esa-sceva/satcom-chunk-collection huggingface dataset:
# FirmHunter: State-Aware and Introspection-Driven Grey-Box Fuzzing towards IoT Firmware
## 2 Background and Motivation
### Motivations  
Given the status-quo of IoT fuzzing techniques, we choose to implement a server-oriented fuzzing tool towards IoT firmware, which is based on system emulation. The reason is two-fold. On the one hand, unlike front-end fuzzing that is restricted by filtering rules or back-end fuzzing is dependent on static analysis of binaries as mentioned in Section 2.3, server fuzzing can achieve both goals of effective test case generation and low pre-analysis overhead. On the other hand, easy accessibility of firmware on the internet and the development of firmware emulation enable the possibility for large-scale testing of IoT firmware images [25,26].  
Equipped with system emulation and robust crawlers, IoT fuzzers can achieve automated testing on firmware images. However, there still exist two obstacles hindering fuzzing from effectively testing IoT via web interfaces.  
One obstacle is the state dependency in test cases. Take CVE-2019-7298 in the D-link DSL-3782 as an example, this vulnerability is located in the input box on the page Diagnostics.asp as shown in Figure 2. After filling this blank with a random IP address and clicking the \"Run test\" button, two requests will be sent from the front-end to the server in the target router, which is shown in Figure 3. The former is a GET request which asks the server to get a sessionKey. After receiving a sessionKey from the server, the front-end will append sessionKey as a form data to the form in the latter request. What an attacker does is just capturing these two request messages, modifying the value in the \"Addr\" field of the latter request with a long string, and replaying these two requests. Then the target router will crash due to buffer overflow.  
However, state-of-the-art IoT fuzzers have not proposed approaches to detect such kind of challenge-response mechanism. FirmFuzz [10] captures the first message after each  
Figure 3: Inter-message dependency in requests.  
Figure 2: Vulnerable web page of DSL-3782.  
button-clicking action and mutates this message, and the most popular web application scanners just choose one message from crawled database to mutate. They both neglect this inter-message dependency in IoT testing and thus cannot find this vulnerability.  
Another obstacle is the scheduling of test cases to mutate. Suppose current IoT fuzzing tools can recognize the inter-message dependency within these two messages in Figure 2. The vulnerability detection time is determined by when the fuzzer turns to mutate the above two messages. For FirmFuzz, you can implement the depth-first-search (DFS) or breadth-first-search (BFS) algorithm on the crawler to traverse web applications. Furthermore, fuzzing one test case is time-consuming as the fuzzer needs to wait for IoT devices to receive messages, execute back-end binaries and send messages back. Once the vulnerable page is located deeply, it will waste lots of time for FirmFuzz to fuzz the previously found pages.
## 4 Results
### Data Visualization
#### 4.3.1 Backend Application  
The backbone of the two frontend applications is a server-side application with various functions (Figure 19). Primarily, it implements a RESTful API as a main interface to request data. In order to query and serve our aggregated and processed data (i.e., photographs enriched with spatial and temporal information, generated 3D building models, custom terrain and map data, or custom points of interest), we used the graph database Neo4j. This enables us to identify relationships between multiple instances of data (e.g., which images depict which buildings), and to store them to improve the querying and finding of relevant data.  
External APIs are requested to complement the custom data: the DEM-Net Elevation API for digital terrain models, the Overpass API for OSM building footprints, and Wikidata for retrieving information for points of interests. Since the requests to those APIs can take up to several seconds and are unlikely to change in the short term, the backend caches the responses. Thus, requests with the same or nearby location query parameters can be answered much faster.  
Besides storage and querying data, the backend features some more computation-intensive tasks. When 3D models are uploaded, they are converted into Draco-3D-compressed glTF files. Additionally, which OSM building footprint overlaps with the uploaded model is checked to avoid interfering with 3D models later in the scene. If the spatial information of an image is updated, it is then determined which buildings are visible and to what extent. Experimental pipelines for automated data generation and enrichment (i.e., spatialization of photographs, generation of 3D buildings) are not yet part of the backend, but the results can be pushed via an API endpoint.
# On the Secrecy Sum-Rate of Internet of Things Networks: Scheduling and Power Control +
## 6 Discussion
### Satellite Communications  
The evolution of wireless communication systems, exemplified by the current 5G technology and the forthcoming 6G advancements, should fulfill significant milestones in terms of enhanced performance, including data rate, latency, reliability, and connectivity. In recent years, satellite communications have been expected to play a crucial role in 5G and 6G networks by offering expansive coverage in several applications such as broadcasting, navigation, and military operations [36]. However, wireless communications, including satellite communication, remain vulnerable to eavesdropping by malicious attackers. Consequently, security and privacy are among the most important design factors in 6G satellite communication systems [37].  
Traditionally, advanced encryption algorithms, secure key management protocols, and authentication mechanisms have been studied to safeguard satellite transmissions. Furthermore, in addition to cryptology-based security measures, physical-layer security can significantly bolster the security of satellite communications. Accordingly, our proposed scheduling scheme aims to enhance the secrecy performance of satellite communications by minimizing information leakage to unauthorized nodes. It is worth noting that our proposed scheme is particularly effective as the number of nodes increases.  
Figure 6: Average achievable secrecy sum-rate for varying SNR when \(M=2\), \(N=200\), and \(K=2\)[21].
## 4 Results
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Position**} & **Coordinate X** & **Coordinate X** & **Coordinate Y** & **Coordinate Y** & **Height H** & **Height H** \\  & **(Metre)** & **(Error Metre)** & **(Metre)** & **(Error Metre)** & **(Metre)** & **(Error Metre)** \\ \hline
1 & 5,914,268.521 & 0.001 & 5,481,721.882 & 0.0011 & 18.615 & 0.0052 \\
2 & 5,913,766.879 & 0.0015 & 5,472,143.054 & 0.0010 & 5.709 & 0.0048 \\
3 & 5,915,137.456 & 0.0019 & 5,482,014.790 & 0.0012 & 14.133 & 0.0065 \\
4 & 5,921,687.950 & 0.0011 & 5,473,141.886 & 0.0007 & 6.304 & 0.0042 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Coordinates aligned with ASG-EUPOS stations of 3 h measurements (November 2020). Therefore, it is possible to reduce the measurement time by half in order to obtain reliable data for the assessment of vertical displacements on islands between the Miedzyodrze Islands. A more extensive analysis of vertical and horizontal displacements was also possible, following a second GNSS survey performed in May 2021, during which vertical movements of benchmarks and their errors were calculated (Table 5). The alignment was carried out using the method of least squares. As a result of measurements connected to the geodetic network point with known coordinates (station Kamien Pomorski, and Penzlau) increments (m) between that point and two new points (2 and 3) were obtained, as well as error matrices of increments (mm\({}^{2}\)) (reports from alignment appendices). The observation equations of triple phase differences were formulated assuming one of the satellites as the baseline. For example, for four available satellites, three equations are formulated (combinations 1-2, 1-3, 1-4) containing three unknown corrections \(dX\), \(dY\), \(dZ\) to the approximate coordinates of the mobile receiver \(XB\), \(YB\), \(ZB\). The full observation system contains multiples of these equations for each pair of measurement moments t\({}_{1}\), t\({}_{2}\). As a result of its solution by the method of least squares, corrections \(dX\), \(dY\), \(dZ\) and coordinates of the mobile receiver \(XB+dX\), \(YB+dY\), \(ZB+dZ\) were obtained with an average error of 0.05 m. Observation equations of double phase differences were formulated analogously to triple phase differences, assuming one of the satellites as the base. The average errors of corrected coordinates were of the order of 0.05 m. Corrections \(dX\), \(dY\), \(dZ\) to approximate coordinates of the mobile receiver \(XB\), \(YB\), \(ZB\), after assuming known, constant values of the number of cycles determined in the first equalization of double phase differences, were determined by repeated solution of the equations of double phase differences. Mean errors after these corrections should be of the order of 0.005 m.
# Interconnecting Haptic Interfaces with High Update Rates through the Internet +
## 5 Simulation Results
### Packet Loss  
Figures 3 and 4 depict the percentage of packet loss inrelation to the delay of the network. This diagram is important as it reveals the correlation between the network delay and the packet loss for each protocol. If the characteristics of the End-to-End delay of the network are known, it can be decided which protocol should be used for the transport of haptic data so as to avoid high values of packet loss.  
In Figure 3 the Internet bottleneck is 20 Mbps for all simulations. The delay was set to 5, 10, 20, 30, 40, 50, and 60 ms for each simulation and was stable for the whole simulation period. All the protocols present quite a low packet loss, lower from the limit of 10% of Table 1. The worst performance is presented by protocol the SCTP and the DCCP, but still they have a packet loss lower than 0.76%.  
On the other hand, Figure 4 presents much higher values of packet loss. In this scenario, the Internet bottleneck has only 1 Mbps bandwidth for all simulations. It is obvious that the network is congested. Six protocols are trying to send a throughput of at least 3 Mbps over the network with a bandwidth of 1 Mbps. The protocol with the smallest percentage of packet loss is the UDP protocol. The protocol with the higher packet loss is again the SCTP and the DCCP.  
\begin{table}
\begin{tabular}{c c c c c c} \hline  & **ETP** & **UDP** & **RTP** & **SCTP** & **DCCP** \\ \hline Header (bytes) & 12 + 8(UDP) & 8 & 12 + 8(UDP) & 12 + 4(Chunk INF.) & 12 \\ \hline Haptic Payload (bytes) & 64 & 64 & 64 & 64 & 64 \\ \hline Efficiency & 76.19\% & 88.88\% & 76.19\% & 80\% & 84.21\% \\ \hline \end{tabular}
\end{table}
Table 4: Protocol Efficiency.  
Figure 2: Dynamic Network Topology of NS2 with TMIX and DelayBoxes modules.  
Figures 5 and 6 depict the interaction between the packet loss and the bandwidth of the network. Figure 5 depicts a network with static network conditions while Figure 6 depicts a network with dynamic delay and bandwidth. Both charts have similar behavior for bandwidth higher than 5 Mbps. From these charts one can conclude that as the bandwidth increases, the packet loss decreases. For bandwidth over 5 Mbps the packet loss is lower than 1%. When the bandwidth is 1 Mbps, the packet loss is very high, which means that the network is congested. Figures 3-5 shows that the DCCP and the SCTP show the worst performance, as far as, the packet loss is concerned when the network is congested. The SCTP and the DCCP protocol use a TCP-like Congestion Control. The sender uses a congestion window and transmits packets until that window is closed. When congestion occurs the congestion window is lowered to half. The DCCP and the SCTP protocols send their packets in bursts. The buffers of the intermediate routers are overflowed and many packets are dropped.  
Figure 4: Packet loss for internet bandwidth 1 Mbps.  
Figure 5: Packet loss for internet delay 40 ms.  
Figure 3: Packet loss for internet bandwidth 20 Mbps.
# FL-SDUAN: A Fuzzy Logic-Based Routing Scheme for Software-Defined Underwater Acoustic Networks
## Abbreviations  
\begin{tabular}{l l} AHP & Analytic Hierarchy Process \\ BS & Base Station \\ CH & Cluster Head \\ DN & Data Node \\ DSR & Direction-Sensitive Routing \\ E2 EL & End-to-End Latency \\ EECOR & Energy-Efficient Cooperative Opportunistic Routing \\ EEHC & Energy-Efficient Hybrid Clustering \\ FCO-MST & Minimum Spanning Tree Algorithms Based on Fuzzy Cut-Set Optimization \\ FLOVP & Fuzzy Logic-Based Optimized Vector Protocol \\ FL-SDUAN & Fuzzy Logic-Based Software-Defined Underwater Acoustic Networks \\ FPO-MST & Minimum Spanning Tree Algorithms Based on Fuzzy Path Optimization \\ LEACH & Low-Energy Adaptive Clustering Hierarchy \\ ODL & OpenDayLight \\ OvS & Open vSwitch \\ PDR & Packet Delivery Rate \\ QoS & Quality of Service \\ ROM & Read-Only Memory \\ SDN & Software-Defined Networking \\ SD-UAN & Software-Defined Underwater Acoustic Network \\ TDMA & Time Division Multiple Access \\ TH & Temporary Head \\ UAN & Underwater Acoustic Network \\ VBF & Vector-Based Forwarder \\ WBFL & Weight-Based Fuzzy Logic \\ \end{tabular}
## 2 Materials and Methods  
Aluminum wrought alloy 1050 specimens (chemical composition shown in Table 1) with a surface area of 0.16-0.17 dm\({}^{2}\) were ground using abrasive papers grits #280, #400, #600, #1000, #2400, and #4000 and then subjected to ultrasonic cleaning in acetone. The surface roughness after polishing was Ra 3.  
PEO treatment was performed at 280 \({}^{\circ}\)C in the electrolyte with a eutectic composition of NaNO\({}_{3}\)--KNO\({}_{3}\) (Sigma-Aldrich, St. Louis, MO, USA) with the mass % of 45.7:54.3 respectively. The electrolyte was held in a nickel crucible (99.95% Ni), which served as a counter electrode. The surface ratio of anode-to-cathode was 1:30, the anodic current density was 70 mA/cm\({}^{2}\), and the voltage was limited by the galvanostatic mode. The applied power supply has the following parameters: \(I_{\text{max}}\) = 5 A, \(U_{\text{max}}\) = 900 V, current and voltage were pulsed with a square-wave sweep at a frequency of 50 Hz (\(t_{a}\) = \(t_{k}\) = 0.01 s) by a pulse generator Digit-EL PG-872 (Minsk, Belarus). The duration of the PEO treatment was 10 min, with a coating rate of 1 \(\upmu\)m/min. Finally, the obtained specimens were rinsed with water and dried.  
The current and the voltage wave profiles and trend plots, as well as the power consumed during the process, were measured using Fluke Scope Meter 199C (Eindhoven, The Netherlands) (200 MHz, 2.5 GS s\({}^{-1}\)), which was located into the electrical circuit between the power supply and the working container.  
Photo images of the PEO treatment progress were made by the high-speed digital camera Nikon lj5 (Tokyo, Japan) with a 1 Nikkor VR 10-110 lens (Tokyo, Japan) and a macro extension tube with a frame rate of 120 fps.  
Cross sections were prepared by a standard method of metallography. Surface and cross-section morphologies of the obtained PEO coatings were examined by TESCAN MAIA3 scanning electron microscopy (SEM) (Brno, Czech Republic) equipped with an energy dispersive X-ray spectroscopy (EDS) system by Oxford instruments (Abingdon, UK) with an X-MaxN detector. The phase composition of the coatings were determined by a PANalytical Empyrean diffractometer (Almelo, The Netherlands) with Cu K\(\alpha\) radiation in grazing incidence mode using a scan with a grazing angle of 3\({}^{\circ}\), with a step size of 0.03\({}^{\circ}\), and at a 2\(\Theta\) range from 10\({}^{\circ}\) to 90\({}^{\circ}\).  
A BuehlerMicromet 2100 (Lake Bluff, IL, USA) micro-hardness tester was used to evaluate micro-hardness on a cross section of the obtained oxide layer. The micro-hardness was determined according to ASTM E384, C1327, and B578 that's standard names as the mean of eight measurements for each sublayer under a load of 10 g.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline  & & & & & & \\ \hline Si & Mg & Fe & Cu & Mn & Zn & Ti & Al \\
0.25 & 0.05 & 0.44 & 0.05 & 0.05 & 0.07 & 0.05 & Base \\ \hline \end{tabular}
\end{table}
Table 1: Chemical composition of the Al alloy 1050.
## 3 Modeling of UAHW Target Recognition Algorithm Based on SMOTE-Stacking
### Model Establishment  
The problem of target recognition for underwater homing weapons is a few-shot recognition problem. SVM exhibits outstanding performance and is well-suited for small-sample scenarios. KNN is easy to implement and also suitable for small-sample problems. DTs offer good interpretability, which is crucial for underwater homing weapons. RFs provide high accuracy and robustness, while XGBoost excels in performance and scalability, making it highly versatile. And, in the first layer of the stacking ensemble model, we selected five different learners, specifically KNN, SVM, DT, RF, and XGBoost. The meta-classification model chosen was GBDT. To enhance the model's robustness, we conducted 5-fold cross-validation on the training set. In each training and testing iteration, the data were divided into five parts, with four parts used for training the model, and one part used as a validation set for model evaluation. For instance, in one training and testing iteration, these four data segments were employed as inputs for the first layer of the stacking model, incorporating the five different learners, resulting in five predictions. These five predictions were subsequently used as inputs for the second-layer meta-learner and were utilized for  
Figure 10: The t-SNE visualization results for the 5-fold cross-validation of features.  
training. A validation dataset was employed as model input for testing in order to search for the optimal hyperparameters. As illustrated in Figure 12, the entire training and testing process was repeated five times to cover all the training data.
## 1 Introduction
### Article Structure  
Having introduced the need for broadband service delivery at fiber-like speeds with low latency and the importance of the 5G technological enhancements in achieving the object, we present a comprehensive overview of the broadband system considering fixed-line and wireless broadband technologies in Section 2. In the section, we offer broad descriptions of different typical architectures along with network evolution in view of the technology types and the associated features. Moreover, Section 3 presents FWA and emphasizes the 5G-based FWA prospect, transport requirements, as well as planning and deployment. Furthermore, Section 4 presents different FWA design considerations and challenges that should be noted in the 5G FWA system planning and deployment. Furthermore, viable solutions for alleviating the associated technical challenges and performance issues are proffered. In Section 5, we give a comprehensive overview of 5G FWA field trials by various operators with a case study and trial results. Section 6 considers a number of potential FWA transport network solutions in conjunction with their advantages and disadvantages. Based on their suitability for the envisaged ultra-dense small cells and massive DUs deployment, in Section 7, we focus on the PON transport solutions that can efficiently support a huge number of the anticipated subscribers. Section 8 offers comprehensive explanations on the need for the RAN decomposition scheme regarding its implementations and implications on the 5G FWA transport network solutions. Furthermore, in accordance with the 3 GPP WG3 5G, we evaluate and simulate the UL transmission bandwidth requirements for a number of split options. In addition, we present a high-level concept of vRANs with PTN for attending adaptively to the dynamic nature of different use cases. We present conclusions and final remarks in Section 9. The tutorial is organized as outlined in Figure 1.  
Figure 1: Schematic of the tutorial organization with related content.
# Multi-Objective Optimization of Three-Stage Turbomachine
## 3 Optimization Problem
### Multi-Objective Rotordynamic Optimization  
The behavior of multimodal optimization problems can vary with the number of variables involved, with multivariable problems representing more complex instances of multimodal optimization. In the context of rotordynamics, this complexity is exemplified by rotor structures with multiple disks and bearings. To create such a multimodal optimization problem, this study draws inspiration from the General Electric J85-GE benchmark, depicted in Figure 1 and develops a three-stage rotor system as illustrated in Figure 4. In Figure 1, the light-colored rotor geometry represents the low-pressure (LP) shaft, while the dark-colored rotor structure corresponds to the high-pressure (HP) shaft. Although this rotor geometry features a twin spool structure, the focus of this study is on the LP rotor group. The study aims to optimize the rotor design to enhance its natural frequency to meet supercritical design criteria, achieve a lightweight rotor design, and reduce bearing forces and disk deflection.  
In order to apply rotordynamic optimization, the rotor geometry in Figure 4 is given as the initial geometry before optimization, inspired by the benchmark given above. Although the cross-sectional structure of J8-GE is not fully known, we expect a geometry output in which the compressor slides toward the bearing on the right and the turbine slides toward the bearing on the left end. Parameters on the given geometry are symbolized with letters close to the relevant location. The subscript indicates the element number, where L represents shaft length, R represents shaft radius, M represents disk mass, \(I_{p}\) represents polar moment of inertia, \(I_{d}\) represents area moment of inertia, K represents bearing stiffness, and C represents bearing damping. The values of these parameters and additional material properties are provided in Table 1. Within this table, \(k_{s}\) denotes the shape factor for circular beams and is also given in Equation (18), E represents [PERSON]'s modulus for material properties, \(\rho\) represents beam density, \(\upsilon\) represents Poisson's ratio, and g represents gravitational acceleration. The operating speed is set at \(\Omega=160\) Hz, with an additional margin of +25% up to 200 Hz defined as the objective function limit.  
\[k_{s}=\frac{M_{p}}{M_{e}}=\frac{\frac{\sigma_{y}D^{3}}{6}}{\frac{\sigma_{y} \pi D^{3}}{32}}\cong 1.7 \tag{18}\]  
Figure 4: Initial rotor structure.  
It is important to note that the shape factor \(k_{s}\) represents the ratio of the plastic moment \(M_{p}\) to the elastic moment \(M_{e}\). Here, D represents the diameter for circular sections and \(\sigma_{y}\) denotes the yield stress of the material. In this case, the shape factor is obtained approximately as shown in Equation (18). For beams with different cross-sectional shapes, this parameter needs to be updated.
# Autonomous Robotics for Identification and Management of Invasive Aquatic Plant Species
## 3 Results
### Autonomous Vehicle Performance
#### 3.1.1 Autonomous Navigation  
With the marine propulsion system, prototypes achieved speeds up to 2.3 m/s and were able to navigate in the presence of moderate wind (4.5 m/s, 10 mph), light rain, and choppy surface water conditions. An iterative controller tuning process was completed to ensure high-performance tracking in autonomous navigation mode. Figure 16 shows typical autonomous tracking performance. No degradation in tracking performance was observed due to wind gusts or high fluid levels in the herbicide tank, though the maximum speed decreased with heavier herbicide payloads.