esa-sceva/satcom-chunk-collection huggingface dataset:
# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 3 Background
### IoT Botnet
#### 3.3.5. The IoT Botnet Boom and the Marketplace  
The number of botnets has increased in the Internet of Things drastically over time, and they have become a great danger due to what we referred to previously regarding their uses for illegal purposes. The occurrence of this boom is due to several factors, which we refer to in the following points:  
* Usually, it is possible to exploit Internet of Things devices because these devices use default authentication data. Moreover, services are exposed and easy to access.
* IoT devices are continuously connected to the Internet of Things networks; that is, they are accessible all the time because of the functions they perform that do not accept halting.
* Their market growth is accelerating considerably [37].
* The security standards for these devices are very low. Few end users change the default manufactory nomenclature once deployed; therefore, it is easy to be speculated that often they use rootroot and admin:admin. The attacker can alter default passwords effortlessly, blocking users from logging in and other attackers from taking control.
* An attacker can easily shut down or dominate large numbers of IoT devices at once when these devices are improperly monitored and mismanaged.  
After the public release of IoT botnet codes, such as those of Bashlite and Mirai, more botnets have appeared, and attackers are hunting for new victims to exploit. Financial gain is a major incentive for spreading more IoT botnets. Thus, there arose the so-called Internet of Things bot market, in which IoT botnets are offered for a price. For example, many renowned cybercriminal groups have already monetized their capabilities by renting out IoT botnets with their powerful stressed services to be used by benefiters in DDoS attacks. This allows inexperienced attackers to conduct DDoS attacks at over 100 Gbps effortlessly [39]. Recently, botnets have been involved in different notable attacks, resulting in denial of service and regression, data exfiltration and theft, lost revenue and tarnished reputations for organizations. Consequently, IoT botnets have become a major issue that affects the security of the Internet of Things and the whole Internet. In the next section, we will explain the importance of IoT botnet detection.
# Quantification and Correction of Wave-Induced Turbulence Intensity Bias for a Floating LIDAR System
## 4 Results and Discussion
### Theoretical Impact of Buoy Movements on the FLS Horizontal Velocity Estimates
#### 4.2.5 Influence of a 10-min Sinusoidal Motion on the Measurement of the Entire LIDAR
We note that the turbulence intensity value presented here corresponds to the motion-induced TI evaluated in a turbulence-free atmosphere, it should not be added to the atmospheric turbulence as a bias, the relationship is quadratic (Equation (9)). In calm sea conditions, the three motions lead to motion-induced TI of the same order of magnitude (0.01 to 0.04) and the horizontal speed is mainly impacted by the yaw (relative underestimation of about 1%). The initial direction of the beam has little influence on the average horizontal wind value. In rough sea conditions, yaw has very little influence on the horizontal wind measurement. The tilt and heave motions cause a huge motion-induced TI of the same order of magnitude (0.1 to 0.2). As a comparison, atmospheric turbulence intensities exceeding 0.1 are very rare in an open sea area [23; 24]. The mean horizontal velocity is also impacted by tilt and heave motions with a relative overestimation of the order of 1 to 2%, corroborating the order of magnitude of error reported by [PERSON] et al. [15]. Influence of Wave-Induced Motion on the Experimental TI Measurement of the WindCube v2\({}^{\text{\textregistered}}\) in Fecamp  
In an experimental situation, the errors induced by the different degrees of freedom of motion of the LIDAR overlap. They add up in some cases and cancel each other out in others. This is the reason why it is essential to use a model that takes into account each degree of freedom of the buoy and their interactions, in order to accurately estimate the magnitude of the LIDAR's motion-induced error. We first study the wave-induced turbulence intensity measurement error. Then, we apply the correction to the experimental data set. We note that the data measured at Fecamp belong to EDF Renouvelables and cannot be made public. We normalize the mean wind and turbulence intensity data set by the mean value of the validation data (anemometer or fixed LIDAR). The absolute error of the turbulence intensity and the regression equations are calculated from the non-normalized data to preserve the physical meaning.
## 3 Methods
### Collocation Procedure and Validation  
In order to determine SST retrieval coefficients and validate the estimated SST fields, we generated a matchup database between the satellite observation data and in situ measurements. To constrain the errors introduced by the temporal and spatial separation, the maximum temporal interval and spatial distance between satellite-derived SSTs and in situ temperatures were set at 30 min and 4 km, respectively. For screening cloudy and problematic pixels and analyzing error characteristics of SSTretrievals, the matchup database consisted of the standard deviation and maximum difference within a 3 \(\times\) 3 window, the SZA, solar reflection angle, and wind speed of SSMIs, as well as satellite-observed BT and in situ SST measurements.  
The collocation procedure was performed to generate a 4-year matchup database between COMS data and drifter data from April 2011 to March 2015. The data for the first three years from the beginning of the data (from April 2011 to March 2014) were used to derive the SST coefficients of each algorithm in Table 3. The derived SST coefficients were applied to estimate and validate SSTs for the period of a year from April 2014 to March 2015.
# Unsupervised Learning Approach for Anomaly Detection in Industrial Control Systems
###### Abstract
Unsupervised learning can identify patterns and structures in data, allowing it to develop predictive models without pre-labeled datasets or extensive prior knowledge of the system's operating paradigm. These features are especially valuable in ICS environments, as they effectively detect emerging security threats that traditional data analytics frameworks may miss. The strategies include an analytical review of data attributes and patterns, the  
Figure 1: OT, ICS, SCADA concept map with OT part in the Purdue model. ing techniques to aggregate tags with similar variations, and the incorporation of outlier detection mechanisms. This study contributes to the field of ICS anomaly detection in the following ways:  
* Heterogeneous system anomaly detection: First, we have developed a methodology that can identify anomalies with unique protocols or complex communication methods in systems composed of devices from different vendors. It is highly adaptable to different ICS environments because it does not rely on pre-labeled data or predefined descriptions. * Leverage restricted network data: We leverage internal data from restricted networks, recognizing the sensitivity and security concerns within ICS networks. Our research focuses on developing techniques that utilize only the internal data accessible within restricted networks. This capability is essential for detecting system changes and anomalies using data that would otherwise be inaccessible for security analysis. * Proactive anomaly response: Our research aims to facilitate the early detection of anomalous changes within the ICS, providing operators with timely information. This allows for quick and informed responses to potential problems before they can escalate into actual damage, strengthening the proactive defense mechanisms within industrial environments. This paper is organized as follows. Section 2 reviews existing research on anomaly detection in industrial control systems. Section 3 describes the research methodology used in this study. Section 4 describes the experimental design and results. Section 5 concludes this study with a discussion.
## 4 Numerical Results with Fixed Time-Step Sizes  
This section investigates the numerical error, for example, how it decreases with the time-step size \(h\). First, we run the simulation for all 18 methods for a very large and fixed \(h\) and calculate the error. Then, this procedure is repeated with smaller and smaller time-step sizes until the minimal error values are obtained. The magnitude of the error is calculated as follows:  
\[Error=\max_{1<i<N}\left|u_{\mathrm{i}}^{\mathrm{anlytic}}\left(t^{\mathrm{fin}} \right)-u_{\mathrm{i}}^{\mathrm{num}}\left(t^{\mathrm{fin}}\right)\right|\]  
which means the usual \(L_{\infty}\) error, i.e., the largest absolute difference between the analytical and the numerical solution at the final time \(t^{\mathrm{fin}}\), is considered. Because some data about the running times of the examined methods for fixed time-step sizes can be found in our original publications, we do not measure the running times here, only in Section 5 with adaptive time-step sizes.  
The system matrix \(M\) has only negative eigenvalues. Let us denote the smallest (largest) absolute value eigenvalues by \(\lambda_{\mathrm{MIN}}\left(\lambda_{\mathrm{MAX}}\right)\). The CFL limit for the explicit Euler method can be analytically calculated as \(h_{\mathrm{CFL}}^{\mathrm{EE}}=\left|2/\lambda_{\mathrm{MAX}}\right|\), and for the higher-order RK method, this limit is only slightly larger [50]. On the other hand, the stiffness ratio of the problem can be defined as the ratio \(\lambda_{\mathrm{MAX}}/\lambda_{\mathrm{MIN}}\).  
To perform the numerical calculations, the software MATLAB has been used, and the command kummerU has been used to calculate the Kummer U function (confluent hypergeometric function of the second kind). Because the calculation of the values of the boundary conditions for a given time point is orders of magnitude more time-consuming than performing the steps of the numerical schemes for all the nodes of the grid, we applied a trick to minimize the running time. The boundary conditions have been calculated only in 4000 time points, and a linear interpolation between the two appropriate times of the pre-calculated boundary values has been used to evaluate the boundary conditions at the actual time of the simulation. Of course, we always checked that the error due to this approximation is always much smaller than the errors of the numerical algorithms at the intermediate space points.
# Using Artificial Neural Network Models to Assess Hurricane Damage through Transfer Learning
## 3 Transfer Learning
### Artificial Neural Network Models  
This study utilizes three well-established neural network models in computer vision, namely, ResNet [26], MobileNet [25], and EfficientNet [32]. These networks were selected for several reasons. First of all, we aim to explore the efficiency of varying neural network architectures for hurricane damage assessment. To that end, collating results from multiple models would provide deeper insight than results obtained from one model trained on a single neural framework. Second, these models have been pre-trained using large image datasets, and their pre-trained weights are freely available. The following sub-sections provide a brief review of the selected three neural network models with a focus on their typical model architecture.
# Deep Learning for Medical Image Cryptography: A Comprehensive Review
## 3 Vulnerability of Deep Learning-Based Medical Image Analysis
### Adversarial Attacks against Medical Images
#### 3.1.3 PGD (Projected Gradient Descent)  
The generalization of BIM, known as PGD (projected gradient descent) [76], does not include the condition \(\alpha\)T = \(\epsilon\). Perturbations are limited by projecting adversarial samples from each iteration into \(\epsilon-L_{\infty}\) or \(\epsilon-L_{2}\) neighbor of the clean image.
# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 5 Analysis
### RQ3: What Methods and Techniques Are Utilized to Detect IoT Botnets?
#### 5.3.2 Methods Based on Blockchain Technology  
This section reviews the proposed methods that are based on blockchain technology. Initially, blockchain was used to register financial transactions; such transactions are encrypted and managed by all parties (e.g., Bitcoin and other cryptocurrencies). All transactions are thus transparent, and any changes can be easily tracked and identified [94]. It is possible to apply blockchain to boost IoT botnet detection. Three of the selected studies that used blockchain are discussed below.  
The goal of AutoBotCatcher [71] was to analyze IoT device communities dynamically, according to their network traffic flow. The authors implemented a dynamic P2P botnet identification and prevention framework for IoT based on blockchain, referred to as AutoBotCatcher, which performs group identification on IoT application network flows. IoT gateway devices become peers of a BFT blockchain in AutoBotCatcher, where system vendors and/or security regulators take positions as block generators and engage in the process of consensus. Blockchain was used for snapshots of the IoT devices' mutual communication graph to perform dynamic, network-based botnet group identification.  
The researchers of [72] created a lightweight security IoT solution that uses hacker tools against hackers, an IoT vaccine, in essence. The solution provides IoT devices with managed protection and intelligence using a \"friendly\" botnet powered by the Bitcoin blockchain, a validated existing communication framework for distributed systems. To date, NeuroMesh has been tested on routers, cameras with CCTV and smart meters. NeuroMesh was able to destroy the Mirai botnet in all cases and prevent the running of errant processes. In addition, access to the system was effectively blacklisted for any IP address sent through the blockchain communication channel.  
The authors of [78] proposed new firmware to modernize a platform for IoT devices. The firmware improved the upgrade procedure, making it more efficient and secure. In specific, the suggested method was founded on blockchain and makes use of smart contracts to guarantee firmware integrity and attain malware-resistant properties. To ensure accessibility of the new platform, they used a peer-to-peer file distribution method that not merely stores a variety of firmware editions of devices in a dispersed way, but reduces the ability to perform DDoS attacks with protected devices. In addition, this platform greatly enhances device scalability by checking multiple signature requests at the same time. Massive assessments and operation simulations were performed to ensure that the anticipated method can achieve exceptional operating effectiveness for IoT devices on the firmware update platform. They considered the effectiveness related to computing costs and overhead connections, and compared it to the most current works.
## 3 Methodology
### Cluster Analysis
#### 3.2.2 Clustering Loss  
The clustering module is implemented by three-layer MLP, and the parameters of the clustering module are optimized by making similar samples consistent in output. Assume that \(f_{cluster}\) represents the clustering model, \(X\) represents the training sample, and \(X_{k}\) represents the sample similar to \(X\), then we need to maximize \(\text{log}\langle f_{cluster}(X),f_{cluster}(X_{k})\rangle\), and \(\langle\cdot\rangle\) represents the dot product operation. The dot product operation will make the prediction become a one-hot vector and keep the same. At this time, the point multiplication result is the largest. MLP has a strong mapping ability, which can map all samples to one class, and there is a degradation problem. Therefore, in order to prevent MLP from mapping all samples to the same class, we need to maximize entropy to avoid all samples being assigned to the same cluster. In the clustering process, CrossEntropy loss is added by generating pseudo-labels for high-confidence samples. Therefore, the final clustering module optimization function is:  
\[\begin{split} L=-\frac{1}{|\mathcal{D}|}\sum_{X\in\mathcal{D}} \sum_{X_{k}\in\mathcal{N}_{X}}\text{log}\langle f_{cluster}(X),f_{cluster}( X_{k})\rangle+\lambda\sum_{c\in\mathcal{C}}f^{c}_{cluster}\text{log}f^{c}_{cluster}- \gamma\sum_{i=1}^{I}\sum_{c=1}^{C}y_{i}^{c}\text{log}f_{cluster}(X_{i})^{c} \\ with\quad f^{c}_{cluster}=\frac{1}{|\mathcal{D}|ing browser access, and the screenshot is taken after the webpage has finished loading. The resolution of the webpage screenshot is 1000 \(\times\) 600. Text on the webpage screenshots is recognized using PaddleOCR [32]. PaddleOCR has a high accuracy in character recognition, and its model size is small, resulting in fast character recognition speed.  
Subsequently, the obtained representation vector data are fed into the pre-trained fully connected neural network clustering model, with the model parameters kept fixed. To account for the uncertainty of data points during the clustering process, a soft label strategy is employed. This strategy assigns each data point a probability value indicating its likelihood of belonging to a specific category. These probability values reflect the degree of ambiguity of data points between different categories and can be utilized to assess the accuracy and stability of the clustering. In practical terms, a threshold can be set for each data point based on these probability values. If the probability of a data point representing an illegal website surpasses this threshold, it is considered a potential illegal website.  
After the threshold screening, a dataset containing numerous potential illegal websites is obtained. However, to ensure the dataset's accuracy and establish a reliable foundation for further research, manual screening remains necessary to validate the categories of data points. During this process, a thorough review of the content, structure, domain names, and other pertinent information of potential illegal websites is conducted to make a more precise determination of their legality.
## 5 Circuit Implementation
### Circuit Implementation of the Financial System  
Based on the circuit implementation of Multisim 14.0, the circuit of system (1) is given in Figure 11. The circuit consists of resistors, capacitors, power supplies, operational amplifiers, and multipliers. Generally, it is not easy to directly design a circuit to implement the behavior of a complex system, as the circuit implementation needs to be designed based on the specific system characteristics and the allowable range of circuit components. Due to the fact that the maximum value of the trajectory variables \(x,y,\) and \(z\) of the financial system (1) are all less than 5, and the voltage of the power supply is 15 volts, there is no need to make scale changes for the variables \(x,y,\) and \(z\), i.e., the circuits of system (1) can be directly designed based on the system equations.  
Figure 11: Circuit implementation of financial system (1) based on Multisim 14.0.  
In Figure 11, the TL082 CP denotes the dual input general-purpose operational amplifier, which is produced by IPC-2221A/2222, and it is used to solve the differential equations. For example, in order to implement the first differential equation \(\dot{x}=z+(y-0.9)x\) in system (1) using the circuit, three operational amplifiers of the TL082 CP in Figure 11 are used to simulate the operations of the model, i.e., the differential variable \(\dot{x}=-100x/111.111+100 xy/100+100z/100\). Similarly, the circuits of other systems are designed based on this principle.  
According to the circuit implementation of financial system (1) in Figure 11, the waveform diagram of the variables \(x,y,\) and \(z\) in the oscilloscope of the circuit implementation is given in Figure 12a, and the attractor of system (1) based on the oscilloscope of the circuit implementation is shown in Figure 13 when \(c=1\). Obviously, the financial system (1) is in a state of chaos. Furthermore, the attractor of system (1) based on the oscilloscope of the circuit implementation is given in Figure 14 when \(c=2\), and it is in a state of period. Therefore, one can easily control the behavior of system (1) using the demand elasticity of the commodity \(c\), and the results of the circuit implementation have once again verified the simulation results in Figures 1 and 3.  
Figure 12: The results of circuit implementation of the consensus of master–slave systems (1) and (3). (**a**) The waveform diagrams of variables \(x,y,\) and \(z\) displayed on the oscilloscope. (**b**) The corresponding waveform diagrams of variables \(x\) and \(x_{1}\) of the master and slave systems displayed on the oscilloscope.  
Figure 13: Attractor of financial system (1) by the circuit in Figure 11 when \(c=1\). (**a**) Phase diagram \(x\) vs. \(y\). (**b**) Phase diagram \(x\) vs. \(z\).
## 3 Results and Discussion
### In Vitro Drug Release and Mathematical Model Fitting  
Ethlycellulose acts as the rate-retarding polymer by lowering the diffusion of drugs through the polymer walls/holes. In vitro drug release assay was performed to recognize the release behavior and mechanism of the drug release from the porous matrix in pH 1.2 solution. As shown in Figure 7, in 24 h of study, the release of ITB from optimized IBNS4 was 80.16 \(\pm\) 5.15%, compared to the pure drug (ITB) with 22.74 \(\pm\) 1.51%. Initial burst release was observed within the first 6 h with a drug release of 61.80 \(\pm\) 2.29%, which could be due to the adsorbed drug over the surface of NSs or non-bounded drug-polymer moiety [49]. This type of burst drug release is preferred as per pharmacokinetic studies to initiate the action by reaching the minimum drug concentration, followed by sustained release up to 24 h to prolong the effectiveness of the drug at the site of action and cancer cell [50]. The porous nature of the particle allowed the entry of medium and dissolution of the drug. the effective surface area will also be more due to the porous nature of the particles, and thereby the dissolution was observed to be better compared to the pure IBT. The prolonged release of ITB from optimized IBNS4 could be due to the slow dispersion of aqueous media inside the hydrophobic EC [51].  
Figure 3: FTIR spectra of pure ibrtinib ITB (**a**), and IBNS4 (**b**).  
Figure 4: DSC thermogram peaks of pure brtutinib ITB (a) and IBNS4 (b).  
Figure 5: XRD Bragg peaks of pure brtutinib ITB (blue) and IBNS4 (green).  
Furthermore, the kinetic release study of optimized IBNS4 for different kinetic equations (zero-order, first-order, Higuchi, and Korsmeyer-Peppas) was observed and fitted. The best fit was the Korsmeyer-Peppas model for optimized IBNS4, showing a higher correlation (R\({}^{2}\) > 0.90) compared to other models, ensuring the release of ITB from the NSs could be the result of a combination mechanism of diffusion and erosion [52]. Moreover, the Korsmeyer-Peppas model with exponent n < 0.45 denoted that the release is diffusion-controlled, called the Fickian mechanism.