dataesr/scientific-paragraphs-categorization huggingface dataset:
For the 1:2 electrolyte the most common local structures all include more than one coordination bond to TFSI, which dominates the 1st solvation shell, which agrees well with the observations made by Kameda et al. 42  that for their (LiTFSI)(ACN) 2 electrolyte, studied by neutron diffraction, show that Li coordinates with 1. 63 ± 0. 07 ACN molecules and 2. 0 ± 0. 1 TFSI ions. Notably the fifth most common structure, making up over 6%, exclusively consist of three TFSI ions -which largely explains the pSN ACN = 0 feature (Fig. 5 ). Connecting further to the data in Fig. 5 , the pSN ACN = 2 feature for the 1:2 electrolyte is also    38  indicated here, as the most common local structure have two ACN solvent molecules in the Li + 1st solvation shell. While the top structures for 1:2 were also reported in our previous work  22  and were based on the same simulation trajectories, the CHAMPION code base has since then undergone some major modifications, but only minor modifications to the underlying algorithms and the parameters controlling tolerances and sensitivities in CHAMPION, primarily affecting the bidentate coordination have been made, which nevertheless changes the exact ordering of the structures.
Acknowledgments The research presented has received funding through the  HELIS  project (European Union's  Horizon 2020 research and innovation program  under Grant Agreement No. 666221 ) and the  Swedish Energy Agency  grants (# P43525-1  and # P39909-1 ). P. J. would also like to acknowledge the  BASE network as well as Chalmers Areas of Advance Materials Science and Energy , for continuous support, and specifically the Theory and  Modelling scheme of Advanced User Support  to F. Å. and R. A. A. A. F. acknowledges the  Institut Universitaire de France  for the support. F. Å. , R. A. and P. J. are shareholders of Compular AB, the company developing CHAMPION.
K T ,eq (h, T ) ∇ T (2) Then the parameterizations and constitutive laws that are needed to estimate the transfer properties embedded in the three main equations above may be found below (Eq. (  3 ) to (  14 )). The different variables appearing in the equations are listed and briefly described in Table  1. -Generalized Darcy's law: V (h, T ) = -K H (h, T ) ∇ (h + z) (3) Table  1  Variables and parameters of the system of equations solved by permaFoam (in the source code the used units are the SI base units).
[39]. Given the strong non linearities and couplings encountered, few references analytical solutions exist for the considered set of equations, and only for very simplified problems. Thus to perform code-to-code intercomparison exercises is a commonly accepted method for validating numerical simulators for cryohydrogeology, and so has been done for the validation of permaFoam implementation for the simulation of coupled heat transfer and water flow with freeze/thaw in saturated porous media  [13]. Considering water flow in variably saturated porous media, permaFoam inherits of the validation that has been done for RichardsFoam  [39]  since it has the same numerics for Richards equation resolution.
New features embedded in this release of permaFoam This permaFoam package encompasses the new features that have been introduced in RichardsFoam3  [42]  along with other specific developments: (i) better handling of memory use during computation; (ii) possibility of on-the-fly modification of the control parameters of the linearization procedure; (iii) new boundary conditions to be compiled along with the solver itself, and dedicated to the simulation of rain infiltration (rainFallFlux) or no infiltration (noRainFlux) conditions while allowing exfiltration with OpenFOAM ® stand-alone (i. e. without mandatory use of swak4foam as it was the case in RichardsFoam2 -Orgogozo  [40]  -see section 3. 3); (iv) computation of the field of piezometric head along simulation. NB: in the demonstration cases, a way to implement a constant piezometric head boundary conditions with OpenFOAM ® is proposed.
5a ). The hydrological variables monitored are river levels, volumetric water contents at various depths two distances from the river (VWC1 at High and Low locations, displaying VWC at 10, 40 and 70 cm depths). Field studies, generally carried out in September, provide access to topography, soil properties, vegetation cover, supra-permafrost water levels and active layer depths across the valley. Thermal and hydrological parameters are measured from pits. More in Grenier et al. in prep. The numerical simulation presented here is a preliminary run aiming at providing a basic representation of coupled TH processes and identify data or process gaps. After a spin-up, a converged mean year representing conditions encountered from 2012 to 2019 is obtained. The full set of coupled TH equations including vegetation transpiration and evaporation is solved (Eq.
Acknowledgements The authors acknowledge the help of  ESI Group -OpenCFD Ltd , and especially of  Mark Olesen , for the set up of this version of permaFoam. This work has been funded by the  French Research Agency ANR  (grant n •  ANR-19 CE46-0003-01 ), and benefited from access to the supercomputers of  CALMIP  (project  p12166 ) and  GENCI  (project  A0060110794 , CINES and TGCC).
In addition, thanks to this hybridization, the proposed approach allows us to distinguish a malfunction process anomalies from the real intrusions and classify these latter into temporal or sequential categories. Moreover, the approach targets an industrial level: Manufacturing Executive System (MES) that no research work has targeted before. Furthermore, this paper fills a gap in the industrial datasets by proposing another one with more features, which is also publicly available. This dataset has been captured and built to implement this approach. A paper has been published to give more details regarding this industrial dataset. This paper is organized as follows. Section 2 presents the related works. In Section 3, the first module of the global approach is presented with its principles, its basis, and its results.
The authors simulated four attack kinds (Probe, R2L, U2R and Denial of Service (DOS)) and captured real traffic. They evaluated their approach by measuring the detection delay, false positives, and detection rate. Their performances seem good. Another innovative approach is detailed in  [14]. In this research work, the authors propose an innovative signature-based IDS, which combines a conventional detection method using known attack signatures and the system state checking methods. After analyzing the packets in the known signatures database, the IDS keeps in its memory a system state (a numerical representation of the system). Therefore, an alert is raised when the system reaches a critical state. For their implementation, the authors put in place a set of signatures for the Distributed Network Protocol (DNP3) and Modbus protocols, and device states.
Finally, they use a last detector based on a heuristic approach to detect any first time observed changes in servers or services. This last detector keeps a log of the whole components state to avoid duplicated alerts. The authors mention that the proposed approach is effective to monitor SCADA networks and detect attacks. In  [24] , the authors present a PeriodAnalyser tool which uses an automated NIDS approach. This tool is based on message repetition and temporal information to define periodic cycles in the network traffic. Their approach is composed of three modules: multiplexer module, which analyzes the application headers to filter the Modbus/TCP, MMS packets and multiplexes them into different flows. Two kinds of flow are identified at this stage which are long-lived and short-lived connections.
The second module is tokenizer, which transforms the filtered flows into a standard format independent of the protocol. And finally, a learner module is in charge of identifying all the cycles in the previously pre-processed flows. The authors use three traces of a real environment to evaluate the approach, which shows a good modeling accuracy. In  [25] , the authors propose a new IDS approach to protect a SCADA system. They use a One-Class Support Vector Machine (OCSVM) classifier, which uses offline network traffic for its training step. The architecture is hierarchical since all IDS refer to a Security Information and Event Management (SIEM) database. Alerts are sent to the latter using the Intrusion Detection Message Exchange Format (IDMEF) standard. Their IDS is composed of four steps: training, classification, anomaly detection and sending of the IDMEF messages containing the incident source, their time and the alert classification.
Industrial IDS for IoT equipment Other researchers have focused on intrusion detection in Internet Of Things (IoTs), which are an integral part of Industry 4. 0. In  [30] , the authors propose an approach called Intrusion Detection and Prevention Mechanism (IDPM). The IDMP consists of two layers, the first of which is based on learning the normal behavior of the system using a Random Neural Network (RNN), which takes diverse datasets and covers both valid and invalid cases as input parameters. The trained RNN model is then embedded in the base station of the IoT system to detect any anomalous behavior and to prevent its propagation. The second one is designed to detect a wide range of Illegal Memory Accesses (IMA) bugs and data integrity attacks. The proposed solution's also acts as a health monitoring system for the IoT sensor nodes by analyzing data transmitted to the base station.
As in the case of any malfunction, the valid sensor node may either stop its operation and/or transmit invalid data to the base station. The RNN model has been trained to detect such cases as an intrusion and report them to the main server. The proposed solution effectiveness and performance overhead are measured for an existing IoT system consisting of sensor nodes transmitting data to a base station. Through an experimental setup, it is shown that without a proper security mechanism, it is possible to hack into the application running on the base station. Furthermore, it is also demonstrated that the base station successfully detected the presence of the malicious sensor node when the given IoT device is enabled with the proposed IDPM. In  [31] , the IDS principle approach is designed to find any anomaly in the network by monitoring the characteristics of the neighboring nodes at one hop.
BR also has a list of malicious nodes for all 6BR sub-nets. 6LoWPAN Border Router (6BR) which maintains three dynamic lists: the first list contains 6BR (6BRAN) area nodes. 6BRAN is developed and updated by the BR and transferred to 6BR in a secure channel. The second contains MObile Nodes (MON) and the third list contains MAlicious Nodes (MAN). The 6BR is responsible for setting the maximum delay response field in the Destination-Oriented Directed Acyclic Graph (DODAG) Information Object (DIO) message and the last actor is Monitoring Nodes (MN) which maintains a suspicious node list. T-IDS consists of three modules: IdentityMod, MobilityMod and IDSMod. For the IdentityMod module, after deploying the nodes, and before starting the construction of the Routing Protocol for Low-Power (RPL) topology, the BR uses IdentityMod to configure the 6BRAN list of each 6BR in the network.
This list will be used to control access and authenticate nodes. The MobilityMod module manages hierarchically the mobility with the collaboration of BR, 6BR and nodes in the network. MobilityMod is used by different actors to maintain the network state regarding mobile nodes. In fact, 6BRAN contains the mobility status of each node. Intrusion Detection Module (IDSMod) detects attacks whenever the IDSMod asks the IdentityMod and the MobilityMod to check if the node belongs to the network and if it is a mobile node. Therefore, with minimal knowledge and collaborative observation, the nodes can detect the nodes behaving in a suspicious way based on certain RPL rules. Even if the authors show how T-IDS can deal with a Sybil attack, the resources appear to be costly. In  [33] , the authors have chosen the anomaly-based detection as a method of intrusion detection in wireless sensor networks.
To test and compare detection rates, a Multi-Layer Perceptron Back propagation Neural Network (BPN) was chosen from the architectures and was compared to a Support Vector Machine (SVM) classifier. In their approach, the authors use NSL-KD-DTrain+_20Percent as a dataset. Before starting the training step, the authors have processed and normalized the data in order to convert the raw input data into an appropriate format. The machine learning the algorithms can then use this information for subsequent analysis. The authors then trained the model with the chosen dataset. Finally, they employed the SVM for the classification and the detection phase. In this work, the authors have focused on DOS (Smurf, Neptune, Back, Teardrop, Pod, Land) attacks. Their results show a very good level of performance using the neural network method for the majority of attack types, but the results are not significant with attacks with few samples such as the ''Pod'' and ''Land'' attacks.
Non-industrial IDS Other research works have been published recently on intrusion detection fields, which are not targeting industrial systems. Among them,  [35]  where the authors propose a feature optimization and selection method to improve intrusion detection for Fog Computing (FC) and Edge Computing (EC) called Machine Learning-Enabled Intrusion Detection System (ESOML-IDS). For their experimentation, they use the UNSW-NB15 dataset which contains only 42 features (including 3 categorical and 39 numeric features). The authors compare the results of the ESOML-IDS method with other machine learning algorithms. This comparison shows that the method is much better. However, by analyzing the performance metrics (Accuracy, Precision, Recall, F1-Score), these results do not exceed 84%. In order for this method to be more efficient, it would be better to have a dataset with more features (more than 42 features), so that the selection is efficient and makes sense.
In  [36] , authors present a study to train the neural network using meta-heuristic approaches and to enhance the perceptron neural network precision. They have used Invasive Weed Optimization (IWO) and Neural Network (NN). Their method aims to reduce the error and improve the prediction. For their experimentation, they have used three datasets: UCI Heart disease data (with only 13 features), Iris dataset (with only four features) and the Wisconsin Diagnostic Breast Cancer (WDBC with 31 features). Their results show a reduction of error while increasing the NN layers number which is a good improvement for neural network models. However, they do not show any results regarding the prediction. Furthermore, it would have been wiser, if they had calculated precision, recall, F1-score and the confusion matrix to see the rate of false positives and false negatives.
In  [37] , the authors propose an approach to detect Android malware using Support Vector Machine (SVM) classifier and Harris Hawks Optimization (HHO) algorithm. This latter is responsible for the optimization of SVM hyperparameters and features weighting while SVM performs and evaluates the classification. The authors have also proposed an approach to recognize the most relevant feature for the best malware detection. Their approach was tested and evaluated on five datasets from CIMalAnal2017 sampled datasets. The results are promising regarding the precision and accuracy rates. However, the approach suffers from time consumption and computational complexity. Furthermore, this work only focuses on one kind of attackmalware-and gives no indication of distinguishes a real malware attack from a simple bug in Android.
Another work  [38] , where the authors propose a new method of detection for intelligent systems called Fusion of Deep Learning based CyberAttack Detection and classification model for Intelligent Systems (FDL-CADIS) combines deep learning techniques and classification models. The proposed FDL-CADIS technique transforms the Malware binary files into two-dimensional images and employs them into a new model called MobileNetv2. The authors have used for their hyper parameter tuning process, the Black Widow Optimization (BWO) technique. The proposed method has been tested on 3 datasets and their results seem promising. Nevertheless, criticisms of this method include the fact that it only detects malware and that there is no information regarding the used features to check their relevance.
Intelligent behavioral based IDS: Assumptions The approach of this IDS is valid whilst respecting several assumptions presented below: • This IDS uses network traffic. Therefore, the industrial platform has to be connected to the network. • This IDS uses the neural network algorithm which requires a huge amount of data for its training step to obtain good classification results. Therefore a large dataset is used in this work. • Most attacks go through the network layer of the Open Systems Interconnection (OSI) model.
Industrial dataset (1) Generation process: To measure the IDS efficiency of the industry 4. 0, a real industrial dataset is required. This 4th generation is characterized by the diversity of attacks: Information Technology (IT) attacks, Operation Technology (OT) attacks, and the side attacks that range from IT to OT equipment. To perform this study, a real industrial dataset was constructed and is available with this link: Industrial dataset To construct the proposed dataset, several steps have been performed and detailed in Fig. 1. To construct the dataset, seven attacks are simulated to obtain the malicious traffic: (1) Implemented IT attacks: • DoS/DDoS: A DDoS attack aims to make a server, service or infrastructure unavailable. The attack can take different forms: saturation of the server's bandwidth to make it unreachable or exhaustion of the machine's system resources, thus preventing it from responding to legitimate traffic.
To perform these attacks, the following were sent; a TCP SYN flood, TCP ACK (Acknowledgment) flood, TCP RST (Reset) flood or Xmax flood by setting all TCP flags (CWR, ECN, URG, ACK, PSH, RST, SYN, FIN). UDP flood packets were also simulated. The script implementing these attacks uses hping3. If hping3 is not found, it attempts to use the nmap-nping tool instead. • File Transfer Protocol (FTP) brute force: Brute force attack is a method used in crypt-analysis to find a password or key. As soon as the attacker obtains the FTP server login and the password, he can retrieve MES database information (configuration file, users, password. ) and use this information to alter the database containing all the information regarding the production. This attack consists of testing, one by one, all the possible combinations.
For it to be performed, the dictionary method is used to crack the FTP server connection. First step is to obtain the login and the password of the FTP server by using either a hydra or Metasploit tool then a connection to the server to retrieve some files and delete others related to the MES database. • Web Hypertext Transfer Protocol (HTTP) DoS: The principle of this attack is to paralyze the Apache server which uses HTTP protocol to make it unavailable by sending a large number of requests. In this attack, a script written in Python called SLOWHTTPtest is used to perform an application layer Denial of Service attacks (DoS). Its principle relies on the fact that requests are not processed before being completely received by the server. If the data is not complete or the speed of the sending packets is too low, the resource is kept busy until it receives all of the data.
In this attack, Apache is targeted by causing very significant memory and CPU usage on it. • Botnet: A botnet is a network of computers infected with malware so that they can be controlled remotely, forcing them to send spam, spread viruses or launch DDoS attacks without the knowledge or approval of the real owner of the computer. In addition, an attacker can paralyze the entire production system by launching a DDoS with a botnet which can be financially very consequential for a factory. The Ares tool, which is a written remote administration tool RAT in Python, is used to perform this attack. (2) Implemented OT attacks: • SQL attack: This attack is a lateral attack which goes from IT to OT equipment. It is composed of two steps. The first one is a SQL brute force to retrieve the MES database's login and password.
The principle is the same as for the FTP brute force but uses the mssql_login module of Metasploit. Then, the second step consists of dropping or altering data by taking control of the machine hosting the MES database. • PLC disturbing process: Two attacks are launched to disturb the PLC process. Their principle consists of disrupting the production line functioning by modifying either the recipe scheduled (production order) by the operator, or by provoking a remote emergency stop. After studying and analyzing the registers' configuration of the platform PLC, we decide to modify the registers responsible for the worst and the most widespread scenarios in industrial attacks, namely the complete shutdown of the production line and the modification of the production line recipe. In our case, register 2 of M580 PLC is responsible for remotely stopping the conveyor, and register 120 of M340 PLC is in charge of seamlessly modifying the number of balls.
Therefore, the vials are filled, capped and removed to destocking without the operator noticing the modification of his planned PO. To perform this, we correctly connected to the PLC line and modified the Modbus registers. For this attack, the Metasploit attack tool and its Modbus client module was used. • MITM: This is an attack whose principle consists of intercepting communications between two machines, hosts, servers. , without either of them suspecting that the communication channel between them has been compromised. For this attack, we entered into the middle, between the PLC and the server using the Ettercap tool, then the content of the registers was modified to disturb the production line's nominal functioning. This attack triggers either a remote emergency stop or a modification in the operation recipe.
After simulating these attacks, both normal and malicious traffic are captured to get network files (PCAP files). From these files, raw data is extracted and pre-processed to obtain the final dataset used in the proposed behavioral-based IDS. This dataset is divided into training and testing datasets. It is a labeled dataset with nine labels built in a real industrial platform at Brest university and available for the researchers community. More details regarding this dataset are given in Table  1. (2) Extraction process: To build the dataset, an extractor is developed in Python to extract features from the pcap files. The extractor gives a csv file as the output containing 133 transport and application layer features. The application layer features are related to the Modbus/TCP protocol. Some of these features are directly extracted from the TCP or Modbus headers such as IP addresses, ports numbers, protocols.