-scale photospheric magnetic field of the star by means of Zeeman-Doppler imaging and follow its temporal evolution. The comparison of the magnetic maps shows that a polarity reversal of the axisymmetric component of the large-scale magnetic field occurred between 2007 and 2008, this evolution being observed in both the poloidal and toroidal magnetic components. Between 2008 and 2009, another type of global evolution occured, characterized by a sharp decrease of the fraction of magnetic energy stored in the toroidal component. These changes were not accompanied by significant evolution in the total photospheric magnetic energy. Using our spectra to perform radial velocity measurements, we also detect a very low-mass stellar companion to .

# Introduction

All rotating Sun-like stars exhibit spectral features indicative of magnetic fields in their atmospheres. Chromospheric emission (as measured for instance in the cores of CaII H & K spectral lines) is often taken to be a good magnetic tracer, assuming that the correlation observed locally in the Sun between photospheric magnetic field and chromospheric flux (Schrijver et al. 1989) holds for other stars as well. For a few tens of stars, time-series covering several decades are now available and provide information about the existence and length of magnetic cycles that different types of cool stars generate (Baliunas et al. 1995, Hall et al. 2007a). From this long-term monitoring, several trends can be inferred. First, the chromospheric flux increases with the rotation rate, which is indicative of a more efficient field generation by dynamo action whenever fast rotation is present. Another observation is that all active stars do not undergo smooth activity cycles, as the Sun does most of the time. Among the most active dwarfs (which are also younger and rotate much more rapidly than the Sun), stellar activity has a tendency to fluctuate erratically, while regular cycles are instead observed in slowly rotating, older stars such as the Sun. It also appears as if the long-term magnetic variability of Sun-like stars is very sensitive to fundamental stellar parameters, so that stars very similar to the Sun can have a different magnetic behaviour. While often being considered an excellent solar analogue, 18 Sco has been reported to follow an activity cycle shorter than solar, with a period of $\approx$`<!-- -->`{=html}7 years (Hall et al. 2007b).

Since many stars experience a series of activity maxima and minima in a similar way to the Sun, a natural step is to determine whether these oscillations in chromospheric flux are associated with global polarity reversals of the large-scale magnetic field, as observed on the Sun between two successive solar minima. For the Sun, the global component of the magnetic field displays a strength of a few Gauss (e.g., Sanderson et al. 2003), is dominated by a dipole that is almost aligned with the spin axis when the Sun is close to the minimum of its activity cycle, and is organized in a more complex multipolar geometry around solar maximum. The global component of the magnetic field has been observed on other cool active stars (Petit et al. 2005, Petit et al. 2008, hereafter P08). The observation of a preliminary sample of 1 M$_\odot$ stars by P08 suggests that rapid rotation has the effect of generating a large-scale toroidal field at the stellar surface, the majority of the surface magnetic energy being concentrated in the toroidal field whenever the rotation period is shorter than about 2 weeks, as also found by 3-D MHD simulations of stellar dynamos (Brown et al. 2009). Our first study did not, however, provide us with any information about the variety of configurations that these non-solar magnetic geometries can assume with time.

In the present paper, we concentrate on , the most rapid rotator in the stellar sample first presented by P08, to investigate the temporal evolution of its large-scale magnetic field. We first describe the new data sets obtained in 2008 and 2009, as well as the procedure used to reconstruct magnetic maps from the time-series of high signal-to-noise line-profiles. We then compare the maps obtained in 2007 (see P08), 2008, and 2009 and discuss the information we obtain about the nature of magnetic cycles in rapidly rotating solar analogues.

# Observations and data modelling

## Instrumental setup, data reduction, and multi-line extraction of Zeeman signatures

```latex
\onltab{1}{
\begin{table}
\caption[]{Journal of observations for 2008 and 2009 (2007 observations are described in P08).}
\begin{tabular}{cccccc}
\hline
Year & Julian Date & exp. time & $\sigma_{\rm LSD}$ & rot. phase \\
 & (2,450,000+) & sec. & $10^{-5}I_{c}$ & & \\
\hline
2008 & 4696.49 & 1600.0 & 6.7268   & 0.6133 \\
 &4701.41 & 1600.0 & 9.2876   & 0.1726 \\
 &4702.48 & 1600.0 & 3.8056   & 0.2936 \\
 &4703.45 & 1600.0 & 3.8787   & 0.4040 \\
 &4704.50 & 1600.0 & 4.0409   & 0.5237 \\
 &4725.39 & 960.0   & 5.0916   & 0.8975 \\
 &4725.41 & 960.0   & 5.1507   & 0.8991 \\
 &4725.42 & 960.0   & 5.1279   & 0.9006 \\
 &4725.43 & 960.0   & 5.1300   & 0.9021 \\
 &4726.38 & 1600.0 & 4.3341   & 0.0093 \\
 \hline
 2009 &4984.61 & 1600.0 & 4.9114   & 0.3538 \\
 &4985.61 & 1600.0 & 4.8112   & 0.4673 \\
 &4986.57 & 1600.0 & 4.8541   & 0.5763 \\
 &4995.55 & 1600.0 & 11.8554 & 0.5970 \\
 &5002.59 & 1600.0 & 4.4350   & 0.3965 \\
 &5002.61 & 1600.0 & 9.0171   & 0.3988 \\
 &5005.58 & 2400.0 & 4.4490   & 0.7373 \\
 &5006.58 & 2400.0 & 14.8898 & 0.8504 \\
 &5010.54 & 2400.0 & 4.5288   & 0.3001 \\
 &5011.53 & 2400.0 & 4.8640   & 0.4129 \\
 &5013.57 & 1600.0 & 4.9603   & 0.6446 \\
 &5017.61 & 2400.0 & 5.1851   & 0.1043 \\
 &5018.62 & 2400.0 & 4.8179   & 0.2188 \\

\hline
\end{tabular}
\noindent Notes: From left to right, we list the year of observation, the Julian date, the exposure time, the error-bar in Stokes V LSD profiles, and the phase of the rotational cycle at which the observation was made, taking the same rotation period and phase origin as P08.
\label{tab:obs}
\end{table}
}
```

The new data sets were obtained with the 2-m Telescope Bernard Lyot (Observatoire du Pic du Midi, France), using the NARVAL spectropolarimeter. The instrumental setup and data reduction procedure are identical to those presented by P08. Observations consist of high-resolution spectra (R = 65,000) covering the entire optical domain (from 370 to 1,000 nm) and providing simultaneous recording of the stellar light as unpolarized (Stokes I) and circularly polarized (Stokes V) spectra. In 2008, a total of 10 spectra were recorded between August 15 and September 16 (Table ). Another set of 13 spectra were acquired in 2009, between June 02 and July 05. The data were processed with LibreEsprit, the automatic reduction software developed for NARVAL (Donati et al. 1997).

For each spectrum, both Stokes I & V parameters are processed using the LSD technique (Least-Squares Deconvolution, Donati et al. 1997). Using a line-mask defined by a solar photospheric model, we compute LSD line profiles using about 5,000 spectral lines. The multiplex gain in signal-to-noise ratio between the raw spectra and the LSD mean profiles is about 30, reducing the noise to between 4 and $15\times 10^{-5}I_{c}$, where $I_{c}$ represents the intensity of the continuum. In these new data sets, the noise is higher and also more variable than observed in our 2007 data, owing to poor transparency that significantly affected part of the 2008 and 2009 observing runs.

The sequences of Stokes V LSD line profiles are plotted in Fig. , after removal of a mean radial velocity of -26.7 and -26.5  in 2008 and 2009, respectively. Zeeman signatures are evident in a majority of the observations. In 2008, they display several similarities with the signatures recorded in the 2007 data set. We first note the maximum recorded amplitude of the Stokes V signal of $7\times 10^{-4} I_c$ (of about 10 times the noise level), against $6\times 10^{-4} I_c$ one year earlier. We also note that the shape of the Zeeman signatures evolves with time, the signatures being sometimes mostly symmetric about the line center (rotational phase 0.6133 in 2008, 0.0909 in 2007), sometimes almost anti-symmetric (phase 0.5237 in 2008, 0.4121 in 2007), and sometimes almost flat (phases 0.2936 in 2008, 0.3199 in 2007). All of these recognizable line-patterns are evident in 2008 with a sign reversal in the Zeeman signatures compared to 2007 observations. No similar sign change is observed in the Stokes V profiles of other cool active stars monitored during the same two runs, ensuring that it is very unlikely that a possible sign switch has been introduced by mistake during data reduction, affecting all data collected during one of the runs. In 2009, another type of evolution was observed relative to 2008, symmetric Stokes V signatures being absent in the latest data set, and antisymmetric signatures of both polarities being observed all the time, except a possibly symmetric (although noisy) signature at phase 0.8504.

## Magnetic mapping

The sets of profiles are used to model the large-scale magnetic geometry of the star, using the tomographic inversion technique of Zeeman-Doppler Imaging (Donati & Brown 1997, Donati et al. 2006). To compute synthetic Stokes V line profiles, we develop a model of a stellar surface divided into a grid of pixels, each pixel being associated with a local Stokes I and V profile. For a given magnetic field strength and orientation of each pixel, local Stokes V profiles are calculated based on the weak field assumption, i.e., assuming that Stokes V is proportional to $g.\lambda_0^2 .B_\parallel .\partial I / \partial \lambda$, where $\lambda_0$ is the average wavelength of the LSD profile (about 534 nm), $B_\parallel$ is the line-of-sight projection of the local magnetic field vector, and $g$ is the effective Lande factor of the LSD profile, which is equal to 1.2. We further assume that there is no large-scale temperature inhomogeneities over the stellar surface, so that Stokes I profiles are locally the same over the whole photosphere. For each pixel, we impose a Gaussian shape on the local synthetic Stokes I profile, which has a FWHM equal to 10.1  (which provides the best fit to the observed series of Stokes I profiles). At a given rotational phase, the amplitude of the local Stokes profiles located on the visible hemisphere of the star are then weighted according to a linear limb-darkening coefficient equal to 0.75 (see P08) and their wavelength location is shifted according to the line-of-sight velocity of the pixel, assuming that =4.3  (Valenti & Fischer 2005) and $i=50$`<!-- -->`{=html} (P08).

Synthetic Stokes V profiles are computed for all observed rotation phases and compared to the data sets. The data adjustment is iterative and based on a maximum entropy algorithm (Skilling & Bryan 1984). The surface magnetic field is projected onto a spherical harmonics frame (Donati et al. 2006), where the magnetic field geometry is divided between a poloidal and toroidal component (Chandrasekhar 1961). As in P08, we limit the spherical harmonics expansion to $\ell \leq 10$, after checking that increasing even more $\ell$ does not provide a superior data adjustment. We finally assume that the star is not rotating as a rigid body, but experiences a latitudinal shear that we simply model as $\Omega(\theta)=\Omega_{\rm eq} - d\Omega .\sin^2(\theta)$, where $\theta$ is the stellar latitude, $\Omega_{\rm eq}$ is the rotational rate of the equator and $d\Omega$ is the difference in rotation rate between polar and equatorial regions. We use the new data sets to obtain estimates of the  parameters (Table ), following the method described by Petit et al. (2002). For 2008 and 2009, we obtain a shear level of $d\Omega=0.12$ , in very good agreement with the value obtained by P08. Values derived for  are also in excellent agreement in 2007 and 2008 (with $=0.71\pm 0.01$ ), but the measurement for 2009 provides us with a different estimate ($=0.66\pm 0.01$ ). This apparent discrepancy may simply reflect the uncertainties in this parameter. Errorbars listed in Table are directly derived from the  map in the - plane and might be underestimated, as suggested by Petit et al. (2002).

Using this procedure, the spectropolarimetric data are adjusted at a reduced  equal to 1.1 and 0.9, in 2008 and 2009, respectively (Fig. ). The  value for 2008 equals that obtained one year earlier, and the slightly smaller  achieved in 2009 is partly due to the higher relative noise in the data. The reconstructed magnetic topologies are illustrated in Fig. , together with the magnetic map obtained in 2007 (P08). In Table , we list several numerical quantities derived from the spherical harmonics coefficients defining the magnetic geometries. As in P08, errorbars listed in Table are estimated by reconstructing a set of magnetic maps using different input parameters for the inversion code (with individual parameters being varied over the width of their own errorbars). We note that the largest variations in the output quantities are generally obtained by varying the stellar inclination, because of the relatively large uncertainty in this specific parameter.

## Temporal evolution in the large-scale magnetic field

```latex
\begin{table*}
\caption[]{Magnetic quantities derived from the set of magnetic maps. }
\begin{center}
\begin{tabular}{ccccccccccc}
\hline
fractional year               & $v_{\rm r}$          & $B_{\rm mean}$ & pol. en.        & dipole            & quad.             & oct.                  & axi.                   & \hbox{$\Omega_{\rm eq}$}& \hbox{$d\Omega$}& $\log R'_{\rm HK}$ \\
                        & (\hbox{km\,s$^{-1}$})                          & (G)                        & (\% tot)         & (\% pol)         & (\% pol)          & (\% pol)          &(\% tot)              & (\hbox{rad\,d$^{-1}$})                        &  (\hbox{rad\,d$^{-1}$})                  &                                   \\
\hline
2007.59               & $-26.86 \pm 0.03$ & $51\pm 6$          & $34\pm 1$   & $43\pm 8$   & $20\pm 2$     & $23 \pm 4$    & $73\pm 3$     & $0.71 \pm 0.01$ & $0.12\pm 0.03$  & -4.47 \\
2008. 67               & $-26.72 \pm 0.04$ & $59\pm 3$          & $39\pm 3$   & $36\pm 8$   & $18\pm 2$     & $19 \pm 4$    & $61 \pm 3$     & $0.71 \pm 0.01$ & $0.12 \pm 0.03$ & -4.47 \\
2009. 47               & $-26.48 \pm 0.03$ & $58\pm 8$          & $81\pm 2$   & $23\pm 7$   & $40\pm 2$     & $21 \pm 2$    & $36 \pm 12$  & $0.66 \pm 0.01$ & $0.12 \pm 0.02$ & -4.48 \\
\hline
\end{tabular}
\end{center}
\noindent Notes: We list the stellar radial velocity (with its associated $rms$), the mean unsigned magnetic field ($B_{\rm mean}$), the fraction of the large-scale magnetic energy reconstructed in the poloidal field component, the fraction of the {\it poloidal} magnetic energy in the dipolar ($\ell = 1$), quadrupolar ($\ell = 2$), and octopolar ($\ell = 3$) components, and the fraction of energy stored in the axisymmetric component ($m=0$). We also list the differential rotation parameters \hbox{$\Omega_{\rm eq}$}\ and \hbox{$d\Omega$}. The last column contains the $\log R'_{\rm HK}$ values derived from our sets of Stokes I spectra. Values for 2007 are taken from P08, except for the $\log R'_{\rm HK}$ value which was recalculated using a new calibration of NARVAL measurements against Mount Wilson estimates (Wright et al. 2004), involving 29 solar-type dwarfs.
\label{tab:dynamo}
\end{table*}
```

Between 2007 and 2008, the most striking evolution in the magnetic field distribution is a polarity reversal of the large-scale field. In the ZDI maps of Fig. , this change is mostly visible in the azimuthal component of the magnetic vector. A more quantitative way of estimating the details of this sign switch consists of tracking its origin in the evolution of the complex spherical harmonics coefficients $\alpha_{\ell,m}$, $\beta_{\ell,m}$, and $\gamma_{\ell,m}$ (defined by Donati et al., 2006). Because of the uncertainty in the stellar rotation period that prevents us from comparing, at 1-year intervals, magnetic features that manifest themselves at specific rotation phases, we choose to limit our comparison to axisymmetric features (defined by modes with $m=0$). We observe that all coefficients $\alpha_{\ell,0}$, $\beta_{\ell,0}$, or $\gamma_{\ell,0}$ with a magnetic amplitude greater than 1 gauss (which only concerns modes with $\ell \le 4$) have a different sign in both years, with the marginal exception of $\gamma_{3,0}$. Another noticeable temporal evolution concerns the fraction of magnetic energy stored in the axisymmetric field component (all spherical harmonics modes with $m=0$), 61% of the large-scale magnetic energy being in axisymmetric modes in 2008, compared to 73% in 2007. Another difference is the fraction of magnetic energy contained in modes with $\ell > 3$ (14% and 27%, for 2007 and 2008, respectively, if the poloidal component is considered alone; 5% and 13% if the toroidal field is also taken into account), suggesting that the field distribution is more complex in 2008.

A similar comparison between the 2008 and 2009 maps also reveals a striking evolution in the field geometry. The main change in the field distribution shows up as a much higher fraction of the magnetic energy being stored in the poloidal field component (about 80% in 2009, against less than 40% in the two other data sets). This evolution occurs together with an increased level of non-axisymmetry in the field distribution, with only 36% of the magnetic energy showing up in modes with $m=0$. We also note that the poloidal component of the field is dominated by the quadrupolar terms in 2009, while the dipole was predominant in 2007 and 2008. The polarity of the global field is the same in 2008 and 2009 (the only spherical harmonics coefficients with both $m=0$ and an amplitude greater than 1 gauss having switched sign in the meantime are $\alpha_{1,0}$ and $\gamma_{3,0}$).

# Discussion

From new observations of  completed in 2008 and 2009, we have obtained information about the magnetic properties of rapidly rotating 1  stars, and provided fresh insight into the temporal changes affecting their magnetic geometries. As already outlined by P08,  exhibits a large-scale toroidal component in its photospheric magnetic field, an element that is absent on the solar surface but whose incidence appears to be common among solar analogues with sufficiently high rotation rates. Analyses of the new data sets show that the toroidal field can experience dramatic changes over a period of a few months. At least two types of evolution are evident, with the possibility of polarity switches (between 2007 and 2008), as well as the possible conversion of magnetic energy from the toroidal to the poloidal field component (from 2008 to 2009). These changes occur with a total magnetic energy that remains approximately constant, as can be seen from the mean (unsigned) magnetic field or from the stellar chromospheric emission (Table ).

Similarly rapid evolution of a photospheric magnetic field was reported for $\tau$ Bootis (Fares et al. 2009), where a close-by planet orbiting the star was associated with a significant tidal coupling between the star and the planet. While no low-mass companion has been reported for , radial velocity ($v_r$) measurements listed in Table show that  is not a single star, since the observed variations in $v_r$, of the order of 400 , are much larger than the radial velocity accuracy of NARVAL (about 30 , Moutou et al. 2007). Older radial velocity estimates by Nidever et al. (2005), dating back to 2000, confirm the existence of a long-term trend, with a mean radial velocity of 25.063  at that time. Despite the poorly sampled time-series at our disposal, a preliminary estimate of the companion mass can be performed, assuming for simplicity a single companion, a circular orbit, and an orbital plane orthogonal to the stellar rotation axis. By doing so, the best fit is obtained for an orbital period of 14.2 yr, an orbital radius of 5.9 AU, and a companion mass of 0.1 . We note that a short orbital period (of a few days) can be ruled out by our data, since no significant variations in $v_r$ are observed within the timespan of our individual data sets, apart from weaker activity-induced fluctuations. Although rough, this first estimate suggests that tidal effects generated by the presence of the companion remain weak (due to the absence of synchronized orbital and rotation periods) and are unlikely to affect significantly the dynamics of the outer convective layers of . In this context, the fast magnetic field evolution of the star is probably controlled by other fundamental parameters, the rapid rotation being the most obvious deviation from a strict solar situation. In turn, and although $\tau$ Bootis also differs from the Sun in terms of its higher mass ($1.33\pm0.11$  is proposed by Valenti & Fischer 2005), we note that this star is also characterized by a short rotation period, which might help to explain the shortness of its activity cycle (with a length of 2 years only, Fares et al. 2009).


author: Hemian Yi$^{1}$, Zhijun Wang$^{1}$, Chaoyu Chen$^{1}$, Youguo Shi$^{1}$, Ya Feng$^{1}$, Aiji Liang$^{1}$, Zhuojin Xie$^{1}$, Shaolong He$^{1}$, Junfeng He$^{1}$, Yingying Peng$^{1}$, Xu Liu$^{1}$, Yan Liu$^{1}$, Lin Zhao$^{1}$, Guodong Liu$^{1}$, Xiaoli Dong$^{1}$, Jun Zhang$^{1}$, M. Nakatake$^{3}$, M. Arita$^{3}$, K. Shimada$^{3}$, H. Namatame$^{3}$, M. Taniguchi$^{3}$, Zuyan Xu$^{4}$, Chuangtian Chen$^{4}$, Xi Dai$^{1}$, Zhong Fang$^{1}$ and X. J. Zhou$^{1,2,*}$
date: May 22, 2014
title: Evidence of Topological Surface State in Three-Dimensional Dirac Semimetal Cd$_3$As$_2$

**The three-dimensional topological semimetals represent a new quantum state of matter. Distinct from the surface state in the topological insulators that exhibits linear dispersion in two-dimensional momentum plane, the three-dimensional semimetals host bulk band dispersions linearly along all directions, forming discrete Dirac cones in three-dimensional momentum space. In addition to the gapless points (Weyl/Dirac nodes) in the bulk, the three-dimensional Weyl/Dirac semimetals are also characterized by "topologically protected" surface state with Fermi arcs on their specific surface. The Weyl/Dirac semimetals have attracted much attention recently they provide a venue not only to explore unique quantum phenomena but also to show potential applications. While Cd$_3$As$_2$ is proposed to be a viable candidate of a Dirac semimetal, more experimental evidence and theoretical investigation are necessary to pin down its nature. In particular, the topological surface state, the hallmark of the three-dimensional semimetal, has not been observed in Cd$_3$As$_2$. Here we report the electronic structure of Cd$_3$As$_2$ investigated by angle-resolved photoemission measurements on the (112) crystal surface and detailed band structure calculations. The measured Fermi surface and band structure show a good agreement with the band structure calculations with two bulk Dirac-like bands approaching the Fermi level and forming Dirac points near the Brillouin zone center. Moreover, the topological surface state with a linear dispersion approaching the Fermi level is identified for the first time. These results provide strong experimental evidence on the nature of topologically non-trivial three-dimensional Dirac cones in Cd$_{3}$As$_{2}$.**

The Dirac materials, such as graphene and topological insulators, exhibit novel quantum phenomena and properties with their low energy electron behaviors described by the relativistic Dirac equation. The massless Dirac fermions on the surface of graphene and the three-dimensional topological insulators show cone-shaped band dispersion with the Dirac points lying at discrete points in two-dimensional (2D) momentum plane. Recently, much attention has been attracted to the Weyl/Dirac semimetals which represent a new topological state of quantum matter that is different from the topological insulators. These so-called three-dimensional (3D) Weyl/Dirac semimetals have inverted band structures in which the bulk valence band and conduction band contact at discrete points (Dirac points) in three-dimensional momentum space. They can be viewed as the 3D analogue of graphene and the surface state of the topological insulators that host Dirac band dispersions linearly along all directions. In addition to the gapless points (Weyl/Dirac nodes) in the bulk that are "topologically protected" by the behavior of the band structure, the Weyl/Dirac semimetal is also characterized by "topologically protected" surface state with Fermi arcs on the surface. The Weyl/Dirac semimetal is expected to show various new quantum phenomena and unusual properties like magnetic monopole in the bulk, giant diamagnetism, quantum spin Hall effect or quantum anomalous Hall effect in its quantum well structure. In the case with both the time reversal and inversion symmetries, one may expect a 3D Dirac semimetal state described as four-component Dirac fermions which can be viewed as two copies of distinct Weyl fermions. To get Weyl semimetal, either the time reversal symmetry or the inversion symmetry has to be broken.

While a number of materials and systems have been proposed for realizing the Weyl/Dirac semimetal, few has been materialized so far. Among the proposals, Cd$_{3}$As$_{2}$ has been paid a special attention for a couple of reasons. First, band structure calculations predict that Cd$_3$As$_2$ is a symmetry-protected topological semimetal, with a single pair of 3D Dirac points in the bulk and nontrivial Fermi arcs on the surface. The pseudo-relativistic physics of dispersions results in 3D Dirac points that are protected by crystal symmetry and robust against perturbations. No gap can be opened by the spin-orbit coupling, in contrast to Dirac materials like AMnBi$_{2}$(A= Sr,Ca). Second, Cd$_3$As$_2$ is chemically stable in air which makes it more convenient for property investigations and potential applications when compared to other candidates. Third, similar to graphene, Cd$_{3}$As$_{2}$ has particularly high carrier mobility up to 15000 $cm^{2}V^{-1}s^{-1}$ at room temperature and 80000 $cm^{2}V^{-1}s^{-1}$ at 4 K, which makes it ideal for revealing novel quantum phenomena from transport measurements as well as designing electronic devices. It provides a promising platform to realize quantum spin Hall effect and sizable linear quantum magnetoresistance even up to room temperature. While the indications on the 3D Dirac fermion nature of Cd$_3$As$_2$ are accumulating, with some angle-resolved photoemission results reported for the Cd$_3$As$_2$ (001) surface and (111) surface, more experimental evidence and theoretical investigation are necessary to pin down the issue. In particular, the topological surface state, the hallmark of the 3D semimetal, has not been identified in Cd$_3$As$_2$. If the 3D Dirac fermion nature of Cd$_3$As$_2$ can be fully proven, it will open an opportunity to expand further into a Weyl semimetal when the time-reversal or inversion symmetry is broken.

Angle-resolved photoemission spectroscopy (ARPES) is a powerful tool which can directly reveal the presence of the Dirac cone and its 3D character. Here we report our ARPES study and band structure calculations on the (112) crystal surface of Cd$_{3}$As$_{2}$. Linear-dispersive energy bands are observed in the low energy region that are associated with the bulk Dirac nodes. Such linear-dispersive behavior of the bulk bands is further examined along the out-of-plane direction by varying the photon energy of the light source. In particular, we have identified for the first time the topological surface state in the gapless bulk Dirac nodes of Cd$_3$As$_2$. These results are consistent with the band structure calculations and provide strong indications of topologically non-trivial 3D Dirac cones in Cd$_{3}$As$_{2}$.

Figure 1 shows the crystal structure, Brillouin zone and X-ray diffraction patterns of Ca$_3$As$_2$ (see Supplementary for experimental details). The crystal structure of Cd$_{3}$As$_{2}$ is body-centered tetragonal with an I41cd symmetry; it is related to the tetragonally-distorted anti-fluorite structure with 1/4 Cd site of ordered vacancy. As seen from the small cubic sub-cell (bottom of Fig. 1a), the As ions are approximately close-packed and the Cd ions are tetrahedrally coordinated. The overall crystal structure of Cd$_3$As$_2$ (top of Fig. 1a) can be viewed as a 2$\times$`<!-- -->`{=html}2$\times$`<!-- -->`{=html}4 superstructure stacked from the small cubic sub-cell. Fig. 1b shows the reduced Brillouin zone and the projected (112) surface Brillouin zone for the small unit cell of Cd$_{3}$As$_{2}$ that is used in our band structure calculations. Powder X-ray diffraction pattern (Fig. 1c) on the sample from grinding the grown Cd$_{3}$As$_{2}$ single crystals provides an accurate determination of the lattice parameters a=b= 12.6467Å and c=25.4428Å. Fig. 1d displays the XRD pattern of the Cd$_{3}$As$_{2}$ single crystal. The observed peaks can be indexed into (n n 2n) (with n being integers) reflections which indicate that the naturally cleaved surface is (112). It actually corresponds to the close-packed As planes in the small cubic sub-cell with a distance of 3.68 Å between two adjacent planes.

Figure 2 shows constant energy contours of the spectral weight distribution for the cleaved (112) surface of Cd$_{3}$As$_{2}$ crystal over a large momentum space (Fig. 2a), and their comparison with band structure calculations (Fig. 2b). Here the plotted hexagonal Brillouin zone is the projected (112) surface Brillouin zone (Fig. 1b). The spectral weight repetition over three zones reaffirms that the measured crystal surface is (112). Right at the Fermi level, the measured spectral weight is point-like that concentrates at the Brilllouin zone centers ($\Gamma$ points) (Fig. 2a1). With increasing binding energy, the spectral weight distribution gets expanded and at high binding energies like 450 meV (Fig. 2a4) and 600 meV (Fig. 2a5), two fine features, the inner part and outer part, can be discerned as marked by blue dashed lines. The inner part appears as a small circle. The outer part changes from a point-like Fermi surface to a ring-like circle and eventually to a hexagon-like shape at high binding energy. From the band structure calculations, there are only Fermi points at the Fermi level (Fig. 2b1). With increasing binding energy, the point gradually becomes hexagon-shaped at 150 meV, and warped hexagon-shape at high binding energies. The spectral weight evolution with increasing binding energy is reminiscent with many materials with Dirac cones such as graphene and topological insulators. The hexagon-shape indicates that the related Dirac cone is anisotropic, a situation similar to that found in Bi$_2$Te$_3$. Although the calculated fine-details of the electronic structure are not fully resolved in our measurements, our results agree well with the band structure calculations. Overall, we find that the periodicity of the ARPES signal can be well described by using the small sub-cell (Fig. 1a); the effect of the (2$\times$`<!-- -->`{=html}2$\times$`<!-- -->`{=html}4) super-cell that is supposed to cause band folding is rather weak.

Figure 3 shows band structures of Cd$_3$As$_2$ (112) surface measured along two high-symmetry directions. There is a good agreement between the measured band structures (Figs. 3b and 3c) and the band structure calculations (Fig. 3d). Along the $\Gamma$-K cut, from the calculation, there are four main bulk bands, labeled as BV1, BV2, BV3 and BV4, within the energy range shown (Fig. 3d). Along the $\Gamma$-M cut, there are three bulk bands, labeled as BV5, BV6 and BV7(Fig. 3d). As seen from the measured band structures (Figs. 3b and 3c) along $\Gamma$-K (cut B, green line in Fig. 3a) and $\Gamma$-M (cut A, red line in Fig. 3a), all these seven bulk bands from the calculations can find good correspondence. It is clear that, within the similar energy range, we have resolved more bands than reported before on the (112) surface of Cd$_3$As$_2$. The good agreement between the measured and calculated band width also indicates that the band renormalization effect in Cd$_3$As$_2$ is weak. Furthermore, there is a surface band from the calculated results (labeled SV1 in Fig. 3d) that appears near the zone center ($\Gamma$ point). The surface state only appears in surface band calculation when taking into account the spin-orbit coupling as well as the inverted bulk band structure near the Fermi level. As seen from Figs. 3b and 3c, there is a band in the measured data labeled as SV1 that is in good agreement with the calculated surface band. We note that there is some band intensity asymmetry along the equivalent momentum cut locations. For example, as seen in Fig. 3b, along $\Gamma_1$-M, three bands are clearly seen but along the equivalent $\Gamma_{21}$-M, the BV5 band gets stronger and the BV6 band becomes invisible. For the SV1 band, it appears clearly only on one side of $\Gamma$-M (Fig. 3b) and $\Gamma$-K (Fig. 3c) measurements. These intensity variations can possibly be attributed to the photoemission matrix element effect. From the measurements, there are three bands, two bulk bands(BV2 and BV5) and one surface band (SV1), that are Dirac-cone-like approaching the Fermi level. The good agreement between the measurements and band structure calculations provide an unambiguous identification of each band in Cd$_3$As$_2$ that lays a foundation for our further study below.

The nature of the surface band SV1 can be further examined by varying the photon energy during the ARPES measurements to detect band structures at different K$_z$ planes. As seen in Fig. 4a, at different photon energies, the SV1 band (marked as dashed blue lines) shows little change within the experimental uncertainty. This again provides an additional strong evidence on the nature of the SV1 surface band. We also find that this surface state is rather robust as it does not show obvious change during long time ARPES measurement even at a high temperature ($\sim$`<!-- -->`{=html}300 K). Interestingly, the SV1 surface band lies within the gap region formed by the BV2 and BV3 bands along the $\Gamma$-K and BV5 and BV6 bands along $\Gamma$-M. This is distinct from the topological surface state in 3D topological insulators such as Bi$_2$Se$_3$ and Bi$_2$Te$_3$. This surface state possesses a Fermi velocity as high as 7.5eV which has nearly the same value along G-K and G-M directions, suggesting an isotropic nature of the SV1 surface state. These results are consistent with the existence of a two-dimensional Dirac cone derived from the SV1 surface band. The revelation of the topological surface state is in agreement with the expectation from theoretical calculations on the non-trivial bulk band topology of Cd$_{3}$As$_{2}$.

The existence of possible 3D Dirac fermion in Cd$_{3}$As$_{2}$, which is supposed to disperse linearly along all three directions in momentum space, can be checked by the two-dimensional energy dispersions in the K$_x$-K$_y$ basal plane by varying K$_y$ values (Fig. 4b) and the band dispersion along K$_z$ by varying the photon energy (Fig. 4a). As seen from Fig. 4b, although the signal is weak, there is an overall trend that, with the momentum cut moving along K$_y$ within the K$_x$-K$_y$ basal plane (cuts B1 to B5 in Fig. 4c), the cross point of the BV1 bulk band approaches the Fermi level at K$_y$=0 and sinks below the Fermi level when the momentum cut moves away from the $\Gamma$-K direction. The dispersion can be fitted with a linear line at the Brillouin zone center (cut 3). Away from the Dirac point, the dispersions can be fitted with hyperbola lineshape, similar to the Dirac cone formed on the surface of topological insulators. The measured momentum dependence is consistent with the calculated result (Fig. 4d). These results are consistent with the presence of two-dimensional Dirac fermion from the BV1 band in the K$_x$-K$_y$ plane. On the other hand, as seen from Fig. 4a, the BV5 bulk band changes its position sensitively with the photon energy. It reaches the Fermi level near photon energies of 21.2 eV (Fig. 4a1) and 97 eV (Fig. 4a4) where Dirac-like linear bands are formed. For other photon energies, the cross point of the band appears below the Fermi level. Although we do not know the exact K$_z$ values corresponding to these photon energies, the observation of the Dirac-like bands at some discrete photon energies (K$_z$s) is consistent with the theoretical expectations that the conduction and valence bands touch only at discrete points in the momentum space. As the bulk Cd$_3$As$_2$ has I41cd symmetry identified for the X-ray diffraction patterns, in principle, the Dirac points are along the \[001\] direction due to the C4 symmetry. On the (112) surface, however, the Dirac points is located along the \[112\] direction. This is possible because APPES is mostly sensitive to the surface layers that has C3 symmetry as observed in the Fermi surface of this surface in Fig. 2. It is quite unique for Cd$_3$As$_2$ (112) surface that the bulk Dirac cone, as well as the surface Dirac cone, lies close to the Fermi level, indicating its electric neutrality that is ideal for investigating the intrinsic non-trivial properties.

In summary, we report angle-resolved photoemission measurements and band structure calculations on (112) surface of Cd$_{3}$As$_{2}$. We find that the overall measured Fermi surface and band structure show a good agreement with the band structure calculations. We have revealed the existence of two-dimensional Dirac fermions from topological surface state at the (112) crystal surface of Cd$_{3}$As$_{2}$. We also present experimental results of 3D Dirac fermions in Cd$_{3}$As$_{2}$ by observing the linear-dispersive bulk valence band along all the three directions in the momentum space. These results are consistent with the band structure calculations which indicate that Cd$_{3}$As$_{2}$ is a three-dimensional Dirac semimetal. Further high resolution ARPES work needs to be done to search for the arc-type Fermi surface as expected from theory.

$^{*}$Correspondence and requests for materials should be addressed to X.J.Z. (email@example.com).

We thank Desheng Wu for preparing single crystal and discussion. This work is supported by the National Natural Science Foundation of China (91021006, 10974239, 11174346 and 11274367) and the Ministry of Science and Technology of China (2011CB921703, 2013CB921700 and 2013CB921904). The synchrotron radiation experiments were performed with the approval of HSRC (Proposals No. 12-B-47 and No. 13-B-16).

H.M.Y. and X.J.Z. proposed and designed the research. Z.J.W, X.D. and Z.F. carried out band structure calculations. Y.G.S. grew the single crystal Cd$_3$As$_2$ samples. H.M.Y.,C.Y.C.,Y.F., A.J.L., Z.J.X., S.L.H., Y.Y.P., X.L., Y.L., L.Z., G.D.L., X.L.D., J.Z., Z.Y.X., C.T.C. and X.J.Z. contributed to the development and maintenance of Laser-ARPES system. M.N., M.A., K.S., H.N.and M.T. contributed in synchrotron radiation ARPES measurements. H.M.Y., C.Y.C., Y.F., A.J.L.,Z.J.X. and S.L.H. carried out the experiment. X.J.Z.and H.M.Y. wrote the paper. All authors participated in discussion and comment on the paper.

The authors declare no competing financial interests.