dataesr/scientific-paragraphs-categorization huggingface dataset:
Dinoflagellate contributions remained fairly constant through time at both Bio-STM and Bio-SAM sites. Prymnesiophytes tended to be more abundant during summer in Bio-STM while they showed similar relative abundances across all three seasons at the Bio-SAM site. The highest relative abundance of pelagophytes were observed at Bio-SAM during summer and autumn in SAW, with no clear pattern observed at Bio-STM where the contribution of this group tended to be lower (Fig. 7 ). To investigate protist community composition below the euphotic zone we also used the Bio-physical moorings dataset, which covered systematically the entire water column at the Bio-STM and Bio-SAM (0-3100 and 0-2800 m, respectively) sites and the Bio-STF site on the Chatham Rise crest (0-350 m) (𝑛 = 137 aphotic samples). Overall, Dinoflagellates dominated the metabarcode dataset mainly through Syndiniales (40 ± 15%) which contributed substantially more than Dinophyceae (14 ± 10%).
6% similarity) were the most abundant ASVs (Fig. 8 , Figure  S11  and Figure  S9 ). Among the class Prymnesiophyceae, Phaeocystis globosa (ASV_0065) was the most abundant ASV (Fig. 8 ). Among the STF metabarcodes, ASVs assigned to Syndiniales Group-I (ASV_0002, ASV_0022) were the most abundant ASVs (Fig. 8 ). Mamiellophyceae Ostreococcus sp. was also among the most abundant species overall, although the relative contribution of several Chloropicophyceae ASVs identified as Chloroparvula pacifica (ASV_0014) or most closely related to this species (ASV_0086, 99. 7% and ASV_0336, 99. 5%) increased substantially compared to STW (Fig. 8 , Figure  S9 ). It is worth noting the high abundance of sequences affiliated to Chloropicon sp. in addition to Chloroparvula pacifica, which contributed to the overall increase in the relative abundance of Chloropicophyceae in the STF dataset (Fig.
8  and Figure  S11 ). The identification of F. sublineata should be taken with caution because the V4 region of the two sequences included in PR2 is 100% similar to the annotated sequence of Fragilariopsis kerguelensis, making it impossible to unambiguously assign the ASVs identified as Fragilariopsis sp. to F. sublineata or F. kerguelensis species. To reflect this ambiguity the ASVs assigned to F. sublineata in PR2 are referred as F. sublineata/kerguelensis throughout the text (see discussion). Among Prymnesiophyceae, Phaeocystis antarctica (ASV_0027, ASV_0179) was the most abundant species instead of the P. globosa found in STW. ASV_053 coccolithophore having 100% similarity with Emiliania huxleyii and Reticulofenestra parvula increased substantially relative to STW dataset, particularly in the Chatham Rise region (Fig.
8 , Figure  S11 ). Pelagophyceae in the STF metabarcodes was dominated by Aureococcus and Pelagococcus spp. (Figure  S9 ) although the overall relative contribution of Pelagophyceae was relatively low (Fig. 5 ). The relative abundance of Cryptophyceae and Dictyochophyceae remained minor overall (<2%) (Fig. 5 ), but both groups showed changes in their specific composition across the water masses metabarcode datasets. Among Cryptophyceae, ASVs identified as Plagioselmis prolonga (ASV_0102) and Teleaulax sp. (ASV_0107) increased substantially from STW to STF samples at the cost of the decrease of ASV assigned to Geminigera sp. (ASV_0174) which was closely related (99. 5%) to partial V4 sequence of Geminigera cryophila RCC5152 strain. Plagioselmis prolonga (ASV_102) clearly dominated SAW waters where the contribution of ASVs assigned to Teleaulax sp.
Gutiérrez-Rodríguez et al. sp. clone from the Beaufort Sea (99. 6%), and ASV_0118) identified as Aureococcus anophagefferens (Fig. 8  and Figure  S9 ). The contribution of Cryptophyceae in SAW was very low (0. 18 ± 021%) but unlike STW, Plagioselmis sp. clearly dominated accounting for >85% of the sequences affiliated to this class (Figure  S9 ). To investigate how the relative abundance of different species and ASVs varied between water masses, we ran a differential gene expression analysis based on the negative binomial distribution (DESeq) using water mass as a categorical variable. For the euphotic zone, this yielded 70 and 35 ASVs out of 3984 ASVs that were significantly more or less abundant (𝑝-value <0. 01) in STW compared to SAW datasets, respectively (Figure  S12A ). ASVs that showed greatest differences (>ten log2-fold changes) in their relative abundance were not necessarily among the most abundant ones in each water mass.
g. Dinophyceae_XXX_sp. and Pelagophyceae_XXX_sp. ) suggesting the opposite affinities for STW and SAW observed for ASVs within these groups could reflect different ecological preferences at the species rather than strain level (Figure  S12A ). DESeq analysis between the STF and STW also depicted specific differences as observed between STW and SAW, with some additional diatoms ASVs assigned to Thalassiosira sp. and Pseudo-nitzschia delicatissima enriched in the STF dataset (Figure  S12B ). In most cases, the distinctive species pattern observed between the STF and either STW or SAW metabarcodes coincided with those identified from the comparison between STW and SAW described above (Figure  S12B ). For instance, ASVs belonging to Polar-centric Mediophyceae species found in higher abundance in STW compared to SAW, were also associated preferentially with STF compared to SAW while diatoms ASVs identified as F.
sublineata/kerguelensis, and Cylindrotheca closterium that were enriched in SAW compared to STW, were also preferentially associated with the STF rather than STW (Figure  S12B ). Only few ASVs, such as those assigned to the prasinophyte Chloropicon sp. and dinoflagellate Gonyaulax sp. , were distinctively associated with STF waters (Figure  S12C ). The most abundant reads found below the euphotic zone belong to the Syndiniales Group II and the polycystinean order Spumellaria Group I family (Figure  S8 ). Several ASVs contributed to the dominance of Spumellaria Group I family, but different ASVs dominated in each water mass dataset (Figure  S13  and Figure  S14 ). ASV_0023 and ASV_0039 affiliated with the Group I family of Spumellaria dominated in SAW, while ASV_0064 and ASV_0085 were most abundant in STF (Figure  S14 ).
Conversely, most abundant radiolarian species in STW were unidentified species assigned to the acantharean order Chauncanthida (Figure  S14 ). Several less abundant Radiolaria ASVs showed significantly different abundances across the aphotic depth layers of different water masses suggesting differences in their ecological preferences (Figure  S15 ). Reads assigned to known photosynthetic species also showed differential abundance below the euphotic zone in the different water masses datasets. Most notably the higher abundance of reads affiliated to the Mamiellophyceae Ostreococcus sp. and the Prymnesiophyceae P. globose in STW compared to SAW yielded significant differences in their abundance below the euphotic zone as well. A pattern also observed for less prominent diatoms ASV_0480 and ASV_0291 identified as Asterionellopsis glacialis or Thalassiosira rotula, respectively, that despite being less abundant in the euphotic zone yielded significant differences in their abundances below the euphotic zone.
Analysing the seasonal variability was beyond the scope of this study, since the bulk of the dataset was collected from different regions and times of the year. Only samples collected as part of the Biophysical Mooring time-series provided an adequate framework to evaluate seasonal variability. However, since the number of time points obtained for these sites (Bio-SAM, Bio-STF, and Bio-STM) was rather limited (2 time points per season for spring, summer, and autumn), we only briefly discuss the influence that seasonality may have on water mass and regional patterns presented in this study.
Cryptophyceae In our dataset, the contribution of Cryptophyceae metabarcodes was relatively low on average (<1%) but showed increasing abundance from SAW to STW (Fig. 6 ). Similar water-mass preference was depicted by quantitative pigment analysis in the same STFZ region over the Chatham Rise, where cryptophytes contribution in STW (47%-63% chl a) was higher than in SAW (6% chl a)  (Delizo et al. , 2007). Cryptophyta are an ubiquitous phytoplankton group with widespread distributions from coastal to open oceanic systems and from tropical to polar latitudes  (Buma et al. , 1992; Piwosz et al. , 2013; Nunes et al. , 2019). They have been reported to form blooms in coastal embayments  (Jeong et al. , 2013; Johnson et al. , 2013)  and Antarctic coastal waters favoured by low salinity conditions  (Moline et al.
Heterotrophic and mixotrophic protists below the euphotic zone We used the samples collected during six voyages of the Biophysical Moorings time-series between 2009-2012 to investigate the protistan community composition below the euphotic zone (Table  1 ). Here, Syndiniales dominated the metabarcode dataset in agreement with other metabarcoding surveys that have reported the dominance of this group of parasites  (Guillou et al. , 2008; Vargas et al. , 2015; Giner et al. , 2020). Radiolaria, a common host of Syndiniales  (Bråte et al. , 2012) , became the most abundant group after removing sequences assigned to Syndiniales (Fig. 7 ). Radiolaria, a holoplanktonic amoeboid group with widespread distribution in modern oceans  (Suzuki and Not, 2015; Biard et al. , 2016) , are mainly heterotrophic protists with many mixotrophic species in the photic zone bearing endosymbiotic microalgae  (Caron et al.
The high copy number of 18S rDNA in Radiolaria may contribute to their high relative abundance in metabarcode datasets  (Vargas et al. , 2015; Gutierrez-Rodriguez et al. , 2019) ; however, it is unlikely to be responsible for their dominance, particularly in relation to dinoflagellates and ciliates, which are known to also have high copy numbers  (Gong et al. , 2013; Piredda et al. , 2017). Moreover, the positive relationship between cell length and 18S rDNA copy number  (Zhu et al. , 2005; Biard et al. , 2017)  and the higher C and 𝑁 density (mass: volume) of Radiolaria compared to other protists  (Mansour et al. , 2021)  suggest that gene-based relative abundance of these groups was likely reflected in their relative contribution to the total community biomass. Utilizing their sticky pseudopodia and large size, Radiolaria dwelling below the euphotic zone can effectively intercept sinking particles and act as flux-feeders influencing the quality and quantity of vertical fluxes  (Ohman et al.
Acknowledgements We acknowledge the crew and scientific complements of  RV Tangaroa  and  RV Kaharoa  for their efforts in facilitating the sampling throughout all the voyages included in this work. We thank  Els Maas  and  Cliff Law  for collecting DNA samples during KAH1303 voyage and for sharing the physical and chemical data obtained on this voyage. Thank you to  Daniel Vaulot  for critical feedback on PR2 references and assignation. We are thankful to the anonymous reviewers for their efforts and constructive comments that helped improve the manuscript. We are grateful to the  Royal Society of New Zealand  which funded this research through the  Catalyst Seeding General fund  (grant reference.
INTRODUCTION These days more devices are being connected to the Internet. The Internet enables users to access data and services with high availability. There are a plethora of cloud services that allow users to store their data online on a cloud server. Dropbox 1  and Google Drive 2  are two well-known examples of such cloud services. More companies are shifting towards the usage of a cloud environment to provide their services to their customers. Setting up such an environment these days is also not difficult as there exist tools that can be used to quickly set up a cloud environment. A set of detailed instructions is provided by the tools to guide developers during the setup. Kubernetes (K8s)  3  is an example of such a tool that provides instruction on how to set up a cluster and use it to deploy different services.
Though the tools make it easier for a company to deploy a cloud environment and use it to provide their services to their customer, it is equally important to keep this environment secure from any malicious actor that might want to gather private (confidential) data from the customers or take down the whole environment. In this respect, microservice-based applications must be monitored at runtime to identify anomalous behaviours that occur during their operations. This requires having a constantly updated view of the actions and events happening and then comparing them to an expected model of operation. Logs and network traffic information such as NetFlow can be collected and monitored by the services running within the environment. The challenge here is to show how to deal with the large volume of log/NetFlow data that are generated by the services.
In recent years, the utilisation of RNNs or DNNs to detect anomalies that occur during the runtime of a software system has been a trending approach investigated by many researchers  [7, 14, 19, 24]. A neural network can be trained with the log data or NetFlow data produced by the applications to model the behaviour of the applications. While it has been shown that using this approach can detect anomalies with high accuracy, it is not clear how to explain the classification decisions made by the neural network. Furthermore, it is also not clear how the neural network should be interpreted  (and visualized)  to understand the behaviours that are modelled. Not being able to understand or explain the decisions that are made by a model could lead a company to not adopt these models in practice as there might be legal/regulatory compliance requirements that they need to follow.
In this work, we provide a novel anomaly detection approach that uses a passive-learning approach to learn probabilistic state machines from the NetFlow data gathered from a K8s cluster. The state machines are used to model the normal network behaviour of the services running with the cluster. Large deviations that are detected within the models are considered to be suspicious and an alarm should be raised. We show that we can use state machines to model the runtime behaviour of a K8s cluster and detect attacks that were launched against the cluster. The remainder of this paper is structured as follows. Section 2 addresses related work and positions our work. Section 3 introduces different approaches to model attacks in K8s. Section 4 details the approach using the learning of probabilistic state machine models to detect anomalies in the cluster.
Kubernetes threat matrices These sophisticated attacks usually consist of several steps that may require the detection of different indicators (e. g. , malicious network traffic, CPU overload, mounting sensitive directories) to identify specific attack patterns. As of today, the correlation of data from different sources remains complex. The MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) (adversarial tactics, techniques, and common knowledge) framework is an up-to-date database of attack techniques grouped by objectives known as tactics. The ATT&CK framework, originally generic, has been specialised for K8s, highlighting multi-stage cyber-attack patterns and techniques that attackers can use to infiltrate and perform damage on K8s clusters  [15]. The threat matrix is made up of ten distinct families of tactics that an attacker can combine to reconstruct and exploit possible attack paths, e.
METHODOLOGY The novel state anomaly detection approach presented in this work learns a state machine model from the NetFlow data collected from the K8s cluster. As it is an open challenge for using this approach on microservice architectures, we formulate the following research questions: • RQ1: How can state machine models be used for anomaly detection on a K8s cluster? • RQ2: How effective are the state machine models for detecting anomalies on a K8s cluster? We first answer RQ1 in the following subsections.
State-Machine Learning For this work, we use Flexfringe to learn Probabilistic Deterministic Finite Automaton (PDFA)s from the NetFlow data gathered from a K8s cluster as this framework provides us with the ability to use different state-merging heuristics for the learning of PDFAs. The goal is to use Flexfringe to learn a PDFA that models the normal behaviour of the K8s cluster. Any large deviation in the behaviour is considered as an anomaly and an alarm is raised. 4. 1. 1 Probabilistic State Machines. State machines or automata are mathematical models that are used to model sequential behaviour and they can be either deterministic or non-deterministic. In the former one, the automaton can only switch to the next state if a symbol a i has been read from the input; thus an automaton cannot change state if no symbol has been read from the input.
CLUSTER ENVIRONMENT SETUP The state-of-the-art lacks representative datasets and relevant runtime examples, mostly due to the privacy and operational specificity of deployed systems in operation. Therefore, we designed an opensource microservice orchestration testbed to collect real-world traffic and evaluate our methodology. Multi-step attack scenarios were then deployed, exploiting vulnerabilities of the platform or the applications. We generated a labelled dataset with mixed background traffic generated by benign users and malicious traffic collected from the generation of the attack scenarios.
g. , get/list/exec pods located under the same namespace of the currently compromised pod. (4) Lateral Movement: the attacker uses this information to move to another pod that has root privileges. (5) Privilege Escalation: deploying a pod to own the node, e. g. , enabling the "hostPID" parameter to remove the isolation and the "nsenter" command to give low-level access to handle the Linux kernel namespace subsystem. The attacker then breaks out of the container and gains root in the host. (  6 ) Persistence: two variants corresponding to different persistent levels are deployed. First, a daemon set resilient to container restart but not to deployment deletion is created; then a Docker container is deployed outside the cluster, thus resilient to the entire cluster recycling. (1) Initial access: attacker able to communicate remotely with the pod hosting the vulnerable OpenSSH server.
(2) Execution: the remote attacker simultaneously sends 1000 requests with very long passwords to the front end pod, to cause a CPU overload. (3) Impact: the CPU is overloading as it receives many simultaneous requests. With the K8s Metrics Server  [22] , we identify that the CPU overload comes from the front end pod running the OpenSSH server. The memory of this pod goes from 10 to 150 MiBytes and from 5 to 550m CPU cores, only 5 seconds after launching the attack. Scenario 3: Malicious code in workload. This scenario illustrates how an attacker can open a container shell through an RCE vulnerability in a Joomla application. The attacker then deploys malicious code in workload, e. g. , a bitcoin miner in the cluster. (1) Initial access: exploiting the CVE-2015-8562 vulnerability  [17]  on Joomla, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header; (2) Execution: RCE attack deployed by unauthenticated remote attackers to gain instant access to the target server on which the vulnerable Joomla core version is installed.
Data collection To compensate for the lack of representative datasets, we generated our own labelled dataset collected on the microservice orchestration testbed. The objective is to collect both background traffic, produced by benign users with realistic behaviours, and malicious traffic simultaneously. A data collection session has been organised for two hours: during the first hour, thirty benign users were using the applications on the K8s testbed, generating background traffic, and during the second hour, the attack scenarios were deployed on the cluster while benign users were still using the applications. Then, the training set is composed of traces collected during the first hour, and the test set is composed of traces collected afterwards. Traces were manually labelled depending on the IP addresses of users and the timestamps of attacks.
Performance Results The state machine model was trained on the NetFlow data that were gathered before the attacks were launched against the K8s cluster. When creating the traces, we have sorted the NetFlow data in four different manners: connection, source host, destination host and timestamp of the flows. The intuition for sorting the NetFlow data in different manners is that some behaviour might only be seen when a particular sorting level is used. We have computed the performance results of our approach using each of the different encodings that we have mentioned in Section 4. For comparison, we have trained an isolation forest with 100 estimators on the same training data that was used to learn our state machine model. We have used the isolation forest that is provided by the scikit-learn machine-learning package  4.
CONCLUSION & FUTURE WORK In this work, we presented a novel anomaly detection method that uses a state machine model to detect anomalies within a K8s cluster. To the best of our knowledge, this work is the first that tries to apply state machine models to microservice architectures. The state machine model was learned from NetFlow data gathered from the K8s cluster when it was used normally. We have set up an experiment in which we launched three different attack scenarios on the cluster. Using our state machine approach, we managed to detect all three attack scenarios, achieving a balanced accuracy of 99. 2% and a F 1 score of 0. 982. For our future research directions, we would like to use other types of log data gathered from the cluster to learn our models as currently we only use the NetFlow data.
Different types of log data contain different types of information that are useful to learn a more accurate model. We can assess whether using another type of log data or a combination of different log data can help us learn a more accurate model. Furthermore, we also want to use other datasets to evaluate whether our approach is generalisable and can be applied to other types of systems as for this work we have only used data that were collected from a K8s cluster to run our experiments. This future research direction also allows us to compare our approach to other existing approaches.
Modern epidemiological analyses to understand and combat the spread of disease depend critically on access to, and use of, data. Rapidly evolving data, such as data streams changing during a disease outbreak, are particularly challenging. Data management is further complicated by data being imprecisely identified when used. Public trust in policy decisions resulting from such analyses is easily damaged and is often low, with cynicism arising where claims of 'following the science' are made without accompanying evidence. Tracing the provenance of such decisions back through open software to primary data would clarify this evidence, enhancing the transparency of the decision-making process. Here, we demonstrate a Findable, Accessible, Interoperable and Reusable (FAIR) data pipeline. Although developed during the COVID-19 pandemic, it allows easy annotation of any data as they are consumed by analyses, or conversely traces the provenance of scientific outputs back through the analytical or modelling source code to primary data.