dataesr/scientific-paragraphs-categorization huggingface dataset:
Nowadays, software and system development is a more complex process than ever was and it faces challenges, where security became one of the most crucial. Based upon coengineering in the AQUAS project, complex standards covering development processes regarding safety, but performance and security are missing. In the paper, the representative standard for Industrial Automation and Control Systems (IACS) is selected for gap analysis, both as examples of issues in coengineering in security and performance, and possibly for evolution and extension in security standards. For IACS, the ANSI/ISA 62443 defines procedures for implementing security requirements. Based upon co-engineering in the AQUAS project and experience from the real implementation of security by TrustPort practitioners of this domain, the paper introduces the 62443 standard gaps analysis with the goal to identify the missing part.
A. Security for industrial automation and control systems Part 3-3: System security requirements and security levels The ISA99 standard, part of the ISA-62443 series, provides detailed technical control System Requirements (SRs) associated with the seven Foundational Requirements (FRs) described in ISA-62443-1-1 (99. 01. 01) including definition of the requirements for control system capability security levels, SL-C (control system). These requirements are to be used by members of the industrial automation and control system (IACS) community along with the defined zones and conduits for the System under Consideration (SuC) while developing the appropriate control system target SL, SL-T (control system), for a specific asset. ISA-62443-1-1 (99. 01. 01) defines seven FRs: 1) Identification and authentication control (IAC) 2) Use control (UC) 3) System integrity (SI) 4) Data confidentiality (DC) 5) Restricted data flow (RDF) 6) Timely response to events (TRE) 7) Resource availability (RA) These seven requirements are the foundation for control system capability SLs, SL-C (control system).
III. METHODS We are using an extensive Secure Software Development Life Cycle catalogue containing security requirements together with the advanced modelling framework TTool based on UML/SysML-Sec for performance analysis  [14] , see Fig. 1. Also, we are using experience from the combined analysis of Security and Performance using SSDLC and TTool (https://ttool. telecom-paristech. fr/) applications for Interference Analysis in UC4 (Industrial drive, AQUAS project)  [17].
S. National Institute of Standards and Technology and the U. K. National Cyber Security Centre recently reversed their long-standing advice on password policies, acknowledging that policies previously considered "most secure" (complex passwords, changed frequently) caused users to invent workarounds that undermined authentication  [15] [25]. This gap is solved partially for particular requirements using Secure Software Development Life Cycle catalog, and containing security requirements together with the advanced modelling framework TTool based on UML/SysML-Sec. This approach  [16] [17] can help discovering interconnections between the security requirements (security) and its impact on the final system response (performance) during the development stage. Basically, SSDLC helps selecting security mechanisms that could answer to security requirements, see Fig 2.
g. attacks) of particular requirements are missing. Based on co-engineering in AQUAS project, the methods for verification (attacks) were described for particular requirements in SSDLC. There are as follows: a) Valid message during flood attack 1. The evaluator performs flood attacks containing only valid messages targeted to data inputs. The maximum power is given by the maximum capacity of the connected interface. 2. The evaluator performs a flood attack for 50 % of the input capacity and verifies the system functionality by sending a valid message. 3. The evaluator performs a flood attack for 75 % of the input capacity and verifies the system functionality by sending a valid message. 4. The evaluator performs a flood attack for 100 % of the input capacity and verifies the system functionality by sending a valid message.
Related Work Policy management and deployment in NFV architecture have recently been the topic of several researches. Many approaches have been proposed to define and enforce security policies over NFV architecture to ensure their security. Basile et al. propose in  [4]  an approach aiming to provide specific security properties over Virtualized networks. This approach relies on a new software component called Policy Manager to handle high-level security policies specified by the users and refine them into configurations for specific VNF. Unfortunately, this approach does not specify what kind of properties can be handled and how these required security property are refined to deployable configurations. In  [14] ,  Montero et al. propose a user-centric model named SECURED, allowing to express and deploy security policies to protect users' security in NFV.
Due to its user-centric characteristic, the proposed model is completely oriented to protect users' security when interacting with NFV network services and cannot be used to secure NFV network services themselves. In FlowIdentity  [24] , a Virtualized network access control function using OpenFlow protocol is proposed. It is a solution for network access control in SDN architectures with policy enforcement over a stateful role-based firewall on OpenFlow switches. Unfortunately, the proposed approach is deeply dependent on the SDN architecture and thus cannot be directly used in an NFV architecture. To overcome the previous limitations, Leopoldo, et al. propose ACLFLOW  [13]  that is a Network Functions Virtualization (NFV)/Software-Defined Networking (SDN) security framework allowing to translate regular ACL rules into OpenFlow filter rules.
ACLFLOW optimizes the evaluation of ACL rules by prioritizing the most popular rules to accelerate switching operations. Unfortunately, ACLFLOW cannot be used to enforce more advanced access control policy models such as Role Based Access Control (RBAC), Organization-Based Access Control (ORBAC), Attribute-Based Access Control (ABAC), etc. To solve multi-propagation problems of the concept of NFV such as verification and authorisation issues, Guija and Siddiqui  [7]  use the NFV-based SONATA Service Platform for authentication and authorisation mechanisms, specifically for Identity and Access control of micro-services in 5G platforms for services Virtualization, orchestration and management. This solution relies mainly on OAuth 2  [8]  and OpenID Connect  [19]  to form the implementation of the user management module allowing Role Based Access Control and Identity management to follow the centralized authorization approach.
The DTE domains o ftp server high d and o db server low d are respectively created by the transformation of the rules r 1 and r 3. After the transformation, o ftp server high d contains the ftp server having the security level high while o db server low d contains the database servers having the security level low. Finally, c t is a DTE type that will be associated to any access query satisfying the context C 1 , C 2 , and C 3 of the rules r 1 , r 2 , and r 3. Let us consider the access query AQ : S q = web client, O q = ftp server, A q = read, C q = {query time = 12 am} to be evaluated and performed on the considered system. According to our Fig. 1. Transformation from a specific policy to a DTE policy transformation method, AQ will inherit the domain of its subject, so it will initially belongs to the domain s web client high d.
OpenFlow Manager (OFM)  [2]  is an application that runs on top of ODL allowing to visualize OpenFlow topologies, program network traffic flow paths and gather network traffic stats. -OpenStack Infrastructure: OpenStack as a virtual infrastructure manager (VIM) layer is used to give a standardized interface for managing, monitoring and assessing all resources within VNF infrastructure. In addition, Fig. 3  illustrates the different steps that are implemented in order to deploy an access control policy on a VNF network service. In the following, more details on each step are given. -Onboard and deploy the network service (Steps 1 and 2): In these steps, Tacker uses the network service descriptor provided as an input to onboard and deploy the network service on the OpenStack infrastructure. -Access control policy parsing and transformation (Steps 3 and 4): In these steps, the access policy engine parses the VNF service descriptor, the security properties associated which the different VNF that compose the network service (e.
g. , security level, trust level, etc. ), and the access control policy to be deployed. Then, it transforms the access control policy to a DTE policy as described in Definition 3. -DTE policy refinement (Steps 5 and 6): The ACE engine queries Tacker to get the set of resources (e. g. , VMs, Connection points, networks, etc. ) that are used to deploy the different VNF that compose the deployed service. Then it refines the DTE-policy at the resources level of the VNF service. -Policy enforcement (Steps 7, 8, 9 and 10): To enforce the DTE policy, the ACE first uses Tacker to deploy VNF Filter which is a special VNF that implements a DTE engine we developed in python  [21]. Second, it loads the refined DTE policy to be enforced over the deployed VNF service on VNF Filter. Third, ACE updates the forwarding graphs of the deployed network service (as illustrated in Fig.
2 ) and uses OpenFlow Manager of ODL to make sure that all network flows exchanged between the VNF that compose the deployed network service will transit through VNF Filter. Once VNF Filter receives a network traffic, it starts by parsing the traffic to extract its source and its destination as well as the actions that are implemented by its content. Finally it uses the DTE engine to check whether the traffic is allowed to transit from its source to its destination i. e. , the actions that are implemented by the content of the traffic are allowed to be performed by the traffic source component over the traffic destination component. We experimentally evaluate the performance of our approach. Our access control engine prototype is hosted in a server running Linux with an Intel Xeon E5-2680 v4 Processor with 8 vCPU and 16 GB of RAM while our implementation of the VNF filter including the implementation of the DTE engine is hosted in a virtual machine running Linux having a processor with 2 vCPU and 2 GB of RAM.
sec level : high}, P R 1 = {file name : any}}, C 1 = {between 8am and 8pm}, D 1 = allow -r 2 = S 2 = {func : web server, sec level : high}, A 2 = write, O 2 = {P E 2 = func : database server, sec level : low, P R 2 = db name : service db}, C 2 = {between 8am and 8pm}, D 2 = allow -r 3 = S 3 = {func : web client, sec level : high}, A 3 = access, O 3 = {P E 3 = func : ftp server, sec level : high, P R 3 = file name : web conf ig}, C 3 = {between 8am and 8pm}, D 3 = allow According to Definition 3, the transformation of the policy SP to a DTE specification is illustrated using the schema in Fig. 1. Subjects S 1 , S 2 , of rules r 1 , r 2 are respectively represented in the transformation by the DTE domain s web server high d while the subject S 3 of r 3 is represented by the domain s web client high d.
Use of semantic resources Five main common data-related tasks regularly involve semantics: search, information extraction, data models, data integration and automated reasoning (Figure  1 ). Data search involves the use of indexes associated with keywords, either free or from semantic resources. Semantic keywords make it easier to avoid mistakes due to misspelling and enable the use of synonyms and possibly multilingual approaches. Information extraction, commonly done via text-mining, facilitates identifying elements and relations in the text that can be associated with controlled vocabularies, i. e. , named entity recognition. Data models act as a conceptualization of reality based on entities and their relations; a semantic data model relies on meanings, making FAIR easier to realize. Data integration refers to the harmonization and reuse of data created by others preserving the meaning when moving across systems.
Ontologies play a major role for data integration as they can provide rules to transform and harmonize data in a meaningful manner. Automated reasoning makes it possible to find out non-explicit content, leading to the discovery of new facts and knowledge. Based on the consideration that semantics is ubiquitous in tasks involving data, the group investigated the status of formal semantic resources for the agriculture domain. To this end, we used: a "Map of data standards for food and agriculture" (from now on "the Map") corresponding to a catalog of SRs and standards that later became the "Agrisemantics Map of Data Standards"  (Pesce et al. , 2018) , and the AgroPortal vocabulary and ontology repository  (Jonquet et al. , 2018b (Jonquet et al. , , 2018a)). To the best of our knowledge, the Map and AgroPortal are the only initiatives specifically addressing the agrifood domain.
, 2018; Pommier et al. , 2019). The reader can also refer to  (Harper et al. , 2018)  for an overview of use of ontologies in different agriculture databases and (Drury et al. , 2019) for a review of semantic resources in agriculture and examples of their application. The area of plant sciences seems to be the one for which the most SRs have been developed  (Cooper et al. , 2018; Pommier et al. , 2019). The reader can also refer to  (Harper et al. , 2018)     Given the fact that only few semantic resources are available in standard and machine-readable format, with expected consequences on the data interoperability and the activity of data researchers and practitioners, the group moved on to investigate real-life problems and bottlenecks that researchers and practitioners encounter when working with data and SRs, together with their wishes and/or proposed solutions.
We set up an open-ended question survey and a template to gather information 4   (Aubin et al. , 2017a; Baker et al. , 2017; Caracciolo et al. , 2019a). We asked for information on open problems, and ideas for solutions at different stages of development, including ongoing and future projects. We collected 20 use cases, 5 from institutions based in 10 distinct countries; 15 from Europe, 2 from North and 2 from South America, 1 from Asia. They were primarily from research organizations (15), with a handful from international (3), professional (1) and governmental (1) organizations. We found that different roles and backgrounds are involved in different tasks dealing with SRs, showing that the process of producing SRs is highly collaborative and requires various competencies. For instance: application developers and data managers (both as producers and users of SRs); information technology professionals and librarians; knowledge engineers and linguists (mostly producers); domain experts and researchers (producers, advanced users).
A large number of tasks (e. g. , creation, use, publication of a SR) and a great variety of tools were mentioned in the use cases. Typically, projects combine open source applications and ad-hoc in-house tools, while commercial solutions tend to support tasks for which no equivalent free open source software is available. Almost half of the use cases mentioned Semantic Web technologies, especially the use of triple stores (i. e. , databases specialized in the storing and querying of RDF triples). We analyzed the tasks mentioned across the different use cases, particularly regarding requirements that should be supported or enabled by tools. Four main areas and corresponding needs emerged: (i) Tools supporting creation and maintenance of SRs should include different types of users performing different editing phases, favoring visual and collaborative approaches, and allowing connection to existing SR catalogs or repositories so that they can be easily integrated and re-used.
(ii) Mapping between SRs (i. e. , correspondences between two SRs) should be supported by tools with an intuitive user interface and implementing state-of-the-art mapping algorithms, together with best practices guidance in the mapping process and a minimum of validation for the mappings created. Ideally, mapping should be also supported for non-SRs (e. g. , via spreadsheets). (iii) An effective use of SRs in data related applications requires lowering the barrier for non-semantic experts by, for instance, using human-readable labels rather than only identifiers, complemented with services and metrics on SRs usage. (iv) Finally, discoverability and availability of SRs aligned with the F and A in the FAIR principles which involves means to create global, unique and persistent identifiers together with some associated metadata on provenance, format, version and so on.
Whenever possible, such type of metadata should be generated automatically rather than relying on manual processes carried out by data curators (for example, information about data format, mapped resources, or previous versions of a given dataset, could be extracted automatically). From our analysis on the use cases, we identified three main messages: 1. Tools designed to work with SRs should be accessible to non-ontologists. This implies that more attention should be paid to graphical interfaces, support for validation, and for methodological guidance in each task. 2. Online platforms are needed to lift the burden of local (or ad-hoc) installations and maintenance from users or individuals. 3. Tools supporting common tasks involving SRs (e. g. , editing, format conversion, mapping, and documenting) should be integrated, or integratable, to form flexible and interoperable workflows to minimize the breadth of skills required to work with SRs.
These four cases are representative of the various ways in which the recommendations can be implemented -a large portal for SRs (AgroPortal), an initiative aimed at lifting domain specific SRs with Semantic Web technologies (Caliper), an RDF and OWL files editor (VocBench), and a platform enabling reasoning and data integration based on semantic technologies (k. LAB and ARIES). The Scientific and Technical Information Department (DIPSO) of the French National Research Institute for Agriculture, Food and the Environment (INRAE) is heavily committed to developing semantic resources like ontologies and thesauri for data related uses within the organization. In particular, INRAE's laboratory of Clermont-Ferrand, Technologies and information Systems for agricultural systems (TSCF), works on the use of sensor data -represented as linked open data-to improve agricultural practices and decision support  (Nguyen et al.
, 2020; Roussey et al. , 2019). The two National Research Agency supported projects, D2KAB and FooSIN, 8 respectively headed by University of Montpellier and INRAE, are explicitly relying on Semantic Web technologies and SRs in their processes from transforming agrifood data to knowledge. Two Dutch centers, the Wageningen Data Competence Centre (WUR) and the Dutch Techcentre for Life Science (DTL), are early supporters of data sharing and interoperability in agriculture, and implementers of recommendations on tools interoperability in the area of infrastructures for open science. The Global Open Data for Agriculture and Nutrition (GODAN), an international initiative aimed at promoting the production and sharing of open data in agriculture and nutrition, supports Agrisemantics 9 The Italian Council for Agricultural Research and Economics (CREA) is interested in the application of the Semantic Web technology stack (starting with RDF, including standard modelling, use of global identifiers) to improve the production and sharing of soil maps.
AgroPortal AgroPortal is a public repository of semantic resources (AgroPortal, release 2. 0, Sept. 2020;  Jonquet et al. , 2018b Jonquet et al. , , 2018a) )  reusing the NCBO BioPortal technology  (Noy et al. , 2009) , and offering ontology hosting, search, versioning, visualization, comment and recommendation. It enables semantic annotation and supports basic alignment features via a user web interface and web services. At the time of writing, the platform hosts 128 SRs, ranging from reference domain ontologies to important thesauri used in agrifood. AgroPortal primarily addresses the first three groups of identified user profiles, however, the platform is easily accessible for data managers too. We overview hereafter AgroPortal implementation of the Agrisemantics recommendations, for more details see Annex II.
AgroPortal relies on semantic web technologies and aims to facilitate discoverability and long-term availability of SRs (R37, R25 and R38); it uses RDF as a pivot language and transforms non-RDF SRs to alternative RDF files available for download and stored them in an RDF triple store (R29). AgroPortal is endowed with a REST web service API serving XML or JSON-LD content and facilitating automatic use of SRs and related services in data workflows (R1). Based on those services, content search, indexing and annotation tasks are supported (R27). Specific agrifood communities (e. g. , INRAE, Crop Ontology project, RDA WDI WG) are supported with customized facilities, such as SR grouping and interfaces (R19). 11 AgroPortal supports SR developers in using a unified metadata model based on a shared specification (MOD 1.
4  (Jonquet et al. , 2018b )) (R3) and, when available, metadata can also be automatically generated (R6). AgroPortal's SR metadata are mainly used to: (i) serve as a means to create connections to other existing catalogs, libraries and repositories (FAIRsharing, OBO Foundry, Ontobee, etc. ) (R10); (ii) assess SRs via analytical metrics (user reviews, projects, usage description, etc. ) (R22); (iii) help in determining the level of FAIRness of SRs (IDs, language, license, provenance, etc. ) which in the future will be done automatically. As a result, it will allow SR developers to make their SRs more FAIR and SR users to identify FAIR SRs (R14). Finally, AgroPortal supports basic 7 The up-to-date list of adopters can be found at: https://agrisemantics. org/#adopters/. 8 www. d2kab. org and https://ist.
VocBench 3 VocBench 3 ("VocBench" n. d. ) is a free and open source (R2) advanced collaboration environment for creating and maintaining ontologies, thesauri, code lists, authority tables, lexicons and link sets in compliance with Semantic Web standards recommended by the W3C (R25, 26, 27 and 28)  (Stellato et al. , 2015). VocBench is used to maintain vocabularies and ontologies in a wide number of domains, 13  including the agrifood sector (e. g. , at FAO, it is used to maintain AGROVOC and the vocabularies in Caliper; at INRAE, it is used to maintain vocabularies on ecosystems and biodiversity). The VocBench 3 project is funded by Action 1. 1 of the ISA2 Programme of the European Commission for "Interoperability solutions for public administrations, businesses and citizens". VocBench site contains documentation, download links and other references (R4).
VocBench fully meets the established requirements for data editing and consumption tools, supporting the profiles defined in Section 2. 3 (semantic professionals, data managers, policy makers) in fulfilling their job by respecting the requirements associated with their figures. As a software suite, many of the tools offered by VocBench are available as separate components that can be integrated in other software (R1). Depending on the standard being adopted and the type of user, the system provides several user-tailored facilities for easily modeling the needed resource (R5, R7, R26) and toggles or makes optional (with properly conceived default settings) various features (R8). Quality checking (R9) is provided by dedicated Integrated Constraint Validation tools (ICVs) and by support for SHACL shapes.