dataesr/scientific-paragraphs-categorization huggingface dataset:
spammy by Kaspersky and W32/Sality by McAfee were identified as aliases for the same sality malware, and therefore grouped as part of the same family. Cloud-based Malware Families: We mainly focus in this paper on malware that uses dedicated malicious services hosted on EC2. Therefore, we build clusters of malware families for our dataset including 8, 867 distinct samples that belong to this category. Using our approach, we are able to identify 377 distinct malware families. As clearly illustrated in Table  3 , which provides the list of top 20 malware families, we were not able to identify a predominant malware family that uses dedicated malicious cloud services. More interestingly, our dataset includes Fig. 3 : Malware dataset analysis malware that uses different topologies, including also decentralized peer-to-peer networks such as the Sality malware.
Clearly the use of dedicated malicious cloud services is not limited to a small set of malware families, but it could be generalized to all categories of malware. O c t 2 0 1 0 A p r 2 0 1 1 O c t 2 0 1 1 A p r 2 0 1 2 O c t 2 0 1 2 A p r 2 0 1 3 O c t 2 0 1 3 A p r Time Evolution: Since the hosting and usage of malicious services on public cloud infrastructures such as EC2 is not limited to specific malware families, our next goal is to identify if there is a clear trend on the amount of malicious software that make use of cloud services. Figure  3a  illustrates the number of distinct samples that connected to dedicated malicious domains hosted on EC2 during the period of our observation. To account for changes in the overall number of submissions, the figure also shows the percentage of distinct samples compared to the total number of samples submitted to Anubis in the same period.
In other terms, miscreants have been recently referring to public cloud services in order to setup and manage their entire malware infrastructure. Therefore, although the use of public cloud services is still limited to only specific components of malware infrastructures, we observe an increasing appetite for miscreants to- Since most miscreants refer to public cloud services to host only certain components of their malware infrastructure, the second question we would like to answer is whether they specifically refer to public cloud services for this purpose, or whether they use these services as redundant or failover components. We observed for this purpose the history of DNS records for all dedicated malicious EC2-based domains in our dataset until they were blacklisted, then we identified all IP addresses that were associated with these domains and their registrars in the DNSDB service.
The results of our investigation were compelling. Out of the initial 1, 648 dedicated malicious EC2-based domains that constitute our dataset, 1, 620 domains (almost 98. 3% of our dataset) were exclusively associated with IP addresses that belong to the EC2 IP range. Note that while 87. 5% of dedicated malicious domains were associated with only a single EC2-based IP address, another 10. 8% where found to be associated with multiple IP addresses that all belong to the EC2 IP range. In other terms, miscreants were specifically using public cloud infrastructures such as EC2 to host their dedicated malicious services. While the use of public cloud services to host dedicated malicious domains is still limited to only certain components of today's malware infrastructures, miscreants appear to be specifically targeting cloud infrastructures for this purpose, and do not use public clouds only as redundant components of their malware infrastructures.
In this section, we observe only dedicated malicious domains that were hosted on EC2, and that were contacted by our malware dataset collected over a period that ends by June 2014. Hence, we only consider historical DNS records associated with malicious servers that are no longer hosted on EC2 cloud at the time of writing. Note that these domains may be still accessible but no longer associated with any EC2 IP address. We defined two metrics for our experiments. First of all, we measured the time between the domain first appeared in the passive DNS service and the time the malware was analyzed by Anubis. Second, we extract the time when a dedicated malicious domain is no longer associated with an EC2 IP address, after the malware was first submitted to the Anubis service. The results of our experiment are summarized by the cumulative distributions that are illustrated in Figure  5.
We monitored for this purpose all DNS records in the DNSDB service, searching for different IP addresses that were associated with every malicious domain in our dataset. Confirming our hypothesis, we found multiple instances of malicious machines that remained active on EC2 even for several months before they were migrated towards other IP addresses in the cloud. As illustrated by the examples in Table  4 , the first two malicious domains were associated with the same EC2 IP address for up to twenty consecutive months before they went out from the EC2 IP ranges. Interestingly, certain malicious domains, such as domains 1 and 2, as well as domains 3 and 4 in Table  4 , were associated with the same IP address during the same period of time, which seems to indicate that miscreants may associate different domain names with their malicious machines in the cloud in order to obtain a better resilience against domain blacklisting.
Discussion When we started our experiments, we were surprised to discover that over 3. 5% of the malware samples in our dataset exhibited at least one network connection with a machine hosted on the Amazon cloud. However, as clearly depicted in Figure  2 , the vast majority of these connections had nothing to do with the fact that criminals were intentionally using the Cloud as part of their infrastructure. In fact, once PPI and other benign services were filtered out, we discovered that less than 1% of the traffic toward Amazon involved a malicious EC2 machine. Even though this number may seem incredibly small (roughly one every 3200 malicious samples), it is still relevant when scaled to the entire dataset containing tens of millions of malicious samples. Moreover, our experiments show that the use of public cloud services by malicious software has been increasing over the last six years, despite the measures taken by certain cloud providers to limit the extent of these abuses.
We believe that focusing only on the biggest cloud providers in terms of market share also shed light on the limits of current security and accountability mechanisms implemented by today's cloud providers. Finally, Wang et al. [22]  propose a system that measures the churn rates in EC2 and Azure in order to evaluate the efficacy of IP blacklists for malicious activity in the cloud. The authors actively probed the EC2 and Azure IP ranges, and proposed a clustering mechanism that groups together IP addresses implementing the same services. They also observed all web services hosted by cloud providers, spanning both benign and malicious activities. The results of their experiments show only small amounts of malicious activity (mostly phishing and malware hosting) by comparing data from their system with public blacklists.
Each sequence was tested for expression changes by a two-tailed heteroscedastic t-test using statistic software R (R Development Core  Team, 2008)  between their three independent RPM values in galls and their three independent RPM values in control roots. Expression differences between galls and roots were considered significant when P < 0. 05. Fold change (FC) was used to measure the expression differences between galls and control roots as the ratio between the average of the RPM values of the three samples in each group. The full raw sequencing data were submitted to the GEO database (http://www. ncbi. nlm. nih. gov/geo/) with the accession number: GSE71563.
sRNA sequences annotation Clean reads were mapped to the Arabidopsis or M. incognita genomes (http://www. arabidopsis. org/ or http://www6. inra. fr/ meloidogyne_incognita) by SOAP (Short Oligonucleotide Analysis Package; http://soap. genomics. org. cn/) and sRNAs were categorized into types: rRNA, tRNA and snRNA were analyzed in GenBank and in RFAM; known miRNAs and their isomiRs (miRBase19), repeats, exon and intron were analyzed by BGI Genomics in-house database. Unannotated sequences were screened with Mireap (http://sourceforge. net/projects/mireap/) which predicts novel miRNA by exploring secondary structure, DICER cleavage site and minimum free energy (MFE) of the unannotated small RNA tags. The following restrictions were imposed: minimal miRNA sequence length (18 nt), maximal miRNA sequence length (25 nt), minimal miRNA reference sequence length (20 nt), maximal miRNA reference sequence length (23 nt), maximal copy number of miRNAs on reference (20 nt), maximal free energy allowed for a miRNA precursor (À18 kcal mol À1 ), maximal space between miRNA and miRNA* (300 nt), minimal base pairs of miRNA and miRNA* (16 nt), maximal bulge of miRNA and miRNA* (4 nt), and maximal asymmetry of miRNA/miRNA* duplex (4 nt).
2 (464297_mat), miR839 (008535_mat) and aly-miR857 (006362_mat)). qRT-PCR was performed as described by  Frenquelli et al. (2010) ). The independent RNA samples used for RNAseq were used for cDNA synthesis. Total RNA (10 ng) was reverse-transcribed with the MicroRNA Reverse Transcription Kit (Applied Biosystems, Foster City, CA, USA) in a final reaction volume of 5 ll. Independent reverse transcription reactions were set for each miR-snoR pair. qRT-PCR was performed using TaqMan Fast Universal PCR Master Mix on a 7500 Fast Real-Time PCR System following the manufacturer's protocol. Each independent cDNA template was run in triplicate (384-well plate). Data were normalized to the expression of two small nucleolar RNAs (predesigned TaqMan â small RNA control assays snoR101 and snoR66; Applied Biosystems) and relative expression was calculated using the comparative Ct method (2 ÀDΔCt ).
Tendencies were similar with both normalizers. Validation of the transcript level for predicted miRNA target genes was performed by qRT-PCR. RNA samples used for sequencing were reverse transcribed with the High-Capacity cDNA Reverse Kit (Applied Biosystems), using 500 ng of RNA per reaction and following manufacturer's instructions. Normalization was referred to GAPC2 according to the method of  Barcala et al. (2010). Relative expression was calculated using the comparative Ct method (2 ÀDΔCt ). Primer sequences are listed in Supporting Information Table  S1. For all q-PCR data a Student's t-test was performed (P < 0. 05) to identify FC differences between galls and uninfected controls. For tissue localization of GUS activity, seedlings from pMIR390a::GUS, pTAS3::GUS, pARF3:ARF3-GUS and pARF3: ARF3 m-GUS lines were treated and phenotyped as described in  Cabrera et al.
2% were exclusive from control roots and 25. 8% were shared between both (Fig. 2b ). The matched sequences were aligned against sequences in GenBank, Rfam and miRBase to find previously known sRNAs. Fig. 2(c ) summarizes the number of sequences found in each library corresponding to different sRNA types. Approximately half of the unique sequences (54% and 50% for galls and control roots, respectively) were unannotated; that is, either they could not be mapped to the Arabidopsis genome (and could be of nematode origin) or they hit Arabidopsis sequences not classified as sRNAs (Fig. 2c ).
Fold change values for the DE miRNAs were validated by TaqMan ® assay-based real-time PCR (Fig. 3a ). Seven miRNAs were selected for validation, three induced and four repressed in galls, representative of different expression patterns in both libraries; that is, a high number of readings (e. g. miR390a), low number of readings (e. g. miR857), and intermediate number of readings (e. g. miR775s). qPCR was done after cDNA synthesis with the same RNA samples used for the construction of the six small RNA libraries, and resulted in a high validation rate of the sequencing results (6 out of 7 tested; Fig. 3a ). Different sensitivities of both techniques might explain the nonvalidated expression pattern of miR167d. The potential target genes of the known DE miRNAs were downloaded from the Plant MicroRNA Database (http://bioin formatics.
cau. edu. cn/PMRD/; Zhang et al. , 2010)  and were also predicted by using the psRNATarget web server (http://plantgrn. noble. org/psRNATarget/) accomplishing restrictive parameters (see the Materials and Methods section). The TAIR10 transcripts database was used as the reference genome, identifying 108 putative target genes for the upregulated and 222 for the downregulated miRNAs in galls, respectively (Table  S3 ). Some of the predicted targets had been experimentally validated in different biological systems, for example, those for miR390, miR156 or miR172 that preferentially target TAS3, trans-acting short-interfering RNA 3  (Montgomery et al. , 2008) , SQUAMOSA PROMOTER BINDING PROTEINS (SPLs;  Wu & Poethig, 2006 ) and Rhomologous Arabidopsis protein (RAP)  (Aukerman & Sakai, 2003) , respectively.
, 2010). Accordingly, a GUS-based sensor line that is not induced when the TAS3-derived tasiRNAs are actively binding the ARF3 sequence, pARF3:ARF3-GUS, was not induced in   3  Quantitative-PCR (q-PCR) analysis of differentially expressed miRNAs and their predicted targets in galls induced by Meloidogyne javanica in Arabidopsis thaliana. (a) miRNA expression values in galls relative to uninfected controls by RNAseq (gray) and q-PCR (black). All miRNAs tested showed significant expression differences between galls and controls (P < 0. 05) by RNA-seq and q-PCR, except miR839 by q-PCR with P < 0. 16. (b) Expression of six putative miRNA targets measured by q-PCR. All were repressed in galls vs control roots (P < 0. 05) agreeing with microarray data  (Jammes et al. , 2005; Barcala et al. , 2010).
Identification of putative nematode-responsive novel miRNAs Those sRNA sequences that mapped in the Arabidopsis genome but were not classified as any previously described miRNA were analyzed using Mireap software (http://sourceforge. net/projects/ mireap/) to predict their secondary structures, DICER cleavage sites and MFE (minimum free energy; À40/À74 kcal mol À1 ;  Bonnet et al. , 2004). Six hundred and two sequences ranging from 19 to 25 nt and present in at least one of the six libraries presented structural hairpin characteristics. However, only 11 of these sequences ranging from 21 to 23 nt were DE (P < 0. 05) in galls as compared to control roots, three of them being upregulated and eight downregulated (Table  2 ). From them, one upregulated and two downregulated also presented MFE values similar to those described for Arabidopsis miRNAs (Table  2 ).
Acknowledgements This work was supported by the  Spanish Government  ( AGL2013-48787  to C. E. and  PCIN-2013-053  to C. F. ) and by the  Castilla-la Mancha Government  ( PEII-2014-020-P  to C. F. ). J. C. was supported by a fellowship from the  Ministry of Education, Spain. C. M. was supported by a PhD grant from  INRA-SPE Dpt  and the  Conseil R egional Provence-Alpes-Côte d'Azur (PACA). B. F. was supported by the  French Government.
Two additional BAC clones of SusPtrit (S35P1J10A and S73P5N20A) were also sequenced following this 454 sequencing approach. The three SusPtrit BAC clones, S35P2K14E with S35P1J10A and S73P5N20A, together cover only partially the targeted Rphq2 genetic window. The number of reads per BAC clone obtained from 454 sequencing ranges from 15,570 to 38,120 reads with an average length of 350 bp, corresponding to 20× sequencing depths for each BAC clone. For each BAC clone, the short sequences obtained by 454 sequencing were assembled in contigs by Greenomics™. The obtained 454 sequence contigs were aligned to the previously assembled Sanger sequence contigs [Lasergene software (DNASTAR ® 8 Inc. , Madison, WI, USA)]. No discrepancy was observed between the assemblies obtained via both approaches. Based on the AFLP fingerprints of the BAC clones of Vada, V76P5D5A overlaps proximally with V41P7L3A and distally with V48P5B18A.
We identified the overlapping sequences and confirmed the fingerprints. According to the AFLP fingerprints of the BAC clones of SusPtrit, S73P5N20A overlaps with S35P2K14E, and S35P1J10A is located proximally but is not overlapping. We identified the overlapping sequences between S73P5N20A and S35P2K14E which also helped us to order the 454 sequence contigs. The 454 sequence contigs obtained for clone S35P1J10A were ordered according to a dot plot analysis against V41P7L3A which shares the same marker (WBE114). The dot plot analysis was carried out using MUMmer software  (Kurtz et al. 2004 ). The consensus sequence corresponding to the Rphq2 genetic window of Vada, flanked by markers WBE114 and WBE115, was generated and annotated using the TriAnnot pipeline version 3. 5  (Leroy et al. 2012)  following the barley default analysis template (http://clermont.
inra. fr/triannot). The consensus sequence corresponding to the Rphq2 genetic window of SusPtrit was annotated separately using the same pipeline, TriAnnot_v3. 5. The sequences of Vada and SusPtrit were also annotated separately using   RiceGAAS  (Sakata et al. 2002 ; http://ricegaas. dna. affrc. go. jp/). Since the RiceGAAS is dedicated to rice and not barley, there is a chance for false positives when applied to barley sequences. Therefore, the sequence of the predicted genes were used to blast against the barley expressed sequence tag (EST) tentative consensus (TC) sequences from the barley TIGR Gene Indices database (http:// www. tigr. org/tdb/tgi/index. shtml). A predicted gene was retained if the best blast hit was above a threshold e value ≤1. 0E-15. Comparison was made between the gene annotations by TriAnnot_v3.
Transcriptome sequencing The results from the annotation were compared with transcriptome data obtained from leaf tissue of L94 and Vada. Tissue was collected from the first leaf of seedlings and from flag leaves of L94 and Vada at 0, 6, 12 and 48 h after inoculation with P. hordei. The samples were processed by the Beijing Genomics Institute (http://www. genomics. cn/en/index). The RNA isolation and cDNA synthesis were performed according to the TruSeq™ RNA sample preparation guide from Illumina (Catalog # RS-930-20 01, Part # 15008136 Rev. A, November 2010). After extraction, RNA samples were combined in aliquots to obtain two pools of leaf RNA, one for L94 and one for Vada. The cDNA libraries were constructed for each pool and sequenced on an Illumina HiSeq™iSeqq. The software TopHat was used to map the raw reads of transcriptome data on the previously assembled BAC contig sequences from Vada and SusPtrit.
Marker saturation of the regions containing Rphq2 Between the flanking markers (WBE114 and WBE115), BAC end sequences and annotated gene sequences were used to develop sequence characterized amplified regions (SCAR) and cleaved amplified polymorphic sequence (CAPS) markers, polymorphic between Vada, SusPtrit and L94. Markers polymorphic between Vada and L94 were genetically mapped using the homozygous recombinant plants from  Marcel et al. (2007a)  to confirm their position and order. SCAR and CAPS markers were also developed from the AFLP fingerprints by converting polymorphic bands to single locus PCR markers following the strategy proposed by  Brugmans et al. (2003). Primers were designed using Lasergene software (DNASTAR ® 8 Inc. , Madison, WI, USA). The markers developed were used to assist in ordering the BAC clones.
Sequence annotation The pipeline TriAnnot_v3. 5  (Leroy et al. 2012)  predicted 12 genes on both Vada and SusPtrit contigs. The RiceGAAS pipeline predicted 33 genes for the Vada contig and 50 for the SusPtrit contig. Among the 33 predicted genes for Vada, 22 hit a barley EST in TIGR Gene Indices database above a threshold e value ≤1. 0E-15. Among the 50 predicted genes for SusPtrit, 34 had a hit above the same threshold. In Vada as well as in SusPtrit 11 genes were common to the predictions of both TriAnnot_v3. 5 and RiceGAAS pipelines. The pipeline TriAnnot_v3. 5 provided a more reliable prediction due to its specificity and sensitivity compared to RiceGAAS  (Leroy et al. 2012). This is because RiceGAAS depends solely on ab initio predictions and was trained for annotating rice sequences rather than barley sequences.
Kin-2 which had only 90 % sequence similarity. The other annotated genes were not shared between Vada and SusPtrit (Fig. 1 ). The V. UF and V. HP from Vada did not align to the S. UF and S. HP from SusPtrit, respectively, and were regarded as different loci. The RiceGAAS pipeline predicted one additional kinase in SusPtrit. That sequence hit a barley EST in TIGR Gene Indices database with an e value of 1. 0E-34. The likelihood of genes listed in Fig. 1  to be candidates for Rphq2 will be discussed in the "Discussion". Using the sequence information between WBE114 and WBE115, we developed 39 new markers that were polymorphic between Vada and SusPtrit, and also determined their alleles for the line L94 carrying the susceptibility allele at Rphq2. Interestingly, SusPtrit and L94 have for all those markers the same allele.
2014 ). The GLP cluster represents a common presence-absence polymorphism in wheat but presence of the cluster does not correlate with the presence of Sr2, indicating that a GLP member of the cluster and not the cluster itself likely confers Sr2 resistance. Suppressed recombination due to strong haplotype divergence and presence of a complex cluster of GLPs render the map-based cloning of Sr2 a strenuous exercise  (Mago et al. 2014). Thus, a practical consequence of the strong haplotype divergence at the Rphq2 locus is that we do not expect further recombination between V. Perox-2/S. Perox-2 and V. Kin-1/S. Kin-2, as in heterozygous material this chromosome region will probably hardly pair. Indeed we failed to obtain recombinant plants in this region after screening more than 3000 plants (data not shown).
Nevertheless, among the 111 accessions having the PAA haplotype, we observed variation from a high level of partial resistance (including Vada and H. laevigatum) to a high level of susceptibility to barley leaf rust (data not shown). Susceptible PAA accessions are likely to carry a susceptible rphq2 allele and to recombine with the Rphq2 locus in Vada, allowing further fine mapping of Rphq2.
Acknowledgments We particularly wish to thank  Dr D. Schulte  and  Dr R. Arriyadasa  ( IPK, Gatersleben, Germany ) for providing information and assistance concerning the exploration of the Morex BAC libraries. We are also grateful to  Dr N. Stein  ( IPK, Gatersleben, Germany ) for kindly providing the Morex genomic sequences. We thank  Dr F. van Eeuwijk  and  Dr O. Dolstra  for useful discussions. We acknowledge  Harry Belcram  ( INRA URGV, France ) for helping with the construction of the two BAC libraries. The authors wish to thank the  University Malaysia Sarawak, Malaysia  for granting the PhD fellowship to FKS Yeo allowing this work at  Wageningen University , the Netherlands.
Nucleocytoplasmic large DNA viruses, or representatives of the proposed order Megavirales, belong to families of giant viruses that infect a broad range of eukaryotic hosts. Megaviruses have been previously described to comprise a fourth monophylogenetic TRUC (things resisting uncompleted classification) together with cellular domains in the universal tree of life. Recently described pandoraviruses have large (1. 9-2. 5 MB) and highly divergent genomes. In the present study, we updated the classification of pandoraviruses and other reported giant viruses. Phylogenetic trees were constructed based on six informational genes. Hierarchical clustering was performed based on a set of informational genes from Megavirales members and cellular organisms. Homologous sequences were selected from cellular organisms using TimeTree software, comprising comprehensive, and representative sets of members from Bacteria, Archaea, and Eukarya.