dataesr/scientific-paragraphs-categorization huggingface dataset:
Using the 1-km chord system as a baseline, a new 5-km chord system was built in 2015. The 5-km system was initially tested at the BAO tower near Boulder, Colorado, and showed a ∼5 ppmv difference on average from multiple collections between the 5-km chord data and the in situ data on the tower, with a precision of ∼0. 5 ppmv. The 5-km system was then deployed over the city of Paris in November 2015. Comparisons have been made with the Paris system, which show excellent agreement between the GreenLITE system and a nearby Picarro in situ instrument-again, despite GreenLITE measuring integrated path concentration versus the Picarro's point measurements-as well as a regional model run by LSCE using up-and down-wind Picarro instruments to constrain the model. The current plan is to keep the system operational through mid-November 2016, to have a full seasonal data cycle and assimilate this extensive dataset into the existing inverse transport modeling system for the estimate of the Paris emissions, which presently assimilates point measurements at perimeter-urban sites only.
Acknowledgments We would like to acknowledge the  Department of Energy, National Energy Technology Laboratory  for cofunding the initial GreenLITE development under contract number  DE-FE002574  and the  National Institute of Standards and Technology  for partially funding the testing of the 5-km system prior to deployment to Paris, France, under contract number  70NANB15H317. We would like to thank  Laura Dobeck  and  Lee Spangler  for supporting testing of the initial system at the ZERT site, and the ISGS team (specifically,  Randall Locke ,  Curt Blakley ,  Carl Carman , and  Sallie Greenberg ) for supporting deployment of the system to the IBDP site, as well as  Steve McDonald  and  ADM  for allowing access to the site for testing the operational capabilities of the system. Thanks to  Dan Wolfe  and  Arlyn Andrews  of  NOAA  for support in installing the retroreflectors at the BAO tower, and to  Michael Hannigan  and  Johanna Gordon  for access to the  University of Colorado Picarro data.
Traffic volumes in mobile networks are rising and end-user needs are rapidly changing. Mobile network operators need more flexibility, lower network operating costs, faster service roll-out cycles, and new revenue sources. The 5th Generation (5G) and future networks aim to deliver ultra-fast and ultra-reliable network access capable of supporting the anticipated surge in data traffic and connected nodes in years to come. Several technologies have been developed to meet these emergent demands of future mobile networks, among these are software defined networking, network function virtualization, and cloud computing. In this paper, we discuss the security challenges these new technologies are prone to in the context of the new telecommunication paradigm. We present a multi-tier component-based security architecture to address these challenges and secure 5G software defined mobile network (SDMN), by handling security at different levels to protect the network and its users.
I. INTRODUCTION The evolution to 5G and future mobile telecommunication networks is characterized by a significant surge in demands in terms of performance, flexibility, portability, and energy efficiency across all network functions. Software Defined Mobile Network (SDMN) architecture integrates the principles of Software Defined Networking (SDN), Network Function Virtualization (NFV) and cloud computing to telecommunication networks. The SDMN architecture is designed to provide a suitable platform for novel network concepts that can meet the requirements of both evolving and future mobile networks. The underlying principle of the SDN architecture is the decoupling of the network control and data planes. Using this principle, network control functions are logically centralized and the underlying network infrastructure is abstracted from the control functions.
The introduction of NFV offers a new paradigm to design, deploy and manage networking services based on the decoupling of the network functions from proprietary hardware appliances, and providing such services on a software platform. However, the separation of control and data planes as well as the virtualization of network functions and programmability introduce a number of novel use cases and functions on the network. This will further usher in new stakeholders into the networking arena and hence will obviously alter the approach to security management in 5G and future telecommunication networks. Several proposals are available for securing general SDN networks  [1] -  [6]  and SDMNs  [7] ,  [8]. However, none of these solutions provide a unified solution to secure future 5G SDMN backhaul network.
Additional security mechanisms are implemented to prevent unwanted access to the mobile backhaul network using policy-based communications. Here, we propose that all flows to mobile users are admitted based on policy. The proposed architecture serves to protect the backhaul devices, the air interface and the mobile devices from source address spoofing and Denial of Service (DoS) attacks as well as supports the automation of tracing back attackers. Moreover, security assessment and awareness are gained with Software Defined Monitoring (SDM) and data collection to detect, prevent and react to security threats. Finally, Proof-of-Concepts (PoC) of proposed security components are verified in testbeds. The paper is organized as follows; Section II presents an overall description of the SDMN architecture, it further provides a general overview of the security challenges in SDMN together with existing security solutions.
III. PROPOSED SECURITY ARCHITECTURE Given that most of the requirement specific to telecom architectures are tightly coupled with the control and data planes than with the application plane  [9] ,  [12] , hence, the proposed security architecture is geared towards securing the control plane, data plane and the Ctrl-Data interface (southbound interface). Figure  2  presents the proposed security architecture for SDMN networks. The proposed SDMN security architecture is a multitier security approach with five components, namely;.
A. SECURE COMMUNICATION (SC) COMPONENT The SDMN architecture comprises of two main communication channels, the data and control channels. The data channel handles the transportation of the user communication data while the control channel handles the movement of essential control and signaling data between the data and control planes. The major security concerns in SDMN communication channels are the lack of IP-level security and weak authentication between backhaul devices as shown in Table  1. Existing SDMN communication channels are heavily reliant on higher layer security mechanisms like TLS (Transport Layer Security) /SSL (Secure Sockets Layer). A typical example is the widely used OpenFlow protocol which runs over a TLS/SSL based control channel  [30]. However, such higher layer security mechanisms offer no protection to information at IP levels.
This leaves the communication sessions vulnerable to IP based attacks such as TCP SYN DoS, TCP reset attacks and IP spoofing  [31] ,  [32]. In addition, the TLS/SSL authentication mechanism is also exposed to IP spoofing and Compression Ratio Info-leak Made Easy (CRIME) attacks  [31]. These vulnerabilities buttress the need for secure communication mechanisms in SDMN architecture so as to mitigate against such threats. To Figure  3  illustrates the secure HIP tunnel establishment under the proposed SC component. Here we propose three key modifications to existing SDMN architecture. First, we introduce distributed Security Gateways (SecGWs) for securing the controller from outside network and mitigating against the odd of a single point of failure. SecGW is the intermediate gateway device between the controller and the data plane switches.
It not only hides the controller but also reduces the security work load on the controller. Second, we added a new Security Entity (SecE) to control SecGWs and other security functions in SDMN. Third, we installed local Security Agent (LSA) application in each data plane switch to manage security related functions in the switch. The proposed solution is a bump-in-thewire mechanism and it does not affect the underling control protocols like Openflow nor other user-plane communication protocols. In Table  3 , we compare various features of the proposed SC component with other security solutions.
This is central to the overall performance of the network and can well be handled by the DPI. The DPI can routinely gather network information and channel it back to the control layer. As illustrated in Figure  6 , the proposed DPI component is a part of an active monitoring probe that detects security threads. It is also able to react to detections. Optionally, the DPI component can work with mirrored traffic as a part of network monitoring functions. In both cases, the DPI component can be virtualized. This component will be adapted to analyze and detect diverse security threats related to application flows matching with predefined malware rule databases. The developed solution concentrates on the analysis of HTTP application flows. The detections are written to the local database and optionally provided directly to the other network functions.
-Traffic mirroring and analysis: a passive traffic monitoring device located at the backhaul to monitor variety of network functions. • Interface: -SDM CTRL Interface: controls the use of monitoring resources, recuperating traffic or metadata for analysis. This interface allows monitoring  VOLUME 5, 2017  requests to be sent to ascertain the status of the network, hence enabling applications and network functions to send requests for monitoring-based information, and monitoring functions can send status and recommendations. The SMM component introduces a dedicated Software Defined Monitoring controller (SDM CTRL) to orchestrate the monitoring activities related to security that are performed by sthe ecurity sensors (i. e. , probes) deployed in the network and in the cloud. The SDM and SDN controllers can be separate modules or integrated into one module.
The SDN CTRL also interacts with the routers implementing the SDN CTRL interface to manage the traffic (e. g. redirect traffic to the security appliances) and recuperate certain information. The SDM controller interacts with the security appliances or probes implementing the SDM CTRL interface to manage them and recuperate the metadata part of the traffic or verdicts. This information can be used by the network monitoring function in the cloud to perform analysis and trigger mitigation actions; of by the other network functions/services and applications. Security sensors used in SMM component can be passive (not disrupting traffic) or active (in the data path to perform online countermeasures); and can either be installed in existing network elements or in dedicated security appliances. The probes analyze network traffic, correlate information from different sources and produce meta-data and verdicts that can then be used by a centralized decision point and by the different network functions.
We used the latest version of POX controller  [40]  as the SDN controller and OpenVswitch (OVS) version 1. 10. 0 virtual switches  [41]  as DP switches. We have used four virtual hosts as users. For each OVS, two virtual hosts were connected. We used two D-LINK DSR-250N routers to connect the controller and the switches. For this experiments, we kept out-band control channel. We modeled the Security Gateway and LSAs using OpenHIP  [42]. We used IPERF network measurement tool  [43]  to measure the performance in terms of throughput and latency. We finally connected an attacker to each hub for each scenario of the experiment, the attacker operates from an i5-3210M CPU of 2. 5GHz processor laptop. The experiment settings of IPERF testing tool is presented in Table  4.
For the next experiment, we added a TCP SYN DoS attacker to the data channel (Hub2). We ran each experiment for 500 seconds while launching attacks between 100 and 200 seconds time interval. Table  6  shows the average performance of each architecture. 6  clearly shows the vulnerability of current SDMN channel to TCP DoS attacks. The experiment results show a 20% drop in throughput for both TCP and UDP in current SDMN data channel. The percentage drop in throughput is directly proportional to the percentage of time during which attacks were launched in reference to the overall experiment duration. We therefore conclude that current SDMN data channel is highly vulnerable to DoS attack, given that the effect of the attack on throughput lasted for the whole duration of the attack. Moreover, our experiment results also showed a 14 times increase in both latency and jitter using current SDMN data channel compared to normal operation.
However, using the proposed secure channel, we experienced similar performance as in normal operation. Thus, we verify that the proposed secure channel is capable of securing the SDMN data channel from potential DoS attacks. In the next experiment, we orchestrated a TCP SYN DoS and Reset attack on the control channel (Hub1). We then recorded the connection delay and flow table update delay experienced between the controller and the DP switch 1. We ran each experiment 25 times and recorded the average performance of each architecture. Table  7  shows the outcome of this experiment.
However, using the proposed secure channel, we observed consistent performance, hence resistant to those attacks. This confirms the ability of the proposed secure channel to secure the SDMN control channel from IP based attacks. In the second set of experiments, we aim to measure the performance of the PBC component, as well as determine the strength and effectiveness of its security. The proposed PBC component consists of CES/RGW and is implemented in Python. The prototype is developed as CES proof-of-concept. Figure  10  presents the implementation of our CES testbed, which is built in Linux environment and employs control/data plane split architecture. The testbed has two private networks that are respectively served by CES-A and CES-B. The edge of each network bears a data-path element, which enforces the rules generated by the control plane and forwards the new flows towards the CES function at the control plane, i.
e. for connection admission, policy negotiation or security analysis. The nodes in the setup are implemented as linux containers and are connected using basic Linux networking support. Tests were conducted with a total of 8 simulated hosts. Each network edge has two external interfaces: a) a public interface to receive traffic from the legacy Internet; and  b) a more secure private-transit link to receive flows from hosts in a different CES network. The setup also contains few nodes in the legacy Internet to launch typical Internet attacks or abuses for testing the CES/RGW security. Under this setup, the PBC is tested for both its use cases: 1) policy-based communication between CES nodes; and 2) inter-operability with legacy IP networks, using Realm Gateway (RGW) functions. Table  8  presents results of CES security testing, in terms of the processing delay of the security mechanisms.
Since we measured the connection setup on zero-latency links, one must add edge-toedge latency of the real networks to get the actual connection setup delay. To account for network uncertainties, CES state machine can absorb any host retransmissions while the CETP process is still concluding. Figure  11  illustrates the connection setup delay of nearly 80 connections, using CETP host policies of varying complexity. The figure reveals that less complex policies are negotiated quicker than more complex policies that result in another round trip. Most of the presented delay in the figure is the due to slow control/data plane interaction, while the policy processing by CES is carried out in the order of milliseconds. In future, we aim to improve the CES-to-CES signaling by direct CES-to-CES control plane communication, and then synchronizing the negotiated user connection to the data-plane.
• Security LAN: It includes security services, such as the security sensor. • Server LAN: It includes internal services. • Client LAN: This is the end-user network. In this testbed, a security use case had been defined as a proof of concept to show how SIEM and SMM components help detecting and isolating insecure network before they can negatively affect the rest of the network. Upon discovering a potential threat by SMM, the SIEM identified the problem and automatically performs the previously considered or planned reactions to mitigate it, by interacting with the Northbound API of the SDN controller. After the threat had been resolved the SIEM software allows the affected devices to rejoin the network. For the purpose of this use case, a VLC server streamed video in the server LAN and several VLC Clients were consuming this video from the Client LAN.
Possible malware detections are then written to the local database with the other analysis data produced by the DPI component. Tests were conducted with a total of 10 simulated hosts. In the evaluation environment about 5 percent of all data flows were interpreted as HTTP application flows by the DPI engine and therefore were compared with fingerprints (i. e. , signature detection). In real time analysis we could not measure any increase of CPU usage compared to the reference DPI analysis when the same number of metadata attributes were extracted. It has been found that the actual performance penalty should be measured at high data rates when packet drops may occur due to the additional processing. The average processing delay was defined as the measure of the delay from the time the flow starts to the time a packet is received that allows the first detection decision to be made.
CES links data services with the security infrastructure which has always been an essential part of mobile networks; e. g. authentication can be made a precondition of end to end data communication. CES can also enforce black lists when necessary. In addition, SIEM-based security management and real-time sensors-assisted monitoring can also be used to enforce network-wide security. Notwithstanding the vulnerabilities that have been considered in this work, there are still some gray areas in SDMN security that require further investigations. For instance, the closely inter-linked security and scalability mechanisms in SDMN due to the centralized control plane. Hence, the need for further investigation into the control-data plane intelligence trade-off and the dependencies between security architectures and traffic forwarding mechanisms, this is required in order to minimize the delays incurred in traffic forwarding resulting in variations and multiplicity of purpose in SDMN security architectures.
Various security methods have been implemented on the SDMN platform. In this work, we presented a multi-tier security architecture based on five key components: (1) secure communication channels leveraging on HIP. This is used to secure both control and data channels; (2) policy based communications. This will serve to mitigate DoS attacks as well as source address spoofing, it will also allow network communications between end hosts only after a successful negotiation of policy between edge nodes. This will effectively tackle the problem of unwanted traffic across the network and managing all flow admissions by policy; (3) security management and monitoring where the security mechanisms implemented are monitored on one hand while detected security threats are isolated using DPI and traffic monitoring techniques on the other hand; (4) Security Defined Monitoring (SDM) to orchestrate the monitoring activities related to security and finally 5) Deep Packet Inspection (DPI) component for improved security threat detection.
ABSTRACT This article examines Japanese visual novel games, an under-researched game genre whose main feature is character-driven prose storylines in light of existing scholarship on characters and manga/anime aesthetics  (Azuma 2007 (Azuma & 2009;; Galbraith 2009 Galbraith & 2011;; Nozawa 2013; Kacsuk 2016). It offers a brief overview of the visual novel game genre as a game genre where the presence of characters constituted by what  Azuma (2007; 2009)  defined as 'database elements', character building blocks which, by virtue of their commonality within fan culture, constitute each an access point and an expression of the wider fan culture as a whole. In turn, fans develop enthusiastic reactions to these fantasy elements, the so-called moe phenomenon  (Galbraith 2009). Moe is an open-ended phenomenon which runs as the basis for the development of emphatic bonds with characters within visual novels.
Examining visual novel games under the framework provided by Espen  Aarseth (2012)  for the analysis of narrative within games, characters' constitutive database elements are examined, exploring them as being present at both the representational level and, due to the open-ended nature of the bond of empathy developed between the character and the player, the simulation level. The constant presence of database element-constituted characters on the screen makes visual novels' narrations dependent on characters, whose database elements are each an open window through which the setting and narration of the game is conveyed to the player through character identity. This process is demonstrated through the examination of Sokō Akki Muramasa (Nitroplus 2009), a visual novel game whose various storylines turn the player's expected consumption of characters against them, and by doing so reinforce both the character's identity and the importance of the game's narration.
Furthermore, the visual element, character representations, is developed according to what cultural critic  Azuma Hiroki (2007; 2009)  has called the 'character database'. By virtue of their constant presence on the screen and the pivotal role female characters play in how the player is supposed to make sense of the narrative, approaching visual novels and how, in turn, the characters are influenced by the narrative, means analysing these games requires a double approach to the game's narrative and limited interactive elements. Within this paper I'm going to showcase a Japanese visual novel game, Sokō Akki Muramasa (Nitroplus 2009), and place particular attention in how female characters become the focus of the player's reading of the game's underlying narrative and themes and how, through the characters, the game's depiction of a fictionalised, exceptional Japan and a fictionalised and monster-ified  (Miyake 2015)  West is depicted and shown to the players.
First, I will make a brief outline of visual novels as a game genre, what are the peculiarities of their framework of interaction and consumption of content and how this influences the narrative which is transmitted through the characters. Subsequently I will outline the peculiarities of Sokō Akki Muramasa against the wider genre of visual novels and how the peculiarities of the game influence how the game's themes are showcased to the player. Finally, I will analyse each of Sokō Akki Muramasa's female characters in their respective storylines and how the design of characters according to the character database is employed within the characters' storylines to advance the game's wider narrative.