dataesr/scientific-paragraphs-categorization huggingface dataset:
Background and related work Most frequent attacks on Web servers include SQL injection attacks (for Web servers connected to an SQL database) and code injection attacks (Flash, Javascript, etc. , carried out through so-called Cross-site scripting or XSS attacks). These attacks generally correspond to the exploitation of the same kind of vulnerability related to the lack of sanitization of URL parameters or of HTML form inputs. In the following, we will focus on SQL injection attacks, without loss of generality. To check whether SQL injection attacks are possible, the vulnerability scanners send specially crafted requests and analyze the responses returned by the server. A server may respond with a rejection page or with an execution page. A rejection page is returned by the server as a consequence of an error while processing the request.
An execution page is returned by the server as a consequence of a successful execution of the request. This page may correspond to the 'normal' scenario, i. e. , in the case of a legitimate use of the Web site, but may also result from a successful exploitation of an injection attack. These latter requests are those we consider in this paper. In particular, our objective is to identify the vulnerabilities that can be successfully exploited by the attackers. For instance, the successful exploitation of an SQL injection vulnerability in a login form may lead to bypass an authentication, and the successful exploitation of a File include vulnerability on a search form may lead to display extra data like /etc/passwd file content. In order to identify the vulnerabilities of a Web site, the scanners generally send specially crafted requests via the identified injection points allowing them to determine whether the input parameters submitted to the target system are sanitized or not.
Error pattern matching approach To identify SQL injections, the error pattern matching approach consists in sending specially crafted requests to the application and looking for specific patterns in the responses, e. g. , database error messages. The basic idea is that the presence of an SQL error message in an HTML response page means that the corresponding request has not been sanitized by the application. Therefore, the fact that this request has been sent unchanged to the SQL server reveals the presence of a vulnerability. Scanners such as W3af (http://w3af. sourceforge. net) (sqli module), Wapiti (http://wapiti. sourceforge. net), and Secubat  [4]  adopt such approach. As an example, to detect injection vulnerabilities in authentication forms, the sqli module of W3af sends three requests based on the SQL injection: d'z"0 (or d%2Cz%220 encoded in ASCII).
The three corresponding responses are then analyzed. If they include SQL error messages (e. g. , Mysql_ and supplied argument is not a valid Mysql), W3af informs the user that the application is vulnerable. The list of keywords adopted by Secubat for the error pattern matching approach is presented in  [4]. This list, derived by analyzing response pages of vulnerable Web sites, is aimed at covering a wide range of error responses and a variety of database servers. A confidence factor that measures the level of confidence that the attacked Web form is vulnerable is also assigned to each keyword.
Discussion and contributions The assumption used by the error pattern matching approach is debatable. Indeed, error messages that are included in HTML response pages do not necessarily come from the database server itself. A database related error message may also has been generated by the application. Moreover, even if the message is actually generated by the database server, this is not sufficient to conclude when receiving this message, that an SQL injection is possible. Indeed, this message means that, for this particular request, the inputs have not been sanitized. However, it does not mean neither that the server does not sanitize all the SQL requests nor that the non-sanitized input can be chosen in order to successfully exploit any vulnerability. Regarding the similarity approach, it is easier to generate random or syntactically invalid requests to obtain rejection pages than to send valid injection attacks to obtain execution pages.
The graphs including edges corresponding to the exploitation of a vulnerability are so-called vulnerability graphs. Figure  2  pictures this iterative approach. Red edges identify vulnerabilities whose exploitation reveals new states and edges of the navigation graph that were initially inaccessible. This algorithm has been implemented in a software tool using the Python language, which greatly facilitates the handling of HTTP concepts (cookies, settings, etc. ). This tool is interfaced with the statistical analysis software R (http://www. r-project. org/) which integrates a set of clustering programs that we detailed in Section 2. 1. They have been used to develop our classification algorithm. This tool is called Wasapy, which stands for W eb Application Security Assessment in Python.
Example In order to illustrate our approach, we developed an ecommerce Web site for buying books, using the PHP language and a MySql database. This site is a simple proof of concept but it uses technologies and a structure similar to 'real' Web sites. Figure  3  presents the HTML page graph describing the structure of the Web site. A page is represented by an icon. An edge between two pages corresponds to the existence of an HTML link in the source page leading to the second page. Let us note that a particular reflexive link exists for the display. php page. This page enables to list the available books and includes a filtering function in a particular form field. A user may then enter a regular expression in this field and submit it to the site, in order to update the list of books. This site includes three vulnerabilities.
The pages including these vulnerabilities are identified by a star on Figure  3. The first vulnerability is associated to the page login. php. The exploitation of this vulnerability allows an attacker to bypass the authentication thanks to an SQL injection. The second vulnerability is associated to the page display. php. It allows an attacker to download the content of the database. The last vulnerability associated to the page check. php allows an attacker to pay the products he ordered without providing any credit card number. This vulnerability cannot be exploited unless some products have been added to the virtual shopping cart. First, we consider a non-malicious user, who does not have any account on the site. The only actions that the user can do are • access the index. html page • fill in the form with the authentication information in the login.
Results and discussion This section presents the experiments that we have carried out to validate and assess our algorithm. We have considered several applications using Wasapy and the three open-source vulnerability scanners discussed in this paper: W3af 1. 1, Skipfish 1. 9. 6b, and Wapiti 2. 2. 1. The experiments are run on a Gnu/Linux (2. 6 kernel) host running several virtual machines thanks to the VirtualBox utility. All the virtual machines run the Apache Web server 1. 3. 37 or 2. 2. 8 with PHP 4. 0. 0 or 5. 0. 0 and MySQL database server 5. This section is organized as follows. Section 3. 1 presents conventions and abbreviations. Section 3. 2 presents the first experiments carried out in order to assess our approach. Five Web applications including SQL vulnerabilities are used. We purposely injected these vulnerabilities to calibrate Wasapy.
Experiments with modified applications The five applications chosen for this first set of experiments are described hereafter: • phpBB-3: This application (http://www. phpbb. com) is a forum manager written in PHP and using a MySQL database. We modified the authentication form of the application by inserting a vulnerability (v1) that can be exploited by an SQL injection. This vulnerability allows an attacker to reach the restricted administration area of the forum. Table  1  shows that the performances of W3af and Wapiti are similar in average, even if the vulnerabilities detected are not the same (Wapiti successfully detects v1 and v2 whereas W3af does not detect them; on the other hand, W3af detects v4 and v8 whereas Wapiti does not detect them). This result is consistent with the fact that both scanners use a pattern matching-based algorithm.
Hence, the source code is necessary to identify these vulnerabilities. This explains the failure of all scanners. Fttss is an application that has been tested in  [16]. Hence, some results associated to the three commercial scanners considered are available (cf. Table  4 ). The commercial scanners do not detect the OS commanding vulnerability, which is the only vulnerability known of this application. In contrast, W3af and Wasapy are able to identify this vulnerability. It is noteworthy that none of tested scanners reports false positives in this case. Regarding Riotpix (cf. Table  5 ), the results are similar to those of Cyphor. The vulnerabilities are only accessible to successfully authenticated users. Therefore, we had to provide a valid login/password to all scanners. Two vulnerabilities have not been found by any scanner.
They correspond to code injection into variables that are not visible to the client and thus cannot be discovered by scanners (their identification would require a source code analysis). These results also show that Wasapy is efficient for this kind of vulnerability. Regarding the Pligg application (cf. Table  6 ), all vulnerabilities but the first two are available on hidden injection points. The scanner must be aware of the presence of the injection point in order to test the vulnerability. For the first two vulnerabilities, Wasapy found them, whereas the other scanners found only one of these vulnerabilities. This is due to the fact that error messages are not forwarded to the client.
• SecurePage: This application (http://www. 01php. com/fiche-scripts-126. html) written in PHP, is designed to protect the access of a Web site through authentication. Valid pairs for this authentication are stored in a MySQL database. A vulnerability (v2) similar to v1 was purposely injected. • HardwareStore: We developed this application, in PHP 5. 0. This application allows a user to inventory computer equipments in a database and to interrogate this database. The user needs first to be authenticated. Five SQL vulnerabilities were injected in this application. v3 allows SQL injection in a search form and allows an attacker to access the whole database. v4 allows SQL injection in the authentication form. v5 allows SQL injection in a parameter of an HTML request. For this vulnerable HTML page, we have purposely disabled the error message reporting, in order to compare the behavior of W3af and Wapiti in such a situation with the behavior of Wasapy.
c  The cookie stores at the client side a variety of information about the running session (keys, contents, user preferences, etc. ). d For simplicity, only the HTML links activated by the request appear, without explicitly specifying the parameters associated with these requests. e French funded ANR's program ARPEGE(2009-2011). f The configuration file of PHP5 includes -For production Web sites, you are strongly encouraged to turn this feature off, and use error logging instead.
Motivation: DNA copy number profiles characterize regions of chromosome gains, losses and breakpoints in tumor genomes. Although many models have been proposed to detect these alterations, it is not clear which model is appropriate before visual inspection the signal, noise and models for a particular profile. Results: We propose SegAnnDB, a Web-based computer vision system for genomic segmentation: first, visually inspect the profiles and manually annotate altered regions, then SegAnnDB determines the precise alteration locations using a mathematical model of the data and annotations. SegAnnDB facilitates collaboration between biologists and bioinformaticians, and uses the University of California, Santa Cruz genome browser to visualize copy number alterations alongside known genes.
Hocking et al. (2013)  observed large annotation error rates for several segmentation algorithms applied to a large database of neuroblastoma tumors. In this article, we propose to eliminate these errors with SegAnnDB, a computer vision system whose model always agrees with the provided annotations. Previous work in DNA copy number analysis can be roughly divided into two categories of methods: visualization and mathematical models. This article combines these two lines of research by proposing a mathematical model that can be iteratively improved by adding visual annotations to zoomed scatterplots of the data. First, we will review previous methods in both categories. Many software packages have been developed for visualization of aCGH data. For example, Visualization and Analysis of Molecular Profiles (VAMP) can be used for exploratory analysis, or to visualize predicted alterations from a model (La  Rosa et al.
, 2006). Another visual analysis program is ChARMView, which allows manual identification of regions for significance testing  (Myers et al. , 2005). A potential problem with these programs is that the displayed model is calculated before visualization, and cannot be interactively updated. Several Web sites for array CGH analysis have been proposed. CGHweb allows visual comparison of several algorithms applied to the same normalized profile  (Lai et al. , 2008). ArrayCyGHt and CAPweb provide normalization and copy number calling  (Kim et al. , 2005; Liva et al. , 2006). ISACGH supports analysis, segmentation, visualization and export to the Ensembl genome browser  (Conde et al. , 2007; Flicek et al. , 2012). ArrayFusion exports data and segmentations in formats suitable for genome browsers  (Yang et al.
, 2006). Like the method we propose in this article, these Web sites facilitate collaboration with biologists. Unlike these Web sites, our SegAnnDB software allows the user to interactively update the displayed segmentation model. In contrast to visual methods for alteration detection, mathematical models can be used to automatically predict lists of alterations based on certain mathematical assumptions about the data. The available mathematical models specifically designed for detecting CNAs are summarized by  Neuvial et al. (2011). However, a major problem with this class of methods is model selection. Given a particular dataset to analyze, it is obvious to choose neither a particular model nor its tuning parameters. How to evaluate which model is best? Without doing more experiments, the only method of evaluation is to plot the model alongside scatterplots of the data.
A good model should capture all visible alterations in the data and should not predict any false-positive detections. This visual criterion for model evaluation can be used by creating a database of annotated regions that encode an expert's interpretation of the data  (Hocking et al. , 2013). In that study, default parameter values of several models were shown to yield many false-positive and false-negative detections. And even after tuning the parameters of each model, there were no models with perfect detection accuracy. In this article, we propose to solve this problem by interactively annotating alterations in scatterplots of the data (Fig. 1 ). Then our software selects a tuning parameter that agrees with the user-defined annotations and immediately shows the updated model. If the displayed segmentation model does not capture the alterations that are obvious from visual inspection, then annotations can be added to correct the model.
A user-specific model can thus be iteratively improved until it agrees with the annotator's visual interpretation of the data. In addition, the annotations can be assembled into a database, so we can apply algorithms that automatically recognize previously annotated patterns. We note that this computer vision approach has also been successful for recognizing phenotypes in cell microscopy  (Jones et al. , 2009). After annotating a small subset of the data, the system adapts to the annotations and provides consistent predictions for unannotated data. This article describes SegAnnDB, a Web-based free/opensource implementation of this interactive genomic segmentation model. The name is short for Segmentation and Annotation DataBase, as annotations are stored in a database, which is used by machine learning algorithms to find an appropriate segmentation.
Uploading profiles The first step of any analysis is to upload the normalized log ratio data to the Web site. The data should be uploaded in gzipped UCSC bedGraph format, as this is the format that will also be used to export the data for viewing on the UCSC genome browser  (Kent et al. , 2002). The fourcolumn text-based bedGraph format is simple, so any bioinformatician should be able to quickly convert data from any platform-specific format. The bedGraph header line must contain the following three important variables specific to SegAnnDB. The db variable should indicate the genome version of the probe positions (e. g. db¼hg19). The maxSegments variable specifies the maximum number of segments per chromosome for the initial SegAnnDB scatterplots, before manual annotation (k max in Section 3.
Once a profile has been uploaded, it must undergo two main processing steps before interactive annotation is possible. First, the log ratio values and several maximum likelihood segmentation models are saved in BerkeleyDB, a highly efficient database system. Second, Portable Network Graphics (PNG) scatterplots are generated for several zoom levels (Supplementary Table  S1 ). The only limit on the number of profiles is the amount of disk space available on the SegAnnDB server. Importantly, the amount of time and disk space required is linear in the profile size (Table  1 ).
Data storage, export and server configuration To support interactive annotation and model updates, SegAnnDB needs to store data in a fast database system. We used Berkeley DB, as it allows quick storage and retrieval of any data types. In addition, the disk space requirements are approximately linear in profile size (Table  1 ). Data can be exported to the UCSC genome browser by clicking a button on the SegAnnDB Web site. This sends the copy number data, annotations and model directly from SegAnnDB to the UCSC genome browser. Figure  2  explains the relationship between the uploader, annotator, SegAnnDB server and UCSC genome browser. Configuring the SegAnnDB software on a Debian/Ubuntu GNU/Linux system requires Python and several free/opensource extension packages. For example, the Pyramid Web framework and the SegAnnot and PrunedDP segmentation modules are required.
Supervised versus unsupervised analysis In the machine learning literature, a learning problem is 'supervised' when there is a teacher or oracle that provides correct predictions for training an algorithm. In this article, the type of supervision that we proposed is a set of annotated regions from an expert's visual interpretation of the data. These annotated regions are then used by SegAnnDB to build a model with consistent breakpoint locations and copy number calls. In contrast, most statistical models for DNA copy number analysis can be viewed as unsupervised because they do not use an annotation database for model training. Typically, an unsupervised statistical model is first fit to the data, and then an expert plots the model to judge if it fits the data well. This sequence of steps is inverted on SegAnnDB: first, we plot and annotate the data, and then we fit a model to the combined data and annotations.
We considered the DNAcopy circular binary segmentation model of  Venkatraman and Olshen (2007)  as an unsupervised baseline model and compared its performance with SegAnnDB. We analyzed speed, train error and test error with respect to seven annotation datasets, consisting of 708 neuroblastoma, lymphoma and medulloblastoma copy number profiles (Supplementary Table  S4 ). The data come from cell lines and primary tumors (Supplementary Fig. S2 ) analyzed using different platforms (Bacterial Artificial Chromosome (BAC)/P1 Artificial Chromosome (PAC), Nimblegen, Affymetrix), so the number of probes per profile ranges from 1719 to 1 868 857 (Supplementary Table  S3 ). In total, there were 4467 annotated chromosomes containing 6937 annotated regions. Supplementary Table  S5  shows that the PrunedDP algorithm used by SegAnnDB took 52 h to train on the entire dataset, but DNAcopy took 43 h for each of the 31 parameter values we tested.
PrunedDP was faster overall because it was faster for the high-density profiles (Supplementary Fig. S3 ). The displayed segmentation on SegAnnDB is always consistent with the given breakpoint annotations, so SegAnnDB has 0% training error by definition (Section 3). In contrast, it may be impossible to achieve zero annotation errors with an unsupervised model that does not directly use the breakpoint annotations  (Hocking and Rigaill, 2012). Supplementary Table  S6  shows that the unsupervised dnacopy. default algorithm predicts 4-50% incorrect breakpoint annotations across the seven datasets we examined. For a more balanced comparison,  Hocking et al. (2013)  showed that DNAcopy breakpoint detection can be improved by picking an undo. SD parameter which minimizes breakpoint annotation error (we did not apply smoothing before segmentation, and we kept default values for all other parameters).
For each dataset, we picked chromosomespecific undo. SD values, yielding better training error rates (Supplementary Table  S6 , dnacopy. sd, 0. 33-2. 75%). Although breakpoints detected by these methods are qualitatively similar (Supplementary Fig. S4 ), SegAnnDB is quantitatively more accurate with 0% error. We also evaluated the test error by training a model on a set of annotated chromosomes, and counting the number of incorrectly predicted breakpoint annotations on a test set. Figure  4  and Supplementary Figure  S5  show that adding more annotations improves the test error of the supervised SegAnnDB and dnacopy. sd methods (dataset-specific parameters were chosen by minimizing annotation error for each randomly chosen training set). Predictably, the supervised methods adapt to the provided annotations and detect breakpoints more accurately than the unsupervised dnacopy.
default algorithm. However, on some high-density datasets, even the best methods showed up to 20-40% test error (Supplementary Fig. S5 ). The large test error of these supervised methods motivates spending time on interactive annotation, which always achieves 0% training error. SegAnnDB is a computer vision system that exploits the strong points of the human visual system and mathematical models. The human visual system is good at detecting noise and breakpoints in the copy number signal over large regions, but bad at detecting the precise location of a breakpoint. Mathematical models are good at detecting the precise locations of alterations, if tuning parameters are adjusted appropriately. SegAnnDB combines the best of both approaches by automatically adjusting the tuning parameters of a mathematical model to agree with an expert's visual annotations.
Time required for visual annotation on SegAnnDB The amount of time is proportional to the number of annotated regions that need to be added to correct the displayed model. More breakpoint annotations are sometimes necessary for larger profiles (Supplementary Fig. S6 ), but when SegAnnDB provides good predictions in unannotated regions (Fig. 4 ), annotating all breakpoints is not necessary (Supplementary Fig. S1 ). So in our experience, it takes $10 min to completely annotate even highdensity profiles, and it should be feasible to annotate each profile in datasets of a few dozen samples. For larger datasets, it may not be feasible to annotate every profile. For example, visually annotating every profile from the 1000 Genomes Project of  Altshuler et al. (2010)  would require $10 min/profile Â 1000 profiles=(60 min/h) ¼ 166 h, which is several weeks of work.