esa-sceva/satcom-chunk-collection huggingface dataset:
# Investigating IPTV Malware in the Wild
## 5 Discussion
* Maximum Threat Score: a metric calculated by Hybrid Analysis (Hybrid Analysis 2022) demonstrating the threat score of a link. * Malicious File and Fileless Signatures: the number of alerts raised by the crafted YARA rules analysis for file malware or fileless malware signatures, respectively. * Extracted URLs: the number of URLs that are extracted from a webpage. Thus, Table 2 shows that the signature and number of files that a webpage tries to download highly correlate with the visitor's signatures (value 0.94). Further, a correlation of \(\sim\)0.67 was observed between the number of fileless signatures and the extracted URLs. This latter correlation can be explained in the form of the delivery of fileless threats, which is the general case through browser exploitations. For the attribution of malicious threats, the contemporary approach is the identification of the techniques and tactics. This, in return, reveals the modus operandi of the attacker and renders the attribution possible [33]. Therefore, within our experiment, we have also collected the Techniques, Tactics, and Procedures of the MITRE ATT and CK framework and presented below the most common techniques that have been utilised on these IPTV sources:  
* T1518: Software Discovery;
* T1082: System Information Discovery; \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & **Signatures** & **Number of** & **Number of** & **Maximum** & **Malicious** & **Malicious** & **Extracted** \\  & **Files** & **Compromised Hosts** & **Threat Score** & **Signatures** & **Signatures** & **URLs** \\ \hline Signatures & & & & & & \\ \hline Number of & & & & & & \\ \hline Compromised & & & & & & \\ \hline Hosts & & & & & & \\ \hline Maximum & & & & & & \\ Threat Score & & & & & & \\ \hline Malicious file & & & & & & \\ signatures & & & & & & \\ \hline Malicious & & & & & & \\ Fileless & & & & & & \\ Signatures & & & & & & \\ \hline Extracted & & & & & & \\ URLs & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Correlation matrix of the investigated IPTV webpages. * T1012: Query Registry;
* T1218.011: System Binary Proxy Execution;
* T1179 also moved to T1056.004: Input Capture: Credential API Hooking;
* T1035: System Services: Service Execution;
* T1518.001: Security Software Discovery;
* T1218.011: RunDLL;
* T1573: Encrypted Channel;
* T1059.007: Command and Scripting Interpreter: JavaScript;
* T1112: Modify Registry. The breakdown of the use of these techniques can be found in Figure 10.
# FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion
## 5 Experimental Evaluation
### Performance Evaluation
#### 5.3.2 Results and Evaluation
\begin{table}
\begin{tabular}{c c c c c c c} \hline  & **Metrics** & **LightGBM [13]** & **RF [8]** & **HAST-II [42]** & **CENTIME [43]** & **FF-MR** \\ \hline \multirow{3}{*}{Macro-averaging} & Macro\_P & 0.9558 & 0.9609 & 0.9892 & 0.9913 & **0.9972** \\  & Macro\_R & 0.9489 & 0.9482 & 0.9391 & 0.992 & **0.9973** \\  & Macro\_F1 & 0.9522 & 0.9543 & 0.9616 & 0.9916 & **0.9978** \\ \hline \multirow{3}{*}{iodine} & Precision & 0.9234 & 0.9319 & 0.9743 & 0.9773 & **0.994** \\  & Recall & 0.9458 & 0.942 & 0.905 & 0.9766 & **0.9935** \\  & F1-Score & 0.9345 & 0.937 & 0.9384 & 0.977 & **0.9951** \\ \hline \multirow{3}{*}{dnscat2} & Precision & 0.9157 & 0.913 & **0.9957** & 0.9864 & 0.9939 \\  & Recall & 0.9107 & 0.9154 & 0.7919 & 0.9874 & **0.9942** \\  & F1-Score & 0.9132 & 0.9142 & 0.8822 & 0.9869 & **0.9954** \\ \hline \multirow{3}{*}{dns2 tcp} & Precision & 0.9911 & 0.9926 & 0.9761 & 0.9931 & **0.9993** \\  & Recall & 0.986 & 0.9881 & **0.9998** & 0.9982 & 0.9995 \\  & F1-Score & 0.9885 & 0.9903 & 0.9878 & 0.9956 & **0.9995** \\ \hline \multirow{3}{*}{benign\_DoH} & Precision & 0.9513 & 0.9697 & **0.9999** & 0.9994 & 0.999 \\  & Recall & 0.9033 & 0.896 & 0.999 & 0.9992 & **0.9995** \\  & F1-Score & 0.9267 & 0.9314 & **0.9994** & 0.9993 & 0.9992 \\ \hline \multirow{3}{*}{non\_DoH} & Precision & 0.9977 & 0.9975 & 0.9999 & **1.0000** & 0.9999 \\  & Recall & 0.9987 & 0.9994 & **1.0000** & 0.9987 & 0.9999 \\ \cline{1-1}  & F1-Score & 0.9982 & 0.9985 & **0.9999** & 0.9993 & **0.9999** \\ \hline \end{tabular}
\end{table} 
Table 5: FF-MR vs. other methods. shallow neural network in HAST-II cannot divide them in a nonlinear way. However, the deep neural network used in FF-MR is able to achieve this distinction by training multiple layers of weights, thus greatly improving the performance of detection and identification. Comparing FF-MR with CENTIME, although both use statistical features and byte sequence features and have similar performance, FF-MR is better than CENTIME in identifying the encrypted DNS covert channel traffic generated by iodine and dnscat2 tools due to the difference in the structure of the two models, improving F1-Score from 0.977 and 0.9869 to 0.9951 and 0.9954, respectively. The main reason for such improvement is that FF-MR is a weighted fusion of session statistical features and multi-channel byte sequence features though a Multi-Head Attention mechanism, instead of simply concatenating the two features in CENTIME. The drawback of CENTIME is that it does not mine the correlations between two features or give weighted attention to important features; thus, the performance of identifying a specific encrypted DNS covert channel is poor. The above results show that the Multi-Head Attention mechanism using the weighted fusion of features plays an important role in accurately identifying an encrypted DNS covert channel with smaller samples.
# Requirements Engineering for a Drone-Enabled Integrated Humanitarian Logistics Platform
## 5 Research Methodology
### Requirement Validation for the AIRDROP Platform
#### 5.2.1 Questionnaire Design  
_Structure and Content_  
The questionnaire designed for the validation of the AIRDROP platform is divided into 21 parts. The first part is introductory, and its aim is to gather respondent information relevant to their occupation (industry), their knowledge, expertise and background with regard to several domains, including logistics and/or humanitarian and disaster relief operations, their experience level in using similar platforms and/or technologies, and the challenges present in the existing solutions they are currently using or considering to use. The next 19 parts refer to the requirement validation, 1 for each category of requirements. Finally, the final part--comprised of three open-ended questions--works as an invitation for general feedback, suggestions and concerns pertinent to the platform and its requirements.  
_Requirement Ranking through the Importance Ranking Scale_  
The significance and impact of each requirement of the AIRDROP platform must be clearly understood in order to evaluate it successfully. A thorough importance ranking scale has been created in order to do this. This scale seeks to give respondents a methodical way to assess the importance of particular requirements in light of their knowledge and experience. The importance ranking scale provided in the questionnaire ranges from 1 to 5. Each number on the scale carries a specific meaning, as described below:  
Figure 3: Types of AIRDROP requirements.  
**Score 1:** A score of 1 indicates that the requirement is deemed unimportant, meaning that its inclusion or exclusion does not have any effect on the solution. In other words, the solution can function equally well with or without this requirement.  
**Score 2:** A score of 2 suggests that the requirement is of low importance. While it is not essential for the core functionality of the solution, its inclusion can provide additional value and enhance user satisfaction.  
**Score 3:** A score of 3 signifies an important requirement. Without this requirement, the solution's functionality may be limited or only partially useful. Its inclusion significantly improves the effectiveness and usability of the solution.  
**Score 4:** A score of 4 indicates a serious requirement. If this requirement is not fulfilled, the solution remains usable but may lack certain crucial features or capabilities. Its inclusion is paramount for enhancing the overall usefulness of the solution.  
**Score 5:** A score of 5 represents a critical requirement. Without meeting this requirement, the solution becomes completely ineffective and unusable. Its inclusion is absolutely necessary for the solution to be considered successful.  
In addition to the five-point scale, a \"Not Sure\" (N/S) category is also provided to accommodate respondents who may have uncertainty regarding the importance of a particular requirement. This option allows participants to indicate their lack of confidence in assessing the importance of a requirement.
## 1 Introduction  
IoT technology is expected to offer a smart solution to users. However, the sad reality is the battery technology is still far away from being smart [1]. Often, users encountered shorter device lifespan. The major problem faced by IoT devices is the limited energy source. Once the device battery is drained [1; 2], communication outages will occur before battery replacement, which potentially extends to other nodes since they rely on the dead node to relay the data. Hence, the availability of the power in the sensor nodes is very important to allow reliable communication. This makes energy efficiency and power management crucial in future IoT applications.  
The transceiver (communication radio) accounts for the highest amount of energy consumption in the sensor node [3; 4]. This is caused by a phenomenon known as idle listening. Idle listening occurs when the node has to stay active to the communication medium and listen for the incoming signal from neighbors, even when it is not actively sending or receiving any information. However, idle listening is necessary to avoid data latency and packet retransmission when the destination node is in a deep sleep during transmission. Another problem causing power wastage in the node's transceiver is overhearing. It happens while listening for incoming signals, whereby the sensor node may receive irrelevant signals [5].
## 2 Materials and Methods
### Real-Time Algorithm  
Figure 2 summarizes the two stages to apply the model: an offline calibration stage, and an online muscle and joint force calculation stage. The offline calibration stage consists of performing kinematic exercises for the anatomical, functional, and kinematic calibration of the model. The anatomical and functional calibration provides (1) the size of the modeled bone, (2) the parameters of the joints (HJC and four-bar mechanism), (3) the points of insertion of the muscles, and (4) the scale of the inertia parameters. This calibration is followed by a series of rehabilitation exercises to obtain the functional relationships between the kinematic variables. The workspace is discretized, and the coefficients of muscle force are calculated.  
The model is then ready for online application in real time. The movement of the lower limb and its associated ACSs are reconstructed from the marker positions recorded by video photogrammetry. A force sensor measures the forces applied on the foot by the robot, while the gravitational forces are estimated from the masses and the positions of the centers of mass, which makes it possible to obtain the generalized muscle forces using Equation (2). According to the current value of the generalized coordinates, the values of muscle coefficients are retrieved from the stored offline values. Then, the magnitudes of muscle forces are calculated using Equation (6), as well as the internal reaction forces in the knee joint.
# Resistance of Concretes to External Chlorides in the Presence and Absence of Sulfphates: A Review
## 1 Introduction  
One of the greatest challenges facing the construction industry is how to ensure the longevity of reinforced concrete structures. A key concern is the ingress of chlorides, which are known to cause the initiation of embedded steel bar corrosion by de-passivating the protective film provided by the high alkalinity of concrete pore solution around the steel bar [1]. Aggressive, chloride-rich environments can arise through, for example, the application of de-icing salts or the presence of aggressive marine environments. In the latter situation, the principal agents of attack are a combination of chlorides and sulphates from seawater [2; 3; 4]. These problems have continued to exist, despite extensive research to understand and profire solutions to them. Furthermore, changes in binder composition, with increasing use of supplementary cementitious materials and cement-replacement materials (here considered as ground granulated blast furnace (GGBS), fly ash, silica fume, metakaolin, calcined clays and limestone), can lead to a reduction in the pH of concrete pore solutions in fresh, hardened concrete [5], while changes in pore structure and phase assemblages can also affect the susceptibility to carbonation, thus, affecting the local alkalinity over the long term. However, these binders also offer increased aluminate levels, which can bind both sulphates and chlorides [6; 7; 8]. A number of studies investigated the attack of concrete structures by external chlorides [9; 10; 11; 12; 13; 14], with others looking at the combined attacks of chloride and sulphate [4; 8; 15; 16; 17]. The increasingly wide palette of cementitious binder available to civil engineers [18] has made these problems even more complex. Hence, there is a need for a comprehensive overview, which brings together key developments concerning the combined attack of concrete by chlorides and sulphates. The present study draws from published research in academic and professional journalsand databases to review how different factors affect the resistance of concrete to external chlorides, with or without the presence of sulphate ions.
# Suitable Integral Sampling for Bandpass-Sampling Time-Modulated Fourier Transform Spectroscopy
## 3 Analyzing Suitable Sampling Conditions for BPS-FTS
Given that bandpass sampling is a classic example of under-sampling, in contrast to Nyquist sampling, the SMTF criterion should be adjusted to employ the average SMTF value rather than the maximum SMTF value; specifically,  
\[|\text{SMTF}|\geq 0.9\overline{\text{SMTF}}=0.9\overline{\text{sinc}}\bigg{\{} \pi\
u r\bigg{[}\frac{(1-k)m}{2\
u_{\text{max}}}+\frac{k(m-1)}{2\
u_{\text{min} }}\bigg{]}\bigg{\}} \tag{13}\]  
When the value of \(r\) satisfies Equation (13), the conditions for approximately accurate restoration of the spectrum can be met. Combined with the above analysis, according to the nature of the sinc function, since the sinc function has periodic zero-crossing points, then the \(r\) value that meets the conditions for approximately accurate restoration of the spectrum will appear periodically in the interval confirmed by two adjacent zero-crossing points. When \(|\text{SMTF}|<0.9\overline{\text{SMTF}}\) in a certain interval, there is no \(r\) in that interval and subsequent intervals that can accurately restore the spectrum. To establish a more suitable understanding of the relationship between the sampling integration time and the accuracy of the reconstruction of the spectrum, Chapter 4 delves into the theoretical modeling and simulation of the interferogram integration sampling process. The influence of rectangular sampling functions corresponding to various integration durations on the reconstructed spectrum is examined. A comparative analysis is conducted, aligning these results with the theoretical insights obtained in this section. This comparative analysis serves as a foundation to establish integration sampling parameters for practical systems.
## 2 Problem Statement
### Governing Equations  
For the sake of brevity and generality, the governing equations are written in their dimensionless form by considering the steady state regime. The equation of heat conduction in the solid walls is  
\[\alpha_{r}\left(\frac{\partial\theta^{2}_{s}}{\partial X^{2}}+\frac{\partial^ {2}\theta_{s}}{\partial Y^{2}}\right)=0 \tag{1}\]  
where \(\alpha_{r}=\frac{\alpha_{s}}{\alpha_{f}}\) is the thermal diffusion coefficient ratio of the solid to the air.  
Figure 1: A typical representative cell of the char layer.  
For the air in the cavity, the conservation equations of mass, momentum, and energy are expressed as follows:  
\[\frac{\partial U}{\partial X}+\frac{\partial V}{\partial Y}=0 \tag{2}\]  
\[U\frac{\partial U}{\partial X}+V\frac{\partial U}{\partial Y}=-\frac{\partial P }{\partial X}+Pr\bigg{(}\frac{\partial^{2}U}{\partial X^{2}}+\frac{\partial^{2 }U}{\partial Y^{2}}\bigg{)} \tag{3}\]  
\[U\frac{\partial V}{\partial X}+V\frac{\partial V}{\partial Y}=-\frac{\partial P }{\partial Y}+Pr\bigg{(}\frac{\partial^{2}V}{\partial X^{2}}+\frac{\partial^{2 }V}{\partial Y^{2}}\bigg{)}+Ra\times Pr\times\theta \tag{4}\]  
\[U\frac{\partial\theta}{\partial X}+V\frac{\partial\theta}{\partial Y}=\bigg{(} \frac{\partial^{2}\theta}{\partial X^{2}}+\frac{\partial^{2}\theta}{\partial Y ^{2}}\bigg{)} \tag{5}\]  
where \(U\) and \(V\) are the dimensional velocity in \(X\) and \(Y\) directions, \(P\) is the dimensional pressure, \(\theta\) is the dimensional temperature and \(Ra\) and \(Pr\) are the Rayleigh number and the Prandtl number, respectively. The dimensional parameters are defined as  
\[Pr=\frac{\gamma_{\rm f}}{\alpha_{\rm f}}\,Ra=\frac{g(\mathcal{D}(T_{\rm h}-T_{ \rm c}))^{4}}{(\varpi\alpha)_{\rm f}L}\,X=\frac{x}{l}\,Y=\frac{y}{l}\,\theta= \frac{T-T_{\rm c}}{T_{\rm h}-T_{\rm c}}\,U=\frac{ul}{\alpha}\,V=\frac{vl}{ \alpha}\,W^{2}=U^{2}+V^{2}\]
## 2 Materials and Methods
### Clinical Parameters  
Clinical measurements were made noninvasively using a periodontal probe (UNC15, [PERSON], Chicago, IL, USA) calibrated every 1 mm. For each examined tooth, probing depth (PD), clinical attachment level (CAL), gingival recession depth (GRD), gingival recession width (GRW) and attached gingiva width (AG) were recorded. In addition, the class of each gingival recession was determined, according to [PERSON] [26].  
Gingival thickness (GT) measurements were taken at the gingival recession sites, using an endodontic instrument after local anesthesia. This invasive method was earlier described by [PERSON] et al. [27]. In places with a present zone of attached gingiva, gingival thickness was measured mid-bucucally at two points: BGT\({}_{1}\) (buccal gingival thickness) -point located in the middle of keratinized tissue and BGT\({}_{2}\)--located 2 mm apically from the mucogingival junction. In the event that the attached gingiva was absent, the gingival thickness was measured mid-bucally at one point, which was localized 2 mm in apical direction from the clinical attachment level (BGT\({}_{3}\)).  
Furthermore, after 6, 12 and 24 months: (ARC) percentage of average root (gingival recession) coverage according to the pattern (e.g., for 24 months of observation) were evaluated: \(\frac{\text{GRD}_{2}-\frac{\text{GRD}_{3}}{\text{GRD}_{0}}}\times 100\%\); (CRC) percentage of complete root (gingival recession) coverage: \(\frac{\text{iCRC}_{3}}{\text{iAll}}\times 100\%\); (%CAL) percentage of clinical attachment level gain: \(\frac{\text{CAL}_{0}-\text{CAL}_{24}}{\text{CAL}_{24}}\times 100\%\) ; and (%GTI) percentage of gingival thickness increase: \(\frac{\text{BGT}_{3}-\text{BGT}_{0}}{\text{BGT}_{0}}\times 100\%\), separately for BGT\({}_{1}\), BGT\({}_{2}\), BGT\({}_{3}\).  
The consort flowchart of the study is demonstrated in Figure 1.  
A member of the research team ([PERSON]), who did not participate in the surgical procedure, was assigned the role of intra-examiner in order to record clinical parameters before treatment as well as 6, 12 and 24 months post-treatment.  
Calibration of the research member ([PERSON]), before the study, was performed in the following way: in three nonstudy patients, with multiple adjacent gingival recessions clinical parameters were measured in two visits two days apart. The measurements were performed with a periodontal probe (UNC15, Hu-Friedy, Chicago, IL, USA) with an accuracy of 1 mm (PD, CAL, GRD, GRW, AG). The BGT\({}_{1,2,3}\) measurements were determined  
Figure 1: Consort flowchart of the study CAF, coronally advanced flap; A \(-\) CTG, augmented connective tissue graft; NA \(-\) CTG, nonaugmented connective tissue graft; n—number of subjects, N—number of gingival recessions.  
with an endodontic file together with a caliper (Iwanson) with an accuracy of 0.1 mm. The intraexaminer repeatability was recognized as adequate with the intraclass correlation coefficient (ICC) of more than 90%.
# A Closer Look at Few-Shot Classification with Many Novel Classes
## 3 Few-Shot Learning with Many Novel Classes
### Problem Formulation
#### 3.1.2 Few-Shot Learning with Many Novel Classes  
A higher value of \(N\) indicates a greater degree of \"novelness\" associated with a few-shot episode. This implies that as \(N\) increases, the few-shot tasks necessitate a broader level of adaptation to incorporate the new knowledge presented in the open-world scenario.  
In the realm of FSL-MNC, the value of \(N\) often far exceeds that found in conventional few-shot learning contexts (e.g., \(N>1000\)), posing significant computational and generalization challenges. We introduce a metric designed to quantify the level of \"novelness\"inherent within a given few-shot dataset. This metric helps distinctly classify FSL-MNC from traditional FSL approaches, highlighting their inherent differences. The novelness ratio, denoted as \(\Omega(D_{\text{novel}};D_{\text{base}})\), is defined as the ratio of the size of the novel class set to that of the base class set:  
\[\Omega(D_{\text{novel}};D_{\text{base}})=\frac{|C_{\text{novel}}|}{|C_{\text{ base}}|} \tag{1}\]  
Figure 2 illustrates a comparison of the novel class set sizes and the novelness ratio exhibited by both traditional few-shot datasets and our ImageNet-MNC dataset (15,000 novel classes and 1000 base classes) tailored for the FSL-MNC benchmark. In traditional FSL, the novelness ratio \(\Omega(D_{\text{novel}};D_{\text{base}})\) is typically less than one (the red bar in Figure 2), indicating a relatively small number of novel classes compared to base classes. Conversely, in FSL-MNC, \(\Omega(D_{\text{novel}};D_{\text{base}})>10\), signifying a substantial increase in the number of novel classes relative to the base classes.  
Mathematically, the FSL-MNC challenge can be precisely described as follows: Given the datasets \(D_{\text{base}}\) and \(D_{\text{novel}}\) where the condition \(\Omega(D_{\text{novel}};D_{\text{base}})>10\) is met, the primary goal is to train model \(f_{\phi}\) using \(D_{\text{base}}\), which can effectively handle few-shot tasks derived from \(D_{\text{novel}}\) with a way number \(N>|C_{\text{base}}|\).