dataesr/scientific-paragraphs-categorization huggingface dataset:
Chen et al. [135]  used XGBoost as a detection method in a SDN-based Cloud network. Then, they evaluated the efficiency of XGBoost through the Knowledge Discovery and Data mining (KDD) Cup 1999 dataset. The evaluation was done considering a binary classification scenario (DDoS/benign traffic). A final comparison was made between XGBoost, Random Forest, and SVM. Additionally, to detect the anomaly in the data plane level and to minimize the load on the control plane, Da el al. [107]  proposed a framework for the detection, classification, and mitigation of traffic anomalies in the SDN environment called ATLANTIC. It consists of two phases, which are (i) the lightweight phase and (ii) the heavyweight phase. The lightweight phase is responsible for anomaly detection by calculating the deviation in the entropy of flow tables, whereas the heavyweight phase uses the SVM model for anomaly classification.
Recently, like the other domains, DL models have been used for DDoS attack detection. For example, Niyaz et al. [136]  proposed a DL-based system for DDoS attack detection in an SDN environment. Specifically, SAE has been used for feature reduction in an unsupervised manner. Then, the traffic classification was performed with the softmax layer in the scenario of two classes (DDoS/benign traffic) and the eight classes, which included normal traffic and seven kinds of DDoS attacks. The experimental results show that the SAE model achieved higher performance compared to the neural network model using their own private dataset. Other DL models have been used for DDoS attack detection like CNN, RNN, and LSTM. For example, Li et al. [137]  used CNN, RNN, and LSTM as neural network models to realize the detection of DDoS attacks in the SDN environment.
The evaluation and training tasks of the used models were done on the ISCX2012 dataset. Similarly, Haider et al. [138]  used the same DL-based model for DDoS attack detection using a benchmark dataset (CI-CIDS2017 dataset). More specifically, four DL-based models were applied in an ensemble (RNN+RNN, LSTM+LSTM, CNN+CNN) or in a hybrid way (e. g. , RNN+LSTM). The results show the capability of DL models and especially the ensemble CNN model in detecting DDoS very well. Ensemble CNN provides high detection accuracy (99. 45%); however, it takes more time for the training and classification tasks. Moreover, Novaes et al. [120]  proposed a detection and mitigation framework against DDoS attacks in SDN environments. To do so, they used the generative adversarial Network (GAN) model in order to make the proposed framework less sensitive to adversarial attacks.
The experiments were conducted on emulated data and the public dataset CICD-DoS 2019, where the GAN obtained superior performance compared to the CNN, MLP, and LSTM models. Although the DL-based models are efficient for the DDoS attack detection/classification, combining deep and conventional ML models can take advantage of both techniques and hence further improve the performance of the security system. Krishnan et al. [139]  proposed a hybrid ML approach by combining DL and conventional ML models called VARMAN. AE was used to generate 50 new reduced features from the CICIDS2017 dataset as well as to optimize the computation and memory usage. Then, random forest acts as the main DDoS classifier. The experiments demonstrate that VARMAN outperforms the deep belief networks model, and this is attributed to the combination of different models.
Public Datasets As the performance of the IDS techniques relies on the quality of the training datasets, in this subsection, we review the publicly widely used datasets to evaluate the performance of the ML/DL-based model for intrusion detection. • KDD'99  [140]   Different ML/DL-based models have been used for intrusion detection/classification. Despite the performance of DL models, many solutions use conventional ML models (shown from Table  10 ) due to their simplicity. However, these models are usually accompanied by some dimensionality reduction methods. Additionally, as seen in the literature review, the detection of DDoS attacks has attracted many researchers. In other words, since the SDN controller represents the central brain of the network that stores and processes the data from all forwarding devices, it can be targeted by DDoS attacks.
e. , Google, Facebook, Skype) compared to other traffic. A two-class dataset is said to be imbalanced if one of the classes (the minority one) is represented by a very small number of instances in comparison to the other (majority) class. The classifier tends to be biased toward the larger groups that have more observations in the training sample  [149]. Therefore, ignoring the unequal misclassification risk for different groups may have a significant impact on the practical use of the classification  [23]. Several methods have been proposed as solutions to imbalance class problems, such as under-sampling, over-sampling, synthetic minority over-sampling techniques (SMOTE), or using boosting methods  [150]. Identifying DL architecture: Engineering the right set of features for a given scenario is often key to the success of a machine-learning project and is not an easy-to-solve question.
Therefore, one of the challenges of ML is to automate more and more of the feature engineering process. DL is currently the most active topic of ML. It can process raw data and generate relevant features autonomously. These features are automatically extracted from the training data by DL. However, it is computationally demanding, especially if computing resources are limited. DL has many hyperparameters and their number grows exponentially with the depth of the model. Therefore, it requires a lot of tuning, and there is no clear mathematical proof to interpret its architecture. Finding suitable architecture (i. e. , number of hidden layers) and identifying optimal hyperparameters (i. e. , learning rate, loss function, etc. ) are difficult tasks and can influence the model performance. Available datasets: Note that the model training performance is highly dependent on the dataset.
Therefore, it is one important component for ML/DL models training, as it has a direct impact on the accuracy and applicability of classifiers  [86]. Although there are a few recent public datasets available for traffic classification  [88, 96] , there is no commonly agreed-upon dataset for most traffic-related classification problems. Additionally, choosing the right dataset is difficult because ML models can only identify applications based on what it has known (existing in the training set). ML algorithms, and especially DL models, can further benefit from training data augmentation. This is indeed an opportunity for using ML/DL algorithms to improve QoS, as the networks generate tremendous amounts of data and the intensive growth of applications on the Internet. However, due to privacy and lack of shareable data, there is difficulty in progressing on traffic classification.
To solve these issues, distributed learning and, especially, FL have started to attract more and more researchers for network traffic management. Moreover, due to the huge number of applications on the Internet, the dataset cannot contain all of them. Therefore, the amount of available data could still be insufficient to train ML algorithms effectively, especially DL algorithms. For these reasons, many researchers try to use old datasets to test their solutions. However, this solution is inefficient, as the behaviors of modern applications change, and their complexity increases every day. Furthermore, most network data are unlabeled; hence, fine-grained classification becomes impractical, and it is unrealistic to achieve low complexity classification based on unsupervised learning. Selection of ML models: ML/DL models are constructed and tested in their environment (i.
e. , dataset, features). However, average high performance does not guarantee high performance with other problems. Additionally, the choice of the appropriate model is a daunting task, since it depends on many parameters such as the types of data, the size of the data samples/features, the time, and computing resource constraints, as well as the type of prediction outcomes. Therefore, in light of the diversity of ML/DL models, choosing the appropriate one is a difficult task because a single wrong decision can be extremely costly. Selection of flow features: Besides the selection of the suitable ML model, the performance of this model relies on the collection of features used for the flow classification. Thus, one of the most challenging aspects of flow-based techniques is how to select the appropriate flow of statistical features.
Abilene dataset [117] contains the real trace data from the backbone network located in North America consisting of 12 nodes and 30 unidirectional links. The volume of traffic is aggregated over slots of 5 min starting from 1 March 2004 to 10 September 2004; • GEANT [118] has 23 nodes and 36 links. A traffic matrix (TM) is summarized every 15 min starting from 8 January 2005 for 16 weeks (10,772 TMs in total); • Telecom Italia [119] is part of the "Big Data challenge". The traffic was collected from 1 November 2013 to 1 January 2014 using 10 min as a temporal interval over Milan. The area of Milan is divided into a grid of 100 × 100 squares, and the size of each square is about 235 × 235 m. This dataset contains three types of cellular traffic: SMS, call, and Internet traffic. Additionally, it has 300 million records, which comes to about 19 GB.
[103]popular encrypted traffic classification dataset. It contains only time-related features and regular traffic, as well as traffic captured over a virtual private network (VPN). Specifically, it consists of four scenarios. ScenarioA is used for binary classification in order to indicate whether the traffic flow is VPN or not. containsonlytime-related features. This dataset has eight different labels, corresponding to the eight different types of traffic captured, which are browsing, audio streaming, chat, video streaming, mail, VoIP, P2P, and file transfers;• QUIC[103]is released by the University of California at Davis. It contains five Google services: Google Drive, Youtube, Google Docs, Google Search, and Google Music. •.
[142]e of the most well-known datasets for validating IDS. It consists of 41 traffic features and 4 attack categories besides benign traffic. The attack traffic is categorized into denial of service (DoS), remote to local (R2L), user to root (U2R), or probe attacks. This dataset contains redundant observations, and therefore, the trained model can be biased towards the more frequent observations; •The NSL-KDD dataset[141]is the updated version of the KDD'99 dataset. It solves the issues of the duplicate observations. It contains two subsets, a training set and testing set, where the distribution of attack in the testing set is higher than the training set; •The ISCX dataset[121]was released by the Canadian Institute for Cybersecurity, University of New Brunswick. It consists of benign traffic and four types of attack, which are brute force attack, DDoS, HttpDoS, and infiltrating attack; • Gas pipeline and water storage tank[142]is a dataset released by a lab at Mississippi State University in 2014.
• Abilene dataset [117] contains the real trace data from the backbone network located in North America consisting of 12 nodes and 30 unidirectional links. The volume of traffic is aggregated over slots of 5 min starting from 1 March 2004 to 10 September 2004; • GEANT [118] has 23 nodes and 36 links. A traffic matrix (TM) is summarized every 15 min starting from 8 January 2005 for 16 weeks (10,772 TMs in total); • Telecom Italia [119] is part of the "Big Data challenge". The traffic was collected from 1 November 2013 to 1 January 2014 using 10 min as a temporal interval over Milan. The area of Milan is divided into a grid of 100 × 100 squares, and the size of each square is about 235 × 235 m. This dataset contains three types of cellular traffic: SMS, call, and Internet traffic. Additionally, it has 300 million records, which comes to about 19 GB.
It uses some in place of manual hard to find the code non-linear hidden layers to reduce the engineering. layer size. input features. CNN is a class of DL which consists of a number CNN Supervised, Unsupervised of convolution and pooling (subsampling) layers followed by a fully connected layers. Pooling and convolution layers are used to reduce the dimensions of features and find useful patterns. Next, fully connected layers are used for classification. It is widely used for image Weight sharing, extracts relevant features, high competitive performance. High computational cost, requires large training dataset and high number of hyperparameter tuning to achieve optimal features. recognition applications. LSTM is an extension of recurrent neural network (RNNs) and was created as the solution to LSTM Supervised short-term memory.
[103]popular encrypted traffic classification dataset. It contains only time-related features and regular traffic, as well as traffic captured over a virtual private network (VPN). Specifically, it consists of four scenarios. ScenarioA is used for binary classification in order to indicate whether the traffic flow is VPN or not. containsonlytime-related features. This dataset has eight different labels, corresponding to the eight different types of traffic captured, which are browsing, audio streaming, chat, video streaming, mail, VoIP, P2P, and file transfers;• QUIC[103]is released by the University of California at Davis. It contains five Google services: Google Drive, Youtube, Google Docs, Google Search, and Google Music. • [102] scenario B and scenario C are classification tasks. Scenario B contains only seven non-VPN traffic services like audio, browsing, etc.
5, KNN, NB, SVM Filter and wrapper method WWW, mail, bulk, services, P2P, database, multimedia, attack N/A WWW, mail, FTP-control, FTP-data, P2P, [83] CNN - database, multimedia, services, interactive, N/A games [81] DT, RF, GBM, LightGBM N/A Web browsing, email, chat, streaming, file transfer, VoIP, P2P RYU [82] Ensemble classifier (KNN, SVM, RF, AdaBoost, Boosting, XGBoost) - Video, voice, bulk data transfer, music, interactive N/A [85] Deep learning - WWW, mail, FTP-control, FTP-pasv, FTP-data, attack, P2P, database, multimedia, services POX [90] DPI and classification algorithm N/A N/A Floodlight [89] Decision tree (C5. 0) N/A Top 40 Android applications N/A [62] Random forest, stochastic gradient boosting, XGBoost PCA Bittorent, Dropbox, Facebook, HTTP, Linkedin, Skype, Vimeo, Youtube HP VAN Fine-grained classification [92] Decision tree (C5.
They proposed two datasets: the first is with a gas pipeline, and the second is for a water storage tank. These datasets consist of 26 features and 1 label. The label contains eight possible values, benign and seven different types of attacks, which are naive malicious response injection, complex malicious response injection, malicious state command injection, malicious parameter command injection, malicious function command injection, reconnaissance, and DoS attacks; • The UNSW-NB15 dataset [143] is one of the recent datasets; it includes a simulated period of data which was 16 h on 22 January 2015 and 15 h on 17 February 2015. This dataset has nine types of attacks: fuzzers, analysis, backdoors, DoS, exploits, generic, reconnaissance, shellcode, and worms. It contains two subsets, a training set with 175,341 observations and a testing set with 82,332 observations and 49 features; • The CICDS2017 dataset [144] is one of the recent intrusion detection datasets released by the Canadian Institute for Cybersecurity, University of New Brunswick.
It contains 80 features and 7 types of attack network flows: brute force attack, heartbleed attack, botnet, DoS Attack, DDoS Attack, web attack, infiltration attack; • The DS2OS dataset [145] was generated through the distributed smart space orches- tration system (DS2OS) in a virtual IoT environment. This dataset contains benign traffic and seven types of attacks, including DoS, data type probing, malicious control, malicious operation, scan, spying, and wrong setup. It consists of 357,952 observations and 13 features; • The ToN-IoT dataset [146] was put forward by the IoT Lab of the UNSW Canberra Cyber, the School of Engineering and Information Technology (SEIT), and UNSW Canberra at the Australian Defence Force Academy (ADFA). It contains traffic collected from the Internet of Things (IoT) and industrial IoT devices.
It contains benign traffic and 9 different types of attacks (backdoor, DDoS, DoS, injection, MITM, password, ransomware, scanning, and XSS) with 49 features; • The IoT Botnet dataset [147] uses the MQTT protocol as a communication proto- col. It contains 83 features and 4 different types of attacks, including DDoS, DoS, reconnaissance, and theft, along with benign traffic; • The InSDN dataset [130] is a recent dataset and the first one generated directly from SDN networks. It consists of 80 features and 361,317 observations for both normal and attack traffic. It covers different types of attack types, including DoS, DDoS, probe, 3. 3. 3. Discussion.
Kmdiff pipeline For the statistical part, kmdiff follows HAWK both in terms of k-mer detection and population stratification correction. Each k-mer is tested for significant association with either cohort using a likelihood ratio test, which assumes that k-mers are Poisson-distributed. To take into account the population stratification and thus to compute corrected P-values, a random sample of k-mers (<1/100th of total) are used to infer a stratification using the Eigenstrat software  (Patterson et al. , 2006; Price et al. , 2006; Rahman et al. , 2018). Finally, P-values are adjusted for multiple tests  (Salkind, 2006)  using Bonferroni correction (though Benjamini-Hochberg can also be used). kmdiff deviates from HAWK in the k-mer counting part. HAWK counts k-mers of each sample before loading and testing batches of them using a hash table.
Results We compare the performance of kmdiff with the state-of-the-art tool HAWK and demonstrate the ability of kmdiff to be more scalable while producing an equivalent output. We present medium and large-scale experiments adapted from  Rahman et al. (2018) , respectively on bacterial and human data. Extended results, together with the benchmark environment and resources description are available as a supplement (see Supplementary Section S1). We also compared the computational performances of kmdiff to kmerGWAS (Voichek and Weigel, 2020), but not the quality of results, as kmerGWAS uses a different statistical model which does not compare two cohorts but instead considers phenotypes as continuous real values. Because of the high memory usage of kmerGWAS, results are limited to the bacterial dataset (see Supplementary Section S1.
Ampicillin resistance This dataset consists of sequencing data from 241 strains of Escherichia coli from  Earle et al. (2016). Among them 189 are resistant to ampicillin and 52 are sensitive. On this dataset, kmdiff is 6Â faster than HAWK and reduces memory and disk usage by 8Â and 4. 5Â, respectively. The difference in memory usage is explained by the use of kmtricks, a disk-based counting algorithm. For the disk usage, the difference is due to the compressed representation of counted k-mers. The k-mers found are exactly the same for both tools: 13196814 over-represented k-mers occur in cases, and 16804587 in controls. After population stratification, due to stochasticity, results differ: 4542 (for HAWK) and 4591 (for kmdiff) k-mers from controls pass significance filters. The difference can be explained by imprecise floating-point arithmetics and non-deterministic sub-sampling during population stratification correction.
Human cohorts To illustrate the scalability of kmdiff, we compared it to HAWK on several datasets of different sizes from the 1000 Genome project (The 1000 Genomes Project Consortium, 2015). We used wholegenome sequencing from two populations, TSI (Toscani in Italia) and (Yoruba in Ibadan, Nigeria), to build benchmark datasets composed of 20, 40 and 80 individuals. As shown in the Figure  2 , kmdiff offers a better scalability than HAWK being at least 13 times faster while using significantly less memory and disk.
In this field, the use of augmented virtual reality could improve the necessary skills that would otherwise only be acquired with years of experience  [63]. An example of the use of augmented reality can be found in the work carried out by Bologna et al. [63]. They investigated the training of operators without the cost of the material and avoiding possible risks for both equipment and personnel in real life, using Meta 2 glasses and the Unity 3D and Visual Studio software. The platform employed incorporated a graphical interface which included figures and terminology that provided the simulation of industrial equipment. This could reduce the lack of trained labour that presently exists in the meat sector. On the other hand, IR 4. 0 technologies must guarantee monitoring and be able to perform measurements in real time throughout the food supply chain.
It is important to take this into account when using public data from neutrino telescope collaborations to probe theoretical models. Tracks and cascades have complementary characteristics. Tracks provide pointing with a good angular resolution (depending on energy and down to ∼0. 1 • above TeV energies) thanks to the long lever arm, but rather poor energy resolution since the neutrino interaction can occur outside the detector and only part of the track is seen. They benefit from the highest effective area but suffer from a huge background of atmospheric muons, several orders of magnitude larger than the atmospheric neutrino flux, not to mention the astrophysical neutrino flux. Cascades have poorer angular resolution due to the roughly spherical topology of the events, but excellent energy resolution if the interaction occurs inside the instrumented volume since all the initial neutrino energy is then deposited within the detector.
The detector facilities were already funded in the 1990s. They underwent an initial stage that lasted several years. This was intended mainly as a proof of concept to facilitate the development of the highly sophisticated technology and experience required for the advanced, second generation of detectors, which were planned to achieve sufficient sensitivity to make the first discoveries. The advanced detectors have completed three observing runs O1-O3 [1190]: 1. The first observing run (O1) involved only the LIGO detectors and officially lasted from  18  September 2015 to 12 January 2016. Data of good quality was also collected a week before and after these dates. The detectors achieved a 80 Mpc range for BNS detections, and measured three binary black hole mergers. 2. O2 lasted from 30 November 2016 to 25 August 2017, and the typical sensitivity was 80-100 Mpc for BNSs.
Analysis of energy and time profiles from gamma-ray data As discussed earlier in Sec. 3, the two classes of effects which are commonly used in order to look for a possible signature of QG with gamma-ray experiments are energy-dependent time delays and anomalous spectral features at the highest energies, for example due to gamma-ray decay into e + e - pairs in vacuum or to a LIV-induced decreased absorption by the EBL. The analyses of energy and time profiles require a large amount of good quality data to be collected in the first place. In particular for the search for QG induced effects, and in order to provide stringent constraints on the corresponding models, the study of the two classes of effects mentioned above implies the detectors to have a good sensitivity and energy resolution. A good sensitivity on a wide energy range not only allows the detection of more sources with a broad distribution of distances, but also the observation of the high variability needed to measure time lags.