esa-sceva/satcom-chunk-collection huggingface dataset:
# Rapid Restoration Techniques for Software-Defined Networks
## 3 Proposed Path Recovery Methods
### Community Detection-Based Approach  
Community Detection (CD) considers that groups of nodes that share common properties can be represented as communities [25]. Here each community is defined as a subgraph whose nodes are densely connected, but sparsely connected with the rest of the network [26]. Many algorithms have been proposed to discover community structures in networks such as the _Louvain_ algorithm and the _Girvan and Newman_ algorithm [27]. Figure 1 shows a synthetic network on the LHS and a representation of the network on the RHS which consists of three non-overlapping communities which are detected using a community detection algorithm. Each community only has two inter-community links whereas nodes within communities are densely connected.  
Community detection has been utilised to resolve various kinds of network-related problems such as routing and data forwarding [28; 29]. We use the concept of a _community_ as an approach to improve the speed that an SDN is restored by accelerating the process of failure recovery. By dividing the network graph \(G\) into \(N\) communities, we make the assumption that when a link failure event occurs, only one community will suffer from that particular failure. If this is the case, the other communities will continue working properly, since no failure is experienced in their domain. The assumption that only one community is affected is reasonable in a large proportion of the cases of link failure. This assertion is true because the criteria that we use to partition the network into communities is link density, and thus, as the density of edges between nodes in the community is higher than the density of inter-community edges, and if the link failure probability is uniform, link failure events are more likely to be confined within one community. It is worth bearing in mind that link failure probabilities will not in general be uniform. In this case the link failure probability may also be incorporated into the community detection process to address this problem. We assume that the link failure distribution is uniform. At the moment of link failure, only the community that includes the affected link will be considered in order to find a path recovery solution. The advantage of our approach is that instead of searching for an alternative path from _end-to-end_ within an entire graph, \(G\), we only consider the problem within a single community.
# TopoSinGAN: Learning a Topology-Aware Generative Model from a Single Image
## 2 Materials and Methods
### Experimental Setup
#### 2.3.2 Dendrology  
In our research, we employed a single gigapixel macro photography (GMP) image, measuring 175 \(\times\) 240, as developed by [52]. This image, a part of a large dataset featuring an ultra-high resolution of 19,812 dpi, was manually cropped and annotated. It encompasses a four-channel composition, including RGB and an additional mask channel that delineates cellular structures of xylem vessels in hardwood tree sections. In the field of dendrology, such images are invaluable, offering insights ranging from tree age to environmental adaptations, as discussed by [53]. A typical 1 mm\({}^{2}\) area of a tree ring contains approximately 750 vessels, presenting significant challenges in manual delineation. This complexity underscores the necessity of leveraging deep learning methodologies for efficient and accurate data synthesis in dendrology studies.
# Towards Incidence Management in 5G Based on Situal Awareness
## 2 Background
### Information Security Incidence Management  
The problems inherent to incidence assessment and management have captured the attention of the research community over the recent four decades. Consequently, several studies have been published in order to collect the most relevant contributions, as well as to identify the causes that have given way to their evolution, as it is described in [19; 20]. The bibliography covers a very large collection of topics that range from the definition of risk and its scientific approach [21] to discussions about their development by different governments and organizations [22]. On the other hand, the need to protect the information technology has also led to the publication of standards [7; 8; 9] and guidelines [9; 11] for their proper implementation. Most of these proposals agree that the incident management process must be carried out in the following steps: framing, assessing, monitoring and responding [20]. Risk framing determines the context and a common perspective on how organizations manage risk, which include their goals, policies, constraints, risk tolerance, priorities, trade-offs, and principles of action [7]. Incidence assessment identifies potential risks, organizational assets and vulnerabilities. Then, it evaluates the risks according to different criteria, such as likelihood of occurrence, capacity to inflict harm or dimensions (confidentiality, integrity, availability, authenticity, etc.) [9; 10]. Because of its complexity [23], this is the step with the largest presence in the literature, which has motivated the development of specific systems for Information Security Risk Assessment (ISRA). In the monitoring step, the ISRM maintains awareness of the incidences being incurred, which implies looking for events in the monitoring environment that allow the detection of the previously determined threats. If any of them is identified, the response tasks decide and apply the appropriate countermeasures.  
Due to the large differences between monitoring scenarios, the success of decision-making depends directly on the previously described processes and their ability to adapt to each use case. The following are examples of methodologies to facilitate their integration into more specific monitoring environments: Cloud Environments [24], industrial control [25], embedded systems [26] and Supervisory Control And Data Acquisition (SCADA) [27]. Given the nature of 5G devices and layers, it is important to track suspicious events in order to provide more intelligence to 5G security and monitoring systems [28; 29]. Forensics are intended to collect, analyze and interpret digital data connected to a security incident in order to track an evidence trail (how an attack was carried out or how an event occurred). In the context of 5G mobile networks, these incidents might be related to physical and virtual devices as well as sensors, SDN/NFV functions and cloud elements [30].
## 4 Network Performance Analyses
### Case Study  
As a first approach to determine the optimal architecture to use in this study, we undertook a performance analysis of a study employing the IEEE 802.15.4 standard. The considerations we consider in our proposed solution include:  
Figure 9: Network architecture. Transmitting nodes send packets from the patient node to a sink node every 3 s; the data frame consists of 2 Bytes that contain each patient's code and the type of arrhythmia detected. * Receiving nodes wait for an acknowledgment packet (ACK) after each transmission. If a receiving node does not receive a response in less than 100 ms, the transmitting node re-sends the information packet. If after 25 attempts, the receiving node does not obtain any response, this node changes its status to an error node. The node distribution is shown in Figure 10. This distribution allows us to determine the possible patient locations, taking into account the specifications of the selected device for implementing the physical layer, CC2420, whose characteristics include:  
* A coverage radius of 30 m and 100 m without obstacles. * A frequency range of 0.4-2.4835 GHz. * Data rates of 250 Kbps. We propose implementing a network as presented in Figure 11, which consists of 3 fixed nodes that will not have power consumption restrictions. These three nodes will receive the reports transmitted by the sensors located on five patients that route the message to the sink node. Fixed nodes have identifiers 0, 1 and 2 and the sink node has the ID 0. Patient devices have IDs from 3 to 7. The routing network consists of nodes 1, 2 and node 0 (network coordinator). Each one of these nodes forms a sub-network in collaboration with patient nodes. Because of their mobility, nodes enter and exit the sub-network continuously changing the configuration and network structures. The simulation for this study was conducted in TOSSIM. Additionally, the TelosB platform was selected because it includes the CC2420 transceiver and the MSP430 processor. Given the nature of this study, where the network backbone nodes are fixed, a routing algorithm that uses a fixed table (see Table 3) was used. Figure 10: Node distribution and coverage in the study. This study simulates a critical case where all the mobile nodes are connected to the most distant sub-network from the sink node. The transmission times for 2 Bytes from all the patients to the main node are presented in Table 4.
## 3 Materials and Methods
### Two-Dimensional Basin Modeling of an Extruded Structural Section
#### 3.2.2 Input Parameters  
The 2D basin model hinges on a comprehensive set of input parameters, including geological layer thickness, depositional type, and paleo-environmental information. In addition, lithology, heat flow, source rock properties, and hydrocarbon generation kinetics also need to be obtained [4] (Table 1). The absolute ages of depositional events were constrained using the International Chronoststratigraphic Chart (www.stratigraphy.org, accessed on 3 November 2023). The lithological data of the strata were derived from wells and published data [4; 16; 18]. Combined with the influence of different lithologies on ground temperature, deposition or erosion on heat flow, the thrust-nappe structure, and other geological processes on the thermal evolution of source rocks, the transient heat flow method was used to simulate the thermal history [27; 28; 29]. It is worth mentioning that five sets of source rocks were set up in this study, namely, Triassic mudstone, J\({}_{1}\)Y mudstone, J\({}_{1}\)y carbonaceous mudstone J\({}_{1}\)y coal, and J\({}_{2}\)kz mudstone, with average thicknesses of 300 m, 150 m, 60 m, 50 m, and 200 m, respectively. In order to model hydrocarbon generation and migration, it is necessary to know the geochemical data of source rocks. In this study, we collected the measured TOC and rock-eval data of Triassic and Jurassic source rocks from both the literature and the Tarim Oilfield, PetroChina. The appropriate values are listed in Table 1.  
It is significant to accurately select a heat flow value for the simulation of thermal evolution. Several researchers believe that the Kuqa Depression has been in a low heat flow stage since the Triassic, which is 50-55 mW/m\({}^{2}\)[9; 30; 31]. The heat flow value has been continuously decreasing since the Cenozoic and finally changed to the present value of 40-45 mW/m\({}^{2}\). The present average heat flow value in the Kuqa Depression is 44.6 mW/m\({}^{2}\)[9]. The assignment of deposition and erosion events and heat flows was achieved by referring to previous studies of the Kuqa Depression [31]. The reasonability of the heat flow history was also calibrated using both measured borehole temperatures and vitrinite reflection data from several wells.
## 5 Scheme Construction
### User Key Generation  
Every new user receives a unique gid after he registers himself in the system. For obtaining identity-related keys, he requests CA. The CA runs the CAKeyGen algorithm.  
After that, the user applies attribute-related keys, and different AAs run the AAKeyGen algorithm for this.  
CAKeyGen(GPP,gid) \(\rightarrow\) (\(CAPK_{gid}\),CASK\({}_{gid}\)): The CA demands the user's gid for issuing identity keys. CA randomly chooses \(r_{gid}\in~{}Z_{N}\) and \(\mathrm{R}_{gid}\in G_{p_{3}}\), then sets \(\mathrm{CASK}_{gid}=g^{r_{gid}}R_{gid}\). Then, it uses MSK to compute \(\gamma_{gid}=Sign\Big{(}MSK,~{}gid\parallel\mathrm{CASK}_{gid}\Big{)}\). Finally, it sends \(CAPK_{gid}=\Big{(}gid,\mathrm{CASK}_{gid},\gamma_{gid}\Big{)}\) and \(\mathrm{CASK}_{gid}\) to the user.  
AAKeyGen(\(S_{gid,k}\),\(GPP\), \(MPK,CAPK_{gid}\), \(ASK_{k}\)) \(\rightarrow\) (ASK\({}_{gid,k}\)): To obtain the attribute-related keys issued, a user passes their attribute set \(\mathrm{S}_{gid,k}\) to the \(\mathrm{AA}_{k}\), which belongs to their domain. Then, the \(\mathrm{AA}_{k}\) uses the MPK to verify whether the \(\mathrm{CAPK}_{gid}\) is valid. If valid, for issuing keys related to \(\mathrm{S}_{gid,k}\), \(\mathrm{AA}_{k}\) randomly selects \(\mathrm{R}_{gid,k}\in G_{p_{3}}\) and computes \(\mathrm{SK}_{gid,k}=g^{\alpha_{k}}\mathrm{CASK}_{gid}^{\beta_{k}}\mathrm{R}_{ gid,k}=g^{\alpha_{k}}g^{\gamma_{gid}}R^{\gamma_{gid}}R^{\gamma_{gid},k}\), where \(\mathrm{R}^{\prime}_{gid,k}=\mathrm{R}_{gid}^{\beta_{k}}\mathrm{R}_{gid,k}\), else it aborts.  
For each attribute \(\mathrm{i}\in\mathrm{S}_{gid,k}\), it randomly selects \(\mathrm{R}_{gid,k,\mathrm{i}}\in G_{p_{3}}\) and computes \(\mathrm{SK}_{gid,k,\mathrm{i}}=\mathrm{CASK}_{gid}^{\alpha_{k}\alpha_{k} \alpha_{k}}=T_{k\alpha_{k}}r_{gid,k,\mathrm{i}}^{\gamma_{gid}}R^{\prime}_{gid, k,\mathrm{i}}\), where \(\mathrm{R}^{\prime}_{gid,k,\mathrm{i}}=\mathrm{R}_{gid}^{\lambda_{gid,k,\mathrm{i }}}\mathrm{R}_{gid,k,\mathrm{i}}\). Finally, \(\mathrm{ASK}_{gid,k}=(\mathrm{SK}_{gid,k},\left\{\mathrm{SK}_{gid,k,\mathrm{ i}}\right\}_{\mathrm{i}\in\mathrm{S}_{gid,k}})\) is given to the user.  
Therefore, the final set of user keys \(\mathrm{FK}_{gid}\) contains:  
\[\mathrm{K1}=g^{r_{gid}}R_{gid} \tag{9}\]  
\[\mathrm{K2}=\left\{\mathrm{SK}_{gid,k}\right\} \tag{10}\]  
\[\mathrm{K3}=\left\{\left(\mathrm{SK}_{gid,k,\mathrm{ii}}\in\mathrm{S}_{gid,k} \right)\right\} \tag{11}\]
## 5 Experimental Results
### Network Configuration  
The network consisted of three End Devices and one Router. The first end device (named ECG) transmitted a 320-Byte ECG signal. This signal was transmitted using a frame, which had a 20-Byte protocol field and an 80-Byte payload size. The frame size was specifically chosen to send the ECG signal in the minimum amount of frames possible. The other two devices transmitted temperature information in a single frame. In all cases, in order to simplify transmissions, we used a 100-Byte MSDU with no security configurations, using short addresses and ACK requests. All the transmissions were performed on Channel 21 of the IEEE 802.15.4 standard.  
The ECG signal was transmitted every thirty seconds and was transmitted in the FCAP region of the super frame structure. The other devices transmitted their information every twenty seconds in the CAP region.  
Two types of tests were realized. The first was a set-up time test. In this test, the time that all the network devices needed to join a network was measured. In the second test, the percentage of packets arriving at their destiny on the first attempt was counted.
# An Improved Empirical Wavelet Transform and Its Applications in Rolling Bearing Fault Diagnosis
## 3 Proposed Method of Fast Empirical Wavelet Transform
### Threshold Denoising Method  
Threshold denoising is mostly used for wavelet threshold denoising. After obtaining the wavelet coefficients through wavelet decomposition, the coefficients are denoised and the signals are reconstructed. In the process of threshold denoising, different threshold functions affect not only the denoising effect, but also the reconstruction results. It is critical to set the threshold when estimating data. Because this method does not need to show the trend completely, the spectrum fluctuation caused by noise needs to be reduced in the process of threshold denoising. Therefore, there is a certain fault tolerance when thresholds are obtained.  
Commonly used threshold functions include the hard threshold function:  
\[\hat{\text{s}}=\left\{\begin{array}{c}s\left|\text{s}\right|\geq\lambda\\ 0\left|\text{s}\right|<\lambda\end{array}\right. \tag{13}\]  
and the soft threshold function:  
\[\hat{\text{s}}=\left\{\begin{array}{c}\text{sgn}(\text{s})\cdot(\left|\text {s}\right|-\lambda)\left|\text{s}\right|\geq\lambda\\ 0\left|\text{s}\right|<\lambda\end{array}\right. \tag{14}\]  
where s is the signal to be processed and \(\hat{\text{s}}\) is the signal after denoising.  
[PERSON] and [PERSON] [33] give the fixed threshold of \(\lambda\):  
\[\lambda=\sigma\sqrt{2\ln(\text{N})} \tag{15}\]  
where N is the length of the signal to be processed and \(\sigma^{2}\) is the estimated noise variance:  
\[\sigma=\text{Mean}(\text{s})/0.6745 \tag{16}\]The hard threshold can preserve the local information of the signal very well in the processing, but the discontinuity of s at \(\lambda\) and \(-\lambda\) leads to oscillation of the reconstructed signal at the discontinuity point. The overall continuity of \(\hat{\mathrm{s}}\) is better during soft threshold processing. Although the derivatives are discontinuous and there is always a constant deviation between s and \(\hat{\mathrm{s}}\), which may affect the accuracy of reconstruction, this method only needs to obtain the spectrum trend and can ignore these defects of the soft threshold. Figure 5 shows the differences in noise reduction between the hard and soft threshold, where the black line is a signal sequence. The signal sequence is processed by using \(\lambda=0.5\) m/s\({}^{2}\) as the threshold. The red line is the result of a hard threshold; the blue line is the result of a soft threshold. It can clearly be seen from the graph that soft thresholds have a good continuity, while hard thresholds have local steps. In this paper, soft thresholds are used to process trend components.
# Comparison of ML/DL Approaches for Detecting DDoS Attacks in SDN
## 2 Related Work  
Previous publications have explored the use of machine learning (ML) and deep learning (DL) algorithms to identify distributed denial of service (DDoS) attacks. These methods typically rely on labeled data to train a predictor, which can guide decision making when deployed in a network. Before implementation, network managers can validate the effectiveness of the ML/DL algorithm using known test samples to obtain confidence in the predictor's performance. However, despite the existing literature on the topic, there are still gaps in the research on ML/DL applications for DDoS attack detection. Table 1 presents a comparison of the suggested model with the existing literature. [PERSON] et al. [7] proposed a dataset comprised solely of TCP stream-traffic generated by the actual network and employed dual features to train their models, including naive Bayes (NB), support vector machine (SVM), and neural networks (NNs), with regular and irregular tags. Their comparisons indicate that NN achieved the highest accuracy (A) and precision (P) with 79.9% and 99.95%, respectively, while SVM showed a better recall value (R) of 79.99% compared to NB and NN. [PERSON] et al. [8] suggested using a decision tree (DT) method to identify DDoS attacks in a cloud network. The DT selection criteria identified qualities with the highest improvement ratio, and the dataset was split accordingly. The process was repeated until no more branches were possible, and the DT was prepared to classify incoming data after learning from the training set traffic. The traffic was classified into four groups, and the model achieved over 98% accuracy in test results with a processing time of only 0.58% of a second. [PERSON] et al. [9] employed entropy and logarithm values to identify TCP-SYN/ICMP flood attacks in software-defined networks (SDNs). They utilized the K-nearest neighbors (KNN) algorithm to locate the K closest entropy metrics, and the existing distance points were examined to determine whether DDoS attacks were being launched against the network. The CAIDA2007 dataset was used in this study, and the accuracy of the Bonesi test was more than 99% when K was set to 9. [PERSON] et al. [10] proposed a better support vector machine (SVM) model using genetic algorithms (GAs) and kernel principal component analysis (KPCA) to detect DDoS attacks.
## 2 Data and Methods
### Methods  
#### 2.3.1 The Mann-Kendall Test and Sen's Slope  
Non-parametric statistical techniques should be applied to data of the general atmospheric environment where the range of change over time is large and observations do not follow a normal distribution [16; 17]. One of the non-parametric statistical techniques, the Mann-Kendall test, is commonly employed to detect monotonic trends in series of environmental data such as climate data, hydrological data, water quality data and air quality data [18; 19; 20; 21]. Since the data used in this study were measured at the same point for a relatively long time period with the same measurement and analysis methods, time series analyses could be applied statistically to the whole data series. In this study, Mann-Kendall trend analysis was applied to both sites.  
The presence or absence of a tendency was confirmed through trend analysis, and the degree of the tendency was judged by the slope of [PERSON]'s slope. The [PERSON]'s slope estimator is the non-parametric procedure for estimating the slope of a trend in a sample of multiple time periods, as developed by [PERSON] [22]. It has been widely used in hydro-meteorological time series analysis [23; 24; 25]. In summary, the Mann-Kendall method is a trend test, and [PERSON]'s slope is a slope calculation method. [PERSON]'s slope is not calculated for any pollutant with a non-significant trend detected in the Mann-Kendall test.  
In this study, the trend package in R was used for the Mann-Kendall test and [PERSON]'s slope analysis [26]. For the quality assurance and quality control of data, the standards and methods suggested by the National Institute of Environment Research (NIER), Korea were used. In order to secure the reliability of statistical data, statistical analysis was conducted only on the days when more than 75% of the data were obtained. Details about QA/QC are shown elsewhere [10; 27]. The hourly data were used for the trend analyses.