dataesr/scientific-paragraphs-categorization huggingface dataset:
Note however, that this dataset is a bi-hemispheric hybrid fusion of CoCoMac and DSI data. The cortical parcellation (see Fig. 1 ) is custom made and partially based on the CoCoMac neuroinformatics database  (Kötter, 2004; Kötter and Wanke, 2005; Bakker et al. , 2012). By default only the cortex is represented and other gray matter structures beneath it have been stripped off. Each hemisphere consists of 37 cortical regions whose labels are listed in Table  4. We nevertheless think that subcortical nuclei like the basal ganglia, the hippocampus and the amygdala that, together with the thalamus, modulate the processing of information by the cortex should be taken into account for building a complete BNM. To be clear, when we speak about a connectome in this work we refer to a parcellated connectome constituted of two matrices: • the weights matrix, a weighted directed graph.
In TVB's demonstration dataset this is asymmetric, as can be seen in Fig. 2a , as it makes use of directional information contained in the tracer studies of the CoCoMac database. • the tract-lengths matrix (symmetric due to the fiber detection techniques used to extract the information being insensitive to directionality) is a weighted undirected graph. The matrix corresponding to TVB's demonstration dataset is shown in Fig. 2b. A summary of some metrics computed on The Virtual Brain's default connectome is presented in Table  3. The elements of the weights matrix are such that {∀u kj ∈ U v = 2 : u kj ∈ R ≥0 }. The symmetry (or lack thereof) is neither a modeling constraint nor an imposed restriction on the weights and tract-length matrices. The general implementation for weights and tract lengths considers full l × l matrices without any symmetry restrictions, where l is the total number of nodes in the network.
However, in the case of an asymmetric connectivity matrix, u kj , the convention to distinguish target (k) and source (j) nodes is the following 2  : To. from 0 1 2 … l 0 1 2 ⋮ l 1 1 0 1 0 1 1 0 1 0 1 0 0 1 0 1 0 1 0 1 0 0 0 0 0 0 B B B B @ 1 C C C C A : ð3: 1Þ The default weights matrix in The Virtual Brain is graded following the CoCoMac  (Kötter, 2004; K tter and Wanke, 2005)  database convention: (0) no connection; (1) weak; (2) moderate and (3) strong. The values of a weights matrix can vary depending on the tractography extraction methods employed  (Bastiani et al. , 2012; Iturria-Medina et al. , 2007 , 2011). The number of nodes in the parcellated or macroscopic connectome, and its influence on the network properties is a subject of debate  (Zalesky et al. , 2010a,b). Indeed, connectomes of different nodal size (e.
Outlook The Human Connectome Project (HCP)  (Essen and Ugurbil, 2012; Essen et al. , 2012b; Glasser et al. , 2013)  has undertaken the challenge to make thousands of datasets publicly available, making comparison of structural and functional connectivity across imaging modalities and across individual subjects easier  (Larson-Prior et al. , 2013). Other studies are attempting to validate the white-matter information extracted from tractography against tracing studies performed in postmortem tissues  (Seehaus et al. , 2013). Also, new methods to parcellate the gray matter based on myelin content have been developed  (Glasser and Essen, 2011; Glasser et al. , 2014)  in order to determine regions of interest on the cortical surface (i. e. , detecting sharp transitions in myelin content allows an identification of cortical areal boundaries).
Fig. 19 , displays a collection of parametric curves with respect to w, while I o has been set to a 0. 325. The region inside the two solid horizontal black lines has been enlarged and is displayed on the right panel to better appreciate the change in the geometry of the nullclines with respect to w. The code to reproduce the illustrations in Figs. 18 and 19 is under the form of an ipython notebook. Access the site http://nbviewer. ipython. org/github/ the-virtual-brain/tvb-library/blob/trunk/tvb/simulator/doc/tutorials/ Tutorial_Exploring_A_Model_ReducedWongWang/Tutorial_Exploring_ A_Model_ReducedWongWang. ipynb to see it.
The number of nodes depends on the chosen anatomical structure on which a simulation is based, while the number of state variables as well as the number of modes depend on the chosen local dynamic model. The Monitors implemented in The Virtual Brain come in two main types (i) simple data reduction, and (ii) biophysical measurement processes. The simplest possible Monitor, referred to as the "raw" Monitor, does precisely nothing to the simulated data, that is, it just returns all the simulated data, i. e. , all nodes, state-variables, and modes sampled at the integration time-step. This, obviously, provides no data-reduction at all and so should only be used for short (temporally) simulations. It is primarily of use for verification of models and simulations, as well as for d 12 m 3 o 1 n n 1 = 2, n = 4, n 3 = 4 + 2 c var v 2 , v 3 or v 6 s var γ 1 , γ 2 or γ 4 voi BOLD v 2 -v 3 , v 4 -v 5 , or v 6 and v 7 voi M/EEG v 2 -v 3 α bif P, Q, U Classification voltage-based the numerical component of detailed mathematical exploration of the underlying dynamical system.
, 2000)  (see derivation in Appendix D); 2. a Gamma function as presented in  Boynton et al. (1996) ; 3. a difference of two damped oscillators as presented in  Polonsky et al. (2000) ; and 4. a mixture of gamma functions, similar to the kernel implemented in SPM  (Friston et al. , 1995). Gamma function cf. Eq. (3) of  Boynton et al. (1996)  A single gamma function has been shown to provide a reasonably good fit to the BOLD impulse response, though it lacks an undershoot. This HRF, h(t), was estimated from data in contrast studies of human V1. h t ð Þ ¼ t τ n 1 exp - t τ τ n-1 ð Þ! ð4:16Þ where τ = 1. 08 is a time constant, and n = 3 determines a phase delay. Values are those found in Fig. 10  in  Boynton et al. (1996). d 18 m 2 o 3 n 3 ξ, η, τ, α, β, γ c var ξ s var ξ, α voi BOLD ∑ k o ξ k -α k voi M/EEG ∑ k o ξ k V v = 2 V v = 1 α bi f K 11 , K 12 , K 21 , μ, σ Classification Voltage-based -phenomenological Mix of damped oscillators h t ð Þ ¼ exp t τ 1 sin 2π f 1 t ð Þ -a Á exp t τ 2 sin 2π f 2 t ð Þ ð 4:17Þ Parameters as found in  Polonsky et al.
Mixture of gammas A HRF can also be described by the difference of two gamma probability density functions similar to the one found in the SPM software package  (Friston et al. , 1995). h t ð Þ ¼ λt a 1 -1 exp -λt Γ a 1 ð Þ -0:5 λt a 2 -1 exp -λt Γ a 2 ð Þ ð4:18Þ Current trends in hemodynamic modeling based on physiological processes try to relate neuronal activity to observed BOLD signals more precisely  (Drysdale et al. , 2010; Aquino et al. , 2012; Biessmann et al. , 2012). In general, canonical HRFs have been derived from measurements in normal adults V1 area  (Boynton et al. , 1996; Shmuel et al. , 2010) ; or primary visual cortex and extrastriate visual areas  (Polonsky et al. , 2000). However, these solutions are limited and may give a poor representation of BOLD signal prediction. Some studies have demonstrated significant variability in the HRFs: between-regions within a subject in one scan  (Miezin et al.
MEG MEG is a non-invasive technique that detects magnetic fields due to currents flowing in the outer layer of the cortex  (Hämäläinen et al. , 1993) , that is, MEG sources are the primary current associated with the ion transport at the stimulated neurons and the passive ohmic current (volume current) in the surrounding medium which completes the current loop. In other words, MEG measures the magnetic fields caused by electrical current dipoles that are generated by neural activity. The MEG dataset provided in TVB represent an array of SQUID (Superconducting QUantum Interference Device) sensors arranged on top of a whole-scalp helmet system comprising 150 channels. Different sensor layouts can be used together with the subject's head model to produce the corresponding lead-field matrix. In general, the head is represented as a spherical conductor and the primary current as an equivalent current dipole inside the conductor.
The first one is the meshresample function from iso2mesh  (Fang and Boas, 2009). The second one is the reducepatch function from Matlab. Differences are immediately visible: the simplified surface produced by the first method is a smooth mesh that has been regularized, and the triangle size distribution is narrow. The main drawback is the considerable reduction (~23%) of the total surface area. The second method, the default decimation method used in brainstorm, yields a surface with a wide face area distribution, while considerably preserving the total surface area. The loss is only about 3%. A third alternative is proposed by brainstorm, reducepatch plus a constraint to split large triangles. However, this last method yields a mesh full of holes. The resulting simplified mesh was not repaired and thus it is not shown here.
The Jets&Poudres code overview The GENeral MIXing (GENMIX) computer code has been developed by Spalding and Patankar  [19]  to solve 2D parabolic ODE by FD method and was known as the Bikini method because it requires a very low-cost memory and computing time. GENMIX code simulates steady flows predominantly in one direction, without recirculation or diffusion effects in that direction and in LTE. The clever software embodies a self-adaptive computational grid, which enlarges or contracts to cover only the regions of interest, which explains the small need of computing time (less than two seconds of plasma jet computing). The fast software Jets&Poudres  [10]  was built on the GENMIX code and upgraded by using thermodynamic and transport properties closely related to the local temperature and composition of the plasma.
The Jets&Poudres settings The models of PSP implemented in the Jets&Poudres software take into account the spray instance (combustion flame or standard plasma gun) with parameters related to power and gun. The program allows calculating many jets fields such as temperature, pressures and velocity and determines the dynamic and thermal history in each point for single particle; it allows assessing if the in-flight particle was partially/completely melted, the percent of molten material used subsequently to investigate the coat formation or the splat morphology  [20]. The model Jets&Poudres forecasts the dynamic  [21]  of a single or multi particles fed in a plasma jet. Its aim is not to forecast a result very close to experiment but to compute rapidly the parameters of the plasma spray, to present synthetic and explicit results and to give the tendencies and phenomena orders of magnitude.
Code credibility Even the Jets&Poudres code was extensively used and validated on cases of plasma gases, operating conditions and Fig. 3. Axial velocity and temperature of sprayed ZrO 2 particle vs axial distance. LAVA  [22]  softwares predictions and experimental data of Smith et al. [23]  are plotted as references. (*) for thin model is used and (**) for thick model. spraying conditions and have compared very well experimental and many CFD codes such as ESTET-3. 4 (see  [21] ). We conduct here a plasma spraying case on ZrO 2 particle injected in Ar-H 2 plasma. The results of our model are compared to the predictions of the code LAVA (Wan et al. [22] ) and the measurements of Smith et al. [23]. The thick and thin models (with/without conduction phenomena inside the particle) of the software Jets&Poudres are considered in this comparison.
In our experiments, we analyzed the network communication of over 30 million samples, submitted between 2008 and 2014. Our system identified 1. 08 million (roughly 3. 6%) that connected to at least one publicly routable Amazon EC2 IP address. These IPs were associated to 12,522 distinct cloud-based domains. Interestingly, we observed that over the same period, only 32, 225 samples connected to Microsoft Azure. Due to the relatively low number of samples that interacted with Azure, we only focused our study on Amazon EC2. To summarize, the paper makes the following contributions: -We present the first systematic, large scale study on the use of public cloud services by malicious software. -We perform a precise categorization of each cloud access, separating the cases in which the malware samples simply rely on legitimate services which happen to be hosted on the cloud, from the cases in which part of the malware infrastructure is hosted on the cloud.
Then, it further extracts and analyzes the DNS features and the content of network communications between the malware and the EC2 machines. A major challenge in our study is that domain names extracted from the Anubis database do not only include dedicated malicious servers, and so we cannot simply mark as suspicious every connection toward a cloud-based IP address. In fact malware often contacts other public and benign cloud-based services, such as IP lookup services, advertisement websites, and URL shortening. These services are not part of the malicious activity and therefore need to be identified and discarded from our subsequent analysis. On the other hand, real malicious domains may have been sinkholed by security organizations at the time the malware was analyzed in Anubis. Malware will be thus redirected towards sinkhole services that are sometimes hosted on EC2, Fig.
1 : Architecture of our platform even though the original domains may have not been hosted on the cloud. Our system filters these cases and does not consider them as cloud-related malicious activities. Finally, in our experiments we discovered that many malware samples were adwares that leverage pay-per-install (PPI) services hosted on Amazon or other cloud providers. PPI services allow software publishers to pay affiliates by the number of installations that they perform on target machines. Caballero et al. analyze in  [8]  the modus-operandi of PPI services and measure their use for malware distribution. Although the use of PPI services to distribute malware still constitutes a malicious activity, PPI services are not malicious per-se, and so they need to be discarded from our dataset as we only focus in this paper on dedicated malicious services that were hosted on EC2.
Platform Description To setup our experiments, we designed and implemented the platform illustrated in Figure  1. Our system consists of two main components: the samples selection and the feature analysis modules. The first extracts from the Anubis database all malware samples that exhibited at least one network connection towards the Amazon cloud. During the period of our study, we identified 1. 08 million malware samples that satisfied this criterion. The samples selection module further discards samples that have contacted benign public services hosted on EC2, and keeps only dedicated malicious services as input to the feature analysis module. Finally, the feature analysis module classifies the remaining malware samples and analyzes their dedicated malicious services hosted on cloud. Samples Selection.
The samples selection module aims at building a database of malware samples that, during their analysis, connected to malicious services hosted on EC2 -as well as the domain names or IP addresses that were associated with these services. Malware Scanner: this module first extracts from Anubis all malicious samples that interacted with EC2 machines. We seed this module with the list of publicly routable IP ranges that were associated to the Amazon cloud in the year in which the analysis was performed. During the six years of our study, we identified 1, 079, 318 distinct samples that connected to EC2. The first thing we noticed in our experiments is that a large number of samples in our dataset were executables that leveraged pay-per-install (PPI) Table  1 : Top 20 PPI services in our dataset services hosted on EC2.
PPI services have recently emerged as a key component of modern cybercrime and miscreants often refer to these services to outsource the global distribution of their malware. They supply PPI services with malware executables, which in turn charge them for successful installations based on the requested features for the desired victims. PPI service providers operate directly or through affiliate programs. They develop downloaders that retrieve and run the requested software (possibly malware) upon execution on the victim computer. To identify PPI downloaders in our dataset, we refer to multiple public sources such as PPI forums  [1]  and public PPI web sites. The main challenge in our case was to identify the different PPI brands, since there are new brands that constantly appear over time.
In order to address this challenge, we analyzed the public PPI services that were mostly contacted by the samples in our dataset, and we tried to infiltrate these services by supplying a small program we developed for distribution. By testing and manually reverse engineering the resulting installer we developed a set of 13 distinct network signatures that match the download URLs associated with different families of PPI services. By using these signatures on the malware traffic we could further discard their associated samples in our dataset. As illustrated in Figure  2 , we were able to discard 1, 003, 289 PPI downloaders, which corresponds to up to 93. 2% of our initial dataset. Table  1  summarizes the top 20 PPI domain names that were contacted by malware in our dataset and the number of samples that were associated with each service.
In addition to PPI downloaders, our dataset also includes benign files that were submitted for analysis in Anubis. In fact Anubis is a public service where Internet users freely submit suspect files for analysis. These files may turn out to be benign files that connect to benign cloud-based services and so they also need to be discarded from our dataset as they do not belong to the malware category. Since our dataset covers a period where the most recent samples are few months old, we use anti-virus (AV) signatures to identify and discard benign Fig. 2 : Composition of our malware dataset samples. We refer to public services such as VirusTotal 5  to scan our dataset, and we consider as benign files all samples that are detected by less than five AV editors. Our dataset finally includes 45, 422 confirmed malicious malware samples.
Domain Filter: The domain filter module further discards from our dataset all domains that are associated with benign cloud-based services. Although these domains supply public Internet services that can be used by malware, they are not part of dedicated malicious services. Out of the initial set of 12, 522 distinct EC2-based domain names or IP addresses, the malware scanner discarded 8, 619 associated to PPI services or that were also contacted by benign programs. The domain filter classifies the remaining 3, 903 domains into four categories, as illustrated in Table  2. The first category includes public benign services that were contacted by malware. We found multiple examples in this category, including public IP resolvers (e. g. hostip. info), advertising and affiliate services, file sharing (e.
g. dropbox), URL shortening (e. g. notlong. com), and multiple other free services (e. g. about. me, spring. me). To identify known public services in our dataset, the domain filter leverages multiple sources such as the Alexa list of top domains, public repositories that provide URL shortening services (e. g. bit. do) and file sharing 6. We also refer to AV labels in VirusTotal in order to identify generic adwares. The domain filter module identifies as advertisement services all domains that were only contacted by Adwares samples. To be conservative, these domains were classified by our system into the public services category. The second category includes domain names that have been sinkholed, and so they were redirected to sinkhole destinations that are hosted on the cloud. EC2 hosts multiple sinkhole destinations that are used to subvert BOT communications with their remote C&C domains.
These domains were not originally hosted on EC2, and so they need to be discarded from our dataset. We leverage the X-sinkole HTTP header 7  in order to identify sinkhole destinations in our dataset. The last two categories include both dedicated malware domains and domains that were once infected and temporarily used as part of the malicious infrastructure. The separation between these two categories is more difficult and more prone to errors. Our system relies on multiple empirical observations in order to discriminate between the two cases. First, we assume that dedicated malware machines that were hosted on EC2 more than one year ago have all been detected or abandoned at the time we run our experiments. We show in Section 3 that this is a reasonable assumption, consistent with the average lifetime of dedicated malicious domains hosted on EC2.
For these, we also analyzed the content of their network communications. Almost 90. 3% of these samples used the standard HTTP protocol (either GET, POST, or HEAD methods). Few samples were IRC bots (19 distinct samples) and spam bots (136 distinct samples) that connected to malicious IRC and SMTP servers hosted on EC2. The remaining samples belonged to the Zeus version 3 and the Sality peer to peer (P2P) malware families, and were using the UDP protocol to connect to malicious P2P services hosted on EC2. Feature Analysis. The analysis module processes the output dataset provided by the feature extraction module in order to extract main trends. First, it clusters malware families according to their antivirus labels, in order to figure out whether there exists a general trend towards moving malware infrastructures into the cloud, or whether this phenomenon is limited to some specific malware families.
Experiments The dataset provided by the feature extraction module (as described in Table  2 ) allows us to analyze both the malware families that are using EC2 cloud services in some capacity, as well as the distribution and lifetime of malicious domains that are hosted on EC2. Therefore, a first question that we would like to address in this section is whether the use of public cloud services is still limited to a small set of malware families, or whether it can be generalized to different families of malware. A straightforward approach to answer this question is to analyze the 8, 867 distinct malware samples that we found to be connecting to dedicated malicious EC2 machines. Since our dataset includes malware samples that are at least few months old at the time we run our analysis, we believe it is reasonable to use AV labels as a reference to understand and classify our dataset.
AV It is well known that different AV vendors assign different labels for the same malware sample. For example, the SpyEye malware can be identified by Kaspersky as Trojan-Spy. Win32. SpyEyes, and by McAfee as PWS-Zbot. gen. br. To limit the impact of such inconsistencies, we applied a majority voting to assign the labels to our dataset. In order to do so, we pre-process each label by splitting it in multiple elementary keywords according to non-alphanumeric characters We then discarded common prefixes such as W32, Mal and Trojan, as well as Generic malware identifiers, such as Heur, Worm, Gen, and malware. To handle malware aliases, we referred to multiple public sources such as the spywareremove website  9  to group together all aliases of a given malware family. For example, the labels win32.