dataesr/scientific-paragraphs-categorization huggingface dataset:
However, these methods must also regularly keep their databases up to date by adding malware variants with minor changes. Furthermore, the signatures are manually analyzed and extracted, which takes time and skill, while creating signatures for multiple threats may generate false negatives. The significant increase in malware variants necessitates the automated generation of malware signatures. It will assist in reducing the number of misleading malware detection alerts. Offline analysis approaches are required to comprehend the fundamentals of malware operation. (b) Smart devices resource constraints: Battery-powered smartphones are constrained due to the processing speed, memory, battery power, or limited storage capabilities. Hence, anti-malware techniques suitable for computing devices are unsuitable for devices with limited battery; thus, there is a need to identify cloud-based analysis and detection techniques  [63, 64].
Repackaging an Application Malware authors injected the malicious code/snippet into the disassembled app download from popular app stores. It was reassembled and repackaged with a jar-signer to distribute the app in a lesser monitored store. Pokemon Go  [75]  Drive by Download Malware developers injected malicious code onto the smartphone using adversarial URL generation, social engineering, and adverts enticing users to disclose confidential information. Android/Not Compatible  [21]  Dynamic Payload Embedded malicious code into an application. For example, using a file or APK to hide the malicious payload. By distributing a bogus vital update to an existing app, the virus is launched when the unknowing user clicks "Yes," thus compromising the smartphone. BaseBridge  [38] , Anserverbot  [76] , DroidKungFuUpdate  [77]  Stealth Malware Techniques Malware developers employed stealth techniques, such as dynamic code loading, obfuscation, reflection, and native code execution, to avoid detection by anti-malware tools.
(a) Repacking (RPK): A popular downloadable app from the official or third-party market. Then, it is disassembled using reverse engineering tools, apktool. The malicious code or payload is subsequently inserted into the benign app and reassembled. Finally, malware developers use custom keys with jarsigner and release them at local app stores. The malicious code is encrypted in a '. dex' file. The Malgenome dataset contains more than 80% of repackaged malware variants of apps available at legitimate third-party stores  [89] [90] [91]. Glanz et al. [92]  reported 15% repacked apps. Repacking enables unseen samples, causing the anti-malware to fail to detect them  [21, 37, 93]. Pokemon Go  [75]  and Anserverbot  [76]  samples are known repackaged malware. (b) Identifier renaming (IDR): Dalvik bytecode binds the identifiers such as classes, methods, and fields.
(a) Native exploits (NEX): App archives combine Java source code, native libraries, manifest declarations, and resources. The native code uses C or C++ for performance improvement and portability. Adversaries misuse the native code to hide malicious behavior. Moreover, they encrypt native code and hide them in non-standardized places. Therefore, the detection system designed for non-native applications may not work for native applications. A packer can convert identified functions into native methods of a '. dex' file, which can be loaded using the JNI (Java native interface) methods dvmLoadNativeCode()  [14]. Android allows users to directly execute native code and machine code on a smartphone processor. The JNI, a predefined interface for communicating between native and Java code, is the most widely used method to invoke native code on the Android platform.
On the other hand, dynamic and hybrid studies need to evaluate the assessment of its framework over FIO evasion sufficiently. (c) REF evasion detection: Various frameworks based on static analysis, such as DroidAPIMiner  [61] , DexHunter  [70] ,  SherLockDroid [174] ,  Kuhnel [175] , DroidRA  [65] , and AAMO  [34] , evaluate the performance against REF evasion detection. Similarly,  Maier et al. [178]  employed dynamic analysis techniques, while RiskRanker [149], and StaDynA  [69] , used hybrid analysis techniques to investigate REF evasion detection methods. (d) DCL evasion detection: DroidAPIMiner  [61] , Poeplau  [14] , Dexhunter  [70] ,  Maier et al. [178] , RiskRanker  [149] , and StaDynA  [69]  are among the malware identification platforms for Android OS. Other approaches, such as AndroSimilar  [169] , analyze their method inadequately for reflection handling and runtime code loading approaches.
Conclusions Android malware has become more substantial and complex due to global evasion techniques, evolving into a prominent incentive. This research exposes critical flaws in Android malware detection systems, particularly when malware employs various evasion approaches. As a result, this research looked at 88 Android malware identification frameworks and 18 assessment articles to see how successful the escape detection tactics are in Android malware identification frameworks. As a result, the study proposed a taxonomy to categorize the evasion methods into metamorphism and polymorphism. The polymorphism group includes package transformation and encryption branches, and the metamorphism group consists of three categories: anti-emulation, superior transformation, and code obfuscation. This research also highlighted the absence of studies comparing malware identification against many prominent evasion approaches  [254].
Therefore, we examine the frameworks relying upon different evasion approaches and classified reviews solely on different malware detection methods. According to the findings, few studies have examined the resilience of current Android malware identification systems to novel evasion tactics. According to this research, the detection techniques depend on static analysis, readily bypassed utilizing simple obfuscation techniques  [106]. On the other hand, dynamic and hybrid approaches can deal with complex code transformation methods and cutting-edge evasion detection approaches. Nevertheless, more studies are needed to assess these frameworks regarding evasion methods. The absence of complete test-bed tools to analyze the efficacy of existing, projected, and future frameworks need to include reviews due to a lack of significant benchmarks for evasion datasets and contemporary trending malware datasets.
The reflection API hides the malicious behavior as it can implicitly transfer control to the functions. Malware developers create stealth malware via code outlining. Without explicit Internet connection authorization, the app cannot establish an Internet socket through native code[108]. Since there is no restriction on native code execution, the attacker can execute native code on the CPU. Therefore, they must use predefined APIs to import code into the JRE. However, the native executable code can be loaded and executed immediately. In addition, at the native level, there is no separation between data and code, whereas Java needs a program to load a class file to launch its code manually. These factors significantly reduce native code protection. Poeplau et al. [14]  studied 1632 popular apps with over one million downloads and reported that 10% of the apps were vulnerable to DCL injection attacks.
Apps using DCL are subject to code injection at the update time. Popular code packers, Ijiami and Bangcle, load encrypted bytecode at runtime and decrypt the same in memory [117]. (d) (c) Dynamic code loading/modification (DCL/DCM): Android apps are written in Java but must be converted into Dalvik bytecode with the. dex tool, executed by the virtual machine. Adversaries execute native code via the JNI. Hence, they can exploit dynamic code loading at runtime to execute the exploits. The malicious dynamic payloads can be hidden inside the app as an external. jar file [109]. Since the payload is encrypted, it can defeat static analysis techniques. Malware writers decrypt and load the malware at runtime [110][111][112][113][114][115][116]. For instance, the malicious code prompts the user for a critical update; hence, a novice user may consent, causing the device to become infected by the malware.
Various detection approaches, including static analysis, can be used to identify repacking evasion. Dempster-Shafe [167] used a control flow graph (CFG) to explore the repacking features and claimed enhanced resilience to app obfuscation techniques. Similarly, Droidgraph [63]  used the level of hierarchical class to identify which malicious code was repackaged from the original APK. This accounts for garbage code, code obfuscation, and API call requests[205,214]. Compared to the native call graph approaches with polynomial time, the code comparison time decreased. On the other hand, reflection eludes detection frameworks that use the control flow graph. Some static analysis methods, Polymorphism Evasion Techniques Package Transformation Encryption Analysis Type Framework Year RPK PKR IDR DEN BEN PEN ST DY HY Battista et al.
AnDarwin [64] , reported the detection of dead code insertion. The code's similarity technique employs distance vectors; thus, AnDarwin is less resistant to transforming dead code insertions [64, 233]. Changes in the distance-vector code enhances the semantic gap between the code vector and dead code insertion transformation. The Q-Floid[192]  framework examines the runtime behavior of a suspicious app based on dynamic analysis and presents the qualitative data flow graph (QDFG). Q-Floid is based on desktop malware detection approaches and has been reported to be able to identify obfuscated code. The QDFG[234]  identifies the transformation of code obfuscation. Although, Q-Floid fails to identify Android malware when employing monitoring services. , AdDetect [225], and Amandroid [231], a few fail, such as APK Andro-Tracer [106], ngrams [170], Elish et al.
[7], and Wu [184]. CIN can be identified using some detec- tion frameworks based on dynamic analysis, such as Q-Floid [161,192], and some hybrid analysis frameworks, such as MARVIN [166,185] and RiskRanker [149]. The obfuscated function call was identified by app topological signature via graphlet sampling (ACTS) from the malware sample. The ACTS framework was developed by Tianchong et al. [232]. (c) Dead code insertion evasion detection (DCI): A code similarity-based Android malware identification framework, MysteryChecker [157] provides a novel attestation technique based on software identifying repackaged malware using randomly generated encryption chains and code obfuscation. DroidOLytics [151] employs statistical similarities to identify ob- fuscated code and repackaged apps. It creates a signature repository with dynamic length modifications to detect code cloning [235].
AndroSimilar [169] employs signature-based identification approaches, achieving a 76% accuracy. However, it has low recognition accuracy for repackaged applications and code obfuscation. 5. 2. 2. Advanced Code Transformation Detection (a) NEX evasion detection: The static analysis framework DroidAPIMiner [61] reported accuracy in identifying NEX evasion, illustrated in Table 6; similarly, the hybrid analysis framework MARVIN [185] and the dynamic analysis framework DroidBar- rier [164] claim to successfully identify an NEX evasion. Additionally, several static analysis frameworks come across limitations in detecting NEX evasion tactics, such as AdDetect [225], APK Auditor [147], Andro-Tracer [106], and ngrams [170]. (b).
SysML is a UML profile used for multi-disciplinary systems engineering. The rise of Industry 4. 0 modernizes industrial systems with new technologies and consequently demands the SysML language to be extended to cover new specific concepts. Among these new technologies, Open Platform Communication Unified Architecture (OPC UA) is a highly recommended standard for the interoperability of industrial systems. OPC UA offers a data modeling mechanism that can represent an industrial system's resources in the form of an OPC UA information model. Technically, the OPC UA information model is the combination of the basic information model proposed by the OPC Foundation and other companion specifications' information models related to the system's specific domains. When refining a SysML design for such an OPC UA-based system, it can be challenging to enrich the design model and integrate all the information from a companion specification.
Introduction One of the prime requirements of Industry 4. 0 is the interoperability between industrial systems. Interoperability means that a system must be able to communicate and collaborate with others, regardless of their differences in manufacturers or functions. Regarding this need, OPC UA  (Mahnke et al. 2009) , standing for the Open Platform Communication Unified Architecture, emerges as a strong solution. Indeed, it facilitates data exchange and management to meet all the requirements of today's automation without relying on individual suppliers. OPC UA is a set of standards developed and maintained by the OPC foundation. Its goal is to allow information to be reliably and securely exchanged between platforms from different vendors and to allow seamless integration of those platforms.
The OPC UA information model is undeniably a core component of every OPC UA-based system. Unfortunately, when the complexity and number of industrial systems grow along with the rise of Industry 4. 0, OPC UA information model implementation becomes challenging while applying the OPC UA standard. First, the OPC UA modeling language is complex and non-visualized; thus, it is uneasy to learn and use, especially for new modelers who lack experience in this language. Second, the resources of an industrial system may grow over time; consequently, its OPC UA information model must evolve. However, designing and deploying an OPC UA information model is timeconsuming, and guaranteeing data model consistency between different design versions are sometimes challenging. Regarding the above challenges, using Model-Driven Engineering (MDE) and Domain-Specific Languages (DSL) is promising to reduce the complexity of modeling OPC UA information models  (Goldschmidt & Mahnke 2012).
QVTo Transformation This section describes the M2M transformation from SysML design models to OPC UA information models using QVTo. We use QVTo 7  as transformation language because it is compatible with UML. Also, it is widely adopted in both academia  (Lee et al. 2017; Commission et al. 2007 ) and industry  (Gerpheide et al. 2016). QVTo transforms models conforming to one or several metamodels. The transformation declaration specifies the source and target metamodels. Fig. 11  illustrates the QVTo transformation process. It involves two levels: the metamodel level and the model level. The metamodel level defines a set of transformation rules that works with the mappings between the input and the output metamodels  8. In detail, it takes as input the UML, SysML, and CS-Robotics metamodels.
Integration Testing with an OPC UA Server The integration testing takes an OPC UA information model as the input and produces a running OPC UA server as the output. Our developers prepare a script, called UaServerGenerator, to automate the generation of the OPC UA server as the autogeneration process presented in Section 3. The script relies on the open62541 library and its tool NSCompiler. It runs only when the input OPC UA information model has a correct format; otherwise, an error appears. In other words, this tool helps to validate the OPC UA information model's syntax. Regarding the OPC UA information model's semantics, the OPC UA experts in our laboratory use UaExpert to manually visualize and evaluate the OPC UA information model. Since the input of the integration testing is OPC UA information models from the unit testing, the number of integration test cases equals the number of unit test cases.
A mobile robot like TurtleBot3 has no joints but wheels instead. To profit from our contributions, we need to modify and produce a SysML model that replaces Axes with Wheels, MotionDevices with MobileRobots, and MotionDeviceSystemType with MobileRobotSystemType. Then, the generated information model for Niryo Ned combined with the generated information model for TurtleBot3 is serialized in a Nodeset file. Using OPC UA modeling language, our modelers encode the necessary details into the file to form the final OPC UA information model for the PAL system. Next, system developers use the script UaServerGenerator to generate and run the OPC UA server. The stakeholders in the project use UaExpert to observe the data updated in the OPC UA server and compare them with the running system. They give us feedback so we can evaluate the use case and fix bugs related to the system.
Maintenance and Issue Tracker To facilitate research and further evaluation of our work, we have released our code on the Eclipse Foundation under the EPL open-source license. The transformation is implemented as a set of Eclipse plugins constituting the Papyrus OPC UA Designer 16. It can be installed using an update site 17. Otherwise, users can use it through the Rich Client Platform (RCP) version available on the Papyrus for Manufacturing's site 18. Users who find a bug in our contribution can contact us through the issue tracker Bugzilla 19 also proposed by the Eclipse Foundation. It is a practical channel for us to receive feedback from the community.
Related work Some MDE approaches for generating OPC UA address space and information modeling already exist. The most relevant work is mapping UML to OPC UA information model  (Lee et al. 2017; Pauker et al. 2018 ). Lee et al. (Lee et al. 2017 ) present a metamodeling approach for transforming OPC UA address spaces into UML models. It is a bidirectional transformation between OPC UA information models and UML class diagrams. They also use the Eclipse Modeling Framework and the Query View Transformation (QVT) to implement their generator. Rohjans et al. (Rohjans et al. 2010 (Rohjans et al. , 2013 ) also present an MDE approach for transforming IEC 61850 and CIM into OPC UA information models. They are the standard data models in the energy domain described in UML. They also developed a tool for automatic model transformation called CIMBAT.
In this work, the transformation is implemented based on Eclipse Modeling Framework (EMF) 21 and the Atlas Transformation Language (ATL) 22. In  (Friedl et al. 2020 ), the authors focus on the creation of the OPC UA information model and its description in a text document. They implement a graphical tool to model OPC UA information models based on the Eclipse Modeling Framework (EMF) and also use an MDE approach for the generation. To the best of our knowledge, there is no existing work addressing the transformation of SysML models to OPC UA information models. The generation of information models compatible with CSs has not been covered so far. Additionally, while there has been previous work done on transforming UML models to OPC UA information models, such as the work done by  (Pauker et al.
Our solution to overcome this obstacle relies on two points. First, modelers modify the UML profile if possible. Second, modelers can use the standard SysML language (BDD, IBD) to create system models that will contain all the details of the specific components of the model. Then the OPC UA information model will be generated from this SysML model. After this research, we plan some near future works. First, the modified CS-Robotics for mobile robots presented in Section 7. 3 are not mainstream. VDMA declares to update CS-Robotics with the concepts for other robot types in subsequent parts released in the future. Thus, we are waiting to improve our UML profile accordingly. Second, there are new use cases in the LocalSEA testbed that require the collaboration of multiple robotic arms. We plan to apply this research's contributions to deploy these use cases.
While other possible 55 environments for real-time sound synthesis exist, such 56 as C++ (notably the JUCE library), Max/MSP, or 57 Faust, this demonstrator is presented in a pure Mat-58 lab implementation, using only the Audio Toolbox 59 (audio system toolbox, matlab, signal blocks). This 60 is advantageous for the many researchers who may 61 want to reuse their preexisting codes, solvers, systems, 62 analysis or display tools. Note that the built-in Matlab tools necessary were not available before R2016a (for the Audio toolbox and most of the elements of the user interface) and R2018a (for the MIDI message handling). After a quick presentation of the dynamical system used in the demonstrator in Section 2, the implementation choices are detailed is Section 3. Ideally, the authors wanted this paper to follow the actual lines of codes implementing the demonstrator.
Sadly, the complete code is too lengthy for a journal paper (notably due to display functions, UI building and general housekeeping). With the intent of being as explicit as possible, Section 3 is built around several code snippets addressing the main challenges of a real-time audio demonstrator. The first of these code excerpts is self-contained and functional, and outputs sound generated by a dynamical system in real-time. The structure of the rest of the section follows that of the code, which is: Initialization of the audio output object (the current example uses the audiodevicewriter object). Construction of the user interface: buttons, sliders and MIDI device handling. Execution of the synthesis loop, typically a while loop with generation of new sound samples, and output of the audio through the audio output object.
( 7 ) The second method is a fourth-order Runge Kutta 149 (RK4) integration scheme  [14]. Using the F notation 150 from Eq. 3, one computes the next sample by 151 X[n + 1] = X[n] + 1 6F s (K 1 + 2K 2 + 2K 3 + K 4 ) (8) where K 1 = F (X[n]) K 2 = F (X[n] + K 1 2F s ) (9) K 3 = F (X[n] + K 2 2F s ) K 4 = F (X[n] + K 3 F s ). ( 10 ) The third and last method is Matlab's built-in ode45 solver  [15]. It is also a type of Runge-Kutta integration scheme but with a auto-adaptive time step.
Real-time audio on Matlab The current implementation uses the Audio toolbox object audiodevicewriter, which communicates with the audio driver of the computer. The Matlab version used during the writing of this article is 2021a. Fig. 2  is a self-contained, minimal working example using the system from section 2 solved with ode45. When running this code, please lower the volume as the sound can be quite loud. Note that, especially on Windows, best results are obtained using ASIO drivers instead of the default audio driver. In that case, the sample rate and buffer size of the ASIO driver should be equal to those of the Matlab audioDeviceWriter object. However, numerous different ASIO drivers exist depending on each user's setup. Therefore, it is hard to provide a flexible and compact ASIO-based solution.
Between 4 and 12 parallel oscillators run with the RK4 solver. Using a simpler explicit Euler scheme allows between 28 and 82 oscillators to run in parallel. This gives an idea of the headroom of this architecture to accommodate bigger systems. As this result heavily depends on the user's hardware, the code to reproduce this test is given in the code archive linked in the Appendix, so each user can know their potential for more complex systems.