Francesco Conti

Gabriele Pieri

Oscar Papini

Marco Reggiannini

Davide Moroni

Maria Antonietta Pascali

Analysis of sea surface temperature maps via Topological machine learning

Keywords: topological data analysis, machine learning, image classification, temperature map, remote sensing, digital image, 3D point cloud, computational topology, upwelling classification

Computational methods to leverage topological features occurring in signals and images are currently one of the most innovative trends in applied mathematics. In this paper a pipeline of topological machine learning is applied to the challenging task of classifying four specific marine mesoscale patterns from remote sensing data, i.e., Sea Surface Temperature maps of the southwestern region of the Iberian Peninsula. Our preliminary study achieves an accuracy of 56% in the 4-label classification. Such results are encouraging, especially considering that the data are affected by noise and that there are low-quality/missing data. Also, the paper devises directions for future improvements.

I. INTRODUCTION

Recent advances in remote sensing are successfully applied to marine observation. Remote sensing provides the experts with a huge number of data acquired by satellite sensors; hence, there is a need for automatic or semiautomatic methods to analyze them. Our case study is the classification of the upwelling regimes of the Iberia/Canary Current System (ICCS), one of the least studied among the upwelling ecosystems [START_REF] Kämpf | Upwelling systems of the world: A scientific journey to the most productive Marine ecosystems[END_REF]. Among all the relevant underlying processes, these mesoscale events (e.g., upwelling, countercurrents and filaments) are of particular interest because they cause the transportation of deeper, colder and nutrient-rich waters to the surface, hence, they affect the biological parameters of the habitat, and enhance the local biodiversity [START_REF] Varela | Coastal warming and wind-driven upwelling: A global analysis[END_REF]. In other words, there is a connection between the biogeochemical and physical processes occurring in a marine biological system. Sea surface temperature is the measure of the water's temperature at the ocean's surface. Sea surface temperature is measured by satellite instruments that record the energy emanating from the ocean surface globally, which is emitted at different wavelengths. These data are then validated with temperature readings collected by ships and buoys.

Collecting, processing, and understanding the sea surface data is important because it allows to understand why some regions are warmer or cooler and its impact on the marine environment. Changes in the environment may impact the life of species living there, modifying the access to food, altering the migration patterns, or changing the access to mates.

Globally, the National Oceanic and Atmospheric Administration (NOAA) has collected data describing the global warming: the ocean has warmed approximately 0.13℃ every 10 years over the last century, hence changing the variety of marine organisms and bleaching corals. It also impacts the amount of water vapor available increasing the chance and frequency of more severe and stronger events (storms, floods, and droughts).

To the best of our knowledge, very few solutions have been developed to tackle the automation of the upwelling event classification. One of the most recent has been proposed in [START_REF] Reggiannini | Mesoscale patterns identification through SST image processing[END_REF][START_REF] Reggiannini | An Automated Analysis Tool for the Classification of Sea Surface Temperature Imagery[END_REF][START_REF] Pieri | MEC: A Mesoscale Events Classifier for Oceanographic Imagery[END_REF]. The method described in [START_REF] Reggiannini | Mesoscale patterns identification through SST image processing[END_REF] aims at the quantitative description of the upwelling events observed in the southwestern Iberian Peninsula; the "spaghetti graphs" are exploited to characterize the upwelling analyzing the temporal evolution of the Sea Surface Temperature (SST) maps. No learning paradigm is applied but, on other hand, the results are preliminary with respect to the automatic classification of large imagery data.

The aim of this work is to develop an automatic method based on topological machine learning to recognize such mesoscale events by analyzing the SST maps acquired by satellite sensing technologies, in the southwestern region of the Iberian Peninsula.

The paper is arranged as follows: Section II is devoted to the description of the classification pipeline; in Section III it is reported how the experiment has been carried out, i.e., data selection, preprocessing, and the result achieved. A brief discussion of the results is reported in Section IV, along with foreseen improvements of our methods for the classification of upwelling regimes.

II. METHODOLOGY

A. Computational Topology

Algebraic Topology is a branch of mathematics dealing with shapes. In a nutshell, you assign an algebraic object to a topological space. Then, you can compute several invariants and descriptors (the Euler characteristic, the Betti numbers, the homology groups). Such invariants and descriptors are used in computational topology to compare shapes, and to define distances between them. One of the most used tools from computational topology is persistent homology, which is a method for computing topological features of a space across different scales. More persistent features are detected over a wide range of spatial resolutions (have a long "lifespan") and are deemed more likely to represent important, or true features of the underlying space, rather than artifacts of sampling, or noise. Applications of persistent homology span from computer vision and shape analysis to biomedical imaging and complex networks analysis. In this perspective, one of the most promising trends is the merging of persistent homology with machine and deep learning [START_REF] Moroni | Learning Topology: Bridging Computational Topology and Machine Learning[END_REF].

B. Topological Machine Learning

The core idea in topological machine learning is to read the digital data as an algebraic object, from which topological invariants are computed; hence, use such invariants for training machine learning (ML) classifiers. One of the most effective tools for producing topological descriptors is persistent homology: it computes a persistence diagram (PD) for each dimension to any algebraic representation of the input data (as a simplicial complex with filtration). A wide range of transformations has been devised to exploit the capabilities of PDs in ML algorithms [START_REF] Chazal | Stochastic convergence of persistence landscapes and silhouettes[END_REF][START_REF] Bubenik | Statistical data analysis using persistence landscapes[END_REF][START_REF] Umeda | Time series classification via topological data analysis[END_REF][START_REF] Adams | Persistence images: A stable vector representation of persistent homology[END_REF][START_REF] Chen | A topological regularizer for classifiers via persistent homology[END_REF][START_REF] Pun | Persistent-homology-based machine learning: a survey and a comparative study[END_REF][START_REF] Corbet | A kernel for multi-parameter persistent homology[END_REF]. Each of them has been devised with specific requirements. Among all of them, our solution follows the classification the MNIST dataset presented in [START_REF] Conti | A Topological Machine Learning Pipeline for Classification[END_REF]. Firstly, we compute for each input data 18 PDs for each homology dimension considered (0 and 1), generated by the following 18 filtrations:

• the grayscale filtration of both the edge map and its negative version;

• the height filtration (8 directions, applied to the edge map);

• the radial filtration (nine origins);

• the density filtration (with radius = 6 and the Euclidean norm).

Hence, several vectorization methods (persistence image [START_REF] Adams | Persistence images: A stable vector representation of persistent homology[END_REF] with bandwidth in {0.1, 1, 10} and resolution in {5, 10, 25}, persistence landscape [START_REF] Bubenik | Statistical data analysis using persistence landscapes[END_REF] with resolution in {25, 50, 75, 100}, persistence silhouette [START_REF] Chazal | Stochastic convergence of persistence landscapes and silhouettes[END_REF] with resolution in {25, 50, 75, 100}, Betti Curve [START_REF] Umeda | Time series classification via topological data analysis[END_REF] with resolution in {25, 50, 75, 100}) are used to prepare the input for the classification step. A total of nine classifiers are trained for each representation; such classifiers are: Support Vector Classifiers (SVC) with kernel RBF and C in {1,2,3,5,10,20}; a random forest classifier (#trees = 100); and Lasso (α=1).

In the end, the several vectorizations of the topological descriptors are used to train several ML classifiers. Among all the trained models, the best performing is selected as the final topology-based classification model.

III. THE EXPERIMENT

In our experiment we collect satellite imagery from two satellite sources: the EUMETSAT's METOP-A and -B [START_REF] Osi Saf | Full resolution L2P AVHRR Sea Surface Temperature MetaGRanules[END_REF], and the NASA's Aqua [START_REF] Nasa/Jpl | GHRSST Level 2P Global Sea Surface Skin Temperature from the Moderate Resolution Imaging Spectroradiometer (MODIS) on the NASA Aqua satellite[END_REF]. A visual inspection of SST maps of the southwestern region of the Iberian Peninsula has been performed by experts, looking for a minimal set of patterns. The annotation process identified four typologies of mesoscale events as the most representative. The first mesoscale pattern (E1) is associated with the meander of the southward upwelling jet to the west, near Cape St. Vincent, alongside occurring the development of upwelling filaments.

Pattern E2 is depicted by the southwards flow of the upwelling jet overpassing the Cape St. Vincent forming an extended meridional filament. Pattern E3 is characterized by a clear line of cool water throughout the whole southern Iberian coast. Actually, experts distinguish two sub-types in the E3 patterns [START_REF] Reggiannini | Mesoscale patterns identification through SST image processing[END_REF], but we do not take care of this splitting in the present experimentation. Finally, pattern E4 occurs when a warm countercurrent develops near the southern Iberian coast, surrounding Cape S. Vincent, and flowing north near the coast. The present experimentation develops in several steps:

• Definition of the SST dataset;

• Preprocessing of the data;

• Topological Machine Learning pipeline. This last step produces a topology-based classification model.

A. Satellite SST

A selection of 503 images (381 METOP; 122 Aqua) from the years 2009 to 2016 has been downloaded and manually classified by experts in the mesoscale patterns: {E1, E2, E3, E4}. The resulting dataset is balanced: it is made of 125 images belonging to the E1 class and 126 to each of the E2, E3, and E4 classes (of which respectively 89, 99, 105, 88 from METOP; 36, 27, 21, 38 from Aqua). The satellite sources declare a spatial resolution at nadir of 1 km, and a temperature accuracy of 0.01 °C (METOP) or 0.005 °C (Aqua); the SST maps collected show values ranging in [-2°C, 36°C]. The files were provided in either NetCDF-4 or HDF format (the latter only for pre-2014 Aqua files) and subsequently converted into 8-bit grayscale PNG images; in particular, for each image, the following steps were performed:

• information about the latitude, longitude and temperature value was extracted from the NetCDF/HDF file and stored in three NumPy arrays;

• a Cartopy GeoAxis was prepared with a Plate Carrée projection and an extent of [36° N, 39.5° N] × [10.5° W, 7° W];

• a grayscale colormap was defined such that a temperature of 5 °C corresponds to gray 95%, a temperature of 25 °C to gray 0% (black) and the inbetween values are linearly interpolated; moreover, the white color has been assigned to missing or lowquality data;

• the temperature data was plotted in the GeoAxis using MatPlotLib's pcolormesh method (normalized between 5 °C and 25 °C) and saved using MatPlotLib's savefig method, with a 0.2-inch white padding, resulting in a 409×409 PNG image (370×370 without the white frame).

Note that the thermal resolution of the raw data is 0.01°C, at least, but when the temperature map is converted into a PNG file, such a resolution may be lower.

B. Preprocessing

The dataset considered is made of images which, even if they could be correctly classified by experts, very frequently are affected by noise (clouds), or may contain vast areas of missing data (e.g., large white stripe, leaving only 50% of sea surface visible). To enhance the signal content of each image and, consequently, the mesoscale pattern of the sea surface, a preprocessing pipeline has been applied (see Fig. 1):

• The Iberian Peninsula is filtered out, using a black mask;

• Multi-threshold Otsu 5-class segmentation, Scikit-Image implementation [START_REF] Liao | A fast algorithm for multilevel thresholding[END_REF] • Median filtering (kernel size: 7) followed by Gaussian filtering (kernel size: 3), implemented in OpenCV

• Fat Edge extraction using the Python PIL inbuilt function ImageFilter.FIND_EDGE (based on a Laplacian kernel of size 3).

C. Best model and Classification results

The methodology described in the previous Section produced 588 topology-based models, which have been trained to classify the upwelling patterns {E1, E2, E3, E4} on the balanced dataset of 403 b/w edge maps, which are the output of the preprocessing steps described in the previous subsection. An external test set is used to perform the model selection, in order to select the best-performing classification model: the best-performing model exploits the Betti curves in both dimensions 0 and 1 (as topological descriptors), and the Ridge classifier (as ML method). The results of classification of such model are shown in the confusion matrix of Fig. 2. In the end, our method is fully automatic and achieved a 56% of overall accuracy in the task of 4-label classification. Also, Fig. 2 shows that the classification is excellent for E3 and E4 patterns, while unsatisfactory for E1 and E2 patterns. In more detail, the misclassification between E2 and E3 caught our attention: there are 14 (13+1) images out of 50 which are classified incorrectly. Actually, in both E2 and E3 there is a cold region flowing; while in E2 the cold water flows in the south, in E3 the cold water flows closer to the coast, bending to east. Moreover, often such an event disappears before it has taken a definitive and clearly visible turn.

IV. DISCUSSION AND CONCLUSIONS

The results described in the previous section are encouraging because they show that topological descriptors extracted from SST maps could provide an excellent support for the detection of E3 and E4 patterns, as in both cases, the classification accuracy is very high (respectively 24/25 and 23/25), showing remarkable robustness against noise and missing signal. On the contrary, the classification of E1 and E2 patterns requires to be improved. There are many approaches we plan to adopt in order to improve our results:

(i) consider a temporal sequence of SST maps, in order to appreciate the evolution of a specific pattern. This approach would help to better discriminate E2 from E3, for example, and also to develop an automatic tool able not only to recognize a specific upwelling event, but also to predict it;

(ii) improve the image preprocessing by exploiting convolutional neural networks to tackle the problem of noisy signal, or missing signal in SST maps, e.g. using an autoencoder with Bayesian optimization, as done in [START_REF] Barth | DINCAE 1.0: a convolutional neural network with error estimates to reconstruct sea surface temperature satellite observations[END_REF][START_REF] Barth | DINCAE 2.0: multivariate convolutional neural network with error estimates to reconstruct sea surface temperature satellite and altimetry observations[END_REF].

Fig. 1

 1 Fig. 1 Image preprocessing. (a) Original greyscale image; (b) segmented image obtained through the Otsu multi-thresholding; (c) smoothing and blurring through median and Gaussian filtering; (d) edges. This last image is the input of the topological pipeline of classification.

Fig. 2 .

 2 Fig. 2. Confusion matrix of classification. Note: E3 and E4 events are classified very well, while the classification of E1 and E2 requires additional work to be improved.

ACKNOWLEDGMENT The authors express gratitude to Prof. Flávio Martins and Dr João Janeiro from the University of Algarve, Centre for Marine and Environmental Research, for their support. FUNDING This work has been partially funded by the European Union's 2020 research and innovation programme, under grant agreement No. 101000825 (NAUTILOS, https://www.nautilos-h2020.eu/).


domain: info shs

text:
Luca Viganò
email: luca.vigano@kcl.ac.uk

The Cybersecurity of Fairy Tales

Keywords: Security Properties, Security attacks, Science and technology, art and literature, Public understanding of science and technology, Representations of science and technology

The timeless nature of fairy tales can help uncover the timeless nature of many cybersecurity notions. Using 16 classical tales as illustration, in this article I show that fairy tales are full of cybersecurity motifs and examples, and can thus be used extensively and effectively to explain cybersecurity notions. Obviously not cybersecurity as we know it today, but rather the fundamental and archetypal concepts that are at its heart. Fairy tales can thus be employed to mediate in conversations with less-knowledgeable, misinformed or even skeptical laypersons about cybersecurity, increase their understanding and awareness, and thereby strengthen the overall cybersecurity of systems and applications.

Introduction

What is the earliest fairy tale that you remember? The one that your parents first told or read to you to lull you to sleep? Was it Cinderella, Little Red Riding Hood or Sleeping Beauty, perhaps confusing the versions of these three fairy tales collected by Perrault [START_REF] Perrault | The Complete Fairy Tales[END_REF] and by the Brothers Grimm [START_REF] Grimm | Kinder-und Hausmärchen[END_REF]? Was it maybe the Grimms' Snow White and the Seven Dwarfs, Hansel and Gretel, The Wolf and the Seven Young Goats, The Devil with the Three Golden Hairs, or Rumpelstiltskin? Puss in Boots in one of the versions of Straparola, Basile or Perrault [START_REF] Carruthers | Origins of Fairy Tales from Around the World[END_REF]? Perrault's Donkey Skin or Hop-o'-My-Thumb? The Grimms' The Girl Without Hands or one of its versions famous in Japan, Russia, Lousiana or Africa? Galland's Ali Baba and the 40 Thieves [START_REF] Galland | Les mille et une nuits -Édition illustrée[END_REF]? Or maybe some other fairy tale, famous or less famous, depending on where and when you were born and, of course, on the personal taste of whoever read or told you the tale.

Whichever fairy tale it was, it most likely contains, explicitly or implicitly, some cybersecurity element. All of the 13 fairy tales I listed above for sure do, as shown in Table 1, which includes three other fairy tales: the Grimms' Simeli Mountain, Harris' Cutta Cord-La! [START_REF] Chandler | Nights with Uncle Remus. Myths and Legends of the Old Plantation[END_REF] and Andersen's The Shadow [START_REF] Christian | The Complete Hans Christian Andersen Fairy Tales[END_REF]. Of course, none of these fairy tales actually deals with cybersecurity: they were all written well before the advent of digital technology and the now widespread use of the word 'cyber' as a prefix in front of 'security' and of 'space', as well as 'sex', 'punk', 'crime', 'terrorism' and other words that the Internet has lifted from the physical, analogical, world to the digital, cyber, world (along with other usages that predate the Internet such as 'cybernetics' and 'cyborg'). 1 So, what does it mean to speak of cybersecurity in the context of fairy tales? For instance, Cinderella, Little Red Riding Hood, Snow White and the Seven Dwarfs, The Wolf and the Seven Young Goats, Donkey Skin, The Girl Without Hands, Ali Baba and the 40 Thieves, Simeli Mountain and Cutta Cord-La! all deal, in one way or the other, with the cybersecurity notion that is called authentication, which the glossary of the Computer Security Resource Center of the National Institute of Standards and Technology of the U.S. Department of Commerce (NIST [START_REF]Glossary of terms and definitions[END_REF]) defines as "verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system" (cf. Table 2, which gives the definition of authentication and other cybersecurity notions provided by NIST or by other sources when NIST did not provide one).

Cybersecurity Notion

• • • • • • • • • Cinderella • • Cutta Cord-La! • •
Authentication is an archetypal notion. It is a cornerstone of cybersecurity, one which we all have to deal with on a daily basis, frequently in its enhanced form called multi-factor authentication (MFA), which requires one to provide two or more factors that they know, that they have or that they are (cf. Table 2). MFA is used also because humans are very bad at keeping and remembering secrets, including passwords as Cassim does in Ali Baba and the 40 Thieves as I will discuss later 2 , but one can't really forget their fingerprints, or their eyes for a retina scan, or their feet that match perfectly the size of a shoe. 3 As a concrete example, consider Cinderella: the Prince is able to authenticate the girl that he has fallen in love with by the fact that she is the only one whose foot fits into the glass slipper, or fur slipper, sandal or shoe, depending on the tale's version (cf. [START_REF] Carruthers | Cinderella -And Other Girls Who Lost Their Slippers[END_REF]) or on the modifications that have been made for the cinematographic adaptation. In Perrault's version Cendrillon ou La Petite Pantoufle de Verre (and, e.g., in Georges Méliès' short film Cendrillon ou La Pantoufle

Access Control

The process of granting or denying specific requests to 1) obtain and use information and related information processing services and 2) enter specific physical facilities (e.g., federal buildings, military establishments, border crossing entrances).

Advanced Persistent Threat / Multi-Stage Attack

An adversary with sophisticated levels of expertise and significant resources, allowing it through the use of multiple different attack vectors (e.g., cyber, physical, and deception), to generate opportunities to achieve its objectives which are typically to establish and extend its presence within the information technology infrastructure of organizations for purposes of continually exfiltrating information and/or to undermine or impede critical aspects of a mission, program, or organization, or place itself in a position to do so in the future; moreover, the advanced persistent threat pursues its objectives repeatedly over an extended period of time, adapting to a defender's efforts to resist it, and with determination to maintain the level of interaction needed to execute its objectives.

Anonymity

A condition in identification whereby an entity can be recognized as distinct, without sufficient identity information to establish a link to a known identity.

Authentication

Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system.

CAPTCHA

Completely Automated Public Turing test to tell Computer and Humans Apart.

Cipher

Series of transformations that converts plaintext to ciphertext [..].

Code

System of communication in which arbitrary groups of letters, numbers, or symbols represent units of plain text of varying length.

Confidentiality

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information

Cryptanalysis

Operations performed in defeating cryptographic protection without an initial knowledge of the key employed in providing the protection.

Denial of Service

The prevention of authorized access to resources or the delaying of time-critical operations.

Eavesdropper

A party that secretly receives communications intended for others.

Encryption

Cryptographic transformation of data (called plaintext) into a form (called ciphertext) that conceals the data's original meaning to prevent it from being known or used. If the transformation is reversible, the corresponding reversal process is called decryption, which is a transformation that restores encrypted data to its original state.

Escalation of Privilege

An attack in which a program or a user is technically able to do things that they're not supposed to do. (Not defined by NIST; definition taken from [Shostack, 2014].)

Identity

The set of physical and behavioral characteristics by which an individual is uniquely recognizable.

Identity Theft / Identity Fraud

Terms used to refer to all types of crime in which someone wrongfully obtains and uses another person's personal data in some way that involves fraud or deception, typically for economic gain.

Information Security

Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction.

Integrity

Guarding against improper information modification or destruction.

Malware

A program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system or of otherwise annoying or disrupting the victim.

Masquerading

A type of threat action whereby an unauthorized entity gains access to a system or performs a malicious act by illegitimately posing as an authorized entity.

Multi-Factor Authentication (MFA)

Authentication using two or more factors to achieve authentication. Factors include: (i) something you know (e.g., password/personal identification number (PIN)); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric).

Password

A string of characters (letters, numbers, and other symbols) used to authenticate an identity or to verify access authorization.

Replay Attack

An attack that involves the capture of transmitted authentication or access control information and its subsequent retransmission with the intent of producing an unauthorized effect or gaining unauthorized access.

Social Engineering

The act of deceiving an individual into revealing sensitive information, obtaining unauthorized access, or committing fraud by associating with the individual to gain confidence and trust.

Steganography

The art, science, and practice of communicating in a way that hides the existence of the communication.

Zero-Knowledge Protocol

A password-based authentication protocol that allows a claimant to authenticate to a verifier without revealing the password to the verifier. Merveilleuse shot in 1912), Cinderella authenticates herself not only by something that she is (her foot is the only one in the realm that fits) but also by something that she has: she completes the multi-factor confirmation of her identity by pulling out of her pocket the second slipper. As a side note, I have always wondered about the actual security of this authentication as it predicates on the quite unlikely fact that Cinderella's feet are the only ones in the whole realm that are tiny enough to fit the slippers. Similarly, Donkey Skin is the only one who has fingers so small to fit a ring. But these are tales of wonder after all. 4The more factors are used during an authentication process, the more confidence a service has that the user is correctly identified. That is why, because it is a matter of life and death, in The Wolf and the Seven Young Goats the mother goat tells her children not to open the door to any caller unless they recognize their true mother by her white feet and sweet voice. This is MFA for access control, to protect the children inside the house. It is, again, not a very secure form of authentication as all goats have white feet, but the other goats would hopefully not devour the children, and the mother's voice is, at least, a unique factor, or so she hoped. The wolf has namely eavesdropped the instructions of mother goat, so he eats some chalk to soften his voice, but the children ask also to see his feet and, seeing that they are black, they do not let him in: one authentication factor is not enough! So, he also smears flour over his coat, turning his black feet white. He is now able to masquerade as mother goat and gains access to the house and eats six of the children (fortunately, the seventh one will save the day with the help of mother goat). A masquerading attack is contained also in Aschenputtel, the gorier version of Cinderella collected by the Brothers Grimm (and in the theatrical/cinematographic version of the tale told in Stephen Sondheim's musical Into the Woods): inspired by the evil stepmother, Cinderella's two stepsisters attempt to authenticate as the object of the Prince's affection by mutilating their feet, but are exposed by the blood trickling from their wounds.

Finally, MFA also allows for a form of 'recovery' if one of the authentication factors fails: in Disney's 1950 Cinderella film, the evil stepmother trips the servant who is carrying the glass slipper, which shatters before Cinderella can try it on, but Cinderella produces the second slipper from her pocket and the happy end ensues. I will return to authentication later and discuss the other notions defined in Table 2 in detail.

Before I do, let me put this article into context. I have published a series of articles [START_REF] Viganò | Explaining Cybersecurity with Films and the Arts[END_REF][START_REF] Viganò | Don't Tell Me the Cybersecurity Moon is Shining[END_REF][START_REF] Viganò | Nicolas Cage is the Center of the Cybersecurity Universe[END_REF]] that discuss how, in the context of research in Explainable Security [START_REF] Viganò | Explainable Security[END_REF], popular films and other artworks can be used to explain cybersecurity notions as well as algorithms and solutions that have been developed to attempt to secure systems, and the vulnerabilities and attacks that they might suffer from. While experts typically only accept detailed technical explanations, laypersons are often scared off by explanations of cybersecurity (say, how to interact with a system or an app) that are detailed but too technical. Such an explanation might even repulse the laypersons and make them lose all trust in the explanation and, ultimately, in the cybersecurity of the system that is being explained. This repulsion and lack of trust might lead to users interacting with systems in ways that, unbeknownst to the users and possibly even to the developers and administrators of the systems, are vulnerable to attacks (to the systems and to the users themselves).

In practice, however, laypersons are rarely given explanations that are tailored to their needs and their ability to understand. On the other hand, a clear and simple explanation, with something that laypersons can immediately relate to or perhaps are even already familiar with, such as popular films, TV shows, novels or other artworks, helps make laypersons less irritated, stressed and annoyed, and indeed more captivated and receptive. It allows experts who provide the explanations to target the laypersons, reducing the mental and temporal effort required of them and increasing their understanding, and ultimately their willingness to engage with cybersecurity systems. This is what I have called Cybersecurity Show and Tell : the added power of telling (i.e., explaining notions in a technical way) and showing (via visual storytelling or other forms of storytelling) helps experts to convey not only the technical definition but also the intuition underlying that technical definition.

Recognizing the transformative role that the arts play in our society, they can be employed to open up conversations with the less-knowledgeable, misinformed or even skeptical public about cybersecurity, thereby increasing the laypersons' understanding and awareness, and strengthening the systems' overall security. The general public enjoy considering science through novel and innovative means, but cybersecurity, also because of the anxiety it can generate in our daily (online) lives, is a particularly challenging area for non-specialists which requires accessible mediation and interpretation. Art's power to target the emotions and intuition of an audience can be particularly effective, especially with the support of psychology to understand the variety of humans' stances and states of mind that cause cybersecurity vulnerabilities. As Marlow and Johnstone [START_REF] Marlow | The Power of the Arts[END_REF] observed, the fields of psychology and mental health have a long history of interdisciplinary explorations with the arts with a view to promoting increased understanding and awareness; other disciplines have a history too, e.g., social sciences [START_REF] William | The Art of Teaching Social Studies with Film. The Clearing House: A Journal of Educational Strategies[END_REF], international relations and politics [START_REF] Valeriano | Teaching Introduction to International Politics with Film[END_REF], and management [START_REF] Champoux | Management: Using Film to Visualize Principles and Practice[END_REF]. The overall aim of my research is to establish such interdisciplinary explorations for cybersecurity. The contribution of this article is to show that, like films and other artworks, also classical fairy tales can be used extensively and effectively to explain cybersecurity notions. 5I proceed as follows. In the next section, I provide more details on the relationships between fairy tales and cybersecurity, and discuss Ali Baba and the 40 Thieves as a concrete example. Then, in the following section, I discuss archetypes and motifs, and afterwards, in the next three sections, I describe different cybersecurity notions that are contained in fairy tales. Finally, I provide some concluding remarks and discuss future work.

Fairy Tales and Cybersecurity

Fairy tales have been fascinating children and adults alike for centuries because they are entertaining, of course, but also because they are educational; they encourage critical thinking, while feeding our imaginations. The psychologist Bruno Bettelheim affirmed that "the fairy tale confronts the child squarely with the basic human predicaments" and thus helps the child understand the meaning of life" [3, p. 16]. Jerome Bruner, also a psychologist, affirmed that narratives simultaneously activate both the paradigmatic or logico-scientific mode of thought, which "attempts to fulfill the ideal of a formal, mathematical system of description and explanation" and essentially formalizes cause and effect relationships, and the narrative mode of thought, which "deals in human or human-like intention and action and the vicissitudes and consequences that mark their course" and "strives to put timeless miracles into the particulars of experience, and to locate the experience in time and place" [6, pp. 12-13].

Fairy tales can be used to teach and explain. Cleto and Warman echo Jones and Schwabe [START_REF] Jones | Introduction: Cross-Disciplinary Perspectives on Teaching Folklore and Fairy Tales in Higher Education[END_REF] to emphasize "the educational opportunities offered by fairy tales, which can fill a broad range of curricular needs: instructors in a variety of academic fields can draw on fairy tales to help students improve critical-thinking abilities, strengthen writing skills, and explore cultural values" [14, p. 6]. Moreover, as observed by Laura Packer [START_REF] Packer | Why We Need Fairy Tales[END_REF], "Fairy tales endure because they are, at their most basic, the stories of our lives in their most stripped-down form. [...] They are the unadorned stories of what drives us, without the civilizing details of technology and manners. They teach us how to survive in this wily and wicked world. They are a shortcut to a common understanding of the way the world works. Fairy tales help us understand that the values of once upon a time aren't so different from our values now."

Although she was not writing about cybersecurity, I second Packer's observation: the cyberworld (e.g., the Internet and social media) is a wily and wicked world much alike, if not possibly even more than, the physical world that we live in, and fairy tales, which are part of our collective imagination and of our cultural good, can act as a shortcut to a common understanding of the way this cyberworld of ours works, including explaining, and understanding, cybersecurity notions if one strips away the details of technology. The timeless nature of fairy tales can help uncover the timeless nature of some cybersecurity notions and methods, thus establishing fairy tales as an effective mediation between the two modes of thought, between the cyber world and the physical world.

Children "play games with exactly the same ritual and exactly the same phrases, in some instances, as the children of thousands of years ago" [2, p. 2] and a similar situation applies for cybersecurity. While, of course, technology is omnipresent in our life today and lies at the heart of cybersecurity as we know and experience (and sometimes dread) it today, 'analogical' cybersecurity notions and solutions have been around since almost the dawn of humankind, or actually as soon as people had information that they wanted to protect (hence, the more general term 'information security' that I mentioned above). Over the course of the centuries, most civilizations invented solutions to protect their valuable information, such as ciphers (e.g., the Caesar Cipher used by the Romans in the 1 st century BC or the cipher scytale used by the Spartans as early as the 7 th century BC) or codes (a fascinating example are rhyming slangs such as the Cockney rhyming slang first used in the 19 th century in the criminal underworld of the UK). There are also solutions based on steganography, in which messages are hidden in other messages (in his Histories, written around 430 BC, Herodotus mentions one of the first recorded uses of steganography: Histiaeus sent a message to his vassal, Aristagoras, by shaving the head of his most trusted servant, 'marking' the message onto his scalp, then sending him on his way once his hair had regrown, with the instruction, "When thou art come to Miletus, bid Aristagoras shave thy head, and look thereon"). 6 Ciphers, codes and steganography are examples of solutions to achieve confidentiality, but can be used to achieve also other cybersecurity properties such as integrity (cf. Table 2).

Technology advancements have obviously changed the concrete realizations, implementations and devices by which we guarantee cybersecurity properties: except perhaps in spy movies, we don't use the Caesar Cipher or the scytale anymore; we use their modern successors along with modern codes and steganography techniques. However, the main ideas underlying the properties and solutions have not changed, and many of these ideas are already present in fairy tales. "The values of once upon a time aren't so different from our values now", as remarked by Packer. Let me give another example. One of the most complex cybersecurity notions is anonymity (cf. Table 2), which comes into play when we want to keep secret the identity or location of an agent participating to a certain event (in voting, delation, donations, sending emails, ...). Different degrees of anonymity exist with formal definitions requiring advanced number theory and probability theory, but the quintessence of existing cybersystems for anonymity can be illustrated through Ali Baba and the 40 Thieves, which also serves to discuss several other cybersecurity notions (cf. Table 1). To demonstrate this, let me give a quick summary of the fairy tale. One day, as he is cutting wood in the forest, the poor woodcutter Ali Baba observes a group of 40 thieves visiting the cave in which they have stored their treasure. The mouth of the cave is sealed by a huge rock, which opens and closes by uttering the magic words "open sesame" and "close sesame", respectively. Ali Baba has thus involuntarily become an eavesdropper as he now knows the thieves' password, which is the confidential information that the thieves use to authenticate themselves to the magic door. When the thieves are gone, Ali Baba enters the cave by repeating the password (and thus carrying out a replay attack ). As he is fundamentally honest, he takes a single bag of gold coins home. A few days later, under pressure from his brother Cassim, Ali Baba is forced to reveal the secret of the cave; this is coercion, a notion that is relevant in cybersecurity in the context of electronic voting (where systems are required to resist the attacks of an adversary who attempts to coerce voters that they vote in a particular manner or abstain from voting). 7Unlike his brother, Cassim is greedy, so he goes to the cave aiming to take as much treasure as possible. He enters the cave with the magic words, but, in his greed and excitement over the treasure, he forgets the words to get out again and ends up trapped -who of us has not forgotten a password one time or the other, albeit maybe not because of greed but simple forgetfulness? 8The thieves find Cassim in the cave and kill him. When his brother does not come back, Ali Baba goes to the cave to look for him, finds the body, and brings it home for a proper burial. The thieves, finding the body gone, realize that a second person must know their secret. In order to track that person down, the chief sends one of the thieves to the town. The thief finds Ali Baba's house and marks the door with a symbol so the other thieves can come back that night and kill everyone in the house. However, Morgiana, a clever slave-girl from Cassim's household, has seen the thief. She foils his plan by marking all the houses in the neighborhood similarly. When the 40 thieves return that night, they cannot identify the correct house, and the chief kills the unsuccessful thief in a furious rage. The next day, another thief tries again and this time marks the target house by chipping a chunk out of the stone step at Ali Baba's front door. Again, Morgiana foils the plan by making similar chips in all the other doorsteps, and the second thief is killed for his failure as well.

What just happened? Given that all the houses have the same mark(s), it is impossible for the thieves to identify which one is Ali Baba's real house. In other words, Ali Baba's house is anonymous as it is not identifiable from the other houses in the neighborhood. To protect Ali Baba's family, Morgiana has created what in technical terms is called an anonymity set, which in this case is the set containing all houses in the neighborhood, and the thieves are none the wiser and they would have to try out all the houses one by one. So, the larger the set, the worse for the thieves and the better for Ali Baba and his family.

Formally, an anonymity set is the set of all possible subjects who might cause an action, and then anonymity can be defined as the state of being not identifiable within a set of subjects, namely, the anonymity set [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management[END_REF]. One can of course give this formal definition of anonymity and maybe accompany it with a mathematical one -and this is what one would do in front of an expert audience, say in a talk at a conference or in a university lecture on cybersecurity -but the point here is that even non-specialists immediately understand what Morgiana is doing and why. In fact, I dare say that we all, more or less, intuitively understand that anonymity cannot really exist in a vacuum (one cannot be anonymous by oneself) but rather requires a large enough set of similar 'things', a large enough set of similar people, actions, messages, etc., so that one's identity, actions, or messages are not distinguishable from those of the others and thus not identifiable.

But that is not all: Ali Baba and the 40 Thieves includes a few more cybersecurity notions. The repeated and manifold efforts of the thieves amount to what is called an attack by an advanced persistent threat, namely an attack that consists of multiple and diverse stages, pursuing the "objectives repeatedly over an extended period of time, adapting to a defender's efforts to resist it, and with determination to maintain the level of interaction needed to execute its objectives". So, given the failure of his two men, the chief of the thieves takes matters in his own hands: he masquerades as an oil merchant in need of Ali Baba's hospitality, bringing with him mules loaded with 38 oil jars, one filled with oil, the other 37 hiding the other remaining thieves. They plan to kill Ali Baba and his family once they are asleep. Again, Morgiana discovers and foils the plan, killing the 37 thieves in their jars by pouring boiling oil on them. When the chief comes to rouse his men, he discovers they are all dead and escapes. Ali Baba shows his gratitude by giving Morgiana her freedom. In a final attempt to exact revenge, the chief of the thieves establishes himself as a merchant (this is again masquerading), befriends Ali Baba's son, and arranges to be invited to dinner at Ali Baba's house. However, the thief is yet again recognized by Morgiana, who kills him. Ali Baba rewards Morgiana by marrying her to his son. Ali Baba is then left as the only one knowing the secret of the treasure in the cave and how to access it.

Archetypes and Motifs

Ali Baba and the 40 Thieves is thus quite the fairy-tale goldmine for cybersecurity notions. 9 Marie-Louise von Franz, the Jungian scholar renowned for her psychological interpretations of fairy tales, remarked that "Fairy tales are the purest and simplest expression of collective unconscious psychic processes. [...] They represent the archetypes in their simplest, barest, and most concise form. In this pure form, the archetypal images afford us the best clues to the understanding of the processes going on in the collective psyche" [49, p. 13]. To paraphrase von Franz, fairy tales represent cybersecurity archetypes in their simplest and barest form, and afford us (some of) the best clues to the understanding of the processes going on in the collective psyche of the cyberworld. Cybersecurity experts have developed solutions to cybersecurity problems that are similar to, and in some cases are simply the digital version of, the ones invented by fairy tale authors centuries before. The problems, and their solutions, are archetypal, they are part of who we are, much in the same way as the stories in the fairy tales are. Again quoting von Franz, "We have written tradition for three thousand years, and what is striking is that the basic motifs have not changed much" [49, p. 16].

To analyze and compare fairy tales, folklorists such as Antti Aarne, Stith Thompson and Hans-Jörg Uther have worked at identifying their building-blocks and patterns: fairy tales are composed of elements called motifs, which are combined in different ways to create a plot of a tellable tale. Many tales have the same patterns of motifs, which are called tale-types. The Aarne-Thompson-Uther (ATU) Index allows researchers to identify the underlying structure of a tale and to cross-reference it with other tales that share the same elements or themes [START_REF] Uther | The Types of International Folktales: A Classification and Bibliography. Based on the system of Antti Aarne and Stith Thompson. Suomalainen Tiedeakatemia[END_REF]. Each entry in the ATU index describes which themes and motifs comprise a specific tale-type, and each motif has an identifying number, which can be cross-referenced with Thompson's Motif-Index of Folk-Literature [START_REF] Thompson | Motif-Index of Folk-Literature: A Classification of Narrative Elements in Folktales, Ballads, Myths, Fables, Mediaeval Romances, Exempla, Fabliaux, Jest-Books, and Local Legends[END_REF]. While these two indices are often used in tandem by folklorists, for this article I will focus on Thompson's index, which gives each motif a letter from A to Z to designate its type and a number to identify it. In particular, the letter H designates tests, which abound in fairy tales and folk literature and are part of Bettelheim's predicaments mentioned above, including tests to prove one's identity, tests of cleverness, strength or skill, riddles, and quests that heroes are sent on. 10 Tests abound in cybersecurity, too. For instance, anyone who has surfed the web has come across a CAPTCHA, which is a test that websites use to identify whether the user is a human and thus prevent access by bots (i.e., web robots attempting to pass as humans).

Thompson defines the tests from H0 to H199 as "Identity tests: recognition" and indeed identity and recognition play a major role in fairy tales, especially those in which the hero(ine) embarks on a journey that will allow them to discover their own true identity or unlock somebody else's identity (see also the essays by Campbell [START_REF] Campbell | The Hero with a Thousand Faces[END_REF] and Vogler [START_REF] Vogler | The Writer's Journey: Mythic Structure for Writers[END_REF]). Propp also noted this and defined two of his functions accordingly: "XXVII. The Hero is Recognized. [...] He is recognized by a mark, a brand (a wound, a star marking), or by a thing given to him (a ring, towel). In this case, recognition serves as a function corresponding to branding and marking. The hero is also recognized by his accomplishment of a difficult task (this is almost always preceded by an unrecognized arrival)..." and "XXVIII. The False Hero or Villain is Exposed. [...] This function is, in most cases, connected with the one preceding..." [32, p. 179]. 9 The cave that opens with a password has also been used by Quisquater and Guillou (and their children), with the help of Berson, as a metaphor to explain zero-knowledge protocols to children and other non-expert users [START_REF] Quisquater | How to Explain Zero-Knowledge Protocols to Your Children[END_REF], where a zero-knowledge protocol is "a password-based authentication protocol that allows a claimant to authenticate to a verifier without revealing the password to the verifier" [START_REF]Glossary of terms and definitions[END_REF]. 10 Tests are present also in the ATU Index, but for the most part they are 'distributed' among the different entries rather than collected under a dedicated label.

Authentication, Identity Theft, Escalation of Privilege and Advanced Persistent Threat

We have already seen an example of exposition of the villain in Ali Baba and the 40 Thieves when Morgiana twice exposes the chief of the thieves, and I have already pointed out that several of the fairy tales I mentioned (and many more that I did not mention) are about authentication, namely the process of verifying the identity of a person, which is recognition in the terminology of both Thompson and Propp.

Cinderella, Donkey Skin and The Wolf and the Seven Young Goats are examples of Thompson's "H50. Recognition by bodily marks or physical attributes", along with Homer's The Odyssey [START_REF] Homer | The Odyssey. Penguin Classics[END_REF] in which Odysseus, when he finally returns to Ithaca after 20 years, is recognized by his old wetnurse Eurycleia by a scar he received during a boar hunt many years before, and by his faithful dog Argos by his smell. Odysseus is also an example of "H30. Recognition through personal peculiarities" and "H31. Recognition by unique ability" as he is the only one able to bend his old bow and shoot an arrow through twelve axe shafts. Similar stories exist in Hindu mythology.

An authentication by voice similar to that of The Wolf and the Seven Young Goats occurs in Harris' Cutta Cord-La! [START_REF] Chandler | Nights with Uncle Remus. Myths and Legends of the Old Plantation[END_REF], although Thompson mistakenly labels it "H18. Recognition by password" (this is mistaken because what matters is not really what is said but rather the voice that says it). Authentication and masquerading occur also in Little Red Riding Hood when the wolf pretends to be the grandmother (masqueradings of this form are related to some of Thompson's motifs "D0-D699: Transformation"), whereas Snow White and the Seven Dwarfs is about authentication, masquerading and fake credentials: the queen disguises herself to give the poisoned apple to Snow White, after the huntsman she hired to kill Snow White spared the girl's life and brought the queen the heart of an animal instead. Similar fake credentials are used for fake authentication also in The Girl Without Hands when the tongue and eyes of a deer are used instead of the girl's tongue and eyes as a proof of her death.

These examples illustrate how identity and authentication, and several related cybersecurity notions, occur very frequently in fairy tales. As noted by Thompson in H0, "elaborate means are employed in folk-literature for the recognition of persons even though they have been separated a very short time", many of which have an equivalent in modern MFA.

In addition to these physical authentication factors and the other ones mentioned above, it is interesting to highlight the following motifs. "H10. Recognition through common knowledge" and in particular "H17. Recognition by reminders of what has been said" list many of the possible factors that could be used for authentication, ranging from a password (a secret known to both authenticator and authenticatee) to an overheard conversation (which might suggest some forms of malevolent or benevolent eavesdropping). "H80. Identification by tokens", "H90. Identification by ornaments" and "H110. Identification by cloth or clothing", such as a ring, a necklace, an amulet, golden apples or a garment, are akin to producing a card to be authenticated by something that one possesses. Finally, "H163. Recognition of own cow in herd of twenty thousand" is, in a sense, the opposite of anonymity, namely the ability to identify, by certain factors, that specific cow in the midst of an anonymity set that contains twenty thousand elements.

Cybersecurity in fairy tales is, however, much more than what relates, in one way or the other, to Thompson's tests (although I will mention a few more below). For instance, there is also, in a sense, the opposite of identity: identity theft. Masquerading is already a case of identity theft in which the attacker illegitimately poses as another, authorized entity, but in Andersen's The Shadow [START_REF] Christian | The Complete Hans Christian Andersen Fairy Tales[END_REF], the identity theft is taken to the extreme when the shadow has become the man and offers to the real man to become its shadow.

A cybersecurity notion related to identity theft and masquerading is escalation of privilege: although the Marquis of Carabas is a fictional entity, and thus there is no real identity to steal, he is brought to life by the trickster cat in Puss in Boots and its variants [START_REF] Carruthers | Origins of Fairy Tales from Around the World[END_REF], who embodies an advanced persistent threat to ensure that his poor master acquires privileges that he could only dream of.

Integrity, Confidentiality and Eavesdropping

In addition to authentication, The Girl Without Hands, with its international versions spanning from Straparola's Italy to Japan via the Grimms' Germany (ATU 706 and Thompson E782.1), provides an example also of confidentiality and integrity, and of an advanced persistent threat. The devil forces the girl's father to chop off her hands (in other versions, e.g., the Japanese one, it is not the devil but the girl's evil stepmother). After many vicissitudes, the girl marries the king and gives birth to a beautiful son. The king's mother sends a messenger to deliver a letter with the joyful news to the king, who in the meantime has gone to war. However, tired from the long journey, the messenger stops to rest and falls asleep, and the devil (again the stepmother in other versions), who still wants to harm the girl, takes the letter out of the messenger's satchel, reads its (which constitutes a breach of confidentiality) and then replaces it with a letter stating that the queen has brought a changeling into the world (this is a breach of integrity, as the original content is maliciously altered). Although frightened and saddened by this letter, the king writes an answer to his mother asking her to take good care of the queen until his return. The messenger returns with this letter, but again he stops to rest and falls asleep, and again the devil replaces the letter with one in which the king orders that the queen should be killed with her child. The king's mother does not believe the letter and writes to the king again, but she receives the same answer, because each time the devil substitutes a false letter, and in the last one even orders that they should keep the queen's tongue and eyes as proof, but the king's mother has a deer killed instead and its tongue and eyes used for the fake authentication as mentioned above, thus spoiling the devil's evil plan.

I already mentioned confidentiality in Ali Baba and the 40 Thieves, and secrets play a role also in other entries in Thompson's index, such as "C420. Tabu: uttering secrets", "C820. Tabu: finding certain secret" and "N450. Secrets overheard". The latter is, essentially, eavesdropping. In addition to the examples of eavesdropping given above (and in many other fairy tales, since eavesdropping is quite a common trope), another example is given by Rumpelstiltskin and its variants [START_REF] Carruthers | Rumpelstiltskin -And Other Angry Imps With Rather Unusual Names[END_REF]. The queen eavesdrops as the imp hops about his fire and sings "tonight tonight, my plans I make, tomorrow tomorrow, the baby I take. The queen will never win the game, for Rumpelstiltskin is my name." The queen thus learns his name and is then able to repeat it to win the bargain that she and Rumpelstiltskin had made.

Encryption, Denial of Service and Tracing

Finally, one can, perhaps with a little fantasy, see enchantment as a form of encryption. For instance, Snow White and Sleeping Beauty have been locked (i.e., encrypted) into an enchanted sleep by a malware (a poisoned apple and a poisoned spindle, respectively), similar to viruses and cryptoworms that lock computers when users unknowingly visit malicious websites or click on phishing emails, such as in the infamous WannaCry ransomware attack in 2017. Attempts to wake them up are akin to cryptanalysis, namely trying to break the enchantment without possessing the 'decryption key', which instead, in Disney's versions more than in the original fairy tales, can only be reversed by 'true love's kiss'. Similarly, kissing the frog is the key to 'decrypt' it and recover the prince in many fairy tales.

When Snow White and Sleeping Beauty are 'encrypted', they are also, in a sense, victims of a form of denial of service: they are denied living their normal life and others are denied interacting with them. A much better example of denial of service is, however, provided by Hop-o'-My-Thumb, which also provides an example of tracing 11 : when his poor parents take Hop-o'-My-Thumb and his siblings to the forest to abandon them there, he uses some stones he had collected to mark a trail that enables him to lead his brothers back home, but the second time round, he uses breadcrumbs instead, which the birds eat up. The birds thus deny Hop-o'-My-Thumb from accessing the pieces of information he had dropped to reconstruct the trace leading back to his parents' house. The same situation occurs in Hansel and Gretel and in many other fairy tales in which children are forsaken in forests [START_REF] Carruthers | Hansel and Gretel -And Other Siblings Forsaken in Forests[END_REF].

Conclusions

Fairy tales are wonderful. Not only because they objectively are, most often, full of wonder, but also thanks to the different social functions they have assumed throughout the centuries, ranging from amusement to instruction according to the basic tenets of the civilizing process in each particular country, from social critique to aids for therapy "with disturbed or abused children because they enable a child to gain distance from trauma and deal with it on a symbolical level that enables the therapist to understand and work with the child" [50, p. 24]. Fairy tales have always been a powerful discourse, capable of being used to shape or destabilize attitudes and behavior within culture: "we initiate children and expect them to learn the fairy-tale code as part of our responsibility in the civilizing process" [Zipes, 2009, p. 29]. The fairy tale has become "a staple of education throughout the west", it has become "totally institutionalized in our society, part of the public sphere, with its own specific code and forms through which we communicate about social and psychic phenomena" [50, p. 24 and p. 29].

This article shows that fairy tales are full of cybersecurity motifs, examples and, in some cases, allegories. Of course, not cybersecurity as we know it today (although I am sure that there are contemporary fairy tales in which cybersecurity plays a role), but rather the fundamental notions that are at the heart of cybersecurity. Much in the same way as fairy tales were "intended to play a major role in the socialization process" [50, p. 21], they can also play a major role in the 'cybersecurity alphabetization' of laypersons, be they children or adults, and favor a first conversation before, if and when needed, plunging into the technical details that underlie cybersecurity notions and solutions.

The investigation in this article is by no means exhaustive and can be extended in many different ways. First of all, to consider more fairy tales and more cybersecurity notions. Moreover, my focus here has been on fairy tales popular in the Western world. Although fairy tales are known to have a certain universality, with the same themes and plots reoccurring in story form all over the world, examples coming from the traditions in, e.g., the Asia, Africa, South America and Eastern Europe deserve a further study. I also plan to consider more recent fairy tales, as well as their adaptations in film (I already mentioned a few above) and in popular culture, including the Harry Potter saga by J.K. Rowling, which contains several examples of cybersecurity notions as I discussed in my previous papers.

Following in the footsteps of scholars such as Bettelheim, von Franz and Zipes who studied the relationship between fairy tales and myths, I would like to investigate the similarities and differences of how cybersecurity is immanent in both. For instance, the search for one's identity, along with the need to prove one's identity, is a common topos. So are MFA (for example, Thor is the only one able to lift the Mjøllnir hammer in Norse mythology, Arthur is the only one able to pull out the sword Excalibur from a stone, and Odysseus is the only one able to use his old bow as mentioned above) and masquerading attacks (in fairy tales but also in myths this often occurs by the attacker magically or divinely shape-shifting into somebody or something else, such as in the Epic of Gilgamesh [START_REF]The Epic of Gilgamesh: The Babylonian Epic Poem and Other Texts in Akkadian and Sumerian[END_REF] or in Ovid's Metamorphoses [START_REF] Ovid | Metamorphoses[END_REF], or by wearing somebody's clothes as in Homer's The Iliad [START_REF] Homer | The Iliad. Penguin Classics[END_REF], which, besides the feats of the gods, describes how Patroclus wears the Pelides' armor to be mistaken for Achilles). This investigation of cybersecurity in fairy tales and myth will hopefully also provide a deeper understanding of the connections between cybersecurity notions and the indices of Thompson and of Aarne-Thompson-Uther, as well as the functions of Propp.

I have been using popular films to explain cybersecurity for several years, both in lectures and in public engagement talks, and I have complemented the anecdotal evidence that I collected at these events with systematic user studies, which showed that popular films are indeed a successful tool to explain cybersecurity to different kinds of people. A few years ago, I started using fairy tales in lectures and talks, too. My experience is that fairy tales are at least as effective as movies, but I plan to carry out user studies to gather concrete evidence.

I would also like to identify and categorize the cybersecurity notions that are not represented in fairy tales, and investigate why. Are there historical, semantical or technological reasons? This would help shed a further light on the notions and on their (non-)archetypal nature. Finally, I would like to follow in the footsteps of Fénelon and Brough. In the 1690s, the Archbishop Fénelon was the tutor of the Dauphin's 7-year-old son and wrote didactic fairy tales to make the lessons more enjoyable. In 1859, John Cargill Brough published The Fairy Tales of Science -A Book for Youth [START_REF] Cargill | The Fairy Tales of Science -A Book for Youth[END_REF], in which he used popular myths and fairy tales to provide an entertaining introduction to topics in science for children (cf. also [START_REF] Keene | Science in wonderland -the scientific fairy tales of Victorian Britain[END_REF]). In addition to using existing fairy tales, I plan to plot new fairy tales oriented to explain cybersecurity or maybe even to inspire novel cybersecurity solutions, possibly inspired by the books by Quaglia [START_REF] Quaglia | Learning Together -Cryptography for Toddlers[END_REF][START_REF] Quaglia | Learning Together -Cyber Security for Toddlers[END_REF] or by the many ideas in [START_REF] Bultel | How to Explain Modern Security Concepts to Your Children[END_REF][START_REF] Cortier | How to Explain Security Protocols to Your Children[END_REF] and in [START_REF]The Science of Stories[END_REF]. The goal will be to explore how venturing into the 'cybersecurity woods' allows for understanding the pathways and journeys that leave us more vulnerable and open to cyber harm, in the hope that we will then be able to live cybersecurily ever after.

A c c e ss C o n tr o l A d v a n c e d P e r si st e n t T h r e a t / M u lt i-S ta g e A tt a c k A n o n y m it y A u th e n ti c a ti o n C o e r c io n C o n fi d e n ti a li ty D e n ia l o f S e r v ic e E a v e sd r o p p in g o f S e c r e t o r P a ss w o r d E n c r y p ti o n E sc a la ti o n o f P r iv il e g e F a k e C r e d e n ti a

Table 1 :

 1 Fairy Tales and Cybersecurity Notions

	The Devil with the Three Golden Hairs			•			•
	Donkey Skin		•
	The Girl Without Hands	•	•	•		•	•
	Hansel and Gretel			•			•
	Hop-o'-My-Thumb			•			•
	Little Red Riding Hood		•			•
	Puss in Boots	•	•		•
	Rumpelstiltskin				•		•
	The Shadow					•
	Simeli Mountain	•	• • •	•
	Sleeping Beauty			•	•
	Snow White and the Seven Dwarfs		•	•	•	•
	The Wolf and the Seven Young Goats	•	•			•

Table 2 :

 2 Cybersecurity Notions (as defined in the glossary published by NIST)

One should perhaps rather speak of information security, which is more general than cybersecurity and is independent of computer systems, as it "means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction" (cf. Table

2). Information is more general than data: data conveys information, but information may also be revealed without revealing data, e.g., by statistical summaries or by actions carried out by agents, be they human agents or computer agents. For instance, if an agent Alice sends an encrypted message to another agent Bob, the encryption might prevent an attacker Charlie from reading the content of the message if he cannot decrypt it (so the message is confidential), but the fact that Charlie

Both Bettelheim[START_REF] Bettelheim | The Uses of Enchantment: The Meaning and Importance of Fairy Tales[END_REF] and Do Rozario[START_REF] Rebecca-Anne | Fashion in the Fairy Tale Tradition (What Cinderella Wore)[END_REF] discuss extensively these 'tests for fit as queen' from a psychological and a sartorial point of view. In particular, Do Rozario[16, p. 121] observes that "the foremost claim of Cinderella and Donkey Skin to social status is through the perfect fit of their wardrobe" and, about Cinderella, that "The smallness of the shoe thus stands in for the smallness of the foot, highlighting an attribute that has long been associated with beauty. [...] The shoe test proves that her foot itself is fashionably small, that she is whom she claims to be. The shoe manifests Cinderella herself"[16, p. 184]. So, the shoe is indeed an authenticator.

Modern fairy tales (such as those by Angela Carter or Gianni Rodari) or tales written on purpose can be used too, but are out of the scope of this article. I will return to this in the conclusions.

Other examples of historical ciphers can be found, e.g., in the books by Singh[START_REF] Singh | The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography[END_REF] and Dooley[START_REF] Dooley | History of Cryptography and Cryptanalysis: Codes, Ciphers, and Their Algorithms[END_REF].

NIST's glossary does not provide definitions of coercion and of electronic voting, but I trust them to be understandable by the non-expert based on what I have written.

A similar situation occurs in the Grimm Brothers' Simeli Mountain.

Again, NIST's glossary does not provide a definition of tracing, but I trust the notion to be understandable by the non-expert especially given one of the definitions given in the Merriam-Webster dictionary: to follow footprints, a track, or a trail.

Acknowledgments

It takes a village to write a paper like this. I would like to thank the following people for their suggestions and comments: Alessandra Di Pierro, Aldo and Claudia Viganò, Giampaolo Bella, Oya Celiktutan, Gabriele Costa, Elisabetta Cremaschi, Emma De Angelis, Anne E. Duggan and Cristina Bacchilega, Graeme Earle, Ziad Elmarsafy, Barbara Fiorio, Daniele Gouthier, Ali Hossaini, Michael Kölling, Ashwin Mathew, Georgia Panteli, Katia Pizzi, Anna Ploszawski, Roberta Profeta, Carlo Sciaccaluga, Diego Sempreboni, Elena Tchougounova-Paulson, Ben Thomas, Marco Volpe, Sarah Werts, Lorenzo Zucca, and a few more that I am sure I have forgotten to mention.