esa-sceva/satcom-chunk-collection huggingface dataset:
# Analysis of ICS and SCADA Systems Attacks Using Honeypots
## 6 Experiment
### Experimental Set-Up  
ICS/SCADA honeypots try to emulate real SCADA systems with protocols, PLC, and HMI. In this experiment, we used Conpot [17], classified as a low-interaction side ICS. This honeypot contains different ICS/SCADA protocols such as Modbus, S7 comm, etc. This is in addition to some TCP/IP protocols such as HTTP and SNMP. Conpot has different PLCs, such as S7-200 and S7-300, from vendors such as Siemens and Schneider. Figures 2 and 3 depict an ICS/SCADA honeypot architecture. We created a virtual server and four virtual machines. All these machines have Ubuntu 16.04 as the operating system, and all these machines are assigned public IP addresses from one of the service providers. Conpot software was installed on these machines. In the first phase, we started with only  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Date** & **Attack** & **Targeted System** & **Impact** \\ \hline February 2021 & Oldsmar Water Treatment Plant Attack & Water Treatment Plant & Attempted poisoning of water supply \\ \hline May 2021 & Colonial Pipeline Ransomware Attack & Oil and Gas Pipeline & Disruption of fuel supply, widespread fuel shortages \\ \hline June 2021 & JBS Meat Processing Plant Cyberattack & Food Processing Plant & Disruption of operations, potential food shortages \\ \hline July 2021 & Kaseya VSA Ransomware Attack & Managed Service Provider (MSP) & Disruption of services for thousands of businesses \\ \hline \hline \end{tabular}
\end{table}
Table 4: 2021 Famous OT attacks: targets and impacts.  
two machines, one with a PLC--Siemens S7-200, and the other with a Siemens S7-300. We collected the log files and forwarded them to the Splunk SIEM solution, as well as the MISP Threat Intelligence platform. After Conpot was successfully installed on the virtual machine, we shut it down and took a clone image from it to redeploy it to another virtual machine. We used SSH to access it and carry out our work. After accessing each Conpot machine via SSH, the following commands were utilized to start the Conpot with the desired template.  
The default option runs if the template name is not selected; Figure 4 is S7-200 from Siemens.  
Figure 4: ICS/SCADA honeypot architecture.  
Figure 3: OT history of cyber attacks.  
Figure 2: CIA in the IT industry vs. AIC in the OT industry.  
The experimental work runs in one phase:
* In this phase, there are two machines: one is the default PLC S7-200, and the other one is the S7-300. All of these machines have public IPs and are hosted on one hardware server, and they are managed through SSH.  
Table 5 summarizes the deployed Conpot honeypots with their IP addresses and template details.  
As previously mentioned, there are currently only two running machines which have a public IP address of 41.38.171.244, and another running machine with a public IP address of 41.38.171.245.
# Adversarial Attack and Defense on Deep Neural Network-Based Voice Processing Systems: An Overview
## 3 Attack Threat Model Taxonomy
### Adversarial Knowledge  
Whether to master the prior knowledge of the attacking system during the attack is vital information for the attacker. The grasp of prior knowledge has a significant impact on the efficiency and success rate of the attack. Therefore, according to the different levels of the attacker's prior knowledge of the speech system, the method of attack can be divided into the following categories:  
White-box: When the attacker has full knowledge of the target system, including the model type, network architecture, and the values of all the parameters and training weights, etc., we call that such an attack one carried out in a white-box setting. An example of this access-type is an open-source model like DeepSpeech [83] and Kaldi [24]. Many white-box attack methods [13; 19; 28; 29; 45; 46; 52; 76] have shown to a certain extent their great advantages in the context of prior knowledge. The white-box attack method of attack is an important foundation for our research, but it has limitations in real attacks.  
Black-box: Conversely, when the attacker has almost no prior information about the system, we only know what the task of the system is. For example, we only know that Siri [84] is a system that can recognize speech, but its model, parameters, etc. are completely unknown. There are also many attack methods against black boxes like [13; 14; 33; 54]. Considering the actual attack environment, the black box situation is reasonable.  
Grey-box: Gray box is a situation in which we only know some of the parameters of the model, network architecture, etc., but not all of them. A typical example is the Azure Speaker Recognition model [85], in which we only understand its task category and its filter extraction but are limited with other information. The method similar to those addressed in [15; 52; 67; 81] attacked the grey-box and achieved great performance.  
In a black-box setting, when an attacker only has access to the logits or outputs, it is much harder to consistently create successful adversarial attacks. In specific unique black box settings, white box attack methods can be reused if an attacker creates a model that approximates the original targeted model. However, even though attacks can transfer across networks for some domains, this requires more knowledge of solving the task that the original model is solving than an attacker may have.
## 3 System Model
### Communication Range Judgment Model  
#### 3.2.1 Neighbor Nodes  
In order to identify the neighbor nodes of each node, it needs to determine the maximum communication range. The distance from node \(i\) to \(j\) can be calculated as:  
\[d_{ij}=\sqrt{\left(x_{j}-x_{i}\right)^{2}+\left(y_{j}-y_{i}\right)^{2}} \tag{6}\]  
Due to the influence of multipath effect (reflection, refractive, obstacle and the influence between different signals), the transmission process leads to signal attenuation and the transmission distance affects the received signal intensity. Generally, the received signal intensity is inversely correlated with the transmission distance [10]. If the minimum power of receiving a packet is \(P_{0}\), when the condition \(P_{r}\geq P_{0}\) with an acceptable probability, \(Prob=90\%\), two sensor nodes can communicate normally [29]. Therefore, the probability \(Prob(P_{r}\geq P_{0})\) is given by:  
\[Prob(P_{r}\geq P_{0})=Prob\Big{(}\ell P_{t}Cd_{ij}^{-2}\geq P_{0}\Big{)}=Prob \bigg{(}\ell\geq\frac{P_{0}d_{ij}^{2}}{P_{t}C}\bigg{)}=\int_{\frac{P_{0}d_{ij }^{2}}{P_{t}C}}^{\infty}e^{-x}d_{x}=e^{-\frac{P_{0}d_{ij}^{2}}{P_{t}C}} \tag{7}\]  
The maximum effective communication distance \(d_{0}\) can be calculated as follow:  
\[Prob(P_{r}\geq P_{0})=e^{-\frac{P_{0}d_{0}^{2}}{P_{t}C}}=0.9 \tag{8}\]  
\[d_{0}=\sqrt{-\frac{CP_{l}ln0.9}{P_{0}}} \tag{9}\]  
**Definition 1**.: _The neighbor nodes set of node i is:_  
\[NE(i)=\left\{j\big{|}d_{ij}\leq d_{0}\right\} \tag{10}\]
# Experimental Evaluation of Graph Databases: JanusGraph, Nebula Graph, Neo4j, and TigerGraph
## 3 Graph Databases
### JanusGraph  
JanusGraph was released in 2017 and is an open-source graph database. According to [PERSON] [16], JanusGraph is a distributed graph database based on another graph database called Titan. It is also based on Tinker-Pop, an open-source framework for graph databases and graph analytics systems. This framework allows programmers to add graph computing capabilities to their applications without having to worry about developing APIs, graph processing engines, or algorithms. Scalability is a critical feature in graph databases. JanusGraph is scalable and can store and query large graphs distributed across a cluster of multiple machines [7]. According to the documentation available on the JanusGraph website, one can see that the database supports third-party applications for data storage and indexing. For data storage, it supports Apache Cassandra, Apache HBase, and Oracle Berkeley DB Java Edition. The indexes allow more complex queries and use Elasticsearch, Apache Solr, and Apache Lucene. It supports the Java programming language and uses the Gremlin query language. JanusGraph has the following characteristics [17]:  
* Elastic and linear scalability for a growing database and number of users;
* Support for a variety of storage and indexing back-ends. The main advantages of JanusGraph are [17]:
* High availability from multiple data centers;
* Dynamic backups. We can also identify some limitations [17]:
* It has a variety of storage and indexing back-ends, which makes JanusGraph dependent on third parties;
* It is difficult to predict its future development.  
Figure 1 represents the graph database visualization using Gremlin-Visualizer, an interactive graph visualization tool for graph databases using the Gremlin query language.  
Figure 1: Data visualization in Gremlin-Visualizer.
# Analysis of University Students' Behavior Based on a Fusion K-Means Clustering Algorithm
## 2 Materials and Methods
### Model Performance Metrics  
In order to evaluate the performance of the clustering model, in addition to SSE and running time, we also adopted the following evaluation criteria: silhouette coefficient (SC) [48], Calinski-Harabasz index (CHI) [49], and Davies-Bouldin index (DBI) [50]. These are commonly used evaluation criteria for clustering performance measurement.
## 4 Performance Analysis
### Average Bep/SEP
#### 4.2.2 ABEP/ASEP in the Erfc Function Form
Therefore, by using the final value theorem and inserting (20) into (44) along with some mathematical manipulations, an exact expression of average channel capacity for the MRC system over \(\alpha\)-\(\mu/\text{IGA}\) fading channels can be derived as  
\[\overline{C}_{\gamma_{\text{MRC}}}=(\Theta_{1}/\ln 2)H_{1,1;[2,1]_{1-1:1},2,2}^{0,1;[1,2]_{1-1:1},1,2}[\lambda_{1}s^{-0.5\alpha_{1}},\cdots,\lambda_{L}s^{-0.5 \alpha_{L}},s^{-1}]_{(1;\{0.5\alpha_{l}\}_{l=1:L})}^{(1;\{0.5\alpha_{l}\}_{l=1: L}),\left| \begin{subarray}{c}(1-\mu_{l},0.5\alpha_{l}),(1,0.5\alpha_{l}) \end{subarray} \right|_{t=1:L}}\left| \begin{subarray}{c}(1,1),(1,1)\\ (1,1),(0.5\alpha_{l})\end{subarray} \right|_{t=1:L}},\left| \begin{subarray}{c} (1,1),(1,1)\\ (1,1),(0,1)\end{subarray} \right|, \tag{47}\]  
where \(s\) is a very small positive number that goes to zero, for instance, \(s=10^{-6}\). Similarly, by inserting (24) into (44), a unified expression of average channel capacity by using the mixed \(\alpha\)-\(\mu\) model can also be obtained. Unfortunately, it will take too long to calculate (47) in order to obtain the exact results in numerical analysis. To this end, an MGF-based method is also considered to evaluate the average channel capacity in this section. Thus, the average channel capacity per unit bandwidth can be given as [50] (Equation (8))  
\[\overline{C}_{\gamma_{\text{MRC}}}=(\ln 2)^{-1}\!\!\int_{0}^{\infty}s^{-1}[1- MGF_{\gamma_{\text{MRC}}}(s)]\exp(-s)ds. \tag{48}\]  
where \(MGF_{\gamma_{\text{MRC}}}(s)\) is given in Equation (A1) in Appendix A. For the integral term in (48), it may be difficult to find an exact closed-form expression. By using the Gauss-Legendre quadrature method, the approximated form of (48) can be re-expressed as  
\[\overline{C}_{\gamma_{\text{MRC}}}=(\ln 2)^{-1}\!\!\sum_{i=1}^{N}\omega_{i}t_{ i}^{-1}(1-MGF_{\gamma_{\text{MRC}}}(t_{i})). \tag{49}\]  
For the correlated two-branch MRC system, based on the similar approach used in (47), by inserting (33) into (44), the average channel capacity per unit bandwidth over the correlated \(\alpha\)-\(\mu/\text{IGA}\) fading channels can be obtained as  
\[ \begin{array}{rl}\overline{C}_{\gamma_{\text{MRC}}}&=\sum\limits_{k=0}^{ \infty}\sum\limits_{l=0}^{\infty}\frac{0.25(\ln 2)^{-1}\varphi_{l}^{k}\varphi_{l}^{ l}}{k!l!l!l!l!}(k+\mu)\Gamma(l+n)\\ &\times H_{1,1;1,2;1,2;2,2}^{0,1;2,1;2,2}[\theta_{1}s^{-0.5\alpha_{1}},\theta_ {2}s^{-0.5\alpha_{2}},s^{-1}]_{(1,0.5\alpha_{1},0.5\alpha_{2},0)}^{(1,0.5\alpha _{1}),(1-n-l,0.5\alpha_{1})}\left|\begin{subarray}{c}(1,0.5\alpha_{2}),(1-n- l,0.5\alpha_{2})\\ (1,0.5\alpha_{1},0.5\alpha_{2},0)\end{subarray}\right|(m+k,1)}^{(1,0.5\alpha _{2}),(1-n-l,0.5\alpha_{2})}\left|\begin{subarray}{c}(1,1),(1,1)\\ (1,1),(0.1)\end{subarray}\right|.\end{array}  \tag{50}\]  
Similarly, the approximated form of the average channel capacity per unit bandwidth over the correlated \(\alpha\)-\(\mu/\text{IGA}\) fading channels is also obtained by inserting (32) into (49).
# Real-Time Security Health and Privacy Monitoring for Saudi Highways Using Cutting-Edge Technologies
## 3 Proposed Methodology  
IoT, cloud and 5G are CET that have improved nearly every aspect of life and these benefits can also be leveraged for travelers' safety on KSA highways. To improve travelers' safety on these highways, information of each vehicle should be collected in its proximity e.g., vehicle ID, passenger information, location, etc., through the front and back IoT-based cameras. The data are collected seamlessly around the clock using the video devices in cars through 5G. The collected data are stored in the cloud for further processing. Thus as mentioned in research [35; 36; 37] these technologies can be helpful in case of accidents on these highways by providing timely medical and legal help through the available information. Keeping in view the benefits of these technologies, this research proposed an RTSHPMP, as shown in Figure 2.
## 5 Numerical Results
### Classification Accuracy  
The proposed 1D-CNN-based classifier is trained until the cross-entropy loss value converges with the learning parameters tabulated in Table 2. Flight test data obtained on several dates are used as the training set of size 65,989; 80% of this set is used for training the neural network and 20% for validation. Flight data obtained on the other two days are used as a test set of size 31,846.  
To verify the relevance of the sampling scheme described in Section 4.4., the test accuracy with test data (5 June 2018) is compared with varying imbalance rate, i.e., the ratio of the abnormal data to the normal data in the original dataset. When the proposed sampling is not implemented, the abnormal data are used in the learning process with this imbalance rate compared to the normal data; if the sampling is applied, the abnormal data set is copied by the factor of the inverse of imbalance rate. Figure 7(a) compares the classification accuracy, defined as the number of correct classification over the total cases, depending on the use of sampling scheme for difference imbalance rate of the original data set. Figure 7(b),\(c\) compares the anomaly detection results for the case when the original imbalance rate is 0.1. This is the case when the \(\times\)70 drone exhibits an abnormal flight behavior; it can been seen that only the result with sampling clearly indicates anomaly in \(\times\)70 data. It can be clearly seen that the proposed sampling technique significantly improves the classification accuracy, achieving zero classification error. It can be also noted that classification accuracy is around 50% when the sampling scheme is not implemented. One thing to note is that this is not improved even for larger imbalance rate of 0.5.
## 3 Numerical Model  
### Stope Rock Mass Strength  
The surrounding rock of the chamber contains joints and cracks. Therefore, the strength of the rock sample measured in the experiment is generally higher than that of the chamber rock at slope. In order to simulate the reduction of the strength of the coal and rock mass, the Hoek-Brown criterion is proposed. Its specific expression is:  
\[\sigma_{1}=\sigma_{3}+\sigma_{cl}(m_{b}\frac{\sigma_{3}}{\sigma_{ci}}+s)^{a} \tag{1}\]  
where \(\sigma_{1}\) is the maximum principal stress at failure, \(\sigma_{3}\) is the minimum principal stress at failure. \(m_{\text{b}}\) is a reduced value (for the rock mass) of the material constant \(m_{\text{i}}\) (for the intact rock); \(s\) and \(a\) are constants which depend upon the characteristics of the rock mass; \(\sigma_{\text{ci}}\) is the uniaxial compressive strength (UCS) of the intact rock pieces. The expressions of \(m_{\text{b}}\), \(s\) and \(a\) are:  
\[m_{b}=m_{i}\exp\Bigl{(}\frac{GSI-100}{28-14D}\Bigr{)} \tag{2}\]  
\[s=\exp\Bigl{(}\frac{GSI-100}{9-3D}\Bigr{)} \tag{3}\]  
\[a=\frac{1}{2}+\frac{1}{6}\Bigl{(}e^{-GSI/15}-e^{-20/3}\Bigr{)} \tag{4}\]  
where GSI is the Geological Strength Index; the parameter \(D\) is a \"disturbance factor\", which depends upon the degree of disturbance to which the rock mass has been subjected by blast damage and stress relaxation. It varies from 0 for undisturbed in situ rock masses to 1 for very disturbed rock masses. In the tunneling process, the excavator machine was used but not the blasting technology, there is almost no disturbance to the surrounding rocks during the tunneling process. Thus, the D parameter was taken as 0 here. \(m_{\text{i}}\) is a material constant for the intact rock.  
[PERSON] et al. provided the calculation formula for the elastic modulus \(E_{\text{cm}}\), uniaxial compressive strength \(\sigma_{\text{cm}}\) and uniaxial tensile strength \(\sigma_{\text{t}}\) of the coal and rock mass in the stope, which can be expressed as:  
\[E_{cm}=E(0.02+\frac{1-D/2}{1+e^{(60+15\text{D-GSI})/11}}) \tag{5}\]  
\[\sigma_{cm}=\sigma_{ci}s^{a} \tag{6}\]  
\[\sigma_{t}=\frac{\sigma_{ci}s}{m_{b}} \tag{7}\]
## 3 Results and Discussion
### Principal Components Analysis (PCA)  
Principal component analysis (PCA) was employed to summarize, clarify, and simplify the dataset generated from the measured variables. In this analysis, the seven microalgal species were treated as independent variables, while the total phenolic content (TPC), antioxidant activity (ABTS, DPPH, and ORAC), and minimal inhibitory concentrations (MICs) against the bacteria served as the dependent variables. By preserving the intrinsic variability among the microalgae species, PCA enabled a graphical representation of the relative distances between them, thereby facilitating the identification of clusters of species with similar properties. Additionally, PCA allowed for the recognition of the most suitable microalgae in relation to specific variables or bioactivities (Figures 3 and 4).  
Figure 3 displays the projection of the variables. The variation parameter ratio, 76.07%, is the aggregate of the components resulting from the aggregate of the individual components (component 1, 46,71%, and component 2, 29.36%), indicating how much of the variance each component contains. Component 1 is more strongly correlated with all the variables than component 2. The minimal inhibitory concentrations (MICs) for the bacteria are positively correlated with component 1, whereas the total phenolic content (TPC) and antioxidant activity exhibit negative correlations. In contrast, all variables--including MICs, TPC, and antioxidant activity--show positive correlations with component 2.  
The analysis of Figures 3 and 4 reveals three distinct groups. _Limnospira_ sp., _Lobosphaera_ sp., and _Odontella_ sp. form a group (pink circle, Figure 4) with high TPC, strong antioxidant activity, and relatively low MIC values against all tested bacteria (noting that a lower MIC indicates a more effective extract, as a smaller concentration is required to inhibit bacterial growth). A second group (green circle, Figure 4), comprising _Dunaliella_ sp. and _Porphyridium_ sp., shows good TPC and antioxidant activity but poor antimicrobial efficacy, as reflected by high MIC values. The third group (yellow circle, Figure 4) includes _Nammochlorosis_ sp. and _Tetraselmis_ sp., which display strong antimicrobial activity (low MICs) but low antioxidant potential.  
Figure 3: Principal component analysis (PCA)—projection of variables in the two first components. Variation parameter ratio: 76.07% (component 1, 46.71%, and component 2, 29.36%).  
The PCA results thus offer a clear visualization and validation of the observed differences among the microalgal species, which were discussed in Section 3.4.1 and Section 3.4.2, corroborating the findings presented in Figures 3 and 4. PCA allows for better identification of the most suitable microalgal extracts to produce a synergistic effect once incorporated into an edible film.
## 3 Model Results for the Tested Area  
### PS-InSAR Line of Sight (LOS) Displacement Results  
The relative deformation in the ascending orbit LOS varied between 6.07 mm/yr and \(-\)35.4 mm/yr, with an average velocity of \(-\)0.29 mm/yr; the descending LOS velocity was between 6.3 mm/yr and \(-\)37.4 mm/yr, with an average of \(-\)1.8 mm/yr as shown in Figure 6. Figure 6 presents motion in the LOS of the ascending orbit and 6b shows motion in the LOS of the descending orbit. The graduated blue colour in Figure 6 shows areas of stable to slight motion towards the sensor, as we considered stable areas as those having an annual average motion of \(\pm\)2 mm. Areas of motion away from the sensor are shown as points on a spectrum ranging from light green, yellow, orange, to red, based on the deformation velocity.  
Figure 6 also indicates locations in the pink colour rectangles including representative PS points used in time series analysis as presented in Figure 7. Cumulative displacement in ascending LOS during the study area from January 2015 to May 2019, reached 156 mm away from the sensor. The highest cumulative displacement in the descending LOS was estimated to be \(-\)164 mm. High velocities away from the sensor in ascending and descending geometries are described as subsidence areas.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{**Ranks**} \\ \cline{2-4}  & **Rock Type** & **FLLD** & **BL** \\ \hline
**M1** & 1 & 1 & 1 \\
**M2** & 3 & 2 & 1 \\
**M3** & 3 & 1 & 2 \\
**M4** & 2 & 3 & 1 \\
**M5** & 2 & 1 & 3 \\
**M6** & 1 & 2 & 3 \\
**M7** & 1 & 3 & 2 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Examined model parameters for causes probability.  
Figure 7a,d represent subsidence in Former Lake Mareetis with liner deformation away of the sensor in ascending and descending geometries respectively, with a cumulative displacement of \(-155.6\) mm in ascending and \(-153.2\) mm in descending. This velocity average results in an overall displacement away from the ascending orbit of \(-156\) mm during the study period between January 2015 and May 2019; whereas, the cumulative displacement in the descending LOS reached \(-164\) mm during the study period. Figure 7b,c show cumulative displacement time series of two representative points of the former Abu-Qir Lagoon in the ascending geometry, and Figure 7e,f show the other two representative PS points for identical areas in the descending geometry. Linear displacement was observed at the four points with a cumulative displacement of \(-151.7\) mm, \(-111.1\) mm, \(-132.6\) mm, and \(-93.1\) mm at the points shown in Figure 7b,c,e,f respectively. Overall, subsidence was found to be the main surface deformation feature in Alexandria as negative values were observed in high deformation areas, and no remarkable opposite deformation away from one sensor and towards the other sensor.  
Figure 6: Displacement in the line of sight (LOS) presented on the Sentinel-2 gray image of 24 October 2018 blue band; (**a**) velocity in the LOS of ascending geometry and (**b**) is motion in the LOS of descending geometry.