dataesr/scientific-paragraphs-categorization huggingface dataset:
Fig. 4  visualises the 23 metabolic subsystems that were consistently enriched in at least two out of five datasets for a MEM. All enriched subsystems are available as Supplementary Fig. 7. tINIT has identified more than twice the number of enriched metabolic subsystems than GIMME combined for all datasets. Interestingly, GIMME found the lowest number of enriched subsystems in comparison to all MEMs. Enriched metabolic subsystems were mainly from the lipid-related metabolism, from fatty acids, glycerophospholipids to cholesterol and their metabolites, ubiquinone, vitamins, etc. GIMME and tINIT had few commonly enriched subsystems in the same dataset. These were downregulation of vitamin E and D metabolism, upregulation of transport reactions, and opposite direction of fatty acid biosynthesis (odd chain).
Results of the enrichment analysis vary with a dataset We opted to analyse the subsystems which were consistently enriched in at least a predefined number of MEMs for each dataset in a similar way as described in Section 4. 4. Fig. 5  visualises the 12 metabolic subsystems that were consistently enriched in at least two out of four MEMs for a dataset. All enriched subsystems are available as Supplementary Fig. 8. Commonly enriched subsystems were relatively specific for each of the datasets, similarly as observed in the case of MEM-based enrichment analysis. This is in line with the fact that each dataset represents a different cell type, which differs in the level of susceptibility to the infection and host response. There were only a few enriched metabolic subsystems common between three MEMs, while there is not even one subsystem commonly predicted by all MEMs in the same dataset.
Taking into account the PCA results and the data from COVID-19 patients, tINIT best preserved the biological variability in the data and enabled the best prediction of enrichment of metabolic subsystems in comparisons to other Fig. 3. The distributions of Jaccard indices within a factor (A) and between the factors (B). Jaccard indices were assessed for all pairs of models and then used to compare the reaction specificity within each of the observed group of models, and between each of the observed group of models and the remaining models.
MEMs. Vitamin D3 is produced in the skin by UV irradiation from 7-dehydrocholesterol. It is biologically active after it is converted by enzymes in the liver and kidney to 1,25-dihydroxycholecalciferol. Vitamin D3 metabolism was predicted to be down-regulated in one dataset by GIMME models, and in all by tINIT models. This is in line with several meta-analyses of published data, which found significantly lower 25 (OH)D concentration, and significant relation between the low concentration and infection, severity or mortality of COVID-19 patients  [61] [62] [63] [64] [65] [66]. Vitamin D3 supplementation has been hypothesised to affect clinical outcomes in patients with COVID-19, however; this was not successfully confirmed  [61, 67]. Currently, vitamin D3 supplementation is not recommended  [68].
Both tINIT and GIMME models predicted downregulation of retinol metabolism in different datasets, which is in line with the observations in COVID-19 patients. Low levels of vitamin A in plasma of COVID-19 patients was observed and this was significantly associated with the severity of the disease  [73, 74]. High-throughput screening of natural compounds found that all-trans retinoic acid inhibited 3C-like protease of SARS-CoV-2 and by this exhibited antiviral effect  [75]. Additionally, an AM580 compound that has inhibited viral replication of MERS-CoV (Middle East respiratory syndrome) in vitro and in vivo in mice, is a retinoid derivate and RARα (Retinoic Acid Receptor alpha) agonist  [76]. However, a meta-analysis of studies on vitamin A supplements in children did not confirm the effect on respiratory tract infection  [77].
Both tINIT and GIMME models predicted also downregulation of vitamin E metabolism in different datasets, however, only one study so far measured the vitamin E level in COVID-19 patients, which was found unchanged  [73]. Modulation of different pathways involved in fatty acid metabolism was predicted by GEMs in applied datasets or cells. Increased levels of plasma free fatty acids and triglycerides were observed in multiple COVID-19 patient studies. Meta-analysis of omics data confirmed alterations in fatty acid metabolism  [58]. The viral infections are known to hijack the lipid biosynthesis to enable viral reproduction  [78]. The SARS-CoV-2 spike protein undergoes palmitoyl modification  [79]  and needs new fatty acids for membrane formation. FASN (Fatty Acid Synthase) is one of the rate-limiting enzymes in fatty acid synthesis and the key enzyme in the synthesis of palmitate.
The retinoid derivate, AM580, is also an SREBF (Sterol Regulatory Element Binding Transcription Factor) inhibitor. SREBF is the major regulator of lipid metabolism and could express its antiviral function through this mechanism  [76]. Downregulation of cholesterol and terpenoid biosynthesis was predicted by tINIT models in almost all datasets. Numerous studies have compared the plasma cholesterol level in COVID-19 patients, and two meta-analyses of this data concluded that total, HLD and LDL cholesterol are significantly lower in hospitalized severe patients and non-survivors  [83, 84]. Although there are some discrepancies between the studies in terms of the direction of change and which serum/plasma parameter is changed, they all confirm that cholesterol metabolism is affected by the SARS-CoV-2 infection.
Conclusion We applied different MEMs in a combination with various scopes of publicly available COVID-19 specific datasets to analyse the metabolic signatures and potentially propose novel antiviral targets. We proposed a set of analyses that can be used to identify the most suitable model extraction method that can be used in the precise analysis of observed datasets. We propose that PCA and/or tSNE analyses can help explore the data and select the MEM that is the best in preserving the biological variability of the data, which seems to be crucial for generating precise predictions. When we paralleled the enrichment of perturbed metabolic pathways with patient data, we confirmed that tINIT-produced models have identified several fatty acid and cholesterol metabolic pathways, which were modulated also in COVID-19 patients.
Acknowledgements The research was partially supported by the scientific-research program Pervasive Computing ( P2-0359 ), by the  scientific-research program Functional Genomics and Biotechnology for Health  ( P1-0390 ), by the basic research project  CholesteROR in metabolic liver diseases  ( J1-9176 ), and by the  Network of infrastructure Centres of University of Ljubljana  ( MRIC-UL-CFGBC, IP-022 ), all financed by the  Slovenian Research Agency. AM was supported by the  Erasmus+ exchange programme of the European Union. We would also like to acknowledge the support by the  infrastructure  project  ELIXIR-SI RI-SI-2  financed by the  European Regional Development Fund  and by the  Ministry of Education, Science and Sport of Republic of Slovenia. The funding sources had no role in the design of the study and collection, analysis, and interpretation of data nor in writing the manuscript.
Data Processing The acquired data were processed using Xcalibur ® software (Thermo Fisher Scientific, San Jose, CA, USA) by integrating selected product ion chromatographic peak areas, which were exported to an excel file containing the areas of each metabolite and finally normalized to the total sum of integrated metabolites. Detected peaks were identified using accurate m/z and retention time (RT) compared to the internal database made by the Mass Spectrometry Metabolite Library of Standards (MSMLS ® , IROA Technologies™, Bolton, MA, USA). According to Rathato-Paris et al. [55] , our annotation is considered putative metabolite identification (level 2). Only metabolites detected in quality control (QC) samples with a coefficient of variation (CV) <30% were kept for further analysis.
, 2020; Bedi et al. , 2021). These solutions may improve the detection rate in overall and only for a specific dataset while their performance varies considerably for another dataset and per each type of attack  (Muhlenbach and Lallich, 2009; Kim et al. , 2004; Jongsuebsuk et al. , 2013; Lin et al. , 2014). On the other hand, they present limited evaluation rather than a detailed analysis  (Sun et al. , 2018; Yang et al. , 2019; Wei et al. , 2020). On the other hand, Machine Learning (ML) techniques are introduced as a complementary to the IDS to dynamically identify the relevant data of interest and intelligently figure out the security threats. Based on the learning process, ML algorithms are divided in different categories such as supervised and unsupervised techniques  (Phadke et al. , 2019).
These algorithms divide unknown traffic in distinct clusters in such that packets with similar properties go to the same group. These clusters will be further used by a security investigator to detect malicious packets and generalize the investigation to the entire cluster  (Mehmood and Md Rais, 2016; Portela et al. , 2019). It should be noted that a data set (e. g. , network traffic data set) may include several features that cause performance degradation in detection process. To overcome this problem, feature selection or extraction methods such as Support Vector Machine (SVM) and Variational Auto Encoders (VAEs) are used to select a smaller number of features and reduce the dimension of the dataset. The selected or extracted features will be provided to the classification and clustering algorithms in order to help them in classifying the known attacks and clustering unknown traffic  (Yousefi-Azar et al.
, 2017; Monshizadeh et al. , 2018; Li et al. , 2020). However, in the field of machine learning, non-labeled data analysis is one of the well-known challenges and many studies have been conducted on different techniques to solve this issue. On the other hand, with the emergence of unknown attacks, current intrusion detection systems suffer from a low detection rate. In real-life scenarios as shown in Fig. 1  for MAWILab-2018 dataset, a considerable amount of incoming data does not belong to any known class and subsequently, leads to class imbalance and high false positive and negative ratios. On the other hand, annotating large datasets is very costly and hence only a few examples can be labeled manually. In addition, for unknown traffic, dividing data into classes without having information on the nature of the traffic is challenging.
Therefore, clustering methods are employed to gain some insight into the structure of the data. However, clustering techniques also have some drawbacks. In intrusion detection, clusters can appear with different sizes, shapes, data sparseness, and overlapping degrees. Even if there are many clustering algorithms, none of them is able to identify all the cluster forms and structures encountered in real-life scenarios. Therefore, a more sophisticated unsupervised approach, which automatically determines the best number of clusters would be a major goal in analyzing non-labeled data. In general, the main challenge of clustering algorithms is that clusters can appear with different sizes, density, and degree of separation  (Fred and Jain, 2005). It is therefore difficult to select an algorithm that performs well on a particular dataset, but also to adjust the different hyperparameters of that same algorithm so that it can be generalized.
Overall, the contribution of this paper is to introduce an efficient method for clustering unknown traffic with the following characteristics: • Categorizing unknown data into distinct clusters in such the packets belong to one cluster are similar to each other and dissimilar to the packets belong to other clusters. This model achieves a good homogeneity score for various datasets with different attacks, which proves that each cluster contains mainly members of a single attack class, and a high silhouette coefficient score which shows that the clusters are well defined and have minimal overlap. • Introducing a new metric that helps to achieve high silhouette score by changing the feature space. The new similarity metric is different from Euclidean distance, where the distance between data points reflects the similarity between packets.
The new similarity matrix will be used to create a co-association matrix that will be fed to DBSCAN as input. • Evaluating proposed architecture performance robustness against three datasets that have different attacks and sizes. • Cluster analysis generalization in a way that few packets from each generated cluster are analyzed, the malicious packets are identified, and the result of analysis is generalized to the entire cluster. This approach saves security investigator time and resources. The rest of the paper is organized as follows. Section 2 provides motivation for the paper and reviews some studies that applied unsupervised techniques such as DBSCAN mainly for intrusion detection application and briefly addresses their short comes. Section 3 introduces the ADBC architecture as well the algorithms that are required for the experimental results.
Motivation and related work Several studies applied unsupervised techniques to analyze unlabeled datasets and to cluster the datapoints based on their similarities. Even though, these studies applied various optimized version of DBSCAN to provide a good silhouette score, yet their achieved performance considerably depends on the datasets. In addition, hyperparameter settings are changing based on the different datasets. Furthermore, majority of the prior art methods are applied for different application than IDS and their employed datasets are dissimilar to network traffic dataset. On the other hand, their testing conditions are distinct and their presented results lack a thorough evaluation of clusters quality and analysis. Therefore, this paper proposes an efficient density-based method to categorize unknown traffic into various clusters.
The purpose of this architecture is to provide a high silhouette score regardless of applied dataset. Furthermore, the architecture aims to provide insights based on the created clusters to a cybersecurity investigator and assist in detecting unknown attacks with reduction of time and computation resources during analysis. In order to analyze unknown data or detect anomalies, several studies have applied various clustering techniques such as DBSCAN and its variants. DBSCAN do not need to have number of clusters predefined, in addition it has the advantage of finding clusters of any shape, as long as their elements are density-connected. This advantage is important when dealing with a clustering problem of unknown data where the shape of the clusters is uncertain. In order to divide data into the groups based on the similarity of characteristics, several studies have applied various clustering techniques such as DBSCAN or a combination of unsupervised algorithms.
DBSCAN do not need to have number of clusters predefined, in addition it has the advantage of finding clusters of any shape, as long as their elements are density-connected. This advantage is important when dealing with a clustering problem of unknown data where the shape of clusters is uncertain. In order to evaluate DBSCAN performance in related articles, mainly the silhouette score is presented to show the level of clusters distinction. However, in these studies achieved silhouette score is considerably depends on the applied dataset. Muhlenbach and Lallich (2009)  proposed a graph-based clustering (GBC) method that defines the best number of clusters and detects anomalies. This study is based on a neighborhood graph and regions of influence approach. The method is evaluated based on the Dunn's, Silhouette, and the Davies-Bouldin metrics and for five datasets from the University of California Irvine (UCI) Repository, three artificial data sets (test-2c-2o, test-random, yin-yang), and Ruspini dataset.
This method is limited to hard clustering and fails if there is recovery between the different clusters. On the other hand, the maximum silhouette score depends on the dataset (achieved values are between 0. 584 and 0. 910 depending on the dataset). Similarly, for Dunn's and Davies-Bouldin's indices, the maximum value depends on the dataset. Turner and Joseph (2017)  combined static rule extraction mechanism with machine learning in order to detect intrusion. The study performs cluster analyses applying a k-means algorithm, a hierarchical agglomerative clustering algorithm, and a density-based clustering algorithm independently and for each ruleset. The silhouette metric is used to evaluate the method performance. However, few data and a small number of clusters (simple clusters) have been used to test the method's performance.
For the experiment, the study applies a feature selection method with cross-validation on KDD Cup 1999 dataset. In order to evaluate the model, metrics such as false ratio (FR) and detection rates have been used in this paper. Though, the model applied clustering technique and discussed about hyperparameter (such as epsilon and MinPts) setting, the study did not provide any analysis on clusters and unsupervised metric such as silhouette score. Dong et al. (2019)  proposed a model combining k-means with DBSCAN for intrusion detection. The combination solves the k-means' sensitivity to initial clustering centers and noise points and reduces the influence of fixed neighborhood radius in DBSCAN. The experiments are done on the NSL-KDD dataset applying false positive ratio and supervised validation.
Though, the model applied clustering technique, the study did not provide any analysis on clusters and unsupervised metric such as silhouette score. Shakya and Makwana (2017)  presented a combination of Sequential minimal Optimization Classifier (SMO), k-means clustering, and DB-SCAN to improve detection rate. However, DBSCAN is only used for noise reduction and not for clustering. The study used KDD dataset, feature selection method and chose accuracy as an evaluation metric. Sabottke et al. (2019)  applied DBSCAN clustering for detecting attacks in web server logs. Three months of web server logs are collected for this study. Potentially malicious sessions lie either in the DBSCAN noise or in the territory of a malicious activity cluster. If samples that are labeled as noise in the DBSCAN clustering are intended to be analyzed as potential threats by human analysts, then it is consequently important to parametrize DBSCAN clustering in order to reduce the number of noise samples.
To evaluate clustering performance, the authors calculate the silhouette score. A high silhouette score indicates that the clusters are compact (each point is similar to the other points in its cluster) and well separated (each point is unlike the points in other clusters). The authors manually examined whether those clusters corresponded to keywords associated with attacks (i. e. , ''login'', ''admin'', and database insertion keywords). These keywords were chosen based on feedback from the human experiment. Finally, they manually analyze the clusters to identify normal and attack behaviors. The clustering achieves a silhouette score of 0. 99. However, the obtained clusters are composed of different types of attacks (mixed clusters) which makes the analysis difficult for security investigator.
Therefore, they proposed a density-based interpretation of the silhouette coefficient, which rates the density of a cluster as the minimal value and sets it in relation to the minimal  distance to the next cluster. In contrast to the original silhouette coefficient, this optimization criterion can adapt to clusters of arbitrary shapes. The comparison of internal validation measures revealed that the density-based silhouette coefficient performed best in most experiments. However, in the search for convex-shaped clusters, silhouette coefficient and edge correlation perform better than the proposed density-based silhouette coefficient. Fred and Jain (2005)  proposed a method based on the concept of evidence accumulation clustering. They combine various clustering partitions of a given dataset to define a partition that is better than the original partitions.
Architecture The proposed architecture is a complementary part of the Hybrid Anomaly Detection Model (HADM) platform, which has been explained and previously published in three papers  (Monshizadeh et al. , 2018 (Monshizadeh et al. , , 2019 (Monshizadeh et al. , , 2021)). The HADM comprises various machine learning (ML) algorithms to filter network traffic and identity malicious activities on the network. The HADM applies classification algorithms to detect predefined known attacks and clustering algorithms to identify unknown attacks. Consequently, current paper focuses on applying clustering techniques for unknown traffic analysis. As shown in Fig. 2 , the architecture comprises several algorithms and a co-association matrix. As it was discussed in Section 2, in order to analyze non labeled datasets in an unsupervised way, several studies have employed clustering algorithms such as DBSCAN or a combination of DBSCAN with other linear algorithms namely SVM or deep learning algorithms such as VAEs.
For the current paper experiments, lambda is set to 5 after testing other values  (Wang et al. , 2019). SVMonline. Incremental SVM calculates the loss and retrains linear SVM in every batch using stochastic gradient descent. It assigns SVM weights to each feature and selects those with the highest absolute value as the best discriminative features. Although SVMonline relies on the linear dependency of features and labels as in F-Score, it is more robust than F-Score, since it splits the dataset into small batches and calculates the average of model coefficients that further increases the robustness  (Chen, 2003).
DBSCAN. It is a density-based clustering algorithm as its name suggests. It was designed by  Ester et al. (1996)  to group connected regions of high density into the same cluster, in a clustering problem with noise where clusters have arbitrary shapes. The outcome of the clustering depends on two hyperparameters: the maximum distance allowed between two points within the same cluster referred to as  and the MinPts, which defines the minimum number of data points required to form a distinct and dense cluster. Let a region of the space with a radius of  centered at a point p of the dataset D be a dense region if it contains at least MinPts points. For each point p, an  -neighborhood N  can be defined as follows: 𝑁 𝜖 (𝑝) = {𝑞 ∈ 𝐷|𝑑𝑖𝑠𝑡(𝑝, 𝑞) ≤ 𝜖} (9) The  -neighborhood equals the set of points inside a hypersphere of radius  centered at point p.
A point is called core-point if its -neighborhood N  contains at least MinPts points. |𝑁 𝜖 (𝑝)| ≥ 𝑀𝑖𝑛𝑃 𝑡𝑠 (10) DBSCAN looks for clusters by checking the neighborhood of each object in the dataset. If the neighborhood of an object p contains more points than MinPts, a new cluster with p as the core-point is created. It then iteratively collects the objects directly density-reachable from these core points, which may involve merging multiple clusters. The process ends when no new objects can be added to any cluster  (Khan et al. , 2014).
Datasets In order to evaluate ADBC model performance, three publicly available datasets are used. These datasets include a variety of network traffic attacks and meet the real traffic criteria to some extent. The mentioned datasets were selected after a survey among 14 publicly available datasets  (Monshizadeh et al. , 2021). The MAWILab-2018 dataset is captured on a link between USA and Japan, every day and since 2001 For the current paper, the traffic from 28th August 2018 is used  (Fontugne et al. , 2010). Furthermore, in order to check model resilience and robustness and to have a diversity of attacks, all the DoS attacks contained in ISCX-2017 dataset  (Sharafaldin et al. , 2018)  were extracted and injected into MAWILab-2018 (DoS attack class). In this dataset, there is an unknown class from the beginning which is labeled as such.