dataesr/scientific-paragraphs-categorization huggingface dataset:
, 2006). No threshold was used to prune weaker edges; however, the BNM is sensitive to connection strength, thereby effectively discarding the effect of smaller weights. All processed data were formatted to facilitate import into TVB, and each C ij was normalized to unity as C ij ¼ C ij =maxðC ij ð:ÞÞ. Note that as the patients have small lesions (in terms of volume), the preprocessing of their MRI scan does not necessitate filling the missing portions of the brain at the lesion site by the brain tissue of the nonlesioned hemisphere homologous (see  Falcon et al. , 2015 and Aerts et al. , 2020 , for a detailed description of such procedure). Functional MRI data preprocessing. RS-fMRI data preprocessing was performed with the FSL feat (FMRI Expert Analysis Tool, version 5. 0. 9; Woolrich et al.
, 2001)  toolbox with standard parameters and not discarding any independent component analysis (ICA) components. The preprocessing steps included the following: discarding the first six images of each scanning run to allow the MRI signal to reach steady state, high-pass temporal filtering to remove slow time drifts (100 s highpass filter), motion and slice timing correction, spatial smoothing with Gaussian kernel (FWHM = 5 mm), brain extraction, and 12 linear registration to the MNI space. Then, functional data were registered to the subject's T1-weighted images and parcellated according to FreeSurfer segmentation. By inverting the mapping rule found by registration, anatomical segmentations were mapped to the functional space and average blood-oxygen-level dependent (BOLD) signal time series for each region were generated by computing the spatial mean over all voxel time series of each region.
TVB provides the possibility to feed computational neuronal network models with information about structural and functional imaging data including population [(stereotactic, S) EEG/MEG] activity, spatially highly resolved whole-brain metabolic/vascular signals (fMRI) and global measures of neuronal connections (DTI), for intact as well as pathologically altered connectivity. TVB is model agnostic and offers a wide range of neural population models to be used as network nodes. Manipulations of network parameters within The Virtual Brain allow researchers and clinicians to test the effects of experimental paradigms, interventions (e. g. , stimulation and surgery), and therapeutic strategies (e. g. , pharmaceutical interventions targeting local areas). The computational environment enables the user to visualize the simulated data in 2D and 3D and to perform data analyses in the same way as commonly performed with empirical data.
Shift of the optimal working point of brain model toward lower excitability in patients with epilepsy We first investigated the dynamical properties of the optimal working point of the brain model that was able to fit the characteristics of the empirical fMRI data from 14 epileptic patients and 5 healthy control subjects. fMRI BOLD activity was simulated with the extended Epileptor model in the case of absence of epileptiform discharges (i. e. , in the spike-free resting-state scenario with p = 0. 1 for all brain regions in Eq. 19) with the brain regions coupled through the empirical subject-specific SC matrix C ij as extracted from the DTI-based tractography (normalized to unity). Using our model, we studied whether the patients' SC led to altered RS-FC at the dynamical level, and, particularly, how this depended on the two free parameters of the model, namely, the local bifurcation parameter a i , that was homogeneously modified over all regions (i.
The simulated data obtained at the optimal working point for the exemplary epileptic patient P1 (i. e. , at a = 1. 74 and K rs = 20) and the healthy control subject (i. e. , at a = 1. 74 and K rs = 20) are shown in Figure  4B-D. For comparison, the same matrices are plotted for the empirical data. Note that due to the lack of simultaneous physiological recording during the RS-fMRI acquisition, no additional physiological noise modeling has been applied and some aliasing artifacts (e. g. , cardiac and respiratory rhythms) could be still present in the data. However, regressing them out also removes a meaningful part of the brain signal. Indeed, we performed an ICA-based noise removal for all of our subjects and the best-fit GS decreases by ;54% for the epileptic group and by ;70% for the control group, although the landscape and working region of the model remain topologically identical and quantitatively similar.
All patients having long-standing drug-resistant epilepsies, so we can hypothesize that the epileptogenic activity may evolve from IEDs related to more permanent connectivity changes as a result of plasticity triggered by the pathologic activity, causing metabolic changes in the BOLD data. This hypothesis is corroborated by some studies showing changes over time of the size of EZ  (Bartolomei et al. , 2008)  or alterations in SC  (Bonilha et al. , 2006). Our results are consistent with those of previous studies investigating connectivity patterns in the presence/absence of IEDs, and using ROI-based or ICA-based FC methods, showing that the features of the brain networks were similar in fMRI or SEEG datasets with and without IEDs  (Bettus et al. , 2008; van Houdt et al. , 2015). We extended these results by considering the nonstationarities within the brain signals using dynamic FC and MSE analyses.
was supported by the  Fondation pour la Recherche Médicale  (Grant  DIC20161236442  to V. K. J. ),  European Union 's  Horizon 2020 research and innovation programme  under grant agreement No. 720270  ( SGA1 ), No. 785907  ( SGA2 ), and No. 945539  ( SGA3 )  Human Brain Project , and the  SATT Sud-Est  ( TVB-Epilepsy ). This work has been carried out within the  Fédération Hospitalo-Universitaire EPINEXT  with the support of the A* MIDEX  project (Grant  ANR-11-IDEX-0001-02 ) and the  Recherche Hospitalo-Universitaire EPINOV  (Grant  ANR-17-RHUS-0004 ) funded by the " Investissements d'Avenir" French Government program  managed by the  French National Research Agency (ANR).
INTRODUCTION There is a permanent confrontation between malware and antiviruses (AVs). 1 On the one hand, malware mainly intend to infect devices in a short amount of time, while remaining undetected for as long as possible. On the other hand, of course, AVs aim at detecting malware in the fastest way possible. When a new malware is detected, AVs lead further analysis to produce a signature and keep their database up-to-date quickly. Malware authors, willing to create long-lasting malware at low cost, can then use simple methods to avoid being detected and analyzed deeply by these AVs. To this end, a malware can search for the presence of traces or artifacts left by an AV, and then decide whether or not they execute their malicious payload. We call such a malware an evasive malware. This article focuses on the evaluation of the evasion techniques used by Windows malware in the wild.
First, we evaluate how common AVs cope both with unknown malware and well-known evasion techniques. To this end, we develop and use Nuky, a ransomware targeting Windows, and implementing several evasion techniques. Eicar https://orcid. org/0000-0002-4751-3941 1 https://www. av-test. org/en/statistics/malware/ Second, we design and evaluate a countermeasure, mentioned by  (Chen et al. , 2008)  and  (Chen et al. , 2016) , that simply consists of reproducing the presence of the artifacts on computers by instrumenting the Windows API in order to force malware to evade. The purpose of this countermeasure is to limit the infection's spread and not to replace malware detection. We study the impact of this approach on both malware and legitimate software before concluding on its limitations. To evaluate these experiments, we create a small dataset and discuss the problem of collecting evasive samples.
ANTIVIRUS ABILITIES AVs are tools that aim at detecting and stopping the execution of new malware samples. They are an aggregate of many features designed to detect the malware's presence by different means, as described by  (Koret and Bachaalany, 2015). Using these features incurs overhead that, if too significant, can hinder the use of legitimate programs. In order to stay competitive, AV editors have to limit this overhead. For this reason, it is difficult for them to apply time demanding techniques. Most AVs use signature checking by comparing the file against a database of specific strings, for instance. The signature database needs to be updated regularly to detect the latest discovered malware. 23  Fewer AVs use features that produce significant overheads, such as running the malware in an emulator.
Detection of AVs' installation and execution artifacts: The installation of the AV makes some changes to the operating system. For Windows, it starts by creating a folder, often in the Program Files folder. This folder contains the executable of the antivirus and the other resources it requires. During the installation of an AV, some of the registry keys are changed or added. They can set up hooks of the Windows API from the user or the kernel level. In the same way, the execution of the core process and plugins of the AV leaves artifacts within the operating system, and these alterations can be visible from the user-mode. A simple technique to detect the presence of antivirus is thus to search for standard AV processes names in the list of the running processes. Detection of VMs, emulators, sandboxes: Finally, an AV can execute malware in a sandbox, i.
e. , a controlled and contained testing environment, where its behavior can be carefully analyzed. These sandboxes intend to reproduce the targeted environment but, indeed, slightly diverge from the real environment. An evasive malware can then search for precise files, directories, process names, or configurations that indicate the presence of a VM or emulator. In the following, we use 2 different configurations of Nuky, first to test the detection capability of the available AVs and then to test the evasive capability of malware using the theoretical techniques enumerated in Section 4. Set-Up: All of our experiments use the same architecture. We prepare Windows images equipped with some of the most popular AVs, according to a study from AVTest. 9 These images are all derived from the same Windows 10 base image, populated with files taken from the Govdocs1 dataset.
AVs' Detection Abilities × × × Immunet (ClamAV) × Kaspersky × Avast × Avast+ × × × × AVG × Avira × K7 Computing × * × * × * × once for each payload on every AV with an image restoration step before each run. As depicted in Table  3 , only AVs equipped with a specific ransomware detection feature succeed in detecting Nuky's payloads. K7 Computing's product also detects Nuky after some time. Nevertheless, Nuky succeeds in ciphering part of the computer's files before being stopped. We expect K7 Computing to generate false positives as a legitimate image rotation made by the Photos program is detected malicious by this AV. Same observation for Windows Defender blocking a file saved using LibreOffice Draw. However, they still detect Nuky as malicious and are the AVs we want to precisely identify in the second experiment to abort Nuky's execution and avoid detection.
Filtering Using Yara Rules To create our filter, we use a program called Yara 11  , which allows matching samples according to a set of rules. Yara can match samples containing a specific string or loading a specific Windows library or function and, thus, does not work on ciphered or packed malware. However, we believe that the evasive tests could occur before the unpacking or deciphering, thus readable and matchable. We create a rule containing five subrules, each composed of several conditions and designed to find malware that respectively try to detect a debugger, detect a running AV or sandbox, manipulate and iterate over folders, find VM's MAC addresses, and find a debugger window. A set of rules designed to match evasive samples already exists 12. However, we create a new one as these rules match too easily and return too much nonevasive malware.
Samples Collection The difficulty of collecting samples of evasive malware lies in the fact that, by definition, these malware avoid being caught. We manually crawl the WEB in public datasets such as hybrid-analysis 13  and public repositories like theZoo 14  , for instance. The data collection covers 3 months between the November 18th, 2019 and the January 21st, 2019. Over this period, we found 62 samples matching the Yara rule among the few thousand samples crawled. To avoid false positives and to be sure to keep samples PE files that are more likely to be actual malware, we selected only samples that are not signed and marked as malicious by VirusTotal 15. Table 6 lists all the MD5 of the 18 selected malware, and Table  5 , the number of samples matched by each rule. The fact that some rules do not give any result might be because we crawled the WEB by hand, and therefore, had not numerous samples to match.
All these similarities could be due to the sharing of code on public projects such as Al-Khaser 16 or smaller ones 17. Some packers also propose the addition of an evasion phase before unpacking such as the Trojka Crypter. 18 16 https://github. com/LordNoteworthy/al-khaser 17 https://github. com/maikel233/X-HOOK-For-CSGO 18 MD5: c74b6ad8ca7b1dd810e9704c34d3e217.
AV EVASION COUNTERMEASURE It is possible to thwart such evasion techniques by instrumenting the Windows API to force malware to evade, as discussed by  (Chen et al. , 2008). To do these instrumentations, we used Microsoft Detours, a framework that facilitates the hooking of Windows API functions. 19 icrosoft Detours produces a new DLL file loaded at execution time in the malware using the AppInit registry 20. This method is efficient against software such as Al-Khaser but needs tests on real malware. We now describe the Windows API functions that we modify, discuss the countermeasure's efficiency on real malware, and measure the overhead it induces.
Countermeasure Overhead We evaluate the overhead induced by the countermeasure on 4 software typically found on Windows computers that are VLC, Notepad, Firefox, and Microsoft Paint. We also measure Al-Khaser, a program performing a set of evasion techniques and generating a report on their results. We removed from Al-Khaser all the techniques relying on time observation. We run each software 100 times, interacts with them, and computes the mean of all the execution times with and without the countermeasure enabled, as shown in Table  7. The only significant overhead that we observe is on Al-Khaser with +14. 62%, as this software heavily calls our instrumented functions, which we consider the worst-case scenario.
Countermeasure We chose to instrument the Windows API functions to block the same basic techniques used by Nuky and not more elaborated ones. As for a signature database, this countermeasure needs continuous updates to be able to thwart new evasive techniques. Of course, with this method, we can only block malware evading using the Windows API and not those using different means. To avoid testing the countermeasure on malware it was designed for, we used a different set of strings to construct the dataset and to implement the countermeasure. However, this bias is still present and is removable by using different techniques to collect malware and to evaluate the countermeasure. We also need to measure the side-effects of this countermeasure on malware, legitimate software, and the operating system.
Dataset There is no public repository properly providing malware with the details of the evasion techniques performed. For this reason, we use a small dataset we created and analyzed by hand, but on which we cannot generalize our conclusion for now. We aim at automatically crawling and flagging samples to create a larger dataset and observe the evolution of such evasive malware through time by letting this experiment run in the long term. Finally, after obtaining a fully formed dataset of evasive malware, we intend to study how they evade. Most of the tested malware just stop their execution, but others could choose to behave differently while still executing.
CONCLUSION We found that AVs are still vulnerable to unknown malware using basic encryption, compression, and attribute modification. Only 3 out of the 9 AVs we tested caught Nuky, and we suspect them to generate a lot of false positives. Other AVs may also still rely on simple signature detection. Moreover, when an AV succeeds in catching our malware, we prove that basic evasive techniques enable us to identify them precisely and change the malware's behavior to avoid detection. We showed that Nuky could escape AVs by detecting AV artifacts but need more tests for the debugger and VM artifacts. A few samples of real malware implementing evasion techniques are collected using Yara rules. We found that a lot of these samples share their evasive code that we retrieved in public code repositories.
Finally, we implemented a countermeasure that seems to be able to thwart evasive malware by instrumenting the Windows API. In the end, 14 out of the 18 malware tested showed a different behavior with and without the countermeasure enabled. The highest overhead measured is on Al-Khaser with an addition of 14. 62% to the execution time. The code for Nuky's evasion part and the Yara rule is available on request.
Context. We present our findings on 18 formerly known ZZ Ceti stars observed by the TESS space telescope in 120 s cadence mode during the survey observation of the southern ecliptic hemisphere. Aims. We focus on the frequency analysis of the space-based observations, comparing the results with the findings of the previous ground-based measurements. The frequencies detected by the TESS observations can serve as inputs for future asteroseismic analyses. Methods. We performed standard pre-whitening of the data sets to derive the possible pulsation frequencies of the different targets. In some cases, we fitted Lorentzians to the frequency groups that emerged as the results of short-term amplitude/phase variations that occurred during the TESS observations. Results. We detected more than 40 pulsation frequencies in seven ZZ Ceti stars observed in the 120 s cadence by TESS, with better than 0.
TESS observations We downloaded the light curves from the Mikulski Archive for Space Telescopes (MAST), and extracted the PDCSAP fluxes provided by the Pre-search Data Conditioning Pipeline  (Jenkins et al. 2016 ) from the fits files. We removed all data points with quality warning flags, and finally we corrected the light curves for long-period systematics. We normalised the light curves by fitting a fourth-order Savitzky-Golay filter with a three-day window length computed with the Python package lightkurve  (Barentsen et al. 2019 ). This correction does not affect the frequency domain of the short-period white dwarf pulsations. The panels of MCT  0145-2211, and L 19-2  were observed in one sector, BPM 31594 was measured in two, while HE 0532-5605, located in the TESS Continuous Viewing Zone (CVZ), was observed in 13 consecutive sectors.
Light-curve analysis We performed standard Fourier analysis and pre-whitening of the data sets with the photometry modules of the Frequency Analysis and Mode Identification for Asteroseismology (famias) software package  (Zima 2008)   1. We also used in-house developed software for the least-squares fitting, used for the analysis of Whole Earth Telescope  (Nather et al. 1990) , Kepler, and K2 data. We chose the detection limit to be at 0. 1 per cent false alarm probability (FAP), that is, in this case, there is 99. 9 per cent chance that a peak reaching this limit is not just result of noise fluctuations. We calculated the 0. 1% FAP threshold following the method described in  Zong et al. (2016) : we generated 10 000 synthetic light curves of Gaussian random noise for the times of the real observations, calculated their Fourier transforms up to the Nyquist limit (≈ 4167 µHz), and then determined the probability for the different signal-to-noise (S/N) ratios that a single peak emerges at that S/N value only due to noise fluctuations.
Bognár et al. :  Known ZZ Ceti stars of the southern ecliptic hemisphere as seen by TESS Table  1. Journal of observations of the eight targets showing light variations in their TESS data sets. All data were collected in 120 s-cadence mode. N is the number of data points after the removal of all those with quality warning flags, δT is the length of the data sets including gaps, and Sect. is the serial number of the sector(s) in which the star was observed. The start time in BJD is the time of the first data point in the reduced data set. The CROWDSAP keyword represents the ratio of the target flux to the total flux in the TESS aperture. change rates driven by the cooling of the star. This decades-long effort is summarised in, for example,  Mukadam et al. (2013). The two main modes identified by  Lasker & Hesser (1971)  have been resolved as triplets, with the amplitude of the central m = 0 peak about 3-5 times smaller than the flanking m = ±1 peaks.
TESS observations The dominant peak is at 1618. 405 µHz, in agreement with the results of the previous observations. This peak is also the central component of a triplet with 13. 42 µHz frequency separations. This is also in good agreement with the 12. 7 µHz finding of O'  Donoghue et al. (1992)  by ground-based observations. Note that there are also residual closely spaced peaks at the triplet components. These are partly caused by the (apparent) changing noise level between the two sectors and sub-sector parts. We also detected the second harmonic of the dominant frequency, significant peaks at 1. 54 and 2. 54 times the dominant frequency, two independent frequencies at 1461. 119   Table  5. This work: results of the fit of the EC 23487-2424 data set with 10 frequencies. The errors are formal uncertainties.
As we saw in other targets in this study, and described by  Bell et al. (2015) , this lack of coherence can reduce the signal amplitude in the Fourier transform if the duration of the observations is much longer than the damping time. Scaling down the expected amplitudes to account for the redder bandwidth of the TESS data can also help explain the failure of these modes to appear in Fig. 10. To look for shorter-lifetime modes, we examined each sector of the TESS data individually to see if significant periodicities were present. However, since each sector is 1/13 as long as the total run, the noise in the Fourier transform in the individual sectors is nearly three times higher, putting our 0. 1% FAP threshold at about 6 mma. No significant periodicities were detected, however, in Sectors 1, 3, and 9, some peaks came close to reaching the 0.
Funding for the TESS mission is provided by the NASA Explorer Program. STScI is operated by the Association of Universities for Research in Astronomy, Inc. , under NASA contract NAS 5-26555. Support for this work was provided by NASA through the TESS Guest Investigator program through grant 80NSSC19K0378. ZsB acknowledges the support provided from the National Research, Development and Innovation Fund of Hungary, financed under the PD 17 funding scheme, project no. PD-123910. This project has been supported by the Lendület Program of the Hungarian Academy of Sciences, project No. LP2018-7/2019. KJB is supported by the National Science Foundation under Award No. AST-1903828. ASB gratefully acknowledges financial support from the Polish National Science Center under project No. UMO-2017/26/E/ST9/00703.