esa-sceva/satcom-chunk-collection huggingface dataset:
# Breaking Alert Fatigue: AI-Assisted SIEM Framework for Effective Incident Response
## 2 Background and Related Work
### Feature Engineering  
The alerts generated by various NDSs may have various formats, thereby making it challenging to analyze the data effectively. Effective analyses of such heterogeneous data typically require a preprocessing step to convert the data into a standardized format. However, emerging methods attempt to avoid the need for data transformation and work directly with heterogeneous formats.
## 3 Proposed Control Scheme
### Design of Stable Sliding Surface  
This sub-section deals with designing a stable modified sliding surface (\(\sigma_{m}\)) to eliminate mismatched disturbance of the system (1). Equation (23) shows that modified sigma's (\(\sigma_{m}\)) dynamics do not depend on signum function, and hence, a considerable amount of chattering effect is removed from the traditional sliding mode controller. The estimated disturbance is used to design a stable sliding surface, and the control input is derived for tracking the system on the input trajectory.  
A similar type of mismatched system as depicted in (1) is considered with second order form,  
\[\begin{cases}\dot{x}_{1}=x_{2}+f(x)+e^{x_{1}}+w,\\ \dot{x}_{2}=b(x)\cdot u,\\ y=x_{1}.\end{cases} \tag{12}\]  
where \(x=[x_{1},x_{2}]^{T}\) are the system states, \(b(x)\) is invertible and not zero, and \(f(x)\) is the system disturbance. \(d(x,t)=d=f(x)+e^{x_{1}}+w\) is considered as lumped disturbance. where external disturbance \(w=3\) acts on a system at time \(t=6\) s.  
The stable sliding mode surface \(\sigma\) is chosen as,  
\[\sigma=c_{1}x_{1}+x_{2}+\hat{d} \tag{13}\]  
where \(c_{1}\) is a user defined positive constant, \(\hat{d}\) is the lumped disturbance estimation. By differentiating Equation (13) and incorporating (12) leads to  
\[\dot{\sigma}=c_{1}x_{2}+c_{1}d+b(x)u+\hat{d} \tag{14}\]  
and control \(u\) is given by,  
\[u=u_{eq}+u_{n} \tag{15}\]  
putting Equation (15) in (14), Equation (14) modifies to  
\[\dot{\sigma}=c_{1}x_{2}+c_{1}d+b(x)u_{n}+b(x)u_{eq}+\hat{d} \tag{16}\]  
Equivalent control law, \(u_{eq}\) is calculated from system nominal or known parameters. The remaining unknown terms have either lumped uncertainty or disturbance will be taken care of by \(u_{n}\), and it is given by Equations (17) and (18) respectively,  
\[u_{eq}=-b(x)^{-1}(c_{1}x_{2}+k_{s}\sigma+\hat{d}) \tag{17}\]  
where \(k_{s}\) is positive constant chosen by designer.  
\[u_{n}=-b(x)^{-1}(c_{1}\hat{d}) \tag{18}\]  
by substituting both (17) and (18) in (16), we get  
\[\dot{\sigma}=\tilde{d}-k_{s}\sigma \tag{19}\]  
where \(\tilde{d}\) is disturbance estimation error and it is given by \(\tilde{d}=d-\hat{d}\).
## 3 Methodology
### Update Phase  
After identifying activities from the construction resources, the duration of all the activities is calculated. These durations are updated continuously using the Bayesian update method and are used as the primary input parameter of the DES model. The input durations are fitted to distributions using the Chi-Square Goodness-of-Fit test, which tests if a sample of data came from a specific theoretical distribution. This test groups the data into bins, then calculates the observed and expected counts for those bins and computes the chi-square test statistics.  
The inputs (i.e., duration of the activities) to the simulation model are assumed to be continuous with an underlying probability density function (PDF). The prior assumptions are updated using Bayes' theorem when new duration data are calculated from the activity identification model. The Bayesian updating can be expressed with Equation (1)  
\[f^{\prime\prime}(\theta)=kL(\theta)f^{\prime}(\theta) \tag{1}\]  
Here, \(f^{\prime}(\theta)\) is the prior distribution, which is revised to the posterior distribution \(f^{\prime\prime}(\theta)\), \(\theta\) is the random variable for the parameter of a distribution, \(k\) is the normalizing constant \(k=\left[\int_{-\infty}^{\infty}L(\theta)f^{\prime}d\theta\right]^{-1}\), and \(L(\theta)\) is the likelihood of observing the experimental outcome assuming a given \(\theta\). The initial distribution assumption for the duration parameter is updated using the more recent observed data. Thus, the judgments and observational data are systematically combined as posterior distribution is obtained from both prior distribution and likelihood function. If the prior distribution is a conjugate of the distribution of the underlying random variable, the posterior distribution can be calculated in the same mathematical form as the prior Ang & Tang [30]. Equations (2) and (3) show the updating process of normally distributed data.  
\[\mu^{\prime\prime}=\frac{\sigma^{2}\mu^{\prime}+n\sigma^{\prime 2}\mu}{n\sigma^{ \prime 2}+\sigma^{2}} \tag{2}\]  
\[\sigma^{\prime\prime}=\sqrt{\frac{\sigma^{2}\sigma^{\prime 2}}{n\sigma^{\prime 2 }+\sigma^{2}}} \tag{3}\]  
Here, \(\mu^{\prime\prime}\), \(\mu^{\prime}\), \(\mu\) are posterior, prior, and sample mean respectively, and \(\sigma^{\prime\prime},\sigma^{\prime},\sigma^{\prime}\) are posterior, prior, and sample standard deviation, \(n\) is the sample size.  
When more data are obtained after the first update, the updating process can be done successfully using these two equations. The posterior statistics from the previous stage become the prior distribution for the next updating stage. Based on these updating techniques, the duration parameter of the DES model is updated using a predefined frequency. As the project progresses, the most up-to-date durations are used as simulation input to generate updated estimations thus, making the model more accurate and reliable. These estimations can be used to update the project plan based on real-life data, thus ensuring data-driven decision-making.
## 3 Cloud-Agnostic Models
### Use Cases  
We defined three use cases that exemplify the usage of cloud-agnostic functions in a practical scenario to highlight their main benefits. The first use case, illustrated in Figure 5, was based on a frequently-described example of an event-driven FaaS-based application, called the _thumbnail generation_[15].  
The use case starts with the upload of an image file to persist in a storage bucket (_Bucket1_). The upload action triggers the execution of a cloud-agnostic function responsible for generating and storing a new image thumbnail in a second storage bucket (_Bucket2_). Prior to the thumbnail generation, the function makes a remote call to the provider's storage service to read the uploaded image bytes. The thumbnail generation operation simply consists in cutting the image width in half using common Java libraries. This first use case intends to demonstrate the high portability of a full cloud-agnostic function between different cloud providers (multi-cloud approach), even when being triggered by an event originated within the cloud infrastructure (storage event).  
The second use case, represented in Figure 6, illustrates two cloud-agnostic functions that interact with each other in a poly cloud approach. The purpose of the use case is to translate and store short pieces of text into a database, and we named it _store translation_.  
The use case starts by sending an HTTP request with a piece of text to be translated by the first cloud-agnostic function deployed in Google Cloud Platform. Because we are already in Google's environment, no extra authentication is required when accessing the Cloud Translation API [42]. The translation result is then sent, once again, via HTTP, to a second cloud-agnostic function, this time deployed in MsAzure. The second function has the single task of storing the translation result into a NoSQL database, using the Azure Cosmos DB service. Because both functions are using the same event trigger type, their function signatures will be the same as well. With this use case, we intend to demonstrate that even when using a poly cloud approach, cloud-agnostic functions can help develop  
Figure 5: Use case 1—_thumbnail generation_.  
Figure 6: Use case 2—_store translation_.  
ers to focus more on business logic and less on provider-specific requirements, such as following a sophisticated function signature.  
The third and last use case is called _search blobs_, represented in Figure 7. This use case was designed exclusively for the purpose of the performance testing evaluated in Section 5.  
The cloud-agnostic function is triggered via HTTP requests, in which the users must specify the blob name that they want to search for, together with the bucket name. The _listBlobs_ operation, found in the cloud-agnostic libraries, is then executed to retrieve a list of blobs contained in a given bucket, which requires a remote call to the storage service. Finally, a simple search is made to check whether any of the blob names include the requested _string_. The search results are then sent as a response to the execution request.
## 5 Applications of Nanocellulose
### Nanocomposite Formation  
In the past few decades, nanocellulose has drawn a lot of interest as a potential reinforcement for different polymeric materials or nanocomposites in a variety of cutting-edge applications. The nanocomposites derived from NC have gained much research interest to be applied in different fields owing to their unique properties, such as biodegradability, non-toxicity, renewability, highly specific surface area, high modulus and mechanical strength, and exciting optical properties and surface chemistry [125]. NC-based composites, in contrast to conventional cellulose-based composites, contain less well-dispersed nanocellulose, the reason being that it is not necessary to load the polymer with a lot of filler in order to get high mechanical properties [126]. [PERSON] et al. prepared NC-reinforced polyethylene composite sheets using polyethylene and in situ surface-hydrophobized, TEMPO-oxidized cellulose nanofibrils using high shear forces [127]. In another study, cross-linked poly([2 (methoxyyloxy)ethyl]trimethylammonium chloride) (C\({}_{9}\)H\({}_{18}\)CINO\({}_{2}\)) and bacterial nanocellulose were combined to create anti-fungal nanocomposites for the treatment of _Candida albicans_ infections [128]. A variety of different nanomaterials can be impregnated into nanocellulose to create highly porous substrates.
# The Effects of Train Passes on Dwell Time Delays in Sweden
## 1 Introduction
### This Study  
To improve the real-time decision-making abilities of train dispatchers, it is useful to first study the effects of their decisions. Dispatching decisions are closely related to the interaction between trains, which can influence the train speed profiles and the orders of trains at conflict points, leading to complex problems if inaccurate decisions are made.  
Thus, this study focused on the different types of passes for passenger trains and explored their effects on dwell time delays. This is the most common type of delay for passenger trains in Sweden. The contributions of this article include:  
1. Based on the historical train operation data, an overview of different types of passes in Sweden is provided, and their impacts to dwell time delays in terms of probability is assessed. With a better understanding of train passes and their effects on delays, timetabling and dispatching measures can be targeted to increase trains' ability to pass each other without incurring delays, resulting in more punctual railway operations.  
2. The use of the odds ratio is proposed to aid dispatchers in making dispatching decisions based on the odds of delays due to various dispatching actions. This is a simple metric that provides clear and direct information on which the dispatching approach has the best odds of not causing delays, allowing for a comparison between the efficiency of two different actions. It can be used to assess any dispatching choice, however, in this study it was utilised to compare different types of train passes. Previous research tends to employ regression models to predict the magnitude of the delays, but few have compared the effectiveness of alternative train passes in reducing the occurrence of delays. This article is organised as follows: In Section 2, the mathematical formulations and methodology used in this study are introduced. In Section 3, we analyse and discuss the results generated and measure the effects of train passes. Finally, Section 4 concludes and includes recommendations for further research.
# Retrofitting of a Multi-Span Simply Supported Bridge into a Semi-Integral Bridge
## 4 Retrofitting Details
### Semi-Fixed Dovel Joint over Abutment  
The new voided slabs and the existing abutments were connected using semi-fixed dowel joints and no expansion joints between them, as shown in Figure 10a. The dowel joints used in the abutment retrofit had the same details as those used over piers. To ensure the effective connection between the new precast prestressed voided slabs and the abutment, the joint gap with a 300 mm width between the abutment back wall and the voided slabs was fixed together by steel reinforcing bars and cast in situ concrete, as shown in Figure 10. The diameter of steel bars No. 1 and 3 depicted in Figure 10b was 16 mm, and the diameter of the No. 2 bar type was also 16 mm.  
The semi-fixed dowel joints balance flexibility to accommodate thermal and seismic movements while providing structural continuity. They reduce the need for extensive substructure modifications, making them cost-effective for retrofitting existing bridges with intact foundations. These joints simplify construction by allowing controlled connections without full monolithic integration, mitigating stress concentrations. They are less suited for conditions requiring a high rotational capacity compared to expansion joints. They are best applied to bridges requiring moderate flexibility and durability improvements without a complete structural overhaul.  
Figure 8: Details of the semi-fixed dowel joint over the pier (unit: mm). (**a**) Details of the joint in the longitudinal direction. (**b**) View of the joint in the transverse direction.  
Figure 9: Photo of the continuous segment with dowels over the pier before concrete casting.
### Commercial Software Applications for Blind and Severely Visually Impaired Persons' Assistance
In contrast to traditional Radio Frequency (RF) communication, where a central device covers a wide area, VLC networks exploit the inherent properties of light. These characteristics allow for the deployment of a multitude of optical access points and the enhancement of overall performance. Considering that LED lighting systems are an integral part of our daily lives, serving not only to illuminate our surroundings but also to provide essential visual information, it becomes apparent that their ubiquitous presence can be harnessed for a broader spectrum of applications. In this context, VIPs can derive substantial benefits from VLC's extensive coverage and its capacity to offer location-specific data. Thus, one can see that the VLC technology has the intrinsic means to solve a significant part of the tasks mentioned in Section 2.1, as it has the potential to identify users' locations and to timely deliver location specific data. Furthermore, as the VLC technology is developing on top of a preexisting and widely available lighting network, its potential is very high. On these grounds, VLC empowers users to be constantly aware of their precise location and receive pertinent information relevant to their specific surroundings. However, despite the promising potential of VLC in assisting visually impaired individuals, there remains a relative lack of relevant research focused on practical demonstrations of these concepts. More concerted efforts in this area are needed to fully explore and use the capabilities of VLC technology for the benefit of those with visual impairments. Examples of preliminary works focused on VLC use in blind persons' assistance can be found in [32; 33; 34; 35]. Although these works emphasize the benefits of VLC and its compliance with visually impaired assistance, their implementation is still at a low Technology Readiness Level (TRL), whereas the experimental results are far from being relevant for real-life utilization. On the other hand, these works have the merit of pushing things forward in the right direction. Conceptualization and Implementation of the Visible Light Communications-Based Smart Backpack for Blind and Severely Visually Impaired Persons' Assistance  
This section approaches the issues related to the design and the practical implementation of the VLC-based blind persons' assistance smart backpack prototype. It aims to provide the purpose, the development guidelines, their argumentation and to illustrate the transition from design guidelines to experimental prototype.
Future Internet_**2015**, \(7\), 225-256; doi:10.3390/fi7030225  
_future internet_  
**ISSN 1999-5903**  
www.mdpi.com/journal/futureinternet  
_Article_  
**EDAS: An Evaluation Prototype for Autonomic Event-Driven Adaptive Security in the Internet of Things**  
**[PERSON] * and [PERSON]**  
Norwegian Information Security Laboratory (NISLab), Gjoyvik University College, 2815 Gjoyvik,  
Norway; E-Mail: [EMAIL_ADDRESS]  
* Author to whom correspondence should be addressed; E-Mail: [EMAIL_ADDRESS];  
Tel.: +47-611-35392.  
Academic Editor: [PERSON]  
_Received: 11 March 2015 / Accepted: 23 June 2015 / Published: 8 July 2015_  
**Abstract:** In Internet of Things (IoT), the main driving technologies are considered to be tiny sensory objects. These objects cannot host traditional preventive and detective technologies to provide protection against the increasing threat sophistication. Furthermore, these solutions are limited to analyzing particular contextual information, for instance network information or files, and do not provide holistic context for risk analysis and response. Analyzing a part of a situation may lead to false alarms and later to unnecessary and incorrect configurations. To overcome these concerns, we proposed an event-driven adaptive security (EDAS) model for IoT. EDAS aims to observe security events (changes) generated by various things in the monitored IoT environment, investigates any intentional or unintentional risks associated with the events and adapts to it autonomously. It correlates different events in time and space to reduce any false alarms and provides a mechanism to predict attacks before they are realized. Risks are responded to autonomically by utilizing a runtime adaptation ontology. The mitigation action is chosen after assessing essential information, such as the risk faced, user preferences, device capabilities and service requirements. Thus, it selects an optimal mitigation action in a particular adverse situation. The objective of this paper is to investigate EDAS feasibility and its aptitude as a real-world prototype in a remote patient monitoring context. It details how EDAS can be a practical choice for IoT-eHealth in terms of the security, design and implementation features it offers as compared to traditional security controls. We have explained the prototype's major components and have highlighted the key technical challenges.  
**Keywords:** Internet of Things; adaptive security; eHealth; event-driven architecture; risk management; event correlation
# Energy Trading Strategy for Heat and Electricity-Coupled Microgrid Based on Cooperative Game
## 4 Model of MGO
### Utility Model of MGO  
As the energy coordinator of the whole MG, the MGO needs to bargain with users about the heat price and the electricity price and then optimize the internal electricity and heat supply to maximize operation utility. The profit function of the MGO in each time slot can be formulated as follows:  
\[U_{MGO}=U_{g}+U_{E}+U_{T}-C_{gas} \tag{13}\]  
\[U_{g}=\sum_{h=1}^{H}\left(N_{s}^{h}p_{gs}^{h}-N_{b}^{h}p_{gb}^{h}\right) \tag{14}\]  
\[U_{E}=\sum_{h=1}^{H}\sum_{i=1}^{n}el_{i}^{h}p_{i}^{h} \tag{15}\]  
\[U_{T}=\sum_{h=1}^{H}\sum_{i=1}^{n}tl_{i}^{h}\lambda_{i}^{h} \tag{16}\]  
\[C_{gas}=\sum_{h=1}^{H}\frac{P_{M,gas}^{h}+P_{B,gas}^{h}}{L}\cdot p_{gas} \tag{17}\]  
In (13), \(U_{g}\) is the benefit from trading with the power grid, \(U_{E}\) is the revenue from selling electricity energy to the users, \(U_{T}\) is the revenue from selling thermal energy to the users, \(C_{gas}^{h}\) is the cost of purchasing natural gas. In (14), \(N_{s}^{h}\) and \(N_{b}^{h}\) are the electricity energy selling to the power grid and the electricity energy buying from the power grid. In (17), \(L\) is the low heating value of natural gas, \(p_{gas}\) is the natural gas selling price. The MGO needs to operate under an appropriate power level and price range, which consists of the following constraints:  
\[0\leq P_{M,gas}^{h}\leq P_{M}^{\max} \tag{18}\]  
\[0\leq P_{B,gas}^{h}\leq P_{B}^{\max} \tag{19}\]  
\[\left|N_{s}^{h}-N_{b}^{h}\right|\leq N_{MG}^{\max} \tag{20}\]  
\[N_{s}^{h}-N_{b}^{h}=P_{M,\mathcal{L}}^{h}+pv_{i}^{h}-\sum_{i=1}^{n}el_{i}^{h} \tag{21}\]  
\[P_{B,T}^{h}+P_{M,T}^{h}=\sum_{i=1}^{n}tl_{i}^{h} \tag{22}\]where \(P_{M}^{\max}\) and \(P_{B}^{\max}\) are the maximum energy of gas consumed by MT and the maximum energy of gas consumed by Boiler. \(N_{MG}^{\max}\) is the maximum net load of MG. Formula (20) is the constraint of the electric energy balance of MG, and \(pv_{i}^{h}\) is the generation power of PV arrays in a time slot \(h\). Formula (21) indicates the constraint of thermal energy balance in MG.
## 3 Materials and Methods
### Laboratory Analyses
#### 3.2.2 Method of Analyses  
The analysis of the main cations (Al, Fe, Ca, Mg, K, Na, Si) and trace elements in water samples were carried out using an ICP-AES (IRIS Advantage) at the Analytical Center of the Institute of Geology and Mineralogy SB RAS. When analyzing the water, every third sample was tested twice. The ionic balance error was less than 15%. Another aliquot was analyzed for major anions (SO\({}_{4}\)2\({}^{-}\), Cl\({}^{-}\), HCO\({}_{3}\)\({}^{-}\)) using capillary electrophoresis on a \"Rapel-105M\" instrument.  
Samples of fish organs (dry weight) were analyzed for chemical elements with an ICP-MS using a NexION 300D mass spectrometer (PerkinElmer, USA, Shelton, CT) (PNIL \"Water\", Tomsk). A pre-prepared sample of 0.2-0.3 g was placed in a 50 cm\({}^{3}\) test tube and 2 cm\({}^{3}\) of especially pure concentrated HNO\({}_{3}\) and 1 cm\({}^{3}\) of H\({}_{2}\)O\({}_{2}\) were added to it. The next step was to decompose the sample in a microwave at a temperature of 190 \({}^{\circ}\)C for 15 min. The resulting mixture was brought to a volume of 50 cm\({}^{3}\) with a 3% nitric acid solution. A solution of Li, Mg, Co, Y, and Tl in 2% nitric acid with a concentration of 1 \(\mu\)g/L for each determined element (\"ICP-MS Tuning Solution\", Agilent Technologies, Mulgrave, Australia) was used for the adjustment. The three sigma method detection limits (MDLs) and 10 sigma Limit of Quantitation (MLOQs) were calculated from 10 measurements of the preparation blank. All measurements were conducted in three replicates for each element. All validations and sample analyses were performed in conjunction with appropriate QA/QC, including blank samples prepared using distilled de-ionized water (>15 M\(\Omega\)) and high purity nitric acid for ICP-MS spectrometry. The ICP-MS control was prepared using a 1.00 \(\pm\) 0.05 mg/L standard multielement solution for ICP-MS (SKAT, Novosibirsk, Russia).  
Element concentrations were determined with an external calibration. Reference materials of muscle tissue of Baikal perch (_Perca fluviatilis_, L.) CRM BOK-2 (GSO 9055-2008, Institute of Geochemistry SB RAS) CO KOOMET 0068-2009-RU were used for the standard curve including at least five points with a correlation coefficient of 0.998. In each sample of crucian organs, the concentration of 72 chemical elements (Li-U) was analyzed. The relative error of the determinations is 15-30% depending on the content of elements. The element bioaccumulation in fish organs was expressed mg/kg dry wt.