esa-sceva/satcom-chunk-collection huggingface dataset:
# Revisiting the Detection of Lateral Movement through Sysmon
## 5 Lateral Movement Categories on Windows Environments
### Pass the Ticket Credential Override  
By exploiting the Pass-the-Ticket (PtT) method, an adversary may move laterally within a network by using stolen Windows Kerberos Tickets as legitimate credentials. PtT is based on the Windows OS's Local Security Authority Subsystem Service (ISASS) process, which is a fundamental part of the Windows credential administration system and is also related to PtH. The aforementioned process stores and handles Kerberos tickets and is related to the extraction of the Kerberos Service Tickets and Ticket Granting Tickets (TGT), depending on the level of access of the compromised host. Recall that a service ticket permits access to a particular process, whereas a TGT is responsible for requesting the aforesaid service tickets from Kerberos TGS to acquire access to any resource that the targeted host has access to. Specifically, for this attack to be successful, the targeted host needs to communicate with LSASS and retrieve the legitimate tickets in its possession. If the attacked host is related to a non-administrative user, then only one ticket will be retrieved, whereas if administrative accounts are compromised, all the tickets related to the targeted server can be harvested. Within the context of this survey, Mimikatz was the preferred tool for the execution of the PtT attack.
# Vibration Response Analysis of Overhead System Regarding Train-Track-Bridge Dynamic Interaction
### Overhead System Model
#### 1.1.3 Model Validation  
Software for finite element analysis of the overhead system model was created using Midas/Civil and ABAQUS. The two calculation models underwent eigenvalue analysis, and the validity of the models was confirmed by contrasting the analysis's findings. The first ten main modes of the \"I\" overhead system are shown in Table 4.  
Figure 4: Material dimension details (unit: mm): (**a**) I100-I beam. (**b**) I56b-I beam. (**c**) T75 steel. (**d**) Steel sleeper beam (B200 \(\times\) 200 \(\times\) 480). (**e**) A section of Bailey.  
The first five primary modes of the overhead system are compared in Figure 6a-e. On the left is the result of the ABAQUS calculation, and on the right is the result of the MIDAS/civil calculation. The first ten natural vibration periods of the models created by the two software programs are not different, as can be seen from the eigenvalue analysis data and vibration mode diagram in the above table. This shows that the simulation of the overhead system's mass and stiffness is essentially consistent, and it can be determined that the models created by Midas/civil and ABAQUS are essentially accurate.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Modality** & **Midas/Civil (Hz)** & **ABAQUS (Hz)** & **Deviation** \\ \hline
1 & 23.206 & 24.239 & 4.44\% \\ \hline
24 & 25.892 & 27.705 & 3.17\% \\ \hline
3 & 26.841 & 28.981 & 4.25\% \\ \hline
4 & 29.367 & 30.568 & 4.09\% \\ \hline
5 & 30.818 & 32.625 & 5.87\% \\ \hline
6 & 33.298 & 37.538 & 3.72\% \\ \hline
7 & 36.877 & 41.804 & 2.55\% \\ \hline
8 & 46.620 & 45.762 & 1.84\% \\ \hline
9 & 48.576 & 48.211 & 0.74\% \\ \hline
10 & 50.310 & 53.507 & 6.34\% \\ \hline \hline \end{tabular}
\end{table}
Table 4: Vertical forward tenth order modal characteristic frequency.  
Figure 5: One-span model diagram of track and overhead system: (**a**) A cross model diagram type I, aerial system. (**b**) A cross model diagram type II aerial system.  
Figure 6: \(Cont.\)  
Figure 6: Comparison of vibration modes calculated by ABAQUS and Midas: (**a**) First order mode. (**b**) Second order mode. (**c**) Three order mode. (**d**) Four order mode. (**e**) Five order mode.
## 3 Results and Discussion
### Adsorption Behavior of GO-MIPs for 4-MEC
#### 3.2.4 Adsorption Repeatability  
To evaluate the stability of the imprinted material, the adsorption repeatability experiment was carried out by using GO-MIPs six times. After every measurement, the GO-MIPs were washed with methanol to remove the 4-MEC molecules for reuse. Figure 6b displays that 82% of the initial value of the adsorption capacity was retained after six adsorption-desorption cycles, suggesting that the GO-MIP composites had acceptable stability under washing and in the incubation procedures, and that the subsequent GO-MIPs sensor could be reused at least six times for further selective recognition and separation. The slight decrease in adsorption capacity might have been because of the imprinted polymer defects, such as swelling and cracking, caused by the removal of the template several times.
## 4 Thermographic Analysis on Frescoed Masonry Walls and Results
### Identification of Masonry Wall Texture and Peculiar Characteristics of the Frescoes  
In the first instance, it was intentional to have an overview of the masonry texture and its quality and then proceed gradually more and more closely to the wall face. Along with the thermographic images \"ordinary\" digital photos have been taken from similar spots (not the same, as a result of the different focal length); in addition, reference thermal reflective elements have been placed in front of the frescoes, made by two parallel rigid meter-sticks, in order to be able to overlay the photos with the thermographic images in the next phase. Considering that in this first case the meter-sticks were separated by 2.70 m, thanks to the procedure and its final binary images, backed by straightening photographic and measurements digital techniques, it was possible not only to seize the quality of the masonry texture but also its geometry, Figures 9 and 10. A quasi-periodic texture made of bricks with different widths, ranging from 25 to 60 cm, but similar heights, of about 20 cm, is observable; such result matches consistently with what was surveyed in the apse, concerning the areas where the fresco peeled off (see Figure 4). Moreover, the opportunities offered by the thermal imaging methods, regarding at the safeguard of frescoes, mural paintings and valuable architectonic elements, have been addressed by numerous authors with reference different declinations [7, 18, 19, 20, 21, 22]. Therefore, even if in the present contribution, where the focus was on the identification of the masonry texture, it was anyway possible  
Figure 8: One of the frescoes under investigation, in particular the one composed by an apostle proceeded by three Saints [PERSON], [PERSON] and [PERSON]. In the pic are visible the reflective meter-sticks located as reference points for the subsequent post-processing (see the cone of vision 4 in Figure 2).  
to contextually ascertain that there are no detachment or infiltration phenomena in place that may endanger the health of the frescoes.  
In addition, at a closer look, and in keeping the historical researches from which it has been deduced that the fresco of the Apostle was superimposed to the pre-existing ones, the mortar distribution (in its area) might suggest a trace of the ancient techniques of fresco-makers: the surface of the previous fresco had been probably \"excavated\" by the masons, allowing the new plaster substance to cling to the ancient mortar below, a less smooth and slippery surface than the wall. Then, the presence of few fragments of mortar out of the joints may show that in order to fasten up the new murals some holes were made by hands in the previous frescoes and therefore their orientation does not follow an exact pattern [19]. This, therefore, testifies that the presented thermographic method, thanks to the possibility of adjusting the parameters described Section 3, is able to provide information, which should be critically evaluated, even about masonries subjected to various superimposed layers of frescoed plaster.
## 3 Model Development and Training
### Human Activity Detection  
We used human activity detection applications to verify our G-CTRNN model and to ensure its real-world applicability, test its temporal learning capabilities, validate its performance, and facilitate comparative analysis with other models in activity recognition tasks. Human activity detection has many field applications, including healthcare, security, robotics, and smart buildings [18; 19]. Many technologies were utilized to implement human activity detection, like wearable, camera-based, infrared (IR), and Wi-Fi sensors [20]. Human activity detection enables intelligent, responsive environments that adapt to the residents' needs and preferences. Recognizing human activities will also help save energy consumption, enhance security, improve indoor environmental quality, and provide personalized services. For example, ref. [21] employed human activity recognition to manage HVAC systems, lighting, heating, ventilation, and air conditioning by responding to occupancy and activity patterns, decreasing energy usage, and enhancing energy efficiency. Moreover, the work in [22] utilized human activity recognition, which identifiesirregularities, like unauthorized access or atypical behavior, thereby bolstering security measures and thwarting potential intrusions.  
In this work, we used the WISDM (Wireless Sensor Data Mining) dataset for training and testing G-CTRNN. The WISDM data contains six attributes extracted from smartphones for various groups of people while carrying those devices. The data contains six activities: jogging, walking, upsairs-downsairs, sitting, and standing, as shown in Figure 2. The data holds significant prominence in the literature due to its widespread utilization and well-organized structure [23]. However, while the WISDM dataset demonstrates the feasibility of applying G-CTRNN to sensor-based human activity recognition, we acknowledge its limitations in representing clinical scenarios. The dataset involves healthy subjects performing standard activities, which may not capture the complexity of gait abnormalities, post-surgical recovery movements, or neurological impairments. Future work will include validating G-CTRNN on more diverse and clinically representative datasets to assess its broader applicability in healthcare contexts.
# An Improved Small Target Segmentation Model Based on Mask Dino
## 3 Materials and Methods  
The Mask Dino framework demonstrates robust task performance, utilizing different types of backbone networks for various segmentation tasks. For semantic segmentation tasks, the ResNet-50's powerful feature extraction capabilities are employed, particularly in capturing local features [23] and texture information. Its hierarchical structure effectively captures the layered details of images. In tasks involving semantic segmentation, panoptic segmentation, and instance segmentation, using both ResNet-50 and the Swin Transformer as backbone networks allows for richer feature fusion strategies, enhancing the model's training performance across different datasets.  
Building on the Mask Dino framework, this paper introduces the FFMask Dino segmentation framework. By appropriately adjusting the network architecture and parameters, the full potential of the Mask Dino structure is maximized, achieving efficient and accurate small object segmentation. The FFMask Dino framework consists of two parts: a backbone network based on ResNet-50 and the Swin Transformer, and a segmentation network based on Mask Dino. To address issues such as segmentation blurriness and missegmentation when handling small objects with Mask Dino, this paper improves the attention and position encoding algorithms of the Swin Transformer, enabling sequence modeling of input images to extract multi-scale features. Additionally, the FFPN module is proposed to fuse low-level detailed features and high-level semantic features from the encoder outputs. The improved structure is shown in Figure 1. The following are the improvements made in this paper:
# Estimation of Distribution Algorithms with Fuzzy Sampling for Stochastic Programming Problems
## 3 Estimation of Distribution Algorithms for Simulation-Based Optimization
### EDA-Based Methods for Simulation-Based Optimization  
The proposed EDA-based methods are a combination of the EDA-MCC method, which is stated in Algorithm 4, and different sampling techniques for nonlinear and stochastic programming problems. In our proposal to build the EDA model (6), we used the UMDA\({}_{c}^{G}\) model as a univariate Gaussian model [26], in which the joint density function is defined as  
\[\phi(x)=\prod_{i=1}^{n}\phi_{N}(\mathbf{x}_{i};\mu_{i},\sigma_{i}^{2})=\prod_{ i=1}^{n}\frac{1}{\sigma_{i}\sqrt{2\pi}}e^{-(x_{i}-\mu_{i})^{2}}\big{/}2\sigma_{i}^ {2}, \tag{9}\]  
where \(\mu=(\mu_{1},\ldots,\mu_{n})\) is the mean and \(\sigma^{2}=(\sigma_{1}^{2},\ldots,\sigma_{n}^{2})\) is the variance. Furthermore, the EEDA model [48] was used as a multivariate Gaussian model which is an extension of the EMNA\({}_{global}\) model [26]. The multivariate joint density function is defined as  
\[\psi(x)=\psi_{N}(\bar{\mathbf{x}_{i}};\bar{\mu},\Sigma)=\frac{1}{(2\pi)^{N/2} |\Sigma|^{1/2}}e^{-(\bar{x}-\bar{\mu})^{T}\Sigma^{-1}(\bar{x}-\bar{\mu})/2}, \tag{10}\]  
where \(\Sigma\) is the covariance matrix. In the EEDA method, the covariance matrix is redefined in each iteration by expanding the original matrix in the direction of the eigenvector corresponding to the smallest eigenvalue. In other words, the minimum eigenvalue is reset to the value of the maximum eigenvalue. Algorithm 7 illustrates the main steps of the proposed EDA-based method.  
Different EDA-based methods can be generated from Algorithm 7 according to the technique used to estimate the objective function values in Steps 2 and 11. Therefore, we have three versions:  
* ASEDA: The Average Sampling EDA if the average sampling is used to estimate the objective function values, as in Algorithm 5;
* FSEDA: The Fuzzy Sampling EDA if the fuzzy sampling is used to estimate the objective function values, as in Algorithm 6;
* DEDA: The deterministic EDA if the objective function has no noise and its value can be directly calculated without simulation.
## 1 Introduction
Detailed structure design and operation principles are illustrated. To evaluate the feasibility of the proposed system, simulations are conducted through VPItransmissionMaker 8.5, a photonics design and simulation software developed by VPIphotonics, with its headquarters located in Berlin, Germany. Numerical simulations demonstrate that the proposed system can accurately recognize and determine the position of bit-flip BPSK targets in the input data with a data rate of 100 Gbps and tunable frequency. The rest of this paper is organized as follows. Section 2 details the operational principles of the proposed system. Section 3 describes the simulation setup and system pa rameters. Simulation results are presented and discussed in Section 4. Section 5 concludes this paper.
## 4 Conclusions  
In summary, this study provided a novel and versatile approach for fabricating ultrathin imprinted films using anion exchange affinity-based controllable surface imprinting. The immobilization template method overcame template protein leakage and enhanced the template immobilization efficiency. The subsequent use of SI-PIMP enabled the formation of homogeneous binding cavities and construction of effective binding sites with low non-specific binding capacity and high imprinting efficiency. By benefiting from the anion exchange mechanism, the resultant imprinted films exhibited a higher imprinting factor and faster binding rate than the reference materials. Binding tests revealed that the binding strength and selective recognition properties could be tuned to a certain extent by adjusting the NaCl concentration. Furthermore, compared to the method based on covalent immobilization, the anion exchange affinity-based interaction approach could facilitate template removal. Therefore, PVC@TAA-MIP nanoparticles are expected to be promising affinity material candidates for BSA analyses.  
The following supporting information can be downloaded at: [[https://www.mdpi.com/article/10.3390/polym14102011/s1](https://www.mdpi.com/article/10.3390/polym14102011/s1)]([https://www.mdpi.com/article/10.3390/polym14102011/s1](https://www.mdpi.com/article/10.3390/polym14102011/s1)), Figure S1: FT\(-\)IR spectra of PVC, PVC@TAA and PVC@TAA\(-\)MIP; Figure S2: XPS (a) wide scan, (b) C 1s and (c) N1s of PVC@TAA-BSA nanoparticles; XPS (d) wide scan, (e) C 1s, (f) N1s and (g) S 2p of PVC@TAA\(-\)MIP nanoparticles; Figure S3: The Scatchard plots of PVC@TAA\(-\)MIP in the absence (or presence) of NaCl; Table S1: The pore structure and surface area of PVC, PVC@TAA, PVC@TAA\(-\)BSA and PVC@TAA\(-\)MIP were studied by nitrogen sorption analysis; Table S2: Influence of BSA concentration on the zeta-potentials and immobilization capacities of PVC@TAA\(-\)BSA; Table S3: Influence of washing solution on the elution efficiency of imprinted materials; Table S4: Imprinting efficiency and selectivity coefficients of PVC@TAA\(-\)MIP and PVC@TAA\(-\)NIP towards BSA in the presence of NaCl.  
Conceptualization, R.S.; methodology, X.Y.; formal analysis, R.S., M.L. and S.Z.; investigation, X.H.; writing\(-\)original draft preparation, R.S.; writing\(-\)review and editing, R.S. All authors have read and agreed to the published version of the manuscript.  
This research was funded by the National Natural Science Foundation of China grant number [No.21978003], the Anhui Provincial Natural Science Foundation of China [2008085 ME174] and The Natural Science Foundation of the Anhui Higher Education Instituions of China [KJ2017A573].  
Not applicable.  
The data presented in this study are available on request from the corresponding author.  
The authors declare no conflict of interest.  
Figure 9: Competitive binding results for BSA and Hb to PVC@TAA\(-\)MIP and PVC@TAA\(-\)NIP in absence or presence of NaCl.
# Self-Sustainable Biomedical Devices Powered by RF Energy: A Review
## 3 RF Energy Harvesting Application in Medical Devices
### RF Energy Harvesting for Wearable Medical Devices
#### 3.1.2 Textile-Based Wearable RF Energy Harvester
The on-body performance of the 2 \(\times\) 2 textile rectenna array was verified through perfect alignment with the Tx antenna, as depicted in Figure 6. The on-body measurement of the proposed system obtained a maximum output power of 1.287 mW with a maximum PCE of 40% at an input power of 12 dBm. [PERSON] et al. [147] proposed 16- and 81-element broadband rectenna arrays based on a strongly coupled bowtie antenna screenprinted on a cotton T-shirt for harvesting power densities of 4-130 \(\mu\)W/cm\({}^{2}\) between 2 and 5 GHz. The broadband rectenna achieved a PCE of 32% at an incident power density of 100 \(\mu\)W/cm\({}^{2}\).
# Novel Feature Extraction Method for Detecting Malicious MQTT Traffic Using Seq2 Seq
## 1 Introduction  
The widespread use of the Internet has resulted in the widespread use of IoT. Korea has implemented advanced metering infrastructure (AMI) for electricity, gas, and water [1; 2; 3]. IoT is used in several fields and is convenient for people. In addition, IoT systems transmit sensitive and important data, necessitating ongoing maintenance. Therefore, IoT security must be ensured.  
However, IoT faces numerous security risks. The number of IoT attacks has increased rapidly [4]. DoS, flooding, SlowTte [5], and malformed attacks have been performed to disrupt IoT systems. A brute-force attack was also performed to obtain authentication passwords. These attacks have released malicious message queue telemetry transport (MQTT) traffic data, MQTset [6]. In earlier studies, attacks were detected using machine and deep learning.  
However, these methods did not achieve satisfactory accuracies because they had basic machine learning methods and used too many features that are not important in detecting malicious MQTT traffic. Furthermore, the study authors did not explain why these features should be used to detect attacks.  
To solve this problem, we propose a novel feature extraction method and deep learning model for detecting malicious MQTT traffic. The overall structure of the proposed system is shown in Figure 1. We intend to identify DoS, flood, SlowTte, malformed, and brute-force attacks. First, we obtain packet information using Tshark [7] before extracting the source port index, TCP length, MQTT message type, keep alive, and connection acknowledgment (ACK) from the packet information. Second, we intend to classify malicious MQTT traffic using the Seq2 Seq model [8]. The accuracy of the proposed method was 99.97%, which is 7.33% higher than that obtained using the machine learning methods (92.64%) [6].  
The contributions of this study are as follows. First, we analyze DoS, flood, SlowTe, malformed, and brute-force attacks. Second, a novel feature extraction method for detecting attacks from malicious MQTT traffic is proposed. Third, we show that the accuracy of our Seq2 Seq model is 99.97%.  
The remainder of this paper is organized as follows. Section 2 presents related studies. Section 3 introduces the MQTT system, packet types, and packet structures. Section 4 analyzes MQTT attacks. Section 5 proposes a novel feature extraction method. Section 6 presents the Seq2 Seq model for attack classification. Section 7 presents experimental results. Section 8 presents a discussion and conclusions.
## 3 ICA and ICT
### ICA in IRNDT  
The ICA has been used in several works in IRNDT. [PERSON] et al. [13] showed that Fast-ICA [106] outperformed PPT, TSR, and PCT. [PERSON] et al. [119] observed that Fast-ICA achieved better scores with the lower-resolution sequences. [PERSON] et al. [120] and [PERSON] et al. [121] have attempted to introduced ICT. [PERSON] et al., highlighted that the ICA could not separate some signal sources and concluded that it was likely due to thermal conduction, which might not always satisfy the condition of non-gaussianity. Nonetheless, signals related, for instance, to uneven heating can be successfully removed. The same authors also concluded that the ICT outperformed state-of-the-art approaches. [PERSON] et al., reach the same conclusion as [PERSON] et al., regarding the performance of the ICT compaired with state-of-the-art approaches. However, both authors agreed on the higher robustness of the ICT. [PERSON] et al. [14] have trained an ANN for blind source separation and used it for defect detection from PT data. [PERSON] et al., used PCA in order to whiten the data, and then performed either the training or the detection. However they did not compared their approach with other existing methods. More recently, [PERSON] et al. [15] has proposed a pre-processing method based on data augmentation and has evaluated it using ICT. The new method named GICT outperforms ICT.  
To summarize the main difference between ICA and PCA have been reported in Table 1. In the next section we introduce the different aspects of our experiments.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Features/Method** & **ICA** & **PCA** \\ \hline Linear transform & ✓ & ✓ \\ \hline \multirow{2}{*}{Goal of the transformation} & maximizing the unmixing matrix as well as & \multirow{2}{*}{project the data into an orthogonal space} \\  & the independence of the components [10] & while maximizing the variance \\  & & of the projected data [122] \\ \hline \multirow{2}{*}{Matrix factorization} & full rank to ensure the independence & low rank to ensure the non-correlation \\  & of the components. & of the components. \\ \hline \multirow{2}{*}{Othrogonalize} & not by default, however commonly a whitening step is & ✓ \\  & computed beforethe ICA, which othogonalize the data. & \\ \hline \multirow{2}{*}{Ignore local data structure} & ✓ & ✓ [28; 41] \\ \hline \multirow{2}{*}{Denoise} & ✓ & ✓ \\ \hline \multirow{2}{*}{Remove uneven heating} & ✓ & \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of PCA and ICA.