dataesr/scientific-paragraphs-categorization huggingface dataset:
e. , hosts and flows). Subsequently, a message-passing algorithm is proposed to efficiently learn from the host connection graph. The performance of their model was compared with some advanced ML models using the CIC-IDS2017 dataset, showing superior results in terms of the F1 score. Moreover, Protogerou et al. [84]  provide an anomaly detection solution within IoT systems by employing a GNN-based model. They propose a multi-agent system based on GNN, where each agent is implemented using a GNN that can learn the representation of physical networks. Such an approach helps to explore the collaboration of intelligent agents to efficiently detect the intrusion. Lo et al. [85]  also use the GNN for IoT network intrusion detection, called E-GraphSAGE. E-GraphSAGE enables the collection of information on flow-based features and topological patterns to learn the patterns of network flows and hence to support the detection of malicious edges.
Using four benchmark datasets, the simulation results show that the E-GraphSAGE performs better than ML-based classifiers such as XGBoost. Similarly, Chang and Branco  [86]  extend E-GraphSAGE by proposing an edge-based residual graph attention network (E-ResGAT). E-ResGAT uses an attention mechanism supporting edge features and embedding residual learning to enhance malicious traffic detection. The obtained results show that E-ResGAT outperforms the original model E-GraphSAGE. In the same direction, Deng and Hooi  [87]  propose a structure learning approach in combination with GNN and use an attention mechanism called GDN. The novelty of their approach lies in using a distance metric to discern the relationships between nodes, primarily by selecting the top-K closest ones as the neighbor dependencies.
Subsequently, a graph attention convolution is utilized to encapsulate the process of information propagation. Experiments on two real-world sensor datasets show that GDN can handle high-dimensional time-series data and outperform baseline models. In addition, Sun and Yang  [89]  introduce a lateral movement (LM) detection system called HetGLM. This system constructs a heterogeneous graph consisting of users, devices, processes, and files. LM detection is redefined as an anomaly link detection task within this heterogeneous graph. The model utilizes metapaths within the graph to profile each network entity and identify authentication activities that deviate from benign behavior. While a few benign samples are required as input, the model benefits from the use of semi-supervised learning, allowing for more efficient detection of lateral movement.
Using the dataset proposed in  [81] , the simulation results demonstrate that XG-BoT achieved state-of-the-art performance in terms of the F1-score. Similarly, Zhu et al. [91]  propose an interpretive method for GNN-based botnet detection called BD-GNNExplainer. This method first employs a GNN model to detect a botnet attack; next, BD-GNNExplainer identifies the most informative edges that are heavily focused on during the training process of the GNN models. Finally, an interpretability score is assigned by comparing the identified edges with the ground truth. The proposed approach aids not only in accurately identifying threats but also in understanding the reasoning behind these identifications. The results show that a model with better classification performance is not necessarily more interpretable.
Data-driven methods, and especially those with GNN as the core module (Table  6 ), have emerged as an alternative due to their scalability and their capability of accurate modeling. In this section, we review two classes of GNNbased solutions: one focuses only on the estimation of the E2E metrics, and the other concerns the E2E DL architectures involved in the decision-making in plus. On the one hand, Rusek and Cholda [105] first propose the adoption of the MPNN for the estimation of delays in queuing networks. The framework is further improved with a bidirectional message passing between links-paths, so-called RouteNet [106]. The experiments are also carried out with the data generated by the packet-level simulator OMNeT++ [119] providing more realistic network traffic. Since then, many RouteNet variants have been proposed to improve the model and to adapt to the scenarios of more sophisticated network configurations.
The AutoGNN is trained to reduce the overall transmission delay using a Reinforcement learning (RL) mechanism, so-called RE-INFORCE [120], coupled with an OMNet++ simulator for providing network traffic data. The above methods are centralized in nature, aiming to optimize the routing decisions from a global perspective. In contrast,  Swaminathan et al. [115]  propose an MPNN-based model to perform the routing optimization locally. The model, as the core module of a controller, provides the next node for each routing request received on individual nodes. The authors propose the generation of a network state matrix, which is the input for the MPNN-based model. The entire model is trained using the DRL framework which was aimed to maximize the rewards composed of (i) Packet Delivery reward, ensuring that the routing algorithm selects nodes in the neighbor of the current node, and (ii) Delay reward again composing of Queueing delay and Link delay.
The training environment is set up using a Mininet Simulator to simulate a SDN and Ryu Software to simulate controller behavior. Similarly,  Huang et al. [117]  propose a distributed traffic routing control algorithm based on a deep graph reinforcement learning framework that combines the GCN model with a DRL training scheme called Actor-Critic  [121]. This framework leverages a GCN model to extract the structural information of the network topology and then generates the next hop policy for each routing request received on individual nodes. The experiments are conducted within an environment interacting with an OMNet++ simulator. It is shown that the framework is capable of reducing packet transmission delay, increasing packet delivery ratio, and reducing the probability of network congestion.
Lesson Learned GNNs have emerged as a powerful data-driven methodology for network optimization, traffic analysis, and security enhancement. Their applications are diverse, spanning multiple network domains and addressing various fundamental network challenges. Enabled by the holistic view of network topology provided by SDN, GNNs not only optimize networks, but also empower SDN and novel concepts like NFV and network slicing in Next-generation networks. However, the lack of real datasets poses a challenge for bench-marking and comparing different solutions. Nonetheless, their potential for transforming future networks is undeniable.
Once trained, GNN-based models can make predictions on network performance in a timely manner. TwinNet is trained on the dataset generated from packet-level simulator OMNeT++. Each data sample consists of a simulated network scenario defined by a topology, a sourcedestination traffic matrix, and a routing and queuing policy. The communication is simulated and the metrics of network performance are obtained to label the corresponding data sample. The traffic matrices are generated to simulate a wide range of network states from low to high traffic loads, including those that may cause congestion and packet loss. Queuing configurations are randomly assigned to each node. The training and evaluation of TwinNet utilize three real-world network topologies. The quantitative results demonstrate the effectiveness of TwinNet, achieving a Mean average percentage error (MAPE) of 3.
However, achieving this goal is a challenging task primarily due to the difficulty of measuring E2E metrics across multiple network slices spanning multiple network domains and involving different network nodes. Moreover, a digital twin targeting the capability of performing what-if scenarios may require the accurate modeling of the network behaviors given different configurations. To fulfill these requirements, the authors made use of GraphSAGE  [85] , a GNN to build a data-driven network modeling capable of predicting with precision the E2E latency of multiple network slices given the slicing configurations and substrate topology. To train the GraphNDT, the authors reused the data from [106]. The dataset was initially generated from OMNeT++ for routing scenarios which consist of three different topologies, routing configurations, traffic matrices, and captured network metrics such as delay, latency, and jitter.
However, by converting the pair-wise source destination traffic matrices into network slices, that dataset was used to stimulate the network slicing management scenario, and the ground-truth network metrics represent the E2E network slicing metrics. The experimental results demonstrate the accuracy of the proposed framework where the predicted latency has less than a 5% error rate under all three network topologies. Furthermore, three what-if scenarios are introduced to showcase the advantages of an NDT. Firstly, it can simulate an increase in traffic intensity to observe potential SLA violations, thus providing network operators with insights into the need for network slice reconfiguration. Secondly, it can simulate link failures and evaluate the monitoring system's adaptive capabilities by observing changes in network metrics.
The results indicate that the model successfully captures both the semantic and structural information in heterogeneous graphs, demonstrating the potential for handling complex real-world graph data. Moreover, the work in  [138]  proposed an innovative Contrastive Pre-Training strategy for GNNs on Heterogeneous Graphs (CPTHG). This strategy captures both the semantic and structural properties of graphs in a self-supervised manner. Contrastive learning is a form of self-supervised learning where the model is trained to identify which samples in the dataset are similar (or contrastive) to each other. The proposed model contains three main components, (i) a semantic-preserving contrast that aims to maximize the similarity between the node pairs that have the same type or share the same semantic information, (ii) a structure-preserving contrast that helps to maximize the similarity between the node pairs that have similar structural roles in the network, and (iii) negative sampling to reduce the similarity between the nodes that do not share similar structural roles or semantic information.
RING 3. 0  [5]  and RIP-MD  [9]  are offered as a black box tool as their code is not available. Arpeggio  [8]  and its recent refactoring PDBe-Arpeggio  [10]  is an open source tool that considers a wide set of specific bonds. However, the user cannot tune the bonds thresholds, energies are not computed, and the execution is not computationally efficient. In general, a serious drawback of the tools in the literature is that the correctness of the obtained RINs is not addressed. Another common issue concerns the computational efficiency of the RIN calculation: usually the performance evaluation of the proposed algorithm is missing or insufficiently addressed. A recent study by some of us developed a computational pipeline combining homology modeling, machine learning and graph theory techniques for the analysis of point mutations in the sequence of a specific membrane protein  [11].
In that framework, one of the available tools  [7]  was used to generate the RIN, and that experience prompted the need for a new tool able to overcome all the above drawbacks. To fill this gap we present RINmaker, a tool for determining and visualizing the RIN of a protein given in input. RINmaker is offered as a cross-platform and open source software that can be used either as a command-line tool or through a web application featuring a modern 3D user interface. Additionally, we offer a web API service for embedding RINmaker into third-party clients. RINmaker allows for determining the C α contact map and a comprehensive set of non-covalent interactions. For each considered bond either default or user specified thresholds can be used for the calculation, resulting in a versatile tool. Moreover, we developed a custom integration test system to ensure the program correctness.
The whole test suite is distributed along with the application, allowing anyone to reproduce the test results. Finally, computational efficiency was the main focus while designing and developing RINmaker. For this reason, we assessed the tool's efficiency through a series of performance evaluation tests, which highlighted that RINmaker can be used in any context where high-throughput production of RINs is required. RINmaker is supported by a detailed supplementary document (see Additional file 1) for all employed rules to identify different non-covalent interactions, as well as for the custom test cases used to assess the program correctness.
Implementation The main goal in designing RINmaker was computational efficiency, which guided all the implementation choices. The style of Generic Programming (GP)  [12]  has been adopted as it enforces a number of optimizations. By properly defining copy-constructors, assignment operators and move-constructors for custom datatypes, C++ and GP allows avoiding unwanted replications of data structures, boosting the overall performance. By using the template system rather than the classic object-oriented programming style based on subtype polymorphism and dynamic dispatching  [13] , the C++ language grants maximum efficiency thanks to the static dispatching of methods and to a number of other compile-time optimizations. A second goal was to ensure the RINmaker correctness. To this aim, the use of advanced preprocessor macros and C++11 lambdas played an important role in designing a programmable and versatile test suite.
Fig. 1  The RINmaker flow: The 3D structure of a protein (left) is mapped into a RIN network (right) via different possibilities (command-line, web API and web GUI). As a specific example, the red and blue amino acids highlighted in the protein structure on the left are mapped into the corresponding nodes on the right • A GUI web application running RINmaker in the background on the server side. The user can search an input file in the PDB databank or upload a local file, select the desired parameters for the non-covalent bonds and visualize the resulting RIN through a real-time rendered 2D or 3D representation, see an example in Fig. 2. Smooth motion, rotation and zoom are available, delivering a 60+ fps experience on an average machine (an Intel i5 10th generation processor with an integrated GPU).
The program builds a balanced kD-Tree representing the protein 3D structure in O(n log 2 n) time, with n being the number of atoms in the input file. With such data structure, the search for non-covalent bonds becomes the search for neighbouring nodes in the balanced kD-tree, which runs in O(log n) time on average and in O(n) time in the worst case. The advantage of adopting the kD-tree data structure and the related proximity search algorithm clearly emerges when assessing the RINmaker performance, as reported in the Results and Discussion section.
Test suite RINmaker is provided with a custom integration test system based on the Google Test Framework  [19]. The program can be compiled in test mode to run a series of tests. Tests are on two levels: tests of single code portions and functions; and tests of the whole program over a given input file. Code-level tests are modular and reusable thanks to advanced macro usage within C++, allowing for easy creation of new tests. A series of input sample PDB files specifically designed for testing the program behaviour on the various bonds are included with the RINmaker distribution. Moreover, a detailed description of all molecules included in tests along with the expected results is included in the Additional file 1. RINmaker can be built either in application mode for producing the normal executable, or in test mode for producing a special executable aimed at testing the program.
Using RINmaker for data analysis of a molecular dynamics trajectory One of the added values of mapping a 3D structure into a network stems from the various probes that can be used to identify emerging patterns that are not immediately visible from the original structure. We provide here an interesting example of this idea using RINmaker, thus showing the efficiency of the tool within this framework. Consider Trp-cage (file 1L2Y. pdb in the Protein Databank  [20] ), a small protein made of 20 aminoacids. Since it is a fast folding protein (folding time in the nsec time domain), it has been thoroughly studied and its structure and properties are rather well understood  [21, 22]. The Trp-cage native 3D structure is depicted in Fig. 3  and contains a short α-helix in residues 2-9, a 310-helix in residues 11-14, and a C-terminal polyproline II helix to pack against the central tryptophan (Trp-6)  [21].
The latter residue appears to be involved in the formation/breaking of side-chain bonds during the various folding-unfolding processes, because of its preferential position in the core region  [22]. Using molecular dynamics in explicit water TIP3P  [23]  with the CHARMM36 force-field  [24] , we first equilibrated the Trp-cage protein for 45 nsec in NPT ensemble with pressure equal to 1 atm kept constant with a Monte Carlo barostat  [25]. Then a NVT production run of additional 45 nsec was performed at temperature 480K and at temperature 330 K. In all cases it was used a Langevin Integrator with timestep set to 2 psec. All simulations were performed using the OpenMM  [26]  python package. From  [21] , it is known that with the use of the CHARMM36 force field, the groundstate (folded state) of the protein is well maintained at 330K, and that the melting point corresponding to denaturation of the protein, appears around 440K.
e. a residue) and the number of total shortest paths in the network. The betweenness centrality is known to be an important indicator of the residue function of a protein upon a mutation of a given residue  [27] , and we show that this information is indeed captured by the RIN topology via our RINmaker tool. For each snapshot of the trajectory (every 30ps), the radius of gyration and the RIN were computed. The latter was used to further compute the betweenness centrality using the Networkx  [28]  python package. Both these quantities were then accumulated in histograms that were then used for a free energy landscape analysis following standard prescriptions  [21]. Figure  4  displays the betweenness centrality of each of the 20 residues of the Trp-Cage as a function of the simulation time t/�t (units of t = 30 psec) for two temperatures: (top panel) T = 330 K below the folding temperature ( T ≈ 400 K ) and (bottom panel) T = 480 K above it.
Performance evaluation In this section we illustrate the performance tests that have been designed and performed for RINmaker. All tests were executed on a mid-end machine, namely a Think-Pad E590 laptop equipped with Intel i7-8565U CPU, 16GB of RAM and a 500GB SSD. The first test aimed at evaluating the running time of the software for a wide set of proteins. We considered the TOP2018  [32]  database and created a script to run RINmaker for all proteins stored in the database, which contains 13,678 entries (pdb files) corresponding to all single chains of the considered proteins. All the created RINs were obtained by using the default values for all input parameters. We measured that the average time to build the RIN for each entry was approximately 66 ms, for a total of 15 min for the entire database.
We also computed the frequency per bond for the obtained RINs, which is reported in Table  1. The reported frequency values are in agreement with the general knowledge in the literature. The second test was a performance comparison between RINmaker, and the most similar tools in the literature, namely RING 3. 0  [5]  and PDBe-Arpeggio  [10]. Note that, since RING 3. 0 source code is unavailable, the test has been performed using the executables of the command-line version of the tool. For PDBe-Arpeggio we used the available Python scripts. While RINmaker and RING 3. 0 are very similar in their general structure, PDBe-Arpeggio significantly departs from both on them on the count that it does not allow users to customize bond parameters (angles, distances, etc), and it heavily relies on external tools such as Open Babel  [33].
The test aimed at evaluating the performance of the three tools for a small set of proteins available in the PDB databank and having an increasing number of amino acids. Table  2  shows the considered set of proteins and reports, for each of them, the user CPU time needed by all the three tools for creating their corresponding RIN. Each reported value has been averaged over ten runs values. The addition of hydrogen atoms is an optional operation in RINmaker and RING 3. 0, while it is always included in PDBe-Arpeggio. Hence, for RINmaker and RING 3. 0, the user CPU time is reported for both cases (i. e. with and without hydrogen addition). We remark that for each protein and run, RINmaker and RING 3. 0 received the same input parameters. However, it is worth mentioning that, although the two tools operated at the same conditions, they do not perform exactly the same activities.
In particular: • RING 3. 0 run the DSSP algorithm for secondary structure prediction  [34] , which is not included in RINmaker; • Both tools report the H-bonds, VdW bonds, Ionic bonds, ππ stacks and π-Cations. However, RINmaker reports also the hydrophobic bonds, which are not included in RING 3. 0. By contrast, in PDBe-Arpeggio everything is pre-defined thus lacking on any possibility of a customized use, as already remarked. Looking at Table  2  it is clear that RINmaker outperforms PDBe-Arpeggio and RING 3. 0 in all tests by at least one order of magnitude in most cases. It is also interesting to point out that the low user CPU times employed by RINmaker when dealing with small molecules imply that the program startup time, consisting of parsing the input and setting up data structures, is negligible compared to the processing time.
This feature makes RINmaker ideal to be embedded into other tools, scripts or pipelines. A different view of the comparison between RINmaker and RING 3. 0 is shown in Fig. 7. It considers the user CPU time distribution w. r. t. the number of residues in the input files and shows the results of both tools in the two cases, namely with and without hydrogen addition. The results highlights even more the different performances of the two tools, RINmaker being the most efficient one. Note that the RINmaker CPU times grow very slowly w. r. t. the number of residues (it is a linear growth in case no hydrogen atoms are added), making it suitable for proteins of any size.
Acknowledgements We thank  Giulio Marcolin  and  Luca Lagunas  for their preliminary contribution to the software. We thank  Giulia Brolese  for improving the RINmaker flow picture. The use of the SCSCF cluster at  Ca' Foscari University of Venice. is gratefully acknowledged. We acknowledge the  CINECA  award under the  ISCRA initiative , for the availability of high performance computing resources and support.
A key challenge in paleoseismology is constraining the timing and occurrence of past earthquakes to create an earthquake history along faults that can be used for testing or building fault-based seismic hazard assessments. We present a new methodological approach and accompanying code (Paleoseismic EArthquake CHronologies, PEACH) to meet this challenge. By using integration of multi-site paleoseismic records through probabilistic modelling of the event times and an unconditioned correlation, PEACH improves the objectivity of constraining paleoearthquake chronologies along faults, including highly populated records and poorly dated events. Our approach reduces uncertainties in event times and allows increased resolution of the trench records. By extension, the approach can potentially reduce the uncertainties in the estimation of parameters for seismic hazard assessment such as the earthquake recurrence times and coefficient of variation.