dataesr/scientific-paragraphs-categorization huggingface dataset:
Introduction Contrary to popular belief, the Mac ecosystem is not unaffected by malware. In 2014, the first known ransomware appeared, and other ransomware has been discovered as Software-as-a-Service (SaSS), where malware is available as requests. Mac devices saw more malware attacks in 2015 than the past five years combined, according to a cybersecurity report from the Bit9 and Carbon Black Threat Research team. 1 In 2016, Mac malware grew 744% with around 460,000 instances detected, says McAfee report  [1]  and increases 270% between 2016 and 2017 (Table  1 ). 2  There exist tools which support malware analysis of Windows, Linux or Android applications, while, investigation of macOS malware and development of tools supporting monitoring their behavior is still limited in functionalities or anti-analysis resistance, or both.
For example, the open source Mac-sandbox  [2]  is vulnerable to anti-analysis techniques such as Dylib name verification. Cuckoo sandbox  [3]  does not support anti-analysis mitigation and human interaction under the macOS environment. The closed source FireEye monitor 3  use a kernel extension which is resistant to anti-analysis techniques, but requires human intervention. VirusTotal Box of Apples sandbox  4  executes malware to show screenshots of what an analyst would see, also reports network traffic and file operations but the underlying technology itself is enclosed. Our goal is to design and implement a malware analysis framework, which can automatically capture malware behavior in an adversary environment, called Mac-A-Mal. It consists of two main modules implemented at user-space and kernel-space.
g. , files, computing resources) based on user and group IDs at various levels. Virtual memory pages are encrypted to prevent memory allocation exploitation attacks. These attacks are widely used by malware to force the processor to execute arbitrary code from another process' memory area. Address Space Layout Randomization (ASLR) is adopted to prevent exploitation by randomly offsetting location of modules and specific in-memory structures. System Integrity Protection (SIP) is a built-in feature introduced in OS X El Captian to protect system files and directories against the modifications caused by non-"entitlement" processes. It also keeps a process from code injection and runtime attachment attacks. A runtime debugging (e. g. , DTrace) cannot interact with a protected process because SIP denies any attempt to load the unsigned kernel extensions (KEXT).
" /usr/libexec/xpcproxy is a "trampoline" that's used by launchd to launch XPC services using posix_spawnp() system call. It uses xpc_pipe_routine() to communicate back to launchd to get the information needed to spawn the XPC servicenotably the path to the XPC service executable and the values that should be set in its environment. The Code signing mechanism uses a digital signature used to verify the software's origin and integrity in case binaries were subverted. Built-in Anti-malware XProtect scan suspicious files by matching their signatures with malware definitions in the Xprotect. plist file. Gatekeeper prevents applications that are downloaded and installed from malicious websites. It suffers from the same restriction of XProtect  [9]. In particular, Malware that signed with a valid Apple certificate can be able to bypass Gatekeeper.
Any modification that invalidates the signature will cause the binary crash. However, malware authors can unsign an application, infect it with malicious code, and then execute it without crashing  [8]. In contrast, all kernel extensions are required to be signed to prevent malicious code in kernel space. Moreover, the verification step is performed in user mode, and therefore malware author can turn on user-mode checking (on their signature) and load their kernel extensions. Static features can be feed to machine learning algorithms to automatically classify malware samples in  [4, 10]. They extracted binary header, load commands, and segments features from the dataset of 2300 benign and 760 malicious samples and achieved 96. 62% accuracy. Dynamic analysis Existing tools shown in Table  2  proposed to monitor dynamic artifacts in the system such as processes in user-space and kernel-space.
FireEye monitor collects information about processes, file and network activities, TTY events from the kernel-space. It, however, lacks any support of analysis automation for large-scale analysis. DTrace logs program execution trace (e. g. , system calls, CPU performance) using probes callbacks from the user-space. Lindorfer  [11]  has used the tool for their analysis of honeypot captured samples. Moreover, it has three limitations: (i) requiring root privilege to run samples, (ii) inability to monitor official Apple binaries without placing them in a temporary folder and (iii) fail to follow a new process or fork triggered by launchd. The limitation (i) has been addressed by the opensource Cuckoo sandbox  [3]  via two running modes: executing DTrace as root permission or dropping privileges to the user with sudo command and alter the local sudoers file to reflect the change.
This solution, however, appears to be trivial to detect a process executing under root privilege, analysts, therefore, must issue an additional sudo to drop the privilege. As a result, the analysis trace might unwillingly include benign sudo activities which confuse analysts. Only filtering them out would lead to significant information missing. Our observation in Table  6  shows that Mac-A-Mal found 31. 03% samples of the dataset exhibits super-user permission (sudo) requests. Mac-Sandbox is an extension of Cuckoo sandbox, which uses Dylib hijacking  [12]  to suspend process and hook system calls of particular interest. Compared to Cuckoo, it extended the static analysis and human interaction simulation. It, however, seems to leave analysis traces on the system caused by its suspending and resuming operations, and thereby highly be vulnerable to anti-analysis techniques.
Moreover, relying on the parent-child process tracing mechanism at user-space, it likely neglects malicious processes spawned by system services. Memory analysis using Volatility plugin  [13]  involves inspection of relevant macOS subsystems and volatile artifacts lie in the memory. J. Rentzsch  [14]  uses function overriding and code injection to execute the hooking code. They patch the target function to jump to a dynamically allocated executable code area (Table  4 ).
Using  challenge is that open spawns the new process which goes through the mac_syscall interface that prevents any tracing attempts regard to sandbox policy. Apparently, by tracing in kernel space, we can execute any samples in which DTrace and MacSandbox failed to. It means any types of files can be opened with the capability of process forks tracing (e. g. , Office documents) without using other file handers. We also classify file types for different ways of handling, for example, archives such as Apple disk image, we firstly mount via hdiutil, and then mac-A-Mal executes all applications inside the attached volume. For cross-platform malware variants using scripting application such as Java, Perl, Python, we use their own interpreters to execute (e. g. CrossRAT malware). Then System call logging module will capture system calls using hooks at the kernel-space.
With SIP enabled, the compiled KEXTs of our module must be signed with a developer ID for signing KEXTs certificate. We further trace processes to give insights into their characteristics, the interaction between them and exclude Fig. 2  Process argument logging irrelevant processes. We capture system calls, their arguments, and program path by making a tunnel to transfer data between user and kernel side as depicted in Fig. 2. In particular, the challenge is to transfer arguments which are typical arrays. 6 Mac-A-Mal hooks system calls at kernel space and therefore can trace process spawns by open, launchd, and xpcproxy processes accurately, while DTrace, Cuckoo sandbox, and Macsandbox cannot trace. Information about process creation is collected by filtering MAC framework Kernel Authorization (KAuth)'s scope KAUTH_FILEOP_EXEC for process notifications.
Then XPCproxy calls posix_spawn() function with the POSIX_SPAWN_SETEXEC flag to execute the XPC service. The general logging scheme optimizes the logger via internal sockets which is thread-safety and synchronous. Also, during malware execution, the extension does not leave any explicit traces on the system in comparison to previous approaches (  [15, 16] ). Automation The communication protocol between the analysis and monitoring machine is designed to be reliable 6 For example a program can spawns: execve('/bin/ls',['-lua','/etc/passwd'],[]) to list /etc/passwd file and its attributes. After hooking from kernel space, we need to copy its values out to userspace's logger. It is trivial to log the first argument, which is a string, but second and third arguments which are arrays are not. However the address value of these arrays in the kernel space is collected, and each argument value has the different 8 bytes of address (for 64bit kernel).
Robust anti-evasion techniques Mitigating anti-debugging techniques Apple introduces two standard methods to detect and prevent applications from being attached by debuggers. Sysctl() retrieves information about a process and determine its debugging status. Furthermore, PT_DENY_ATTACH protects a process from debuggers by using non-standard ptrace requests. Any attempts to trace the process will receive the exit status or a segmentation violation. We place a monitor module in the kernel-space to capture and analyze both sysctl() and ptrace anti-debug calls and their arguments. Mitigating Anti-Virtual machine techniques Analysts usually disable SIP to enable kernel debugging, load unsigned kernel extension, or remove DTrace restrictions. While these deactivation techniques allow bypassing constraints by Apple, their footprints can be leveraged by malware to detect the analysis machine.
Malware family analysis Our Dataset consists of 2,000 unique macOS malware examples collected from VirusTotal Malware Intelligence Services (VTMIS),  8  Macmalware,  9  and Objective-see  10  between January 2017 and July 2017. macOS malware evolution is investigated using heat map from 2016 to 2017. Figure  7  shows that only 2 samples use anti-analysis techniques while 5 samples do in 2017. We observed that some samples are an improvement of existing malware appeared in 2016. In 2017, we have also observed that the increasing trend of using malware to affect victim internet browser, to redirect them to fraud web traffic or unwanted advertising for profit. 11 In 2017, we have also observed that the trend of using malware to affect victim internet browser to redirect them to fraud web traffic or unwanted advertising for profit.
6 shows suspicious behaviors captured by Mac-A-Mal from malware samples in the dataset. Many of them execute network operations, writing data to the victim machine, spawn processes or threads, and perform persistence techniques. Among anti-analysis techniques, we observed common system calls such as ptrace(), sysctl(), sleep() We write analysis rules to identify suspicious characteristics or behaviors such as network activity, anti-debug techniques, persistence mechanisms, etc. We then apply the rules to analyze malware in the dataset. Figure  7  shows our analysis result for malware families. Family OSX/Fake File Opener appears to do something benignly with neither network activity nor persistence mechanisms. However, further analysis on the samples we found a large embedded Info. plist file which registers 232 file extensions to the operating system.
Such behavior makes the malware look potentially like an unwanted application that masquerades 11 For example XAgent is an upgraded version of the Komplex malware which participated in APT28 targeting individuals computers in the aerospace industry in 2016 and Trojan Downloader. Agent. X. CXB spreads malware by executing malicious Visual Basic for Applications (VBA) code which contains payloads for both macOS and Windows. OceanLotus. B has been evolved from its variant in 2016 avoiding Bash command execution, which is more vulnerable to anti-analysis techniques. as a document handler. macOS/Mughthesec tries to hijack victim's browsers, install the SafeFinder adware, and use query victim's Mac address to detect virtual machine, download additional malicious applications such as a scam utility Advanced Mac Cleaner.
Conclusion and future work In this paper, we presented a hybrid malware analysis framework where static and dynamic analysis are combined to support the analysts. Its key feature is a kernel hooking module, which implements various analysis techniques including system calls and services invocations that are macOS specific. We provide many hooks for arguments monitoring, process tracing, anti-analysis detection, and mitigation. Mac-A-Mal performs best among other monitor tools on the same benchmark both regarding tracing process execution time and many CPU counts. With Mac-A-Mal, we discovered 71 unknown Mac malware variants currently using new evasion techniques. Our behavior classification rules allow us to filter out behaviors that are unrelated to malware. While 85% of the collected samples are adware, most of the classified variants (49%) belong to the trojan/backdoor family.
Acknowledgements The project leading to this paper has received funding from the  European Union 's  Horizon 2020 research and innovation programme  under Grant Agreement No  675320  ( NeCS: European Network for Cyber Security ). This work was also partially supported by Securify B. V. Open Access This article is distributed under the terms of the Creative Commons Attribution 4. 0 International License (http://creativecomm ons. org/licenses/by/4. 0/),which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.
51j8 USA) and used to quantify the uplifting response. Normalized degree of lift was determined as the difference in height between the primary bending point and the base of the stem (in terms of their "Y" positions), divided by the respective length of the entire stem for each day [(Y apex -Y base )/(Total Stem Length)]. We calculated the curvature (the summed differences in angle between subsequent pairs of XY coordinates or vectors), which indicates the deviation from a straight line in degrees. Scripts used in this experiment are available under https://github. com/UPSCb/UPSCb/tree/master/manuscripts/Seyfferth2019 Histology, Microscopy, and Vessel Quantification For both the upright and horizontally inclined trees, the stem at 10 cm above soil level was used to prepare fresh 70-µm-thick sections (vibrating blade microtome Leica VT1000S, Wetzlar, Germany) stained with Safranin : Alcian Blue (1:2) for 30 s, washed and mounted in 50% glycerol, and imaged with a Zeiss Axioplan2 microscope, AxioCam HRc camera, and AxioVision V 4.
8. 2 software (Carl Zeiss Light Microscopy, Göttingen, Germany). For TW : OW ratio determination, stereomicroscope images were obtained with a Canon PowerShot G7 digital camera. The distance from the center of the pith to the cambium of both the upper (TW) and lower (OW) sides was used to calculate the TW/OW ratio. Images for vessel quantification were taken with 10× magnification on a Zeiss Axioplan2 microscope. Images just inwards of the cambium, taken for NW, OW, and TW, were analyzed using ImageJ (version 1. 51j8 USA).
Vibrational Microspectroscopy and Data Analysis FT-IR microspectroscopy with a single-element detector was performed using existing protocols  (Gorzsás and Sundberg, 2014). Transverse sections with thickness of 20 µm were prepared from frozen stem samples using a Microm cryotome HM505E and dried in a desiccator between two polished rectangular BaF 2 windows (38. 5 mm × 19. 5 mm × 4 mm, International Crystal Laboratories, Garfield, NJ, USA) for at least 48 h. One section from each of five biological replicates per genotype and treatment was analyzed. Single-element detector images were recorded over four positions, approximately 90° from one another around the entire cross section. A single spectrum was recorded from each position covering an area of approximately 430 × 430 µm, using a Bruker Equinox 55 spectrometer equipped with a Hyperion 3,000 microscopy accessory (Bruker Optics GmbH, Ettlingen, Germany).
Spectra were recorded in transmission mode over the range of 700-3,800 cm -1 , with a spectral resolution of 4 cm -1. Six hundred interferograms were co-added to improve signal-tonoise ratio, and a zero-filling factor of 2 was employed. Spectra were converted to data point tables using OPUS (v7. 0. 122, Bruker Optik GmbH, Ettlingen, Germany), baseline corrected (2-point linear baseline at 812 and 1,809 cm -1 ), and total sum (area-) normalized in the region of 812-1,809 cm -1 , using in-house scripts (https://www. umu. se/en/research/infrastructure/visp/ downloads/) written in Matlab (version 7. 0, MathWorks, Natick, MA, USA, http://www. mathworks. com). Spectra were extracted, and the area measuring 816-1,803 cm -1 was used in subsequent multivariate analyses. Principal component analysis (PCA) and orthogonal projections to latent structures discriminant analysis (OPLS-DA)  (Trygg and Wold, 2002)  were performed using SIMCA-P+ (versions 12-14, Umetrics AB, Umeå, Sweden).
The following settings were used for spectral recording: static scans centered at 1,190 cm -1 (resulting in a spectral range of ca. 510 to 1,802 and ca. 1 cm -1 resolution with a 2,400 lines grating), standard confocality, laser power set at 100% in the software, and exposure time of 30 s per spectrum. Spectra were noise filtered and cleaned from cosmic rays using the chemometrics package of WiRE (version 3. 4, Renishaw Plc, Wotton-under-Edge, UK). Data pre-processing was carried out in Matlab (version 2018a, MathWorks Inc. , Natick, Massachusetts, USA), using an open source graphical user interface adapted from  Felten et al. (2015)  (https://www. umu. se/en/research/ infrastructure/visp/downloads/) with the following parameters: spectra were cut to a range of 510 to 1,800 cm -1 , asymmetric least squares baseline corrected (λ = 5,000, pVal = 0.
Data sequences are available from the European Nucleotide Archive under the accession number PRJEB32252. Quality assessment and pre-processing of the obtained RNA-Seq reads were done following the guidelines described in  Delhomme et al. (2014). Briefly, FastQC (v0. 11. 5; Andrews, 2010)  was used to assess the quality of the raw data. Then, ribosomal RNAs and sequencing adapters were removed using SortMeRNA  (Kopylova et al. , 2012)  and Trimmomatic  (Bolger et al. , 2014) , respectively. Read quality was assessed using FastQC after both these steps and reads that passed the quality assessment were aligned to the P. tremula genome (v1; available at http://plantgenie. org/,  Sundell et al. , 2015). HTSeq was used for summarizing read counts  (Anders et al. , 2015). Read counts were normalized in R (v3.
5. 3, R Core Team, 2019) using DESeq2 (v1. 30. 0, Love et al. , 2014)  and used for PCA and differential gene expression analysis. Gene expression was normalized considering the effect from the genotype (wild type or pLMX5::etr1-1) and tissue (TW or NW) using the following model: gene counts ~ genotype + tissue. Variancestabilizing transformation was applied using the DESeq2 package. A PCA was conducted (using the plotPCA command in DESEq2) to show general differences between all analyzed samples. Differentially regulated genes (DRGs) were selected using an absolute log2 fold change (log2FC) larger or equal to 0. 5 (pAdj < 0. 05) as cutoff (suggested in  Schurch et al. , 2016). The script used for the transcriptome analysis is available under https://github. com/UPSCb/UPSCb/tree/master/manuscripts/Seyfferth2019.
0, Umetrics AB, Umeå, Sweden) on spectroscopic data are given in the respective figure legends (Figures  3  and 4 ), and the choice of these methods is described in detail in  Felten et al. (2018). Statistical analysis for differential gene expression analysis (Figure  5 ) was performed using pre-set statistical settings in the DESeq2 package  (Love et al. , 2014). Briefly, pValues were calculated using the Wald test, and multiple testing correction was performed using the Benjamini-Hochberg approach. Statistical tests for GO term enrichment were performed on the basis of Fisher's exact test and included multiple testing (for detailed description, see  Sjödin et al. , 2009). Hypergeometric distribution was used to determine statistical significant enrichment of cis-elements  (Felten et al.
However, the average S2-layer MFAs in ETI trees were significantly lower than those in wild-type trees (36. 7 ± 2. 2° for ETI trees and 41. 2 ± 4° for wild-type trees). We furthermore assessed whether G-fiber-rich TW areas were chemically altered, in cross sections of ETI and wildtype trees using FT-IR microspectroscopy with a singleelement detector. PCA performed on these spectra did not show clear grouping (Supplementary Figure  S4 ), indicating that the overall chemical composition of the sampled areas is not altered. As unaltered cells/cell wall layers can mask subtle changes confined to small zones/specific layers, we used Raman microspectroscopy with high lateral resolution to specifically focus on the chemical information from G-and S-layers in wild-type and ETI trees. While analyzing data from spectral maps scanned over three adjacent fiber cells with 1-µm step size in TW and NW of both genotypes, four chemically different zones were assigned based on spectral information that overlapped with cell layers visible in the sections: (1) cellulose rich G-layer, (2) cellulose-and lignin-containing S-layer, (3) lignin-rich zone including both the S-layer and the middle lamella (hereafter called S + ML), and (4) lumen (Figures  3A-D , Supplementary Figures  S1, S2 ).
ACKNOWLEDGMENTS We thank the students of the Design Build Test course 2016 at  Umeå University  ( Carolina Eriksson ,  Karolina Eriksson ,  Oskar Hallberg ,  Alexander Lindström , and  Johan Lundberg ) for developing the imaging tools to record and measure tree uplifting. The support of the  Chemical Biological Centre  and the  Department of Chemistry, Umeå University, Sweden , for the  Vibrational Spectroscopy Core Facility  is gratefully acknowledged. We would also like to acknowledge support from  Science for Life Laboratory , the  National Genomics Infrastructure  funded by the  Swedish Research Council , and  Uppsala Multidisciplinary Center for Advanced Computational Science  for assistance with massively parallel sequencing and access to the  UPPMAX computational infrastructure. MR would like to thank  Stephan Siegel  and  Chenghao Li  for the support with the X-ray powder diffraction (XRD) measurements at BESSY II.
Chile host a great tsunamigenic potential along its coast, even with the large earthquakes occurred during the last decade, there is still a large amount of seismic energy to release. This permanent feature and the fact that the distance between the trench and the coast is just 100 km creates a difficult environment to do real time tsunami forecast. In Chile tsunami warnings are based on reports of the seismic events (hypocenter and magnitude) and a database of precomputed tsunami scenarios. However, because yet there is no answer to image the finite fault model within first minutes (before the first tsunami wave arrival), the precomputed scenarios consider uniform slip distributions. Here, we propose a scheme of processes to fill the gaps in-between blind zones due to waiting of demanding computational stages.