dataesr/scientific-paragraphs-categorization huggingface dataset:
com/jries/SMAP Handles arbitrary PSFs; strong performance in 3D SMLM challenge SMolPhot https://bitbucket. org/ardiloot/ Strong performance in 3D SMLM challenge smolphot-software/wiki/Home ZOLA-3D (reF. 102 ) https://github. com/imodpasteur/ZOLA-3D Handles arbitrary PSFs and refractive index mismatch Picasso 18 https://github. com/jungmannlab/picasso Software package optimized for DNA-PAINT Recommended.
The approach can be coupled with attack simulations to provide probabilistic evaluations of security, e. g. , time to compromise (TTC)  [22, 24]. On the basis of such objective evaluations, security controls can be chosen to counter anticipated threats. In this paper, we propose a threat modeling language for enterprise systems called enterpriseLang. It is a domainspecific language (DSL) based on the Meta Attack Language (MAL) framework  [22]. The MITRE Enterprise ATT&CK Matrix  5  serves as a knowledge base for our proposed threat modeling language, which describes adversary behaviors in order to measure the resilience of an enterprise system against various cyber attacks. The MITRE ATT&CK database contains useful information for a threat modeling language, such as assets (e. g. , Computer, Service, OS, Firewall, Internal and External Network), attack steps (e.
g. , Spearphishing Attachment, User Execution, and Data Destruction), and defenses (e. g. , Privileged Account Management, Execution Prevention, and Network Segmentation). Based on a system model and using available tools, enterpriseLang allows 1) analyzing weaknesses related to known attack techniques and 2) providing mitigation suggestions for these attacks. Therefore, stakeholders of an enterprise can assess threats to their enterprise IT environment and analyze what security settings that could be implemented to secure the system more effectively. The rest of this paper is structured as follows. In Sect. 2, we review the state of the art in threat modeling, attack simulations, and enterprise architecture (EA). Section 3 describes the background of this paper, including the MITRE Enterprise ATT&CK Matrix and the Meta Attack Language.
Moreover, the topological vulnerability analysis (TVA) tool  [37]  models security conditions in networks and uses a database of exploits as transitions between the security conditions. Similarly, NetSecuritas  [14]  uses scanner output and known exploits to generate attack graphs and the corresponding security recommendations, e. g. , the mitigation metric. These tools depend on available information about existing systems, from which attack graphs can be generated. Some researchers have investigated the combined use of threat modeling and attack simulations in domains such as energy  [51]  and vehicular IT  [27, 57]. CySeMoL  [45]  is a cyber security modeling language for enterprise-level system architectures; P 2 CySeMoL  [19] , which is further development of CySeMoL, is an attack graph tool for estimating the cyber security of EAs.
g. , webcams or USB memory) using the Data from Removable Media technique. The next step can be data exfiltration. • Command and Control. This tactic enables adversaries to control their operations within an enterprise system remotely. When adversaries have control over the enterprise, their compromised computers may then become botnets within the enterprise that can be controlled by the adversaries. 9 • Exfiltration. After data are collected, adversaries may package it using techniques such as Data Compression to minimize the data size transferred over the network, making the exfiltration less conspicuous to bypass detection. • Impact. Adversaries can breach the confidentiality, degrade the integrity, and limit the availability of assets within an enterprise system after achieving their objectives.
Data from Removable Media. Adversaries are often interested in sensitive information. Sensitive data can be collected from removable media, e. g. , USB memory, that are connected to a compromised computer. This technique can be used before data exfiltration, for instance. Commonly Used Port. Adversaries may conduct C2 communications over commonly used ports, e. g. , ports 80 (HTTP) and 443 (HTTPS), so that their communications are mixed with normal network activities and bypass network detection systems. Network Intrusion Prevention can be used to thwart such attempts at the network level. Data Compressed. After sensitive data are collected, an adversary may compress the data to make them portable before sending them over the network. The data are compressed according to a program or algorithm, and transmission can be prevented by using Network Intrusion Prevention to block certain file types such as ZIP files.
MAL coding standards MAL follows Java-like coding standards, where: -Asset names start with an uppercase letter, e. g. , asset User, OS, Linux. -Attack steps and defenses are given in camelCase, e. g. , userCredentials, userTraining. 13 https://foreseeti. com/securicad-vanguard-for-aws/. 14 https://github. com/mal-lang/mal-documentation/wiki. -Role names are in lowercase, e. g. , user. In the following basic MAL example, bashHistory on Linux can be the starting point for an adversary to initiate an attack, which is defended by operatingSystemConfiguration. If the defense is disabled (i. e. , its value is FALSE), the userAccount. userCredentials attack step will be reached, which enables an attack on the userCredentials of the con-nected UserAccount asset. By contrast, if the defense is enabled, the userCredentials step will not be reached.
By using available tools, the proposed language enables the simulation of attacks on its system model instances and supports analysis of the security settings that might be implemented to secure the system more effectively. -Step 2: Define Objectives: To assess and enhance the security of enterprise systems, security-related assets of enterprise systems need to be understood, and it is important to obtain reasonable coverage of attacks on enterprise systems and understand how these attacks can be associated. The full range of attacks/defenses (techniques/mitigations) detailed by the MITRE ATT&CK Matrix is covered in our proposed enterpriseLang, and the associations between attacks/defenses are described using MAL symbols. In addition, to determine which security settings can be applied for a specific enterprise, attacks can be simulated using the system model instantiated in enterpriseLang, and enterpriseLang supports analysis of which security settings may be useful.
Then, two enterprise system models of known real-world cyber attacks are created to determine: (1) whether the techniques used are present in enterpriseLang and behave as expected and (2) whether enterpriseLang can provide security assessments and suggest security settings to be implemented for the system models. To demonstrate enterpriseLang, two enterprise system models of known real-world cyber attacks are demonstrated using an attack graph excerpted from the generic attack graph of enterpriseLang, which shows the attack steps and defenses for the relevant system model assets, as well as how they are associated. -Step 6: Communication: The research is communicated by the publication of the paper itself and the peer-review process of the journal. In addition, enterpriseLang is an open-source project, and the entire code base of enterpriseLang, including instructions on how to use it, is publicly available from the GitHub repository.
Converting adversary techniques into MAL files After the above items are extracted for each adversary technique, they are converted by applying MAL symbols and coding standards to the following items. We take Access Token Manipulation as an example to show the process, which is illustrated in Fig. 3. -  The assets are categorized according to their functions, types, or fields of use. In this example, the UserAccount, AdminAccount, and WindowsAdmin assets belong to the Account category, where WindowsAdmin extends AdminAccount to specify that the platform on which this technique can be used is the Windows operating system (OS), and the Windows and Service assets belong to the Software category. Considering the attack steps/defenses, the asset User Account contains one attack step and one defense.
Integrating techniques into enterpriseLang In the construction process, 266 adversary techniques are converted to MAL files. As we aim to cover the full range of techniques found and detailed by the MITRE ATT&CK Matrix, and adversary techniques are usually not used in isolation, it is thus necessary to integrate these files into a single language, enterpriseLang, for threat modeling of enterprise systems. As shown in Fig. 5 , Asset 1 and Asset 2 are directly associated according to the description of Technique 1. Similarly, for Technique 2, we know that Asset 2 and Asset 3 are directly associated. To model a more complicated sce- The designed enterpriseLang can then be converted by a MAL compiler, 17 which generates Java code from enterprise-Lang. Several files are created in the specified output folder.
Overview of the language A metamodel of enterpriseLang showing the essential enterprise IT assets and their associations is created during the construction of enterpriseLang, which is inspired by the work of Ek and Petersson  [11]  and is shown in Fig. 6. The following asset categories are captured: A total of 22 enterprise IT Assets (12 main Assets and 10 inherited Assets) are extracted from the MITRE ATT&CK Matrix and included in enterpriseLang. Although it is not shown in this metamodel, each Asset is associated with a pair of attack steps and defenses. For example, concerning the number of attack steps that can be reached for a Fig. 6  The enterpriseLang metamodel containing enterprise assets and associations certain asset, 222 attack steps are associated with Windows, 134 are associated with Linux, and 160 are associated with macOS.
For instance, the Common Vulnerabilities and Exposures (CVE) database 20 contains a list of publicly known cyber security vulnerabilities, each of which is associated with a Common Vulnerability Scoring System score 21 indicating its severity  [23]. Other databases such as the Common Weakness Enumeration (CWE) database 22 list various types of software and hardware weaknesses, and the Common Attack Pattern Enumeration and Classification (CAPEC) database 23 provides a comprehensive dictionary of known patterns of attack 20 https://cve. mitre. org/. 21 https://www. first. org/cvss/v2/guide. 22 http://cwe. mitre. org/. 23 https://capec. mitre. org/. employed by adversaries to exploit known weaknesses in cyber-enabled capabilities. Furthermore, enterpriseLang assumes that all attack steps reachable by adversaries can be performed instantly.
However, successful real-world attacks usually involve a certain cost, probability, and effort. To produce more realistic simulation results, probability distributions need to be assigned to attack steps and defenses to describe the efforts required for adversaries to exploit certain attack steps. For example, a user clicking a Spearphishing Link follows a Bernoulli distribution with parameter 0. 71  [6]. In addition, the defenses in enterpriseLang currently have only Boolean values (TRUE/FALSE) to indicate their status. If the value of a defense is TRUE, it can defend against all the corresponding attack steps. According to the results of comparisons in previous research  [5, 7] , User Training in place follows a Bernoulli distribution with parameter 0. 22. Vulnerability databases such as CAPEC and CWE can also provide information about the likelihood of attacks  [55]  and thus can help produce more accurate simulation results.
Because the MAL, on which the proposed enterpriseLang is based, offers the option of using probability distributions to provide more accurate attack simulation results, probability distributions can be assigned to attack steps and defenses of enterpriseLang. These probability distributions are available from various information sources  [31, 56] , including vulnerability scores and databases, previous research, vulnerability scanners, expert knowledge, hacker knowledge, logs and alerts, and system state information. Therefore, by using the probability distributions assigned to attack steps and defenses, instead of using binary relations, more accurate security assessments could be obtained, e. g. , the probability of successful attack paths and risk matrices, as shown in Fig. 14. There are several potential directions for further improvement of enterpriseLang.
The proposed DSL will be improved in our future work. First, although the MITRE ATT&CK Matrix provides reasonable coverage of attacks on enterprise systems, other information sources (e. g. , the CVE and CWE databases) can be used to enrich enterpriseLang. Further, enterpriseLang is intended to be able not only to model enterprise systems but also to provide probabilistic security measures. Thus, another direction for future work is to assign probability distributions to the attack steps/defenses in order to provide more realistic simulation results  [56].
17 https://github. com/mal-lang/malcompiler. -The Person category includes one asset-User-and reflects the human aspect of cyber security. -The Account category includes two assets: User Account and AdminAccount. A User can log in to an AdminAccount or a UserAccount. By logging to an AdminAccount, one can change the security settings, install software, and access files on a Computer. The AdminAccount has two inherited assets, WindowsAdmin (for Windows) and Root (for Linux and macOS), depending on the OS running on a certain Computer. -The Software category includes three assets: OS, Service, and Browser. When OSs boot up, they can run programs or applications called Services to perform functions. One commonly accessed Service is Browser. In addition, OS has three inherited assets: Windows, Linux, and macOS, which represent the most commonly used OSs.
To reduce the uncertainty in climatic impacts induced by black carbon (BC) from global and regional aerosol-climate model simulations, it is a foremost requirement to improve the prediction of modelled BC distribution, specifically over the regions where the atmosphere is loaded with a large amount of BC, e. g. the Indo-Gangetic Plain (IGP) in the Indian subcontinent. Here we examine the wintertime direct radiative perturbation due to BC with an efficiently modelled BC distribution over the IGP in a high-resolution (0. 1 • × 0. 1 • ) chemical transport model, CHIMERE, implementing new BC emission inventories. The model efficiency in simulating the observed BC distribution was assessed by executing five simulations: Constrained and bottomup (bottomup includes Smog, Cmip, Edgar, and Pku). These simulations respectively implement the recently estimated India-based observationally constrained BC emissions (Constrained emiss ) and the latest bottom-up BC emissions (India-based: Smog-India; global: Coupled Model Intercomparison Project phase 6 -CMIP6, Emission Database for Global Atmospheric Research-V4 -EDGAR-V4, and Peking University BC Inventory -PKU).
The mean BC emission flux from the five BC emission inventory databases was found to be considerably high (450-1000 kg km -2 yr -1 ) over most of the IGP, with this being the highest (> 2500 kg km -2 yr -1 ) over megacities (Kolkata and Delhi). A low estimated value of the normalised mean bias (NMB) and root mean square error (RMSE) from the Con-.
, 2004; Verma et al. , 2007 Verma et al. , , 2011)). The simulated BC distribution from LMDZT-GCM was also found to consistently match the available observations at high-altitude Himalayan Hindukush stations (e. g. Hanle, Satopanth), which are relatively remotely located and mostly influenced by the transport of aerosols  (Santra et al. , 2019). The above evaluations therefore suggest that the large underestimation of BC concentration over the Indian mainland would primarily be due to BC emission datasets instead of the model configurations. The simulated atmospheric BC burden with atmospheric chemical transport models is related to the BC emission strength as input and simulated atmospheric residence time of BC  (Textor et al. , 2006). While the atmospheric residence time of BC aerosols is independent of the emission strength, it is an indication of model-specific treatments of transport and aerosol processes affecting the simulated BC burden.
, 2017). Therefore, in the above context, it is required to assess the efficacy of simulating the BC burden in a stateof-the-art chemical transport model under different emission scenarios (e. g. bottom-up and Constrained emiss ) evaluating the divergence in BC emission flux from state-of-the-art bottom-up BC emission inventories and Constrained emiss BC emissions. In this study, we examine the wintertime direct radiative effects of BC over the IGP by evaluating the efficacy of simulated atmospheric BC burden in a high-resolution (0. 1 • × 0. 1 • ) chemical transport model, CHIMERE, during winter when a large BC burden is observed. This is done by executing multiple BC transport simulations with CHIMERE and implementing new BC emission inventories, which include the recently estimated India-based Constrained emiss BC emissions and the latest bottom-up BC emissions (Indiabased: Speciated Multi-pOllutant Generator -Smog-India; global: Coupled Model Intercomparison Project Phase 6 -CMIP6, Emission Database for Global Atmospheric Research V4 -EDGAR V4, and the Peking University -PKU-BC inventory).
A short description of the five BC emission datasets is provided in Sect. 2. 1. The bottom-up BC emissions applied in the present study are being widely used in regional and global climate models in the assessment of the spatial and temporal distribution of aerosol burden and aerosol-climate interactions  (Eyring et al. , 2016; Zhou et al. , 2020; David et al. , 2018; Lamarque et al. , 2010; Meng et al. , 2018; Wang et al. , 2016) , including e. g. CMIP6, to support the IPCC climate assessment report  (Myhre et al. , 2013a). Henceforth, it is necessary to evaluate the performance of the new BC emissions (bottom-up and Constrained emiss ) with a state-of-the-art chemical transport model for their adequacy to represent the BC distribution and thereby the climatic impacts over the IGP in the Indian subcontinent.
BC transport simulations are performed for the winter of December 2015, keeping a spin-up time of 15 d in November 2015 from 15 to 30 November. Evaluation of the atmospheric BC concentration and BC-AOD in the present study is done during the winter month of December when the winter season is well developed in India and when the monthly mean BC concentration is typically observed as being the highest (e. g. Pani and Verma, 2014). The simulation is done for the year 2015 as the recent bottom-up BC emission database over India (Smog-India) implemented in the present study is for the year 2015.
The WRF meteorological model The WRF model is a state-of-the-art numerical weather forecast and atmospheric simulation system designed for both research and operational applications. The initial and boundary meteorological conditions for WRF simulations are obtained from Global Forecast System (GFS) National Center for Environmental Prediction FINAL operational global analysis data (NCEP-FNL, http://rda. ucar. edu/datasets/ds083. 2/, last access: 15 June 2019) at a spatial resolution of 1 • × 1 •. Meteorological fields are simulated in WRF at the temporal resolution of 1 h with the horizontal resolution the same as that for the CHIMERE simulation. The meteorological boundary conditions are updated every 6 h. The optimised schemes applied in the WRF simulation are as follows: Lin scheme for cloud microphysics  (Lin et al.
Implementation of BC emissions and multiple CHIMERE simulations In the present study, five simulations are carried out subjected to the same model processes with CHIMERE but implementing different BC emission inventories. The BC inventories include recently estimated India-based (i) Constrained emiss and (ii) bottom-up BC emissions (Smog-India), as well as bottom-up BC emissions from global datasets extracted over India: (iii) EDGAR V4 (EDGAR), (iv) CMIP6, and (v) PKU. Spatially and temporally resolved gridded Constrained emiss BC emissions over India are taken as per  Verma et al. (2017). The observationally Constrained emiss BC emissions or socalled Constrained emiss BC emissions were estimated using integrated forward and receptor modelling approaches  (Kumar et al. , 2018; Verma et al.
, 2017 , for formulation and details). A BC emission inventory based on the bottom-up approach is generally compiled using information on activity data and generalised emission factors (see the references for bottom-up emissions, Table  1a ). The recent bottom-up BC emission database over India implemented is from Smog-India  (Pandey et al. , 2014; Sadavarte and Venkataraman, 2014). The CMIP6 BC emissions used in the model simulations of CMIP6 are a combination of regional and global emission inventories re-gridded of EDGAR V4  (Eyring et al. , 2016). In the present study, the global BC emission inventories utilised include the emission databases for EDGAR, CMIP6, and PKU re-gridded to the resolution as per the Smog-India database. The BC transport simulations in CHIMERE corresponding to the emission databases (Constrained emiss , Smog-India, EDGAR, CMIP6, and PKU) are respectively referred to as the Constrained, Smog, Edgar, Cmip, and Pku simulations.
The annual BC emission strength over the study domain as estimated from the implemented inventories lies in the range 415-1517 Gg yr -1. Details on the simulation experiment and a short description of BC emission inventories implemented are summarised in Table 1a. The classified source sectors of BC emission from the emission inventory database include residential, open burning, energy and industry, and transportation. The annual BC emission strength corresponding to each of the source sectors as available from the emission inventory database is also mentioned in Table  1a. The fuel combustion activity among the source sectors includes the following: the combustion of fuelwood, crop waste, dung cakes, kerosene, and cooking liquified petroleum gas (LPG) for residential cooking and heating corresponding to the "residential" sector; open burning of agricultural residue, grassland, trash, and forest biomass corresponding to the "open burning" source sector; coal and diesel for energy corresponding to the "energy and industry" sector; and diesel, petrol, and gasoline corresponding to the "transportation" sector.
3e  for details on the location). Uncertainties in activity data and emission factors have been inferred, leading to uncertainty in bottom-up BC inventories greater than 200 % over India and Asia, as also mentioned earlier  (Streets et al. , 2003; Bond et al. , 2004; Venkataraman et al. , 2005; Lu et al. , 2011). One of the drawbacks of the bottom-up approach is its inability to take into account possible unknown or missing emission sources. Bottom-up BC emissions are thus found to often be lower than the actual emissions  (Rypdal et al. , 2005; Johnson et al. , 2011; Zhang et al. , 2005; Reid et al. , 2009). Bottom-up BC emissions over India include a large missing source of BC emitted over India  (Venkataraman et al. , 2006). Hence, the divergence in emission data (refer Fig. 1b ) using five emission datasets (observationally constrained and bottom-up BC emissions) is indicative of the inadequacy of BC emission source strength, suggesting that specific improvement is required in bottom-up BC emission tabulation over the IGP and specific locations where the divergence is typically noted to be large.