esa-sceva/satcom-chunk-collection huggingface dataset:
# Analysis of Lightweight Feature Vectors for Attack Detection in Network Traffic
## 6 Extracting Features from Encrypted Traffic
### How Encryption Affects the Discovered Relevant Features  
As shown in Table 1, four of the investigated feature vectors use the classic flow-key, which consists of srcIP, dstIP, srcPort, dstPort, and protocol. Extracting flows in the network according to this key requires access to port numbers; this is possible with TLS, but not possible if IPsec is used and TCP headers are encrypted. An exception is the AGM vector, which extracts flows only based on the srcIP.  
The UNSW Argus/Bro vector uses the classic flow-key and contains several features that require information from the TCP header (e.g., flags, sequence numbers, window size) and from application headers (e.g., HTTP and FTP commands). The application-based features are not available if data are encrypted (either TLS or IPsec). After the removal of the negligible features, the UNSW vector still requires relevant data that cannot be extracted from encrypted traffic (e.g., ct_flw_http_mthd).  
The CAIA vector uses the classic flow-key and contains TCP flags as features. The vector can be extracted if TLS is used, but the flow-key and the flag features are not available if IPsec is used. The reduced CAIA vector still contains some TCP related features, so it only works for TLS encrypted data.  
Consensus and TA vectors use port numbers as features, but all the other features can be extracted from the IP header. Since we removed port numbers from vectors due to their low relevance, the features of the reduced vector for both can also be extracted if IPsec is used. Nevertheless, both vectors use the classic flow classification that requires access to the ports.  
The AGM vector uses only srcIP for identifying flows, so classification can be done without access to TCP headers. The features in the original vector contain flag and port information; therefore, extracting such features requires access to TCP headers, which is not possible if IPsec is applied. In the reduced AGM vector, port-based features also remain as relevant features, so it is only suitable for TLS traffic. A summary of the compatibility between feature vectors and encryption methods is shown in Table 7.
## 2 The Literature Sources and Statistical Analysis
### Statistical Method and Result  
Data from the above-mentioned database were imported into and analyzed individually by CiteSpace (version 6.1.R2) software, which is a widely used tool for visual exploration of scientific literature provided by SOURCEFORGE software platform in San Diego, CA 92101, United States. The numbers of articles for valid sample data imported into the software were 125 and 142, respectively, as invalid ones were unformatted or information missed. Cluster and keyword co-occurrence analysis for articles in English and Chinese was performed individually and network maps were visually generated, to illustrate the development trend of key technologies and methods worldwide in the field of intelligent LHD as time went by. The results are shown in Figures 1 and 2, respectively. The keywords in the figures mainly come from both the original keywords of the literature and the those expanded based on the subject classification of the journal or database. The font size in the figure represents the occurrence frequency of the keywords. The larger the font, the higher the frequency of the keyword and the more research on it and vice versa. The horizontal position of the keyword represents the recorded year; the more left, the earlier it was paid attention to and studied. The words with a \"#\" symbol and serial number in the front are the cluster words; the smaller the number, the more keywords are included in the cluster.  
The figures can be analyzed as follows:  
1. As can be seen from Figure 1, the research in foreign countries about intelligent LHD could be traced back early to the 1990s and was mainly focused in 2007-2022. The keyword co-occurrence was not focused, shown as many scattered words with similar font sizes. If anything was summed up, the research topics about simulation prediction, dynamic model, algorithm, navigation and path tracking were relatively popular.
2. From Figure 2, the research about the intelligent LHD in domestic China was much later than that in foreign countries, beginning from about 2007 and mainly focused in 2009-2021, with hotspots mainly focused on key technologies, such as fuzzy control, remote control, autonomous driving, path tracking, environmental recognition, autonomous navigation and safe obstacle avoidance.
3. No matter whether at home or abroad, the research on intelligent LHD was scattered and not extensive. However, it is an undoubtedly important machine and would be one of the hotspots for the intelligent mining industry.  
Figure 1. Keywords co-occurrence network map of English literature about intelligent LHD.  
Figure 2: Keyword co-occurrence network map for Chinese literature about intelligent LHD.
###### Abstract  
Truscutaneous injection laryngoplasty is a well-known procedure for treating a paralyzed vocal fold by injecting augmentation material to it. Hence, vocal fold localization plays a vital role in the preoperative planning, as the fold location is required to determine the optimal injection route. In this communication, we propose a mirror environment based reinforcement learning (RL) algorithm for localizing the right and left vocal folds in preoperative neck CT. RL-based methods commonly showed noteworthy outcomes in general anatomic landmark localization problems in recent years. However, such methods suggest training individual agents for localizing each fold, although the right and left vocal folds are located in close proximity and have high feature-similarity. Utilizing the lateral symmetry between the right and left vocal folds, the proposed mirror environment allows for a single agent for localizing both folds by treating the left fold as a flipped version of the right fold. Thus, localization of both folds can be trained using a single training session that utilizes the inter-fold correlation and avoids redundant feature learning. Experiments with 120 CT volumes showed improved localization performance and training efficiency of the proposed method compared with the standard RL method.  
injection laryngoplasty; neck CT; vocal fold localization; deep learning; reinforcement learning; mirror environment +
Footnote †: journal:  
sequential decision process involving a finer pixel-to-pixel navigation combined with deep feature learning, thereby producing improved predictions [9; 10; 11].  
In this communication, we propose a RL-based method to localize the right and left folds in preoperative neck CT. Due to the existing RL formulation [8; 10; 11], the proposed agent takes sequential steps to navigate through the voxel space to finally converge to the target fold location. Starting from a random initial position, the steps are decided based on local features learned by a deep convolutional neural network (CNN). However, existing RL-based localization methods commonly require an independent agent to be separately trained for each target landmark. However, the vocal folds have high feature similarity as a result of laryngeal symmetry (see Figure 1). Moreover, they are located close to one another in the same area of the larynx. Therefore, redundant features would be learned during the separate training sessions of the two agents. Such training would also fail to utilize the high feature correlation between the folds.  
To benefit from the inter-fold similarity, we propose a mirror environment that allows for a single agent to localize both the RVF and LVF position. The agent localizes the RVF in the original volume and the LVF in the laterally flipped volume, essentially considering the flipped LVF to be the same target as the RVF due to laryngeal symmetry. In this mirror environment, the agent can be efficiently trained in a single session, avoiding redundant feature learning while improving localization performance by sharing correlated features from both the right and left folds during training.
## 5 Discussion  
### Incised Valleys Identification  
The exceptionally broad incised valleys often reach hundreds of kilometers [54; 55]. Some of them are more than 100 m deep [51]. Other identified depths are only ten meters,  
Figure 15: The RGB color blending time slice and Cosine of Phase seismic attribute cross-line through the incised channel, showing the evolution of three separate valley-fill stages: (**A**) accumulation of point bars throughout active fluvial sediments Lowstand Systems Tract (LST). (**B**) Transgressive sediments inactively forming reflection of onlaps against the channel walls. (**C**) Sediments of open-marine high stand covering the whole carved-valley complex. (**A1,A2**), (**B1,B2**), and (**C1,C2**) are simulation diagrams that show the incised valley evolution after [10; 16].  
such as those in References [24; 55; 56]. The shallow valley (<35 m) identified as a multi-storied channel deposit in this research shows a simple valley filling with single fluvial deposits on the base. These deposits are superimposed by valley deposits, such as estuarine facies, and covered with open-sea siltstones (Figure 15). The attribute slides in Figure 15 reveal the RGB color time slice with an accumulation of point bars throughout active fluvial sediments interpreted as low stand, as in slide (A). Transgressive sediments inactively form a reflection of onlaps against the channel walls, as shown in slide (B). Slide (C) explains sediments of open-marine high stand covering the whole carved-valley complex. However, simulation diagrams in (A1, A2), (B1, B2), and (C1, C2) are illustrated, showing the incised valley evolution from the bottom (A1, A2) to the top (C1, C2).  
This research's standard method to interpret the river systems as a sub-surface carved valley, as seen at \(-138\) ms (Figure 5E,F) and observed within DS.1 (Figure 3B), is listed below. The incision of the valley is displayed in the 2D seismic cross-section and 3D time slices:  
1. The tributary channels' existence passes through the floodplains, as shown in Figure 10, resulting in an abandoned floodplain and functioning as interfluves [7].
2. The interpretation of the abandoned floodplain relies on the sequences regional slope towards the incised channel and channel belt (Figure 9) and the absence of higher topographical levees, in addition to the over-bank presence.
3. The point bar tops that lay at the middle height of the interfluve, as shown in Figures 8 and 15, and paleoenvironmental situation, all revealing that the river could not overtop the precursor floodplain even at the maximum flood phase.
4. The presence of transgressive seismic facies in the valley with draping point bar deposits of the channel and onlapping the walls' valley indicates confinement, possibly associated with an estuary environment.
# Data Synchronization: A Complete Theoretical Solution for Filesystems
## 6 Synchronization by Conflict Resolution  
In the realm of file synchronization a _conflict_ is represented by two filesystem commands which can be executed individually, but not together. Resolving the conflict means choosing one of the following actions (see, among others, [9; 16]):  
* discard both commands,
* discard one command and keep the other (loser/winner paradigm), or
* replace one or both commands by a new one.  
Only the second alternative satisfies both the _intention-confined effect_ principle R1 (use only commands issued by the user), and the _aggressive effect preservation_ principle R2 (carry over as many operations as possible). Our synchronizer uses this loser/winner paradigm to solve all conflicts. Resolving a conflict might create new ones, or automatically solve--ormake irrelevant--others. Thus after each step the set of conflicts has to be regenerated, or at least revalidated/reviewed. Termination of the synchronization process is not automatic and has to be proved, see [16]. Fortunately, in our case no new conflicts are generated, and resolved and disappearing conflicts can be identified easily. As each step eliminates at least one conflict, the synchronizer clearly stops after finitely many steps.
## 2 Background and Related Work
### Active Queue Management
#### 2.1.2 Proportional Integral Controller Enhanced (PIE)  
PIE [6] is another well-known AQM similar to RED. During congestion, incoming packets are dropped randomly according to a drop probability before being placed into the buffer. PIE determines congestion and drop probability by using the derivative (rate of change) of queuing latency. To ensure that PIE is \"work conversing\", the random drop is bypassed if the latency samples are less than half the target latency value. After congestion ends, PIE exponentially decays \"drop probability\" to prevent the router from dropping too many packets. PIE also supports explicit congestion notification (ECN) but is optional.
# Performance of a Closed Cycle Power Takeoff for a Shore-Based Wave Energy Device
## 2 Materials and Methods
### 1D Design Results  
The simulation was carried out for 54 different design points, with rotational speeds ranging from 500 rpm to 3000 rpm and pressure drops ranging from 600 Pa to 3400 Pa for all rotational speeds, and up to 8200 Pa for \(N=1500\) rpm. Following [14], the results are presented in their dimensionless form. In addition to the torque efficiency previously defined, the dimensionless pressure drop \(\Psi\) and the flow coefficient \(\varphi\) are as follows  
\[\Psi=\frac{\Delta P}{\rho\Omega^{3}r_{m}^{5}} \tag{31}\]  
\[\varphi=\frac{\dot{m}}{\Omega r_{m}^{3}} \tag{32}\]  
It can be noted that the flow coefficient is proportional to the velocity ratio \(C_{x}/U\) used in the preliminary design Section 2.3. Indeed, the mass flow rate \(\dot{m}=\rho AC_{x}\) is proportional to the axial velocity and the rotational speed \(\Omega=r_{m}U\) is proportional to the blade speed.  
Figure 11 shows the torque efficiency of the turbine for various flow coefficients. At the nominal design point, the efficiency reaches \(\eta=0.91\). However, the actual efficiencies are expected to be lower as some losses have been overlooked. In particular, the tip leakage losses are missing as the shroud is perfect here, with no gap between the shroud and the blades. The efficiency remains high after the peak, which supports the expectation for the turbine to be well suited to a range of sea states.  
Figure 12 shows the dimensionless pressure drop variation with flow coefficient. The pressure drop curves follow a quadratic tendency. This supports the choice of modelling the turbine as a pure flow restriction in the lumped parameter model, where the mass flow follows Equation (9). The curves collapse with the non-dimensionalisation, which means that, even though \(C_{T}\times A_{T}\) is not truly constant when the rotation speed changes, its variation is limited. At lower rotation speeds, the turbine allows the passage of a larger mass flow than at higher rotation speeds for the same pressure drop. \(C_{T}\times A_{T}\) varies monotonously from 0.014 m\({}^{2}\) at \(N=3000\) rpm to 0.016 m\({}^{2}\) at \(N=500\) rpm, which is a 15% difference. By comparison, the maximum efficiency obtained from the 1D Matlab model of the complete system for the Mutriku case was reached for \(C_{T}\times A_{T}=0.01\) m\({}^{2}\). The turbine is thus on the safe side of the optimum peak, considering that the losses have been underestimated in the CFD study.  
Figure 11: Variation in efficiency with flow coefficient for different rotational speeds.
# A Dynamic and Adaptive Cybersecurity Governance Framework
## 5 Proposed Cybersecurity Governance Framework  
To design the proposed cybersecurity governance framework, we considered the following design principles: a cybersecurity risk management approach to manage risk according to the cyber-risk appetite of the organization as we are following a risk-based approach to overcome security related threats. Once the risk assessment is properly performed and cyber-risk mitigation options are put in place, a comprehensive security strategy that is aligned with IT and business objectives to make it an integral part of the organizational strategy should be developed. To implement the security strategy, appropriate security policies that address each aspect of strategy and regulation should be designed. For each security policy, a complete and suitable set of security standards that address each aspect of the security policy should be developed to ensure that security procedures and guidelines comply with the security policy. Institutionalized monitoring processes should be designed to implement the security policy, procedures, and guidelines. This also ensures security audit and compliance and offers feedback on the effectiveness of the cyber-risk treatment options proposed. Moreover, security processes should be designed and implemented to ensure persistent evaluation and updating of the security policy, procedures, guidelines, and risks. Finally, all the security mentioned above related activities are governed and managed by proposing an organizational security structure that is an integral part of the security governance framework.  
In addition to the outlined security governance framework design principles, the following are the tasks that should be performed while designing the framework: (1) Develop the cybersecurity strategy, which supports the overall business strategy of an organization. (2) Get top management's commitment and support of the security activities throughout the organization. (3) Define roles and responsibilities throughout the organization in the implementation of the security governance program. (4) Design communication and reporting channels and techniques which supports the security governance activities. (5) Address the current and future legal and regulatory concerns that may affect cybersecurity and assess their potential impact on the organization. (6) Establish and maintain security policies that support business goals and objectives. (7) Ensure the development of procedures, guidelines, standards, and best practices that support information security policies. (8) Develop a business case model that gives organization value analyses supporting information security investments.  
As shown in Figure 4, the proposed governance framework has four major categories: components, activities, outcomes and processes. It also has about 14 principles. The proposed security governance framework is dynamic, adaptive, and easy to implement by any organization to see security in a holistic approach and to follow risk based approaches.
# Neural Network System for Predicting Anomalous Data in Applied Sensor Systems
## 2 Materials and Methods
### Development of the Anomaly Detector Model  
The anomaly detector assesses whether a sensor reading subsequence, ending with the current value, constitutes an anomaly. If it is identified as such, the detector generates a notification for the monitoring sensor system operator. The specified subsequence length is defined by values corresponding to significant time intervals, which are calculated based on the sensor's sampling frequency. The implementation of the anomaly detector uses the concept of dissonance [40]. Dissonance, unlike most anomaly detection algorithms, requires only one intuitive parameter, the anomalous subsequence length, and is formally defined as follows: Let \(T\) be the sensor reading time series; \(S_{T}^{n}\) is the set of all possible subsequences of length \(n\) in \(T_{i}\); \(T_{i,n}\) is the subsequence of length \(n\) starting at position \(i\); \(D\) is the subsequence under investigation for anomalies; \(M_{D}\) is the set of all subsequences that are not trivial matches with \(D\); and \(k\) is the parameter defined by the system operator indicating the significance level. The Euclidean distance between the two subsequences \(T_{i,n}\) and \(T_{j,n}\) is defined as  
\[ED\big{(}T_{i,n},T_{j,n}\big{)}=\sqrt{\sum_{i=1}^{n}\big{(}T_{i+t-1}-T_{j+t-1} \big{)}^{2}}, \tag{26}\]  
where \(T_{j,n}\) is the subsequence of length \(n\) starting at position \(j\).  
Subsequences \(T_{i,n}\) and \(T_{j,n}\) are not trivial matches if there exists a subsequence \(T_{p,n}\in S_{T}^{n}\) (where \(i<p<j\)) such that  
\[ED(T_{i,n},T_{j,n})<ED(T_{i,n},T_{p,n}). \tag{27}\]  
Subsequence \(T_{p,n}\in S_{T}^{n}\) is called dissonance if  
\[\forall C\in S_{T}^{n}\text{, }\min(ED(D,M_{D}))>\min(ED(C,M_{C})), \tag{28}\]  
where \(M_{C}\) is the set of all subsequences that are not trivial matches to \(C\).  
Subsequence \(D\in S_{T}^{n}\) is called the most significant \(k\)-th dissonance in \(T\) if  
\[\min\Big{(}ED\Big{(}D,M_{D}^{k}\Big{)}\Big{)}\text{isthalargestamongallsubsequences}, \tag{29}\]  
where \(M_{D}^{k}\) is the set of the \(k\)-th closest subsequence that is not a trivial match to \(D\).  
Let \(t_{i+1}\) be the current sensor reading considering a subsequence of length \(n\) ending with \(t_{i+1}\). It is determined whether this subsequence \(D\) is a dissonance with a significance degree of at least \(k\) if  
\[\min\Big{(}ED\Big{(}D,M_{D}^{k}\Big{)}\Big{)}\geq\min\Big{(}ED\Big{(}D,M_{C}^{k }\Big{)}\Big{)}, \tag{30}\]  
then a notification is generated for the human operator that the subsequence is an anomaly. If the condition for dissonance is satisfied, then
## 5 Conclusions  
Triaxial compression tests and a test on the soluble salt content of a treated soil were carried out to investigate the effects of polymer active agent content and maintenance time on the mechanical properties and soluble salt content of sulfate saline soils. The following conclusions were drawn:  
(1) The calcium ions in the CLI-type polymer active agent react with the sodium ions in the sulfate-type saline soil, which reduces the thickness of the double electric layer of the soil particles. This reaction further enhances the attraction between the particles and finally compacts the soil through the agglomeration effect.  
(2) The optimal improvement effect can be obtained when the content of the CLI-type polymer active agent is around 8%, and the reaction between the polymer active agent and the soil is completed when the maintenance time reaches 7 days.  
(3) The calcium ions in the CLI-type polymer active agent can react with sulfate ions in sulfate-impregnated soils under a suitable moisture condition to produce calcium sulfate precipitation, which further alleviates soil salinization.  
Conceptualization, methodology, and data curation, X.Z., J.Z. and Z.Y.; writing--original draft preparation, X.Z.; project administration, Z.Y.; validation, J.L., F.B. and Z.Y.; formal analysis, C.D.; investigation, Y.L. and J.L.; resources, J.L., Y.L., X.Z. and Z.Y.; writing--review, editing, and visualization, X.Z., F.B., C.D. and Z.Y.; supervision, J.Z. and Z.Y.; funding acquisition, J.L. All authors have read and agreed to the published version of the manuscript.  
Figure 9: Schematic diagram of CLI modification mechanism: (**a**) Interaction mechanism between sulfuric saline soil and CLI; (**b**) Improvement effect of different CLI contents.  
**Funding:** This research was financially supported by Open Project of Technology Innovation Center for Ecological Monitoring & Restoration Project on Land (Arable), Ministry of Natural Resources (Grant No. GST2021-006).  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** The data presented in this study are available on request from the corresponding author.  
**Acknowledgments:** The authors would like to thank [PERSON], [PERSON], and [PERSON] from the Geological Survey Institute of Jiangsu Province for their contributions to this research.  
**Conflicts of Interest:** The authors declare no conflict of interest.