dataesr/scientific-paragraphs-categorization huggingface dataset:
(2008)  and  Luettmann and Bender (2007). In particular, it is possible to prevent the execution of software updates, including security patches. These attacks relate to the dependency solving error vulnerabilities and the memory management vulnerabilities. Finally, attacks may also be based on the non-linear/non-monotonic execution vulnerabilities. As exposed in  Pearce et al. (2013)  , an attack might restore a VM to a vulnerable state, by using the hypervisor facilities.
Hypervisor as a target The compromise-free attacks also concern denials of service related to hypervisors, similar to the previous ones: • The management console represents an attack vector, since it can shut down the hypervisor ( management console oversight vulnerability). • Network protocols can be used to flood the hypervisor and/or its execution environment based on DDoS attacks. • Hypervisors are also composed of software components, having their own vulnerabilities that are exploitable by attackers. We can also notice that VMs can indirectly contribute to hypervisor denials of service. For instance, authors of Pearce et al. (  2013 ) pointed out VM sprawling flaws, enabling the rapid spread of misbehaving VMs. This leads to the exhaustion of the hypervisor resources.
OrmandyTavis (2007) also identifies several common attacks against hypervisors, by considering the case of local attackers. Hypervisor extension mechanisms (extension packs, module framework) are also critical components for the hypervisor, as they are capable of loading code, such as a malicious payload, in its instance. Such attack is described in  OrmandyTavis (2007)  , where the Xen loadable module framework permits to load arbitrary code in the Xen address space. These attacks take advantage of the resource sharing with host and virtualization implementation vulnerabilities. Another important compromising attacks correspond to command/control channel exploitation attacks. The command/control channel is a privileged communication medium between the hypervisor and a VM, as depicted in  Waldspurger (2002).
Execution environment of the hypervisor Compromising attacks may also include firmware exploitation attacks against the execution environment of the hypervisor. Hypervisors are running at the top of a hardware layer, except in the case of nested virtualization. They are therefore constrained by the hardware layer, which is composed of devices with their own firmwares. These firmwares may carry their own flaws, providing the necessary material to an attacker to compromise them. The corresponding threats are the hardware tampering, the information disclosure based on side channels, and the elevation of privileges to get control on the software components running over the hardware. For instance, such an attack is showcased in  Wojtczuk and Rutkowska (2011)  , in order to compromise the firmware of network interface cards.
Protection of the hypervisor The hypervisor provides an execution environment to the VMs, enabling them to run in accordance with the VMM properties  ( Popek and Goldberg, 1974 ). In that context,  Szefer and Lee (2011)  proposes the use of hardware to protect VMs from the host, by enforcing isolation through hardware resource access management and privacy based on a trusted platform module (TPM). However, this counter-measure supposes important prerequisites on the hardware architecture, which may not be considered in practice. Additionally,  Li et al. (2010)  introduces a method to protect the hypervisor from host VMs by filtering management hypercalls and checking their integrity at the invocation. Virtual CPU context integrity checks as well as virtual memory encryption are enforced during the execution of the hypervisor.
The overhead affecting the management operation can be more remarkable on VMs with a short lifespan. In the area of OS-level virtualization, the Intel safeguard extension is used by SCONE  ( Arnautov et al. , 2016 )  to protect containers against untrusted execution environments. This framework provides the necessary building blocks to design enclaved linux containers, that are resilient against tampering attacks from the OS, with a limited trusted computing base (TCB). The system calls are performed asynchronously with the assistance of a module outside the enclave, and therefor requires a modification of the host OS. Complementary, the exploitation of command channels can be avoided by obfuscation methods, as detailed in  Carpenter et al. (2007)  , but this mitigation degrades the functionality of the hypervisor.
It enables the applications to control their own operating systemproof sandbox, and a layer interleaving the OS and the hardware is responsible for enforcing the sandbox isolation. The protection against control flow injections is established at the application compilation time by LLVM intermediate code inspections. Formal verification methods are also applied to check the hypervisors. For instance, work in  Freitas and McDermott (2011)  has formally specified parts of an hypervisor based on Xen. But the authors acknowledge that this approach is too expensive to be applied to an entire product. It is also possible to apply capability dropping techniques. Hardening methods are part of them and permit to reduce the attack surface of a system, by imposing a system to restrict parameter values and use specific (security) software components.
Embedding unused hardware increases the exposure to attacks. An example of such protection is given in  Williams and Koller (2016)  , where the authors export the virtual hardware environment stack to the VM itself. The solution is based on a modified version of the KVM hypervisor delegating its monitor to the VMs. It increases the isolation between the hypervisor and the VM, and permits a finely tailored virtual hardware environment for VMs. However, this implies important modifications in the code base of the hypervisor, requiring a per-hypervisor engineering, which has not been performed on other hypervisors than KVM. The outsourcing of in-VM software management contributes also to the code base limitation efforts in virtualized environments. Most operating system images are provided with their software management tools.
The first one relies on a modification of the hypervisor (experimented in KVM) to track the activity of VMs on virtual storage, while the second one focuses on tracking VM networking flows. This approach permits to detect compromised VMs only when malicious interactions with external resources are initiated. The monitoring may also consist in the identification of vulnerable configurations related to components of the virtualization architecture. For instance, the approach in  Barrère et al. (2014)  proposes a solving method exploiting the satisfiability problem (SAT) for supporting resource management. It permits to detect the presence of configuration vulnerabilities in a preventive manner, considering the maintenance operations that are available. The database of the vulnerabilities has to be provided and be adapted to the configurations of inspected VMs.
To enforce security decisions taken by an orchestrator, the resources of the virtualization architecture can be dynamically reconfigured through programmability facilities. These reconfigurations enable to reduce the attack surface (e. g. setting up authentication) or to mitigate the attacks (e. g. isolating a compromised host through firewalling). Considered resources include the different components of the virtualization architecture, but also security mechanisms. We can distinguish different cases: (1) components supporting reconfigurations at runtime can be managed through their configuration interfaces, (2) statically-configured components that are restartable, can be modified by changing the static configuration alteration and restarting the instance, (3) components that are non restartable (nor reconfigurable at runtime) can be addressed through dedicated methodologies, such as dynamic software updates developed in Walla (2017) using IncludeOS unikernels.
SIMULATION RESULTS In this section we present results obtained by executing the second algorithm (see Figure  4 ) written in MATLAB. We have set the number of cells to 5 ( = 4) and in order to execute properly the algorithm we run the following script:  In the table below we have reported the results of the algorithm with different number of. The execution time is measured on a CPU running at 1Ghz frequency (see Table  2 ). 1 ). For each value of ,  varying between 1 to  + 1, the number of shapes resulting from the positioning of  + 1 - cells on  cells are showed by the equation (1): 𝐶 (𝑁+1-𝑘)+𝑘-1 𝑘-1 = 𝐶 𝑁 𝑘-1 = 𝑁! (𝑁-𝑘+1)!(𝑘-1)! (1) The total number of shapes is then: ∑ 𝐶 𝑁 𝑘-1 𝑁+1 𝑘=1 = ∑ 𝐶 𝑁 𝑘 1 𝑁-𝑘 1 𝑘 𝑁 𝑘=0 = (1 + 1) 𝑁 = 2 𝑁 (2).
• Image bank and reference counts An image bank with photos (n = 300) of comb sides covered with various numbers of adult worker bees and photos (n = 600) of comb sides from which adult workers have been removed to make the capped brood cells visible  [34]. Reference images for the open brood cells are not provided here, because they are particularly hard to photograph, even under laboratory conditions (43 h for 16 photos of high quality in special light chamber; P. Le-Bivic, INRA, personal communication), are and difficult to see on photos taken in apiary conditions owing to light conditions  [12, 19]  (brood comb picture in "SM3_brood comb. JPG"). Adult workers and capped brood have been manually counted on these photos with the help of ImageJ software to provide a reference count  [35].
Data Collection Support Spreadsheet Field spreadsheets used to document the coverage percentage of each of the five components on each side of each comb of the hive are provided in the Supplementary Materials ("SM1_ColEval_fieldsheet. xlsx" and "SM2_ColEval_spreadsheet. xlsx"). They are transcribed on formatted spreadsheets (format type. xlsx,. csv,. ods, or others), which transform percentage evaluation into numbers or surface areas, with the coefficient transformation values given in Table  1  (see above in Section 3. 1. Data transformation). Calculation of the theoretical number of cells and adult workers on comb. The number of cells covering 100% of a comb side was measured on 30 combs. For the evaluation of the number of adult honeybee workers covering 100% of a comb side, the body surface area of 130 individuals was measured with image analysis (ImageJ-  [35] ).
Acknowledgments: We wish to thank all collaborators (Alexandre Dangléant,  Pierre Le-Bivic ,  Pierre Moreau ,  Fanny Mondet ,  Orianne Rollin ,  Claudia Dussaubat ,  Pascal Jourdan  and  Marie Fleurot ) who helped to set up the image reference bank and conducted field observations for ColEval testing. We also thank  Vincent Dietemann  for his comments, suggestions, and corrections on this article.
g. , time, wavelength, or frequency) underlies the data, it is finely discretized, resulting in highdimensional vectors. Such data are referred to as functional data. Functional data analysis (FDA) is a branch of modern statistics, the principle of which is the representation of highdimensional measurement vectors through functions (see  [32, 16]  for a practical and theoretical introduction to FDA). Regarding data as functions enables recovering the true nature of the process underlying the function that generated the data. It also provides a smooth representation of the initial curves, which can be affected by measurement noise. Moreover, the FDA framework enables the handling of curves that are irregularly sampled or sampled on grids of different sizes, The dataset is projected along the axis; the red curve clearly shows an outlying relationship between its variables, resulting in a different shape.
This is the "view" adopted in this study. In (c) and (d), the variables 1 and 2 are plotted as two univariate functions with respect to. Determining the degree of difference of the red curve without computing derived functions (e. g. , derivative(s)) is not simple. Moreover, if the dataset is very large, the red curve is totally mixed with the black curves, thus rendering visual detection difficult. variable, as this generalization is the sum of the individual 300 univariate functional depths. To address this, the entire shape 301 of the curve should be considered.
ECG data We tested the proposed approach on the real dataset used by Dai and Genton in  [8]. The dataset consists of electrocardiogram (ECG) time series of the electrical activity (voltage) of heart changes  [19]. Such data can reveal abnormalities in heart activity. The time series are univariate and were labeled by cardiologists as abnormal or normal. This dataset has been used for time-series classification  [46]. We augmented the data set by bivariate time series to demonstrate the applicability of the method to multivariate time series. There are a total of = 810 time series including 208 abnormal and 602 normal cases. All the time series have an equal size of = 86. In contrast with Dai and Genton in  [8] , who only considered the time series between the time stamps = 6 and = 80 to avoid boundary effects, we considered the entire time series to demonstrate the robustness and applicability of the proposed approach.
This would be of interest if the focus was specifically on the ECG data, but here, we use it as a real dataset example. As in  [8] , to obtain a rare class of samples representing outliers, we randomly created a partition of 400 samples (i. e. , the training set) out of the 810 samples by parameterizing the contamination level (i. e. , the rate of abnormal samples) in this partition to 5%, 10%, 15%, 20%, and 25%. Then, for each contamination level, we evaluated the proposed method on the 410 remaining samples (i. e. , the test set).
Pen-digits data We also tested the proposed method on another real dataset consisting of = 10992 bivariate time series representing pen digits (PenDig)  [12]. The digits are labeled according to their class (i. e. , from 0 to 9 ( , ) = (| -|; , ) , = 1, 2 and , ∈ [0, 1] where 12 is the correlation between the variables 1 and 2 , 11 = 22 is the variance of each variable, 1 and 2 are the marginal variances, (ℎ; , ) = 2 1-Γ( ) -1 ( |ℎ|)  ( |ℎ|) is the Matérn class function  [30]  ( is a modified Bessel function  [3] ), > 0 is a smoothness parameter, and > 0 is a range parameter. For this simulation, we used the same parameter setting as in  [8] : 12 = 0. 6, 11 = 22 = 1, 1 = 2 = 1, 11 = 1. 2, 22 = 0, 6, 12 = 21 = 1, 11 = 0. 02, 22 = 0. 01, and 12 = 21 = 0. 016. This covariance function is implemented in the R package  [37].
Choice of the basis of functions For the ECG and the PenDig datasets, we approximated each variable of the bivariate time series by a basis consisting of B-splines of order eight (B-splines are piecewise-polynomial functions of order at least three, and are located at a given observation point ∈  ). Indeed, we noticed that in this dataset, the curves exhibit a smooth pattern without periodicity; hence, the Bspline basis is a suitable choice (as recommended in  [32] ). For the synthetic dataset, we approximated each variable of the bivariate time series by a Fourier (sine and cosine functions) basis with a fundamental period of = 1 = 1 (i. e. , the length of  ). The Fourier basis was deemed suitable because we noticed low-frequency periodicity (induced by the covariance function ( , )) over .
Application of the functional-data fitting procedure We now provide the computational details of the functional-data fitting. Following the recommendations in  [33, 15] , for all 809 datasets, we selected both the penalization and the basis 810 size for the variable of sample through a leave-one-811 out cross-validation procedure over a given grid search for 812 and. We penalized both the first-and second-order 813 derivatives of ̃ to gain smoothness in the mapping-function 814 output. We note that for all the samples of a given variable ,.
824 For the ECG and PenDig datasets, the grid search of 1 839 Finally, we used the coefficient vector associated with 840 both the optimal regularization and basis-size parameters to 841 recover the smooth approximation functions ̃ on a given 842 grid and applied a mapping function to them. used instead  [32]. (ii) Regarding the velocity mapping in Eq. (  10 ), the (iii) The curvature mapping ( ) requires the compuwe computed them as in Eq. (  8 ) and combined them 877 as in Eq. (  11 ).
1052 We report the results for the ECG dataset in Table  2 , 1053 where for each contamination level (columns) and for each 1054 method (rows), we provide , , and (sub-columns). 1055 The results for the PenDig dataset are shown in Table  3 , where 1056 for each case of outlier class (columns), that is, a single digit, 1057 and for each method (rows), we provide the three performance 1058 measures as in Table  2. The results for the synthetic data 1059 are reported in Table  4 , where for each model (columns) and 1060 for each method (rows), we provide the three performance 1061 measures as in Table  2. In these tables, the value in a cell 1062 is the average of a performance measure over the number of 1063 simulations. We discuss the results below.
ECG data 1065 The results for the ECG data set ( rows). We highlight this in Fig. 5 , where it can be seen that  Outlier detection results for the ECG data set with five contamination levels. For each contamination level (columns) and each performance measure (sub-columns), we marked the best results in bold (i. e. , highest correct detection rate and , and lowest false detection rate ). For all the contamination levels, the proposed method achieves the best results with and the. We also notice that, in the proposed method, for a given mapping function and outlier-detection algorithm, performance does not degrade when varies, whereas for and. , performance degrades as increases. The proposes functions outperform state-of-the-art methods when there are few outliers. The outlier detection with OCSVM from and does not present the same robustness to the contamination level as that with iFor in terms of (OCSVM( ) and OCSVM ( ), and Fig.
2 ). Indeed, increases as the contamination level increases. Accordingly, OCSVM appears to be more suitable for datasets containing a small number of outliers. This was also observed in  [11]. Despite the lower robustness, OCSVM( ) and OCSVM( ) are better than the baselines, which exhibit performance degradation as the contamination level changes. Indeed, is approximately constant as increases but degrades for small values of in terms of ( row, columns). = 5% = 10% = 15% = 20% = 25% Methods (.
PenDig data From the results on the PenDig dataset in Table  3 , it can be seen that the proposed method always outperforms the baselines in terms of. This implies that the baselines are not as effective in capturing shape outlying features. When the outliers are '0' digits, the results by the baselines are consistent with the results on the synthetic data when some shape outliers are simulated (Model 5 in Table  4 ). This is not surprising, as Model 5 generates bivariate functional outliers with an elliptic shape in ℝ 2 ; hence, a zero-like shape ('0'). As an value close to 0. 50 implies that the detector performs as efficiently as a random method, we note that the '0' outlier case is the only in which the baselines are effective. The baseline methods cannot distinguish different shape outliers with abrupt shape irregularities such as (smooth) right angles, for example, when the outlier is the '  , averaged over the number of simulations as functions of the contamination level ( = 5%, = 10%, = 15%, = 20%, and = 25%) for each method (proposed in blue, and baselines in red ).
Outliers '0' Outliers  Results on the synthetic datasets. Outlier detection results for the synthetic data generated by the five models (columns), as described in Section 5. 2. We compared the proposed methods, iFor(⋅) and OCSVM(⋅), with the two baselines, and. , in terms of three performance measures (in sub-columns): correct detection rate ( ), false detection rate ( ), and. For each model and each performance metric, we marked in bold the best results (i. e. , highest and , and lowest ). iFor with and has a similar performance as that of the state-of-the-art methods for most of the generating models. For Model 5, iFor( ) outperforms the baselines. MODEL   because it is based on the intersection angles between the samples and is computed for each variable separately. Thus, it fails to consider the correlation between them (as explained in Section 1).
If there are ties, we take the average ranking. given in Tables  8, 9 , and 10 for , , and , respectively. We notice that. is significantly equivalent to iFor( ), OCSVM( ), , and iFor( ), and these methods are ranked first, second, and third on average, respectively (Fig. 7 ). Thus, on the synthetic dataset, the baseline methods are slightly better than the proposed method; however, based on the pairwise comparison tests, the best methods ( ( ) and ( )) are statistically equivalent. As discussed in the two previous paragraphs, the proposed method is superior on real datasets. Moreover, in the iFor rows and OCSVM columns, it can be seen that there is a pairwise equivalence between iFor and OCSVM for ( ) and ( ), that is, these two outlier-detection algorithms are empirically consistent for a given mapping function.
Conclusion In this paper, we proposed a method to improve the detection of different types of outliers in multivariate functional data, based on curve shape. We assumed that the original discrete curves can be well approximated by finite functional basis expansions, where the basis is specified. Based on the smooth reconstruction provided by the fitted basis expansion, we used the arc-length, velocity, and curvature mapping functions to capture latent shape features. Then, we detected the outliers from the mapped curves using outlier-detection algorithms. Through an experimental study on real and synthetic datasets, we demonstrated that the proposed approach outperforms multivariate functional depth baselines on real data and can perform similarly on synthetic data (except for persistent 1403 shape outliers, where the proposed method performs better).
1404 We demonstrated that, compared with the baselines, the pro-   Figure  7 : Ranking of the methods (1 is the best, 8 is the worst) on the synthetic datasets for , , and based on the post-hoc Friedman's aligned rank test. For and , the ranking is given in decreasing order (i. e. , for high and values, the rank is close to 1), and for , the ranking is given in increasing order (i. e. , for low values, the rank is close to 1). The -axis represents the average ranking over the five models, and the integers on the top of the bars represent the final ranking. If there are ties, we take the average ranking. The baseline methods are slightly better than the proposed method, but the best results by the proposed method ( ( ) and ( )) are statistically equivalent to those by the baseline, as demonstrated by the pairwise comparison tests in Tables  8, 9 , and 10.
potential mixture proportions when a sample lies in multiple classes. We did not assume any weighting of the curve variables in the mapping functions; this is left as future work. This weighting could be user-driven, as proposed for functional depth in  [4] , or data-driven. It is conceivable that this can enhance outlier detection in the presence of non-outlying curve variables (when increases). Another possible improvement would be to combine mapping functions in the same detector so that multiple outlier classes may be detected in the same dataset.