dataesr/scientific-paragraphs-categorization huggingface dataset:
Viral gene expression analysis HPV contigs extracted from patient tumor RNA-Seq were aligned to HPV reference genes for genotypes HPV16 and HPV18 from RefSeq (builds NC_001526. 4, NC_001357. 1), as part of the ViralMine pipeline ( https://github. com/LosicLab/ViralMine ). These genotypes were used for gene expression quantification for all HPV clade a7 and a9 infected tumors, as validated HPV reference gene sequences for rarer genotypes were not readily available. Read counts for each viral gene were assigned using the read support for aligned viral contig. HPV genes with no patient contig alignment were considered not expressed and given read counts of 0. HPV gene expression was RPKM normalized using patient tumor RNA-Seq library size.
In other words, this proposition cannot detect all ransomware and cannot be used alone in a ransomware detector. Indeed, many ransomware families do not add the ransom files in every target directory, some families encode the content of their ransom files and others add only one ransom file at the end of their infection (e. g. , Spora ransomware  [4] ). For these reasons, we suggest that using the ransom files must be monitored with a corpus of ransomware behaviors. In summary, this paper presents the following contributions:.
• We make the first and probably unique available collection of ransom files. This collection contains more than 170 ransom files of 62 different ransomware families. This collection is shared in GitHub (https://github. com/lemmou/RansomNoteFiles, accessed on 15 September 2021) for evaluation and study by the research community. It can also be used in the area of criminology and profiling ransomware developers. These ransom files were collected manually from different sources: -From Malware Traffic Analysis Project (https://www. malware-traffic-analysis. net/, accessed on 15 September 2021); -From Hybrid-Analysis, looking for the ransom note filenames (https://hybridanalysis. com/, accessed on 15 September 2021); -By running some ransomware samples in our virtual machines; -From The Week in Ransomware of BleepingComputer (https://www.
Ransom Note Files and Related Works The ransom files are a unique way for the victims to take the first steps to restore their encrypted files. The ransom notes provide information to the victims such as the payment information, fee, deadline, free files decryption, and various instructions to pay the ransom, then recover the encrypted files. The collected dataset of the ransom files includes the ransom notes of different known families like Locky, Cerber, and TeslaCrypt. Table  A1  in the Appendix A shows the collected ransom files. The graph in Figure  1  shows the number of families for each extension of the ransom files. The most used extension is txt followed by htm and html (htm(l)). More than 30 families use txt or htm(l) files as a ransom note. Other ransomware like Blind, Mr. Dec and NemucodAES ransomware use hta files.
[9]  that extracted the ransomware behaviors of more than 20 ransomware families. In addition, in their paper they discussed some behaviors that were automatically searched by analyzing more than 200 different ransomware collected during 2019. On ransomware detection, different approaches have been proposed. For example, monitoring abnormal file system activities to detect ransomware was proposed by Kharraz et al. [10]  in 2015. Their work was the first attempt to detect the ransomware and their analysis of several ransomware families allowed them one year later to propose a monitoring tool called UNVEIL which detects Crypto-ransomware. ShieldFS  [11]  is a ransomware detection tool based on the difference between file system I/O requests of ransomware and benign software. DaD  [12]  is a tool to detect ransomware based on monitoring file system activities of all userland threads.
Email Addresses Several ransomware families notify their victims to use the cited email addresses in the ransom files to receive more instructions about the decryption of the files. Generally, the ransomware developers do not use a single address for all their ransomware versions. The email address can be used to identify the current or the previous versions of the ransomware family and cannot generally identify or predict the next versions of the same family. The collected dataset of ransom files, contains 43 ransomware families that used the email addresses. Table  1  shows the used addresses by some families. Dharma family used 14 email addresses for 10 versions and these email addresses were the single way to communicate with the developers of Dharma. Table  1. Email Addresses used by some Ransomware Families.
Bitcoin Addresses The second method to identify the ransom files is using Bitcoin addresses. Cryp-toLocker was the first ransomware that asked for payment using Bitcoin (Emerging Technology: True scale of Bitcoin ransomware extortion revealed, https://www. technologyreview. com/s/610803/true-scale-of-bitcoin-ransomware-extortion-revealed/, accessed on 15 September 2021). Before CryptoLocker, the earlier ransomware used other payment methods like pre-paid money vouchers, premium SMS, GoldMoney or buying from a site. The ransomware developers add their Bitcoin addresses in the ransom files to receive the Bitcoin payments from the victims. This address is a base58 encoded identifier of 26 to 35 alphanumeric characters starting with 1 or 3  [22]. Our dataset contains ransomware that uses the Bitcoin addresses to receive the payment.
Bitmessage Address Another method used by ransomware developers to communicate with their victims is Bitmessage (Bitmessage:A PeertoPeer Message Authentication and Delivery System, https: //bitmessage. org/bitmessage. pdf, accessed on 15 September 2021). It is a peer-to-peer and decentralized communication protocol used by users to communicate anonymously with other users. This method is used only by few ransomware. This address of 32 to 34 characters is a Base58 encoded public key hash that starts with the term BM-. Scarab ransomware family is one of the seven families in our dataset that used this method to communicate with the victims. It used the same address in the version seen in November 2017 and the version seen in October 2018. Table  3  shows three families of the seven families that used the Bitmessage addresses in their ransom files.
However, in some cases, they can be used to identify the ransom files of the next versions. Table  4  shows some ransomware families that used the same onion address in several versions. Ransomware Tracker is an online service that tracks the IP addresses, domain names, and URLs including C&C servers, botnet and payment sites that are linked to a specified ransomware. We used the Python API of Ransomware Tracker available in GitHub (PaulWeb-Sec: Python API for Ransomware Tracker. https://github. com/PaulSec/ransomwaretracker, accessed on 15 September 2021) to track the extracted URLs from the collected ransom files. We were able to track only the used URLs in the ransom files of two versions of Locky ransomware (Odin and Zepto). The ransom note identifier can use this service to identify the extracted and unidentified URLs from the ransom files, then track these addresses to associate them with a specified ransomware.
• The identifier must be aware of the encoded ransomware names. We suggest storing the previously encoded names by the ransomware in the ransom note identifier database; • Take the most cited ransomware names in the ransom file or the first cited name in the case of equality between many cited ransomware names in the content; • The identifier can search for the used extensions of the encrypted files in the content. Indeed, some ransomware adds these extensions to the content of their ransom files. For example, Blind ransomware added the extension NAPOLEON and BTCWare ransomware added the extension Gryphon. Using the previous items, we tried to identify some ransom files using only the cited ransomware names in the content. We were able to identify correctly 29 families from 31 families that added their names in their ransom files with two false predictions:.
• The version of TeslaCrypt that was seen in July 2015. Our script identified this version as a ransom file of CryptoWall ransomware. The reason for this false prediction is that the ransom file of this version is an exact copy of the ransom file of CryptoWall 3. 0 ransomware; • An unknown version of CrypMic. Our script identified this version as a ransom file of Alpha ransomware. This is due to the injected terms alpha in the content. ID-Ransomware does not identify the ransom file of TeslaCrypt. It also cannot identify the ransom file of CrypMic correctly. Moreover, ID-Ransomware fails to identify correctly the ransom files of 29 families that add the name of the ransomware in the content. For these reasons, we suggest that the ID-Ransomware service adapts its process to identify the ransom files by searching for the ransomware names in the content to improve its efficiency in identifying the ransom files.
As described in Section 4. 2, the filenames of the ransom files cannot classify the ransomware effectively into families because multiple ransomware families change the filenames of their ransom notes in each version. Despite this weakness, we think that the ransom note identifier can check the similarity of a given ransom note filename and the other ransom filenames in its database as a secondary indicator to identify the ransom files. Moreover, another method to identify the ransom files is using their content. Indeed, many ransomwares keep all or the same parts of the content of their ransom files for several versions.
Until now, ID-Ransomware does not use the content of the ransom file to identify the ransom files. The responsible of this service mentioned in a private conversation with us that using the content to identify the ransom files is a future work for the owners of this service. Thus, we suggest using Latent Semantic Analysis (LSA) as a solution to check similarities between the content of the ransom files and the mentioned markers above to increase the effectiveness of this service. We developed some Python scripts to evaluate our ideas to identify the ransom files in our dataset of 71 ransomware families. We get the following results:.
ID-Ransomware was able to identify more ransom files using the ransomware tracker. We think that our script to identify the ransom files using the ransomware tracker must be improved to identify the ransom files; • Using only LSA on the content of the ransom files (with 0. 99995 as a threshold of similarity between the ransom files), only 13 ransom files (7% of 182 ransom files) were not correctly identified. Table  5  shows these false positives. LSA matched the ransom files of different versions of the same ransomware family. For example, the txt ransom file of the version seen during May 2016 of Cerber has high similarity with the ransom file of the version seen during August 2016. The hta ransom file of the abido version of Dharma has high similarity with all the hta ransom files of the other versions.
Moreover, we tested LSA on the content of the ransom files of some new versions have been seen during 2021 of Dharma and GlobImposter. We found high similarity between the content of these ransom files and the content of their old ransom files. ID-Ransomware searches for many markers to identify the ransom files without searching for correlations between the used phrases in the content or analyzing the content entirely. We tested the 182 ransom files in ID-Ransomware. It failed to identify or correctly identify 24 ransom files. The combination of our scripts (without checking the filenames of the ransom files) was able to identify 181 ransom files, including the unidentified ransom files by ID-Ransomware. Only one ransom file could not be identified using our scripts. It is the txt ransom file of Kee ransomware.
This ransom file does not have high LSA similarity on the content (similarity ≥ 0. 99995) with the other ransom files. Related to these results, we suggest that the ransom files identifier must combine and check all the discussed markers in this section to identify the ransom files, including the content and filenames of the ransom files. Indeed, the Kee ransomware can be identified by checking the filename of its ransom file (Hello There! Fellow @kee use!. txt) that contains its name. For these reasons, we propose that ID-Ransomware or any new ransom note identifier service analyses also the filenames and the content of the ransom files using for example LSA and following this scenario: 1. The ransom note file identifier starts searching, then checking the Bitcoin addresses in the content to associate them with the ransomware that used these addresses using the saved Bitcoin addresses in its database or using any external service.
Ransom Names Pre-analysis The focus of this part is to create some statistics on the used terms in the filenames before the semantic analysis in the following parts of this section. The filenames of the ransom notes in our dataset were tokenized to involve the unit of a filename to analyze. Each unit of the filename (named word or term) was standardized, cleaned, removed stop words from the units, then stemmed or lemmatized. These steps are often used in text preparing and pre-processing that precede text analysis of a documents corpus:. After these modifications, we used each word in the filename as a unit in our analysis; 2. Standardization and Cleaning: the words were converted to lowercase. We do not want Read me, READ ME, and READ Me to be considered as separate terms. The non-alphanumeric characters were stripped, concatenated terms in the filenames were split (readme to read me).
To split the terms, we used probabilistic splitter words (Wordninja: https://github. com/keredson/wordninja, accessed on 15 September 2021). We also tested another splitter (A compound word splitter for Python: https: //github. com/TimKam/compound-word-splitter, accessed on 15 September 2021) named Compound Word Splitter. In our case, we found that the first splitter split the terms more correctly than the second splitter did. We did not use the stop words removal because these words are mostly used in the filenames. Finally, the obtained terms were stemmed using Snowball stemmer. The results of LSA are related to the number k of dimensions (also named singular values or latent factors). Choosing few singular values can lose valuable information. On the contrary, choosing many latent factors may not be meaningful.
LSA Applied on Files of an Uninfected Machine We took 3000 filenames of several files from an uninfected machine running Windows 7. We added to this list the filenames of the ransom notes of our dataset. A pre-analysis process like the previous subsection was applied to all these filenames. Then we applied LSA using a splitter and without splitter on this corpus of filenames to extract any similarity between the benign filenames and ransom filenames. The percentage of variance explained by retaining k factors in both cases did not display a clear elbow to find an optimal k. For these reasons, we calculated the similarities between the words defined as ransom filenames and the words defined as benign filenames. Then we took for different singular values the number of queries that corresponded to some cases of similarities.
• All ransom files !-GET_MY_FILES-!. txt and @_RESTORE-FILES_@. txt were detected. However, the txt files of #RECOVERY-PC#. txt were not detected because their filenames contain the word PC, which did not exist in any ransom filename of our dataset and the chosen threshold of similarity (>0. 8) was not sufficient to detect this filename without false positives. Generally, we can detect this ransom file by adjusting the used stemmer to include recovery and recover in the some word recov. Therefore, the stemming method on the filenames has some effects on the results: using one word, we can detect other related words. Table  10  shows the false positive filenames in both states: infected machine state and uninfected state (FP means that the file was detected as a false positive ransom file. TN means that the file is a true negative file).
Machines Learning on Ransom Names In this section, we describe how we used Machine Learning models to classify filenames as ransom filenames or benign filenames. The same pre-analysis presented above was used. The evaluated filenames were separated into two groups based on the chosen split rule: training set and testing set. A popular split  [23]  is to put 70% of the filenames in the training set and the rest in the testing set. The distribution of the filenames in our dataset was imbalanced, more benign filenames than ransom filenames. To solve this problem, we used Synthetic Minority Over-sampling Technique (SMOTE)  [25]  and Neighborhood Cleaning Rule (NCR)  [26]. The first generated minor examples to be added to the original set. The second performs under-sampling based on the condensed nearest neighbor (k = 1 default case) method.
The chosen learning models in this test were: Logistic Regression, Decision Tree, K-Nearest Neighbor, Naive Bayes, Random Forests and Support Vector Machine. The classification method was applied to the Tf-Idf weighted NTM (Filenames-Term Matrix) of the training set. Once the classifier was created, it was applied to the Tf-Idf weighted NTM of the testing set. Among several ways to evaluate which model to choose, we have the accuracy of the models. Table  11  presents the overall accuracy in descending order (with F-measure) in the case without a splitter. We conclude that the Random Forests model is an optimal choice to detect the ransom filenames in our dataset due to its best accuracy value. Random forests (RF) are a part of the tree based model family. These models try to build a combination of tree predictors with different initial variables.
Precision, recall and F-measure are described in Table  12  in the case without splitter. The overall accuracy of this model is 98. 32%, and the overall F-measure is 0. 920. The model misclassifies 13 filenames: nine ransom filenames are classified as benign filenames and four benign filenames are classified ransom filenames. In summary, the detection of the ransom files using LSA or Machine Learning models on the filenames is possible. However, it must be combined with other indicators to detect the ransomware. ID-Ransomware service uses the saved filenames in its database without any check of similarity of the filenames to identify the associated ransomware to a given ransom file. However, checking the similarity of the ransom filenames can be used (with other patterns in the ransom files) to identify the ransomware associated to a given ransom file.
Using the same pre-analysis of Section 4. 2. 1, we found three optimal values for k, which are 6, 10 and 11. Table  16  shows the number of similar ransom files to benign files for each k. As shown in Table  16 , we can differentiate between the benign files and ransom files. Indeed, the number of similar ransom files to benign files is null for k = 6 from a threshold s ≥ 0. 99 and k ∈ {10, 11} from s ≥ 0. 95. Effectively, the content of the ransom files cannot evade from their objective and their context. To prove our idea, we collected three spread ransomware during 2020 and 2021. Then we tried to check their similarities with the benign files and ransom files of the same dataset. The collected ransomware were:.
• CryptoMix that adds a ransom note file named _HELP_INSTRUCTION. txt at the beginning of infection (before encryption) in the root directory; • French101 adds the ransom file HOW TO RECOVER ENCRYPTED FILES. txt in any target directory containing target files before encrypting its content; • StopDjvu ransomware adds _readme. txt in the Desktop of the current user before encrypting its content. The three ransomwares add their ransom files before encryption. We compared the similarities of the ransom files of these ransomware with our dataset of benign files and ransom files. Table  17  shows for k = 10 and s ≥ 0. 95 the files that are similar to these ransom files. These ransom files of these ransomwares are similar only to the other ransom files. No similarities to benign files were seen. We explored other ransomware seen in 2020 and 2021 that add their ransom files before encryption like ChaCha, JSWorm, GlobImposter, StopDjvu and Buran ransomware.
cybereason. com/solutions/ransomwareprotection, accessed on 15 September 2021). Most of these tools detected these ransomware after encrypting some files in the target directories and after they created the ransom files. Only the updated version of Kaspersky Anti-Ransomware detected these ransomware. This tool uses the signature scans with a behavioral analysis to detect the ransomware. In this section, the LSA tests on the content of the ransom files is detailed. Applying this method must be preceded by a pre-analysis on the content to filter it and keep only the significant terms. The results of applying LSA on the content are promising. Indeed, the identification of the ransom files using LSA as the last method to identify the ransom files can give more interesting results using a large database of ransom files.
Conclusions Through LSA and the extracted markers from the ransom files, we present our approaches to identify the ransom files and associate them with their ransomware. The results are promising and can be very promising by assembling all markers by checking the similarities of the filenames and the content of the ransom files in a real ransom note identifier with a large database of ransom files. On the other hand, we found that the used terms in the filenames of the ransom files are limited to a few terms, which make their detection possible compared to the filenames of benign files on a target machine. However, using LSA or Machine Learning models such as Random Forest to differentiate between the filenames of benign files and ransom files shows interesting and encouraging results. Our idea to detect ransomware is based on using the ransom files.
Although variants of DCM such as spectral DCM  10  and regression DCM  11  are shown to scale to whole-brain network models, of up to 66 regions, inference using DCM for a whole-brain model is not yet demonstrated in the context of epilepsy. Recently, efficient and robust inversion of seizure propagation on whole-brain scale was achieved by simplifying the seizure dynamics using a threshold model  12  ; however, this approach considerably restricts the range of model dynamics. In this study, we demonstrate inversion of a phenomenological model of epileptic seizure dynamics at the whole-brain level, containing 164 regions, with the objective of identifying the EZ. Taking advantage of recent advances in probabilistic programming languages (PPLs) for Bayesian inference, such as Stan  13  , we demonstrate that it is possible to invert the coupled Epileptor model that best explain each patient's intracranial recordings.
The problem of model inversion is framed as an optimization problem by defining an objective function over Epileptor parameter space such that the maxima of this function correspond to the parameters that best explain the SEEG data. Specifically, a joint probability density is defined over the Epileptor parameters and observed log power of intracranial recordings by embedding Epileptor equations as priors on brain source dynamics. Next, using maximum a posteriori (MAP) techniques, Epileptor parameters are optimized to best fit intracranial data. In order to test the validity of this approach, first the accuracy of model predictions is tested against the synthetic data generated using The Virtual Brain (TVB)  14. By fitting the synthetic data, we show that the optimized model can accurately identify the spatio-temporal seizure propagation patterns.