In laser-driven plasma wakefield accelerators, the accelerating electric field is orders of magnitude stronger than in conventional radio-frequency particle accelerators, but the dephasing between the ultrarelativistic electron bunch and the wakefield traveling at the group velocity of the laser pulse puts a limit on the energy gain. Quasi-phase-matching, enabled by corrugated plasma channels, is a technique for overcoming the dephasing limitation. The attainable energy and the final properties of accelerated electron beams are of utmost importance in laser wakefield acceleration (LWFA). In this work, using two-dimensional particle-in-cell simulations, the effect of the driving pulse duration on the performance of quasi-phase-matched laser wakefield acceleration (QPM-LWFA) is investigated. It is observed that for a pulse duration around half the plasma period, the maximum energy gain of the beam electrons finds its peak value. However, the results show that for a pulse of that duration the collimation of the bunch is much worse, compared to the case where the pulse duration is twice as long. Furthermore, the dynamics of the laser pulse and the evolution of the quality of the externally-injected electron bunch are studied for a symmetric pulse with sine-squared temporal profile, a positive skew pulse , and a negative skew pulse . The results indicate that for a laser pulse with an appropriate pulse length compared with the plasma wavelength, the wakefield amplitude can be greatly enhanced by using a positive skew pulse, which leads to higher energy gain. Initially, this results from the stronger ponderomotive force associated with a fast rise time. Later, due to the distinct evolution of the three pulses with different initial profiles, the wakefield excited by the positive skew pulse becomes even stronger. In our simulations, the maximum energy gain for the asymmetric laser pulse with a fast rise time is almost two times larger than for the temporally symmetric laser pulse. Nevertheless, stronger focusing and defocusing fields are generated as well if a positive skew pulse is applied, which degrade the collimation of the bunch. These results should be taken into account in the design of miniature particle accelerators based on QPM-LWFA. The ultimate goal of research on this scheme is production of inexpensive, compact and lightweight accelerators which are comparable with bulky traditional accelerators in terms of energy gain and beam quality8. LWFA has been demonstrated and explored in numerous experiments so far and is a very active research area at present11. These experiments have mainly been carried out in the so-called “bubble regime”13. Quasi-mono-energetic (low energy-spread), collimated GeV electron bunches with charges in the pC range have been produced in centimeter-scale acceleration length by using laser pulses with peak powers ranging from tens of TW to PW15. These beams are usable as compact radiation sources in the X-ray and 22. Although petawatt lasers produce high intensity pulses, the rate of pump depletion and etching is greater at high intensities24. Moreover, in high power laser systems, due to technical obstacles, the frequency of optical pumping is low, thus the repetition rate of such lasers is as low as 27. Therefore, there exists much interest in accelerating relativistic electrons within the linear regime of LWFA, in which lower peak power lasers (26.Laser wakefield acceleration (LWFA)23. The phase velocity of a laser-driven wakefield is approximately equal to the group velocity of the laser pulse in the plasma, which is somewhat lower than the speed of light. Thus, the highly relativistic electrons outpace the plasma wave and eventually slip from an accelerating region into a decelerating region of the wakefield2. This process, known as dephasing, limits the acceleration length to the so-called dephasing length, which scales as 23. Dephasing is an important limitation that must be overcome in order to achieve higher electron energy gains, particularly for accelerators operating with lower power lasers. Another limitation is the depletion of the energy of the laser pulse as it drives the wakefield. The laser pump depletion length, 23. Since the maximum accelerating field scales as In general, there are three disruptive processes the control of which is of particular importance in LWFA, namely dephasing, pump depletion, and diffraction28. This occurs in situations where the laser power is greater than the critical power, 30. For example, Goers et al. accomplished sub-TW LWFA by focusing 0.21 TW laser pulses onto hydrogen gas targets 42, in which by equating the density modulation period of the corrugated channel to the dephasing length, the phase velocity of an individual spatial harmonic is matched to the velocity of the accelerating electron beam, which is close to the speed of light, c. Consequently, the chosen individual spatial harmonic exerts an almost constant axial force on the relativistic electrons, while the time average of the axial forces from all other spatial harmonics is zero. Comparison of the longitudinal wakefields acting on an electron moving at nearly c in modulated and unmodulated channels shows that in a modulated channel because of the break in the symmetry of energy gain and loss between the acceleration and deceleration phases experienced by relativistic electrons, the wakefield performs net work on an electron even after it has traversed one dephasing length, while the integral of the axial field over a plasma period is zero in a uniform channel41. As a result, for acceleration using linear wakefields, this technique leads to energy gains several times greater than that from an equivalent uniform plasma channel. Moreover, using a preformed plasma channel allows the pulse to be guided without diffraction over distances in the order of centimeters, which is necessary to reach the desired energy gains.Extending the energy gain beyond what the dephasing limitation dictates is a prime objective in the development of LWFA accelerators. One approach to overcoming the dephasing limitation is to link multiple LWFA stages in series45, as a result of which the temporal profile of the pulse becomes asymmetric. This asymmetry affects the evolution of the pulse as well as the maximum gain and quality of the injected electron beam. Similarly, LWFA is drastically affected by the initial properties of the laser pulse. In this paper, we propose a simple method to enhance the performance of QPM-LWFA by controlling the waveform of the driving laser pulse.The interaction of high-intensity laser pulses with underdense plasmas in LWFA is a complex process occurring in the relativistic regime. As the laser pulse propagates in the plasma medium, its shape evolves due to several nonlinear effects such as group velocity dispersion, self-phase modulation, and self-steepening50. Previous experimental investigations of the impact of asymmetries in pulse envelope and also frequency chirps on plasma wake excitation performed within the self-modulated LWFA regime have shown significant enhancement of the electron energy and total charge for sharp rising asymmetric pulses with positive chirps52.It has been observed that the temporal profile of the driving laser pulse plays an important role in wakefield generation53. It is found that a positively chirped laser pulse, in which the frequency is lower at the front of the pulse, can create stronger and more stable plasma waves than a negatively chirped or a chirp-free laser pulse. The reason is that when the pulse is positively chirped, the ponderomotive force is stronger at its front. By generating stronger plasma waves, which leads to a decrease in the effect of laser fluctuations, a positively chirped laser pulse also improves the stability of the electron beam48. Similarly, temporal laser pulse shapes with a sharp rising front (positive skew) are able to drive larger wakefields, leading to higher electron beam charge and energy56. Such asymmetric laser pulses have been generated experimentally in chirped-pulse amplification laser systems by detuning the laser pulse compressor. Electron beams with stable and small pointing angles have been reported to be obtained using asymmetric laser pulses57. In ionization-induced injection, a negatively skewed laser pulse profile results in a lower energy spread compared to a positively skewed pulse, thus yielding higher bunch quality58.In addition, experimental and theoretical studies in the bubble regime show that frequency chirped and shaped laser pulses can be used to adjust the self-injection rate, beam charge and the output energy of LWFA in the bubble regimeIn this study, through two-dimensional (2D) particle-in-cell (PIC) simulations with the code OSIRIS, the dependence of the final features of the accelerated bunch and its dynamics on the pulse duration and the asymmetries in the pulse envelope is investigated. It is observed that in QPM-LWFA, by selecting proper pulse length, higher energy gain can be achieved. Although further reduction of the laser pulse duration leads to generation of larger ponderomotive force, the use of a relatively short pulse may cause problems due to a short depletion length. Indeed, there must be a trade-off between the weak ponderomotive force available from a long pulse and the pump depletion effect which can cause rapid energy loss of a short pulse in a plasma. Furthermore, the simulations show that the skewness of the laser pulse influences both the quality and the maximum output energy of the electrons injected into a corrugated plasma channel. It is found that for otherwise identical initial parameters, a temporal pulse profile with fast rise time  affects the quality of the externally injected electron beam traveling through the corrugated plasma channel. For each driving laser pulse length, we consider three different initial temporal profiles: a symmetric sine-squared pulse and two asymmetric pulses, one with a sharp rising front and a slow fall (positive skew) and the other with a gentle rising front and a sharp fall (negative skew). The initial asymmetry introduced in the pulse shape is clearly visible in Fig. Figure Figure As discussed above, at the early phase of laser-plasma interaction, the sharp rising front of the positively skewed pulse generates a larger wakefield compared to the symmetric pulse and the negatively skewed pulse. As time passes, the nonlinear evolution of the laser pulses propagating in the channel plays an essential role in the wakefield evolution. Figure Here, we study how QPM-LWFA can be modified by controlling the duration and waveform of the driving laser pulse. The acceleration of externally injected electron bunches traveling in the plasma wakefield driven by asymmetric laser pulses in an axially-modulated plasma channel is inspected by performing 2D PIC simulations. To investigate the influence of the laser pulse duration, we consider a symmetric driving laser pulse profile with three different pulse durations of


The analysis and segmentation of articular cartilage magnetic resonance (MR) images belongs to one of the most commonly routine tasks in diagnostics of the musculoskeletal system of the knee area. Conventional regional segmentation methods, which are based either on the histogram partitioning  or clustering methods , have been frequently used for the task of regional segmentation. Such methods are well known as fast and well working in the environment, where cartilage image features are reliably recognizable. The well-known fact is that the performance of these methods is prone to the image noise and artefacts. In this context, regional segmentation strategies, driven by either genetic algorithms or selected evolutionary computing strategies, have the potential to overcome these traditional methods such as Otsu thresholding or K-means in the context of their performance. These optimization strategies consecutively generate a pyramid of a possible set of histogram thresholds, of which the quality is evaluated by using the fitness function based on Kapur’s entropy maximization to find the most optimal combination of thresholds for articular cartilage segmentation. On the other hand, such optimization strategies are often computationally demanding, which is a limitation of using such methods for a stack of MR images. In this study, we publish a comprehensive analysis of the optimization methods based on fuzzy soft segmentation, driven by artificial bee colony (ABC), particle swarm optimization (PSO), Darwinian particle swarm optimization (DPSO), and a genetic algorithm for an optimal thresholding selection against the routine segmentations Otsu and K-means for analysis and the features extraction of articular cartilage from MR images. This study objectively analyzes the performance of the segmentation strategies upon variable noise with dynamic intensities to report a segmentation’s robustness in various image conditions for a various number of segmentation classes , cartilage features  extraction preciseness against the routine segmentation strategies, and lastly the computing time, which represents an important factor of segmentation performance. We use the same settings on individual optimization strategies: 100 iterations and 50 population. This study suggests that the combination of fuzzy thresholding with an ABC algorithm gives the best performance in the comparison with other methods as from the view of the segmentation influence of additive dynamic noise influence, also for cartilage features extraction. On the other hand, using genetic algorithms for cartilage segmentation in some cases does not give a good performance. In most cases, the analyzed optimization strategies significantly overcome the routine segmentation methods except for the computing time, which is normally lower for the routine algorithms. We also publish statistical tests of significance, showing differences in the performance of individual optimization strategies against Otsu and K-means method. Lastly, as a part of this study, we publish a software environment, integrating all the methods from this study. Medical image segmentation represents one of the essential procedures in medical image analysis. The methods, belonging in the area of medical image segmentation, play an important role for the image area decomposition with the focus image understanding. Such methods enable two important issues: 1) the extraction of morphological features of objects of interest and 2) the consequent extraction of various features of such objects with the aim of the quantification of biological tissues [ the extr the consImage segmentation includes a lot of methods varying in their mathematical strategy and the aim of the segmentation. Edge detection represents one of the most conventional methods for the automatic contouring of objects of interest. Here, we recognize multiple principles such as the maximum of the first derivative, or the zero crossing detectors ,16,17. TThe most extensive area of the medical image segmentation is regional image segmentation. These methods normally enable medical image decomposition into a predefined number of regions ,21. SuchIn this paper, we provide a comprehensive insight in the form of a comparative analysis of selected evolutionary optimization algorithms and genetic algorithms performances, which are used for the tuning of conventional segmentation strategies to achieve a maximal performance under various image conditions and deterioration by image noise. In this study, we compare the performance of optimized segmentation strategies with the elements of artificial intelligence  with conventional strategies based on the hard thresholding (Otsu method) and nonhierarchical clustering (K-means). This analysis should objectively point out on the performance and impact of modern optimization methods with artificial intelligence as from the view of segmentation performance and robustness under additive noise and also computing time, which is an important factor of each segmentation procedure regarding complex effectivity. This objectivization analysis investigates the robustness and computing requirements of individual segmentation strategies provided under the influence of various types of additive deterministic noise with dynamical intensity. That enables the study of the performance of individual optimization techniques and its determining parameters along gradually deteriorated conditions and shows the dynamical features of robustness of individual methods. Besides the analysis of performance, we also publish the application of regional segmentation for cartilage features extraction. As a part of our research, we publish a testing software environment, integrating individual methods of regional segmentation with the possibilities to select individual steering segmentation parameters. The software application enables the application of various deterministic noise generators with the settings of the noise parameters, which control noise intensity to simulate image degradation for the testing of individual segmentation strategies robustness. This application also enables the segmentation accuracy evaluation based on selected objectivization parameters, which are also used in this study to evaluate the segmentation performance.The organization of the paper is following. In In this section, we outline the conventional procedures, serving for a spatial image domain decomposition, which is routinely used as a fundamental tool for medical tissues identification. There are various mathematical approaches, which may be used for the aforementioned image decomposition, including mainly techniques based on histogram partitioning, edge detectors, contours tracing, analysis pixel’s relationships, methods of artificial intelligence, and others ,36,37,38One of the most popular techniques, and it is also the aim of this paper, is the regional image segmentation bases on the histogram thresholding. These methods normally allow for a histogram decomposition bases on either one, or multiple thresholds, defining individual image regions ,38. HereOther popular areas for regional medical image segmentation is clustering analysis. Here, the most popular methods are based on the nonhierarchical clustering such as K-means or fuzzy C-means (FCM) segmentation ,43. ThesThese routine approaches, as we outlined earlier, are usually easily implemented with a reasonable computing time, on the other hand they normally suffer from certain limitations, which may have a significant influence on their effectivity and robustness as well. In the comparison with conventional segmentation methods such as Otsu thresholding, which is based on the hard selection of individual thresholds in histograms, we proposed schemes on thresholding strategies utilizing optimization techniques for optimal thresholds selection from various thresholds combinations. This is supposed to be a more effective approach, which better reflects a pixel’s distribution inside defined regions. Furthermore, we provide analysis of robustness of each tested method upon dynamic various noise influence to objectively show dynamic features of performance when an image domain is gradually deteriorated by additive noise. On the other hand, we are aware that evolution strategies and a genetic algorithm may have a significant influence on the computing time. Therefore, we also publish time complexity analysis, showing their complexity. All the optimized methods we put in a contrast with the conventional approaches such as Otsu thresholding and the K-means method to objectively point out differences in segmentation performance in the context benefits and limitations of using evolutionary and genetic algorithms for various numbers of thresholds and other steering optimization parameters of these optimization techniques.Recently, various implementations of evolutionary and genetic optimization strategies have increased in popularity for solving various engineering problems in the area of optimal settings of steering parameters of various procedures. The main aim of this paper is to objectively point out on the effectivity and robustness (a level of stability in various image environment) of selected thresholding-based regional segmentation strategies, being optimized with evolutionary computing methods (ABC and PSO with its variants: FPSO (fuzzy particle swarm optimization) and DPSO (Darwinian particle swarm optimization)) and genetic algorithms as from the view of their effectivity of segmentation, features extraction, and also time complexity. On the other hand, ABC algorithm is used in the combination with fuzzy thresholding, which forms individual segmentation regions based on the membership functions for each region, where pixels are classified into regions based on the membership values as we describe further. This is also an important issue of this study as shows the impact of fuzzy thresholding besides conventional hard thresholding histogram partitioning.In the contrast of the optimized methods, we put two selected conventional segmentation approaches, which have been considered for a long time as standards for medical image segmentation, as they were used in plenty of research studies, dealing with various object detections from medical images. The first one is Otsu thresholding, which is the implementation of so-called hard histogram thresholding, and the second method is K-means, which defines segmented regions based on the nonhierarchical clustering. Implementation of these routine segmentation strategies, which utilize various principles for image segmentation, point out on differences in performance between non-hierarchical clustering and thresholding for regional image segmentation. In a general way, we define the optimization problem of a set of thresholds:In such configuration, we search for an optimal combination of individual thresholds  and genetic algorithms for histogram-based thresholding. In contrast with these strategies, we put the conventional methods based on the hard thresholding (Otsu thresholding) and K-means, which classifies pixels into regions based on a similarity (Euclidean distance) with region’s centroid. These conventional methods do not contain any optimization elements, so it would be interesting to compare the performance of optimization strategies with these segmentation routines.In order to objectively report the effectivity and robustness of individual methods, we employ selected deterministic noise generators with dynamic noise intensity (controlled by their steering parameters). Dynamical noise impact is manifested by gradual deterioration and modification of pixel’s intensity distribution, which supposedly should have impact on the segmentation robustness as we provide modeling in the section results. In order to provide such analysis, we employ Gaussian, salt and pepper, speckle, and Rician noise generators with dynamical range of their noise impact.In order to objectively measure the noise impact of the segmentation performance of individual studied methods, we employ selected evaluation parameters, which are focused on measuring a level of similarity or difference between the native segmentation (with a zero level of added noise) and respective noise level. This approach enables objective performance evaluation of studied segmentation strategies. For this analysis we use the following objectivization parameters: structural similarity (SSIM), mean squared error (MSE), correlation coefficient (CORR), and signal noise ratio (SNR). Otsu method  is one oBG is count of background pixels at threshold T, PFG is count of foreground pixels at threshold T, and Pall is the total count of pixels in image.L image intensities in the range: p stands for the number of thresholds. A width of one area is defined as the ratio:Otsu method can be extended for a multiregional segmentation scheme , where mP) for individual areas are defined as the maximization of inter-class variance:Optimal thresholds , the onlooker bees (OB), and the scouts (SB) whose task is to improve the overall food resources. The basic parameters of ABC include the number of food sources, the limit, and the number of iterations. The limit determines after how many iterations a worker will abandon their solution if they have not been able to improve it.Ri adjacent to the solution iX. Parameter iX = {iX, 1, iX, 2, …, iX, p} represents the i-th solution in the swarm of bees, where p represents the number of parameters that are optimized. In the first stage of the algorithm, these two solutions are compared using the fitness function and if the solution of the fitness function Ri is better, it is kept as the new solution from this pair. Otherwise, no change occurs. This is done for each of the pairs iX and Ri. It is necessary to apply a selection limit Lv specifying the maximum number of attempts in selecting a solution iX in case an optimal solution Ri cannot be found.The total population (SN) consists of an equal number of EBs and OBs, with each EB having one temporary solution Lv, we consider it as a burnt-out solution. The second stage is essentially an extension of EB. It works with OB in which the existing individual solutions are tested from different perspectives. The more optimal solution should have a higher value of Pi. After selecting the food source iX, a neighboring food source Ri is determined and their fitness values are compared. The last part is the scouts searching for new food sources instead of depleted sources. The process of evaluating solutions is iterative, in most cases 100 cycles are applied. The output of this optimization method is the set of all admissible solutions, where in the final step the solution possessing the maximum value of Pi is selected.However, if an optimal solution cannot be found even after exhausting xi, and its movement corresponds to the velocity vi. The particle velocity is determined as follows:c1 and c2 are positive numbers, rand1 and rand2 denote random numbers from the range 0 to 1. Equation is composed of three parts. The inertia and attraction to the best-found position of a given particle pi, and we denote the value of the fitness function at this position by pbest. This attraction is multiplied by a random weight c1 ∗ rand1 and is called the memory of the particle. The third part of the equation is the attraction to the best-found position of the particle pg, and we denote the corresponding fitness value by gbest. The aforementioned attraction is again multiplied by a random weight c2 ∗ rand2 and is called shared information, or also shared knowledge. Each individual remembers their previous best value and the best value of their neighbors. The agents therefore use the information from the best particle, and therefore this algorithm is more memory efficient than the genetic algorithm.PSO, or particle swarm optimization, is an evolutionary optimization computing technique inspired by the social behavior of birds and fish swarms. This method uses a population of particles that fly in an irregular motion through a given space at a certain speed. The position of each agent is given by the vector min is the true minimum and CBPEmax represents the suboptimal CBPE. CBPE normalization is used to make the algorithm applicable to a wide range of optimization processes. A non-optimal CBPE is considered to be any solution with a CBPE greater than or equal to CBPEmax. These fuzzy variables are defined as fuzzy sets with nine rules for a fuzzy system.FPSO stands for fuzzy particle swarm optimization. It is a modified PSO algorithm using fuzzy logic theory. The position and velocity of the particles in this algorithm are defined to represent the relationship between the fuzzy and the variables. Fuzzy logic controller with two inputs and one output improves the performance of PSO. The two input variables represent current best performance evaluation (CBPE) and current inertia weight. The output variable is change in inertia weight. CBPE needs to be normalized according to the following formula:DPSO is a Darwinian algorithm extending the PSO algorithm by natural selection and survival of the fittest to increase the ability to escape from local optima. Darwinian particle swarm optimization (DPSO) allows many swarms of test solutions to exist at any point in time. Each swarm works like a regular PSO algorithm, except that it uses natural selection  to enhance the ability to escape from a local optimum.kill represents a number of deleted particles from the swarm, p is the probability, f is a random number in the interval 0 to 1, NS represents the number of swarms. Each swarm is evaluated using the fitness function of all particles. In this way, it is possible to analyze the overall state of the swarms separately and thus update the neighborhood and individual best positions of each particle. New particles are created if a new global solution is found. Conversely, particle extinction occurs if the swarm does not find a more suitable state in a defined number of steps.The principle of the solution search is that if it is heading towards a local optimum, then the search for a solution in that region is terminated, and the search for another area begins. Each swarm is monitored at every step. If swarms improve, they are rewarded. The reward is to extend the lifetime of the particles or to produce offspring. If swarms stagnate, they are punished. The punishment consists of shortening the lifetime of the swarm or removing particles. After the removing the particle, instead of being set to zero, the counter is reset to a value approaching the threshold number, according to:Genetic algorithms are based on natural processes with gradual elimination and subsequent selection of the most suitable solutions. It is a combination between biology and mathematics. Patterns from living nature are used, which initially work by chance and gradually produce better solutions. These patterns are then applied using a mathematical model to a variety of technical applications, including image processing using segmentation techniques.Genetic algorithms use special procedures to find the optimal solution using selection, crossover, and mutation operations. They start with random selection and search for new, better solutions; the most optimal solution is then selected from the results. All algorithms include a fitness function that provides information about the quality of the solution. Each approach has specific parameters that must be set. Examples are the number of regions, the number of initialization solutions, the parameters of the fitness function, or the possible number of iterations, which means how many steps the algorithm will take to find the best solution. For GA, the number of crossovers from each iteration, the so-called crossover, is also set. At the beginning, the structure of an individual is proposed to express its quality and to make the crossover and subsequent procedures easier. This process is known as initialization.i is the probability of selecting the i-th individual from the population and fi corresponds to the fitness value of the i-th individual. The crossover operator is analogous to biological reproductive crossbreeding and can therefore be described as the combination of two parents producing an offspring.The selection operator is used to select individuals for further reproduction, it copies the selected strings from the old generation to the new one. Mathematically, it can be expressed as follows:The final stage in the creation of a new generation is mutation, which also plays an important role. It ensures diversity and increases the probability of escaping from the local optimum. It can discover a trait in each generation that no individual has had before and therefore could not pass on to its offspring.n regions, defined by the set of thresholds In a general way, we define the search for optimal combination of thresholds to separate pixels into predefined number of segmentation regions. In order to do this task, we must specify the criteria, based on which, any optimization strategy recognizes an optimal configuration of segmentation model. This task is performed by using fitness function (fit), which is capable of evaluating each possible solution within optimization strategy. In our study, we use a unified version of fitness function to all the techniques were comparable. We define the fitness function based on the Kapur entropy ,70. By tIn this configuration, we compute Kapur entropy for each region by the following way:In these equations (Equations (15)–(17)), the parameters In the following text, we summarize the basic concept of soft thresholding for medical image segmentation. To justify the situation of the application of the evolution algorithms for hard and soft thresholding, we provide the example of usage PSO algorithm  for the I stands for the monochromatic image and I(r) for the image definition. Supposing that I(r) should be decomposed into L regions, which should be extracted with using of soft thresholding by the way to obtain the segmented image, denoted as M(r) with the definition:sg{.} stands for a segmentation method (soft thresholding), which may be considered as a function, providing mapping IN levels of monochromatic image into L regions, that means: sg: IN → L, where L < IN. After performing the segmentation, is it supposed that each pixel I(r) is given by a membership level in each of L regions. In this definition, the soft thresholding utilizes fuzzy triangular membership functions, which assign a membership level for each pixel in each fuzzy-based region. We use the notation: lµ(x), l = 1, …, L for the fuzzy membership function in lth region.Supposing we have a monochromatic image with 8-bit depth (256 gray intensities), which may be described by the intensity function iX = {iX, 1, iX, 2, …, iX, p} defines ith possible solution for bee swarm. Here, this parameter particularly represents a set of random combinations of triangle vertexes to be optimized using ABC optimization. Besides the definition of the vertexes, we define the further conditions (rules) for the construction of PTS functions:Complete division: Consistency: Normality: The soft thresholding particularly utilizes a pseudo trapezoid-shaped (PTS) function. This function may be defined directly based on the centroid’s definition. These centroids could be calculated by using clustering analyses, where the image data would be decomposed into regions, and the centroids of such regions would represent triangle vertex. Unfortunately, such definition would not reflect the pixel’s distribution inside the regions and only rely on clustering performance. Therefore, we employ the ABC algorithm to search for an optimal distribution of these triangle vertex of PTS to find an optimal segmentation model. As we defined earlier in the ABC definition, the parameter: 1–V4), which defines four segmented regions.As the example , we provr from the image I(r) in the lth segmentation class is given by the expression L regions) by the way:The membership function of the pixel In this definition with PTS functions, only two adjacent membership functions give non-zero membership levels for each pixel. Based on this definition of fuzzy space, we define defuzzification to finally classify the pixels into individual classes based on the maximal level of membership functions.Here, the expression In this section, we describe the datasets that we use for the testing of the analyzed segmentation methods. Since the musculoskeletal system plays one of the most important roles in the human body, ensuring movement, we are focused on the MR images of articular cartilage from various MR sequences, which are crucial for movement. The musculoskeletal system in general contains various structures thatenable persons to move. In the main principle, this system can be divided into muscles, which serve as the executors of motion, and the bone supporting system with joints, ligaments, and tendons. Besides the motion activities, this system also perform the further important tasks, including upright posture, protective function of vital organs, and functions, ensuring communication such as the contraction of mimic muscles and gesticulation.Among other medical imaging methods, magnetic resonance plays an important and indispensable role in investigating tendon and muscle traumas and disorders with the aim to distinguish ganglia, cysts, hematomas, and early degenerative structural changes of articular cartilages. Here, the most common MR techniques utilize T1  and T2 (transverse) relaxation times. In the examination of articular cartilage, routine procedures including a spin-echo sequence are used. Individual tissues have various T1 and T2 relaxation times. Therefore, it makes differences in MR signal strength, which reflect measurable differences in grayscale intensities. Here, darker tissues are perceived as hyposignal, contrarily lighter tissues are hypersignal. Based on this fact the obtained MR images allow T1 and T2 weighting. This fact is frequently utilized in articular cartilage imaging with the aim to distinguish the healthy structure from pathological disorders such as early stage of cartilage loss in osteoarthritis.In our study, we use three variable sequences of articular cartilage, including T2-weighted images, proton density-weighted images, and gradient echo images. For each mentioned group, we tested in total of 1000 MR images from the public database Osteoarthritis Initiative (OAI) ,72 to prIn the basic principle, the fat saturation MR sequence involves firstly the excitation and consequently dephasing of the spinning protons in fat tissues. This process is driven by the application of a lipid-specific radiofrequency pulse. This pulse is applied before each repetition of each 2D or 3D sequence. A significant benefit of this approach is a substantial contrast between non-lipid and lipid tissues.The proton density-weighted MR imaging is able to recognize in contrast the cartilage defects and abnormal cartilage composition in their tissues. This imaging sequence enables a suitable investigation of the cartilage morphology, ligaments, and menisci. The fat-saturated proton density-weighted images are suitable for the investigation of a low-signal intensities, which is a typical case of early cartilage loss. Therefore, this technique is well suited for the examination of osteoarthritis. As an example of the articular cartilage data, we provide a comparison of various sequences from the same cartilage area .Proton density sequence plays an indispensable role in structural investigation of the early stage of articular cartilage loss. Here, only a weak contrast between a common cartilage surface and such pathological findings are notable. Therefore, for our analysis these data are substantially important. To objectivize such findings, we provide the example  from ourIn order to objectivize the acquisition parameters for the tested images, we provide In order to provide the analysis of robustness of individual segmentation techniques, we employ various image noise generators, which simulate gradual deterioration of spatial image area by using their steering parameters, as we describe further. For our analysis, we use the following noise generators: Gaussian noise, speckle noise, salt and pepper noise, and Rician noise.x represents the luminance of the noise, 2σ is the variance, and μ represents the mean.Gaussian noise represents white statistical noise. This type of noise is due to natural sources such as ambient temperature. The distribution of Gaussian noise is uniform in the image and affects all pixels with the same intensity. It is a normal distribution of noise distribution in the image. Gaussian noise can be defined using the following formula:I presents the input image, J is the noise distribution in the input image, and n presents unified zero mean value of the noise in input image.Speckle noise is a common noise that occurs in all coherent imaging systems . The cause of this noise is the interference of a signal that has a different phase when returning from the target. This noise is displayed in the image as dark pixels with a higher brightness value. The input parameter is the speckle noise variance. Speckle noise can be described by the formulation:Salt and pepper represents impulse noise. The image degradation takes place at several pixels in the image, with the pixel carrying no information about the original value. The pixel values in the image are replaced by values of 255 or 0. Thus, this noise is represented in the image as white and black dots resembling salt and pepper. The input parameter for setting the noise is the density. This noise is most often noticeable during data transmission.M represents the signal magnitude, I represents the original image with negligible noise intensity, and Rician noise represents the most typical noise in images taken by magnetic resonance. Rician noise is based on Gaussian noise in that the real and imaginary parts of the signal are corrupted by an uncorrelated zero mean. The magnitude of Rician noise can be expressed using the following formula:u(.) stands for Heaviside step function [In this definition, function .d) and for speckle (Sp) and Rician noise (Ric), we control the noise intensity via the parameter variance , we use a constant dispersion . For each image, we defined a multidimensional array, where all these noisy images are stored. In the following outputs: All the performance characteristics are constructed by the way we use the segmentation of native MR images as a gold standard against individual segmentation in individual noise levels. This approach enables objective measurement of the noise influence for each noise level. This finally shows dynamical features of performance within continuous degradation by image noise with variable intensity. The following parameters are considered for this study.x and y using a metric. This parameter is defined by the following formula:iC = l represents the dynamic range of pixel values, k << 1 are small constants with values usually 0.02, μ represents the weighted average of the x and y images, and σ represents the covariance of x and y. These components in the formula allow to compare between x and y images: brightness (l), contrast (c), and texture (s). The comparison method extracts structural information from the scene. This parameter takes values from −1 to 1, with 1 representing the absolute match between the x and y images. Here, we consider that x represents the segmentation with zero level of additive noise and y represents the segmentation output with respective level of the noise.SSIM or structural similarity index  is a parx and y. The correlation coefficient is defined as the ratio of the covariance of the variables x and y multiplied by their standard deviations. The Pearson pairwise correlation coefficient r can be expressed using the following equation:xs and ys represent standard deviations and x and y. The correlation coefficient takes values from −1 to +1, and the closer the absolute value of the correlation coefficient r is to one, the closer the relationship between the variables x, y. The higher the value, the better the segmentation performance.Correlation coefficient represents the linear correlation between two images SNR or signal to noise ratio is a parameter that allows us to express the ratio of useful power to useless power of a signal (image). This parameter is defined by the following equation:SNR or signal to noise ratio is a pair where M represents the image size in the horizontal direction, N represents the image size in the vertical direction, MSE, or mean squared error, is a parameter that can be used to objectively evaluate image quality. This parameter expresses the degree of mean squared error between the original image and the segmented image. This parameter is defined by the following formula:The segmentation results  are evaluated via labeling matrix, where each region has a unique number. This number represents an interval of intensity values, which are classified into a specific region. Thus, this can be interpreted as a transformation of a set of intensity values from the image spatial area into the region index. The evaluation parameters reflect pixel reclassification among individual such regions by the influence of additive noise. By adding additive noise with gradually increasing intensity, a respective pixel will have significantly different intensity value when comparing with the situation without additive noise. Therefore, such pixels may be reclassified in a different region. The evaluation of pixel-wise parameters such as SNR or MSE, reflect the impact of change of pixels assignment among individual regions. The main aim of these parameters is reflecting the impact between change of pixel’s assignment in adjacent regions  and the shift between more regions, where we can suppose a higher noise impact. This situation firstly reflects the change of pixel region reassignment, but also the shift of pixel intensity by additive noise. Finally, the evaluation parameters quantify the impact of a pixel’s assignment change and thus objectively evaluate a robustness of a respective pixel’s classification upon the image noise with gradual intensity. The higher shift between regions is registrable, the bigger impact on evaluation parameters is, which quantify the performance and robustness of the regional segmentation upon dynamic noise intensity.p-values for median tests. The last quantitative analysis deals with the extraction of clinically important cartilage features including the area, perimeter, and cartilage skeleton. Here, we show differences of automatic segmentation and the gold standards. Lastly, we provide a presentation of the software environment, which integrates individual reported segmentation strategies with the possibility of selecting steering parameters of segmentation.In this section, we introduce quantitative results of testing analyzed thresholding-based segmentation strategies. Here, we provide several types of characteristics to provide an objective view of the segmentation performance and limitations. We provide examples of graphical comparisons of the segmentation methods, which show the influence of the variable image noise of segmentation maps. For the generation of the segmentation maps, we use an artificial color coding. Where each single color represents one region of the segmentation model. To provide a complex view on the segmentation performance, we provide this testing for a variable number of segmentation classes because this parameter has a substantial effect on the segmentation performance. One of the important performance features is the time complexity, thus we provide time requirements of individual segmentation methods. This aspect is substantially important when performing a simultaneous segmentation of a stack of MR images. In order to show a statistical significance between the routine methods and optimized segmentation models, we provide the statistical testing of significance of Gradual noise dynamics has a substantial effect on the pixel’s distribution as we mention in the previous examples. In our study, we utilize this fact to test the robustness of segmentation strategies to justify the impact of optimization elements for the performance of regional segmentation as we describe further.The first analysis, which we provide is aimed on the graphical evaluation of the analyzed segmentation methods under gradual increasing noise influence. Based on such results, we can subjectively observe clearly visible notable differences in individual methods in segmentation maps. As the example, we provide the comparison  for all The segmentation results are interpreted in the form of segmentation maps in the color spectrum . The int1, GA1 and ABC1) and 500 , and a population size of 50  and 200 .Based on such experimental results, it is noticeable that an increasing noise intensity can significantly impair the quality of the segmentation results. For lower noise levels the segmentation results point out on a good performance, for example the ABC algorithm does not exhibit more significant signs of the noise. On the other hand, higher levels of noise cause significant impairment of the segmentation model consistency. In order to objectively justify this fact, we further provide a robust testing of these segmentation methods based on the mentioned evaluation parameters, to objectively show the change of segmentation performance among individual methods, and also how the number of regions influence the dynamic of segmentation performance. To better justify the testing scheme, we provide testing on routine approaches of Otsu thresholding and K-means clustering. Here, we only set the number of the segmentation regions. Contrarily, in the evolutionary strategies, including ABC, PSO, DPSO, and FPSO, we use a unified number of iterations, 100 , the index of correlation (CORR), the structural similarity index (SSIM), and the signal to noise ratio (SNR). As the example, we provide these characteristics  for the Judging by the experimental results, significant differences in effectivity among individual methods are notable. The trends of the parameters of similarity  for Otsu and K-means exhibit significantly lower values when comparing with the evolutionary algorithms. That indicates the notable worse results of these routine algorithms in the comparison with the optimization techniques. The higher these parameters are, the better the performance of respective segmentation is achieved. On the other hand, these routine approaches from the view of MSE exhibit the most rapid increasing trend when comparing with optimization techniques. This is also a sign of the much worse effectivity of Otsu and K-means against the elements of artificial intelligence.Besides these characteristics, we also publish the averaged results of individual parameters for individual methods. Note that the individual results are average for each parameter and the type of noise. These characteristics  well refBased on the provided statistical results, we have an insight on a global behavior of the segmentation strategies. Judging by these experimental results, it is notable that the highest performance is achieved in most cases by the ABC algorithm. This is expected due to its enhanced segmentation strategy because it used the fuzzy soft thresholding instead of hard defined thresholds. The further expected fact is the methods with the lowest performance. Here, in most cases are Otsu and K-means, which are comparably worse than the genetic and evolutionary algorithms. The last interesting fact is that PSO and its variants achieve relatively similar results without more significant differences. It is notable that the SNR parameter reports relatively small values. This fact is caused by applying SNR on segmentation maps in the form of index matrixes  instead of intensity values, where we would have a distribution of 256 intensity levels (in the case of 8-bit images). The MSE parameter achieves small values as well. Here, it is expected, due to the nature of MSE. The lower the MSE is, the higher the agreement between the gold standard and the respective segmentation results we have.t-tests for mean values assumes that the tested data come from the normal distribution of probability. We tested all the distributions of SSIM, MSE, CORR, and SNR whether they come from the normal distribution. We used the null hypothesis  as we indicated earlier. Here, we show the comparison of these two ABC alternatives for 4, 7, and 10 regions. Furthermore, here, we can observe significant differences in the algorithm’s performance. Mostly, the higher number of regions are set, the worse segmentation results we achieve.In the last part of quantitative comparison, we compare variable numbers of segmentation regions to justify this effect on the segmentation performance. Here, we provide a comparison of 4, 7, and 10 regions of the ABC algorithm for Rician noise . As it iBesides the quantitative characteristics in this section, we also publish a comparison of time requirements. We provide testing  of the tIn this subsection, we introduce the software environment , which iCartilage area—a total count of the pixels, belonging to the model of articular cartilage.Cartilage perimeter—a perimeter of the cartilage model. Here, we used Sobel edge operator for the detection of cartilage borders, and consequently counted the border pixels.Skeleton of cartilage—the detection of cartilage skeleton and computing its length.Based on the reported analysis of the segmentation performance, mostly the combination of fuzzy thresholding with the ABC evolutionary algorithms appeared as the best segmentation strategy, judging by reported objectivization parameters and mainly provided statistical tests of significance. In this subsection, we would like to provide the last analysis of selected features extraction of articular cartilage from MR images based on the fuzzy thresholding with the ABC algorithm. The aim of this analysis is firstly computing a multiregional segmentation model, allowing for a decomposition of the MR image into a finite number (in this case five) segmentation regions. Consequently, a region, representing the articular cartilage, is selected  as the rBased on the segmentation form as binary images, representing extracted articular cartilage and its respective features, we compute descriptive statistics, pointing out on individual distribution’s error functions, which show percentual differences of individual features, and a distribution of values for the individual parameters of segmentation performance (SSIM and index of correlation). Here, the evaluation parameters were computed between the gold standard binary image and the results of the fuzzy thresholding with the ABC algorithm. Based on the results of the quantitative analysis of difference function for the extracted features, we did not achieve significant differences between the gold standard images and fuzzy soft thresholding with the ABC algorithm. Mostly the distributions of difference function are kept under 6% of difference. Based on this analysis, we provide the descriptive characteristics , which rBased on the provided results, significant differences among individual methods can be observed. In such comparisons, routine methods show significantly worse results when comparing with the evolutionary algorithms. Along these characteristics, we also provide the average values for all the noise levels to provide a global view on all the studied methods. By this statistical comparison, in most cases the ABC algorithm seems to be the most effective. On the other hand, the use of the genetic algorithm for medical image segmentation strategies does not give satisfactory results. Furthermore, this strategy is enough time demanding. We also studied the time complexity for all the studied methods for three different number of segmentation regions. Here, we can conclude that the increasing number of regions increases the time complexity. These comparisons also bring notable differences among routine methods and optimization strategies. The routine methods are less time demanding in the contrast with the optimization strategies, which is predictable because the evolution strategies usually represent complex procedures. The interesting notable fact from this study is the comparison between the hard thresholding-based approaches with PSO and its variants and soft thresholding with the ABC algorithm. Mostly, soft thresholding overcame the concept of hard thresholding. In this view, the soft thresholding appears as more efficient. On the other hand, the hard thresholding strategies in this study are less time demanding. It is important to mention that the quantitative characteristics of the segmentation performance are represented by the trend characteristics  of the eAlthough this study reveals a complex view of selected aspects of the employment of evolutionary computing methods and genetic algorithms for medical image segmentation, there are still open issues for further research in this area. In the future research, it would be worth studying in detail various settings of population size and the number of iterations in the context of their impact on the segmentation accuracy. The further important aspect is the definition of criteria for the evaluation of the most suitable threshold settings. Here, we use Kapur entropy as the fitness function. Nevertheless, other alternatives may be plausible. For instance, using a local statistic of variability of pixel’s distribution inside of regions appears to be a reasonable alternative. Based on these open issues we would like to build future research in this area.


The digital transformation of the defence sector is not exempt from innovative requirements and challenges, with the lack of availability of reliable, unbiased and consistent data for training automatisms  being one of the most relevant gaps. In the context of cyber defence, the state-of-the-art provides a plethora of data network collections that tend to lack presenting the information of all communication layers . They are synthetically generated in scenarios far from the singularities of cyber defence operations. None of these data network collections took into consideration usage profiles and specific environments directly related to acquiring a cyber situational awareness, typically missing the relationship between incidents registered at the hardware/software level and their impact on the military mission assets and objectives, which consequently bypasses the entire chain of dependencies between strategic, operational, tactical and technical domains. In order to contribute to the mitigation of these gaps, this paper introduces CYSAS-S3, a novel dataset designed and created as a result of a joint research action that explores the principal needs for datasets by cyber defence centres, resulting in the generation of a collection of samples that correlate the impact of selected Advanced Persistent Threats (APT) with each phase of their cyber kill chain, regarding mission-level operations and goals. In the context of cyber defence operations, the expression popularised by the research community on machine learning, “you go to war with the data you have, not the data you might want”, is applied literally . Since sOn these grounds, the dataset collection environment should aim to check awareness and assess or train response planning to various cyber threats, which, beyond the conventional state-of-the-art context, shall additionally relate to: (1) assess the capabilities to determine operational impacts of cyber attacks and implement proper recovery and remedial procedures; (2) expose and correct weaknesses in target systems, operations, policies and procedures; (3) assess the effectiveness of the incident reporting; (4) determine what additional capabilities are needed to protect the target system and provide for operations in a hostile environment; (5) develop contingency plans to remediate to the loss of IT assets. These datasets shall cover the whole information stack, from physical (OSI 1 Layer) and digital dimensions (OSI 2–7 Layers) up to the military mission plane .With the aim of solving these difficulties and in order to contribute to specific and generate appropriate datasets tailored to mission-centric cyber tools, this paper introduces CYSAS-S3, a novel dataset that makes cyberspace situations converge with mission-level simulations. CYSAS-S3 is the result of a joint effort that merged academy, research, industry and defence institutions. This paper supports the preliminary results disseminated in  in the cAn in-depth revision of the state-of-the-art in dataset generation applied to cyber defence.The results of a joint effort towards delivering a dataset suitable for calibrating and evaluating cyber defence tools for supporting military operations in cyberspace. The proposal’s design principles have been constituted under the consensus of several stakeholders, which provides a realistic vision of the problem statement.Definitions of Communications and Information Systems (CIS) level and Mission Impact (MI) level scenarios tailored to military cyber defence needs.A CIS-level CYSAS-S3 dataset was gathered in a virtualised operational environment (Cyber Range), comprising three main adversarial scenarios: data exfiltration, denial of service and credential steal. All of them execute a cyber kill chain, clearly differentiating their intrusion phases.A mission-level CYSAS-S3 dataset that represents a simulated parallel mission operation that is dynamically impacted by the situations represented in the CIS-level CYSAS-S3.A full stack of communication evidence, ranging from the physical layer to digital  and mission-level dimensions .In order to support the research application, the proposal introduces guidelines for evaluation methodologies built on the dataset grounds, able to cover the whole life-cycle of cyber defence tools related to the acquisition of cyber situational awareness.Due to the great interest aroused among the audience, as well as the large number of comments received from different stakeholders, the authors decided to publish this extended and much more detailed version of the conference manuscript. Beyond responding to the raised questions, the revision of the conducted research led to the introduction of novel guidelines, as well as providing illustrative cases of applications, highlighting the following key contributions, among others:This paper is organised into seven sections, being the current introduction the first of them. The following reviews the key insights of the state-of-the-art on dataset generation for cybersecurity capability verification and validation: threat modeling and attack scenarios, testbeds and dataset generation environments, network traffic generators, attack models and adversarial activity emulation, synthetic mission simulation and related evaluation methodologies.The bibliography describes a large collection of technological enablers able to partially or totally recreate a testbed environment for adequate dataset injection and execution of processes fitted to real cyber situations , includiA wide narrative revision of the core involved technologies was presented by Ukwandu et al. , which wCritical terrains on intermediate architectural layers of cybersecurity testbeds are the sandboxes, which represent a low-level layer that encapsulates isolated computer networks and systems where users can safely perform their cybersecurity tasks without threats vertically/horizontally propagating to undesired layers . Under tA large number of traffic generators have been developed in the last decades based on different methodologies but are mostly adapted to the specific needs of inferring synthetic network environments by simulation or emulation , rangingThe network traffic generation by maximum throughput is commonly applied for assessing the end-to-end network performance, since they are designed for injecting the maximum network traffic. This paradigm provides priority to the massive injection of packages over quality and realism, so it is most suitable for supporting stress testing actions rather than the training of anomaly-based classification tools. A popular multi-platform maximum throughput traffic generation is iperf , which iThe solutions tagged as high-level and auto-configurable generators are characterised by taking advantage of advanced modelling and procedural content generation towards delivering traffic injectors able to automatically configure their parameters based on live measurements, therefore, creating an output that is statistically similar to the original traffic . Due to Although the section above analysed the state-of-the-art of network traffic generators, none of those has a security-oriented approach since there was no distinction between the inference of neutral (benign) and malicious traffic. The particular traffic generation requirements for this purpose, among others, are discussed in , where tA major disadvantage of manual assembly is the high cost of the attack script collection process. Locating the attack scripts needed for exploiting specific vulnerabilities and obtaining the required vulnerable software is typically time-consuming, and once the needed attack scripts are found, they usually have to be adapted to exploit the vulnerabilities of the victim environments. Depending on the size of a manually assembled exploit database, the previously mentioned activities might require a considerable amount of manpower to be completed in a reasonable time frame. For instance, in , the autOn the other hand, instead of generating workloads using a network environment created specifically for this purpose, it is possible to obtain publicly available traces that are intended for use in security research, most of them being collected and studied in depth in . The malBoth dataset and guidelines for evaluation methodologies have been generated based on the system engineering techniques and innovation practices learnt from the previous research activities of the project’s team members. On that basis, three major project development stages were defined see . The firThrough the CYSAS-S3 generation, the project’s team has assumed that the main purpose of the datasets is to support the proper execution of evaluation loops inherent in verifying cyber defence tools, which typically start with the discovery of potential threats/risks in cyberspace, their propagation to the mission domain and the suggestion of the best suitable countermeasures in support of a Security Operation Centre (SOC). With this in mind, it is possible to state that the following hypotheses have been assumed:Null Hypothesis 0):: to produce samples interoperable with other cyber situational awareness acquisition tools, which was achieved by taking advantage of standardised data models and comprehensible documentation; (2) to simulate mission activities that complement the CIS-level observations; (3) to develop different and heterogeneous scenarios.The background synthetic activities on the CYSAS-S3 dataset do not enforce non-stationarity. This property may occur (or not) based on the activities conducted by artificial neutral agents deployed through the execution environment. As it has been deduced in a posteriori analysis, some samples present this property, and others do not.Non-pre-processing actions have been performed on the gathered information. Since CSA-related solutions should be able to operate on raw data collected from a real monitoring environment, it was assumed that all filtering, rectification, padding insertions, etc., should be conducted by the capabilities to be evaluated.It was assumed that the COTS solutions engaged in the CYSAS-S3 dataset generation process operate as expected. This includes the validity of the logs, events and alerts reported by such solutions.Attack scenarios expect a Cyber Situational Awareness System (CYSAS) to access data sources by means of the configured connectors to derive data observation features and characteristics of a cyber attack. Information needed for assessing CYSAS and its development or refinement should be extracted, in general, from: (1) network and host security sensors and devices; (2) system logs, proxy logs, network traces, and flows; (3) repositories that provide structured cybersecurity information. The following additional statements have been assumed by design:The large volume of network activities generated per scenario makes generating large datasets using PCAP files practically unfeasible in terms of manageability, so aggregated information has been presented via CSV files.Great diversity and heterogeneity of artificial neutral behaviours serving as the background of the attack scenarios may lead to human misunderstandings of the validation results. The in-depth analysis of the impact of the procedurally generated contents entails a complex task beyond the scope of this publication.During the execution of Scenario 3, the credential theft process required that users manually identify the windows machine with a username and password, which has made it unfeasible to automate this task, thus limiting the number of samples obtained and adding complexity to the dataset generation process .In some cases, the execution of all the automatic tasks of collection and processing of logs by the orchestration component of the Cyber Range platform  produced undesired effects on the “homogeneity” of the datasets, for example, by adding unwanted statistical variations. Although they have been detected and corrected, it is possible to assume that they may be not perfectly cured, so the project team decided to provide the resulting CYSAS-S3 dataset raw, thus allowing the testing and validation of data preprocessing functions able to sanitize them.As a first research iteration, and bearing in mind that real users were not involved during the experimentation, privacy was not taken into consideration. The future addition of real users may rely on tools similar to those surveyed in .The following limitations have been identified through the conducted research activities:A pure virtual environment shall be deployed where physical devices are emulated.Benign traffic generation should be limited to the minimum needed to support malicious scenarios while resembling a realistic neutral background procedurally generated.In order to leave the network scenario free from any interference in testing sessions, every scenario shall be executed in isolation in regards to each other, and without external internet connectivity. Thus, every contribution that is expected to be given from external events shall be simulated/emulated within the testbed platform.The testbed and sandboxing platforms should be totally virtualised, so there will be no external specific devices not contemplated by the expert operators.Network-based and local-based data feeds shall be procedurally generated. However, they must resemble real neutral activities and information exchanges, so they will have to make sense and not be random byte exchanges .OSI Layer 2, 3 and 4 configurations should be allowed in the shake of flexibility. Layer 1 interactions may be emulated, while 4+ Layer information will be complemented by that provided by each network node .Each decision-making and actuation capability must be preliminarily agreed, and properly documented, so each possible deviation of the unadulterated situation flow can be considered by post-execution analysis and research.The evaluation of the effectiveness of cyber defence tools shall be realised by stressing the assets  that must be protected against general or specific potential cyber threat situations. This requires their operability in a separated and dedicated emulation/simulation environment and under safe and isolated conditions . Prompted by the virtualization paradigm, each virtual machine or network shall keep the vulnerabilities, services and applications observable in the real analogous environment, producing similar behaviour according to a suitable degree of affinity. Based on this, the following specific assumptions and limitations apply to the platform, testbeds and sandboxing capabilities able to hold the execution of the designed neutral and threat situations:As commented in the section above, instead of generating workloads using a network environment created specifically for this purpose, it is possible to obtain publicly available traces that are intended for use in research. For example, in , it is pactivities both at the network level and on the different hosts interacting in each scenario. This collection of traces combines malicious and benign content with the different cyber kill chains executed on a benign base context.CYSAS-S3 is one of the few datasets that combine Realistic category.As stated in , the traanonymised.Since the entire execution has been carried out in a sandbox provided by Indra’s Cyber Range, the traces have not been Metadata.Like much of the state-of-the-art, CYSAS-S3 provides a large amount of Mission (operation line) traces dependent on the above domains [Among the different collections surveyed, CYSAS-S3 is the only one that combines host, network and  domains .Kill-Chains are clearly visible;CYSAS-S3 is the only one in which the cyber Based on the type of activities contained:In order to produce CIS-level observations on the CYSAS-S3 dataset, three different scenarios have been designed and implemented, which are meant to suffer a variety of attacks that an Advanced Persistent Threat (APT) or similar cyber antagonist  would perform against a certain target infrastructure . The behTailoring to the Assumed Infrastructural ConstraintsThe CIS-level part of the CYSAS-S3 dataset was generated, as illustrated in Design and deployment of the virtual environment on the assigned hardware.Setup a cloud based on the physical infrastructure, select cloud management platforms, and design and deploy the virtual communication infrastructure.Maintain a data and metadata (template) repository, a physical area where templates are stored so that they can be easily browsed and recalled by virtual machines.Connect virtual machines to virtual networks via virtual network interfaces and define virtual routers and switches, modules running on nodes maintaining routing tables and MAC addresses database.An emulation environment provided the space for the controllable scenarios; it was used in order to generate the complex cyber-attacks and data necessary for the development, verification and validation of the software modules and algorithms used by the system. The following conditions were applied to the virtual environment infrastructure:Create the testbed configuration and metadata needed to deploy the virtual network: network and vulnerability inventories, and communication rules. Create the logic schema of the network infrastructure of the network (layers 2 and 3); that is, how many subnetworks it is composed of, how they are separated using network devices , as well as the presence of firewalls and their relative configuration rules.Identify the computer hosts deployed in the network and their operating systems.Determine what services are running on the network host and understand the hosts’ exposed vulnerability surface.The scenario is the virtual operating environment that includes networks, hardware, software and their behaviour during test sessions. The platform to be deployed aims to stage scenarios that meet the evaluation requirements. In the logical representation of components of Define the virtual network with minimal complexity to facilitate PCAP analysis.No layer 2 protocol other than ethernet was used for tagging or for encapsulation.IP was the only layer 3 protocol used, and layer 4 communications were encapsulated either over TCP or UDP.All ICMP communications were also allowed.The following conditions were applied in the virtual network design stage:Allows the procedural generation of real cyber operational environments with integrated CIS systems and replicas of real assets.Allows the instantiation and/or integration of cyber-physical systems .Provides education and training services aiming to prepare cyber workforces under competitive and collaborative exercises.The fictitious scenarios implemented share a common network topology and base infrastructure, being deployed at the Cyber Range Lab of the Indra Cyber Range Platform (ICR) . On the The neutral and malicious activities were generated driven by its STAN  ICR component. Note that although STAN was born conceptually with the aim of serving as a system for modelling adverse behaviours driven by Behavioural Trees, its evolution within the Cyber Range platform has led it to become a central component as a tool for modelling any type of behaviour, deployment and even checking the achievement of objectives and communication with the back-end systems that record them during Cyber Defence Exercises (CDX). The project team defined an internal network, according to Real hosts interoperate with real networks.Real attacks are executed against them.Real sensors (both host and network-level) were deployed logically isolated from the scenario, so that the measurement does not interfere with either legitimate base activity or offensive chains.The benign activity at the host level was generated by the ICR’s component STAN , which was based on replicating real actors in real operational environments. Network activities were not simulated, but they were the results of the interaction between synthetic host nodes.At this point, it is important to remark that the CYSAS-S3 dataset was collected on a sandbox built on ICR, which enables the possibility of deploying hundreds of virtual nodes where:During this scenario, a conventional APT drives hostile activities, where the objective is the exfiltration of sensitive documents from a company. The attacker, after collecting information about the target company, identifies some IP addresses related to it. Then it scans IP addresses to detect the exposed services, and the attacker prepares and configures some tools to carry out the attack. Before exploiting the vulnerability on the File Server, the attacker generates background noise by making a scan on the Web Server and a DOS-like attack on it. Finally, the attacker exploits the EternalBlue (CVE-2017-0144) vulnerability on the File Server: the attacker creates a Reverse Shell on the server, and it exfiltrates sensitive data. phase 0, which occurs once the scenario execution starts. This phase indicates that the attacker has not yet taken any action and is thus why tools, actions and commands are not applicable.Note that the cyber kill chain in all attack scenarios has a preliminary In this scenario, the adversary launches a Denial of Service (DoS) attack by taking advantage of the exploitation script (Slow Loris) against an Apache webserver vulnerable to CVE-2007-6750. This attack generates a certain number of requests that collapse the web server just by exhausting its threat pool for incoming petitions, rendering the server useless until the attack stops. Overall, this is a very economical scenario from the point of view of effort since it does not require excessively high bandwidth and the attacker only needs to compromise a single machine for success. It is especially dangerous since a vulnerable web server may become totally unavailable. The attacker does not need a large infrastructure since the attack is performed using very low bandwidth and only one compromised machine. The attack seeks to render the target’s exposed services unavailable. The attackers use OSINT techniques to find the webserver’s IP address. Then Slow Loris is launched to bring the server out of service. Curl against the target may be triggered in order to check the server’s lack of response. During this adversarial scenario, the intruder has the objective of making the target computer unusable at the same time that the user credentials are stolen. The scenario depicts a joint attack made by a phishing email in which there is a malicious link and a malicious attachment driven by spear phishing tactics. The malicious link will be downloaded and obfuscated via a Meterpreter reverse shell. This reverse shell provided a remote Command and Control (C&C) service ready to listen for incoming connections. Once the connection has been established , the C&C will receive a reverse shell connection, consequently starting the post-exploitation modules of Mimikatz and Chrome gathering for retrieving plain credentials. After the completion of those actions, the malicious service will upload Ryuk ransomware into the victim’s machine and execute it. An overall CSV file that describes per timestamp, the events, registers, and alerts monitored, including the step of the cyber kill chain from which the observation belongs and metadata related to the configuration of the hostile activity orchestrator (the Indra’s Cyber Range STAN component).A PCAP file that packs all the network traces collected within the attack scenario.Reports from NIDS (Suricata) and HIDS (OSSEC) deployed through the synthetic operational environment.Periodic logs of syscalls, registers, privilege gain attempts, etc., reported by winlogbeat Sysmon on the different machines.Several attacks have been performed according to the APT explained in the previous sections. After successive debugging of the activity, the following samples were obtained: 108 from the first scenario, 47 from the second one, and 29 from the last one. Each run is packaged within a single csv in which all entries share the timestamp format that marks the run time. The fields of each one of the different beats in charge of processing and feeding the information into the database have been respected, which, although it complicates the reading of the CYSAS-S3 dataset, facilitates its ingestion by automatic tools. Therefore, each sample of the datasets represents a scenario execution and comprises the following information concerning the observed related indicators:The following describes the most important contents of the different datasets when it comes to identifying the central points that allow the identification of the different links in the killing chain for each defined APT. The associated raw monitored traffic traces have also been collected and packed as PCAP files, so future research may arrange both summarised and large raw registrations. Events captured by the Suricata network probe are mostly traffic flows generated during the scenario execution; they will fall in the module Suricata, category network_traffic and the Suricata event dataset. A typical entry contains the fields indicated in The specific OSSEC information is stored beside the aforementioned message field in the input field (type: log) and log field . The host file contains information related to the system that has generated the alert, and in the agent field, the most relevant of this type are shown: filebeat (showing that the filebeat has been used to send the entry to the ELK server). The winlogbeat entries, which send the Sysmon windows events to the ELK server, can be easily identified by the field type: “winlogbeat” and the hostname: “Fileserver” in the agent column of the csv file. If the event column of the csv information related to the logged windows event can be found, the attributes indicated in The dataset shall be able to cover from the discovery of potential threats/attacks to the suggestion of the best suitable courses of action based on the context of ongoing/planned military missions . In order to support these validations, and beyond the scope of the existing state-of-the-art datasets and evaluation methodologies, mission-level reports of military operations have been synthetically simulated in parallel with the cyber-attack scenarios described in The mission-level CYSAS-S3 dataset synthesized all the simulation logs as CSV files. Each sample has its corresponding simulation log, which preserved the same name but included the prefix “_mia”. For example, the sample cysa_log_202-123616_0.csv corresponds with the simulation: log mia_cysa_log_202-123616_0.csv. Its entry into the mission logs is an observation (probe) reported by an active task. For example, if at the timestamp 2019-02-02T11:40:33Z are two tasks in progress, then two new log entries will be created, each one corresponding to the mission-level metrics corresponding to such task. Finally, it is important to remark that attacks occur only at the CIS level. The mission runs in parallel to the attack, so attacks will impact the cyber assets required for each phase of the mission. The triggering of the cyber kill chain has been randomised so that in each executed mission, attacks will hit different tasks leading to different types of propagations. Each sample will include the exact time at which each phase of the cyber kill chain was executed.As the task progresses, the exploitability scores AS and ACA tend to decrease as the opportunity for interference from a potential adversary runs out . OperatiAS and ACA will be correlated with DCIS. High dependence on CIS infrastructure increases the surface area for attacks, thus lowering the level of ability and resources required for exploitation.DCIS will also be highly correlated with TRD and CDA. It is safe to assume that a high dependency on CIS infrastructure is linked to a higher chance of collateral damage should this infrastructure be attacked .In order to simulate the evolution of the mission-level metrics as the mission progresses, the ISMG introduces pseudorandom mutations at each of its iterations. However, in order to make these mutations somehow realistic and coherent, simulation rules were implemented according to the following basic assumptions:Z. In this context, a scenario where there is no incident that significantly affects any of the mission tasks was assumed. This is a reasonable assumption since it was supposed that at each step of the mission, effective countermeasures are being put in place in response to any possible incoming attacks. Therefore, it was selected: The variation of these scores given the base scores is simulated as follows: for each metric , a base variation coefficient The last step before obtaining the final variation coefficients is to introduce the dependency between the DCIS metric and AS, ACA, CDA and TRD metrics. As the dependency between these metrics is direct, ISMG computed the final variation coefficient by multiplying the base coefficients with the DCIS base coefficient.The following are some recommendations for the adoption of the dataset in mission-focused evaluation methodologies. With this motivation, the authors suggest taking advantage of the existence of correlated information between cyberspace, threats, and missions as part of a complete analysis cycle; this may involve different artefacts for threat management.Since each attack step is properly labelled and distinguishable within the CYSAS-S3 dataset contents, an evaluation iteration  may be triggered per step of the registered cyber kill chains. The Evaluation Loop shall first allow the validation of the capabilities for perceiving and assessing CIS-level risks/threats in cyberspace, which are referred to as Dynamic cyber Risk Assessment (DRA) tools. Then, the functionalities able to infer the propagation of such incidents and observations to the mission domain are analysed, including the identification of mission-level risks/threats, being referred to as Mission Impact Assessment (MIA) tools. In the next stage, the capabilities for identifying, selecting, planning and transposing the consequent courses of action from the mission plane to the cyber domain (countermeasures) shall be evaluated, being referred to as Risk Management tools. All this information must be able to facilitate that users acquire awareness about the operational picture, which, as a next evaluation stage, shall be studied via analysing biometric and cognitive traits. In order to ensure the applicability of the solution, as a final stage, user acceptance shall be measured by direct querying. The evaluation tests  may be conducted before, during or at the end of the Evaluation Loop.The presented research described CYSAS-S3, a dataset designed and built serving the purpose of supporting the calibration, training and evaluation of cyber defence tools. The subject of the conducted efforts faced an unprecedented problem in the state-of-the-art, which is being able to connect in a hyperrealist simulated environment, the impact of real cyber attacks (executed as kill chains of APTs during cyber manoeuvre) on the cybernetic assets that enable the capabilities needed for success on a mission. The datasets connect cyber situations with the effects on each mission’s task, objectives, etc. Each cyber attack described a complete kill chain.The results rejected the null hypothesis adopted when defining its design principles, making the alternative hypothesis valid: thus, it is possible to infer such a dataset from different fictitious attack scenarios. Beyond the scope of this paper, further details were documented, including usage guidelines, more in-depth analytics, etc. The CYSAS-S3 dataset combined cyber defence traits with mission simulations, so it is possible to assess from them the effectiveness of cyber defence tools capable of inferring both vertical and horizontal propagations between cyberspace and ongoing/planned military operations (specific objective 2).Include more varied tactics, techniques, and procedures (TTP), as well as alternative cyber kill chains. Explore promising concepts that embrace adversarial thinking, as is the case of the MITRE Engage taxonomy or related ones.Experiment with new mission types and include native military elements such as: decisive conditions, interdependence between lines of operation, centres of gravity, etc.Generate samples with different profiles, both on the attacker side and on the side of the benign user operating the system. Some parameters could regulate aspects such as initiative, predictability, stress level, etc.The CYSAS-S3 dataset comprised three APT-related simulated scenarios able to complement each other, exploring the heterogeneity between different cyber kill chains (specific objective 3). The presented research may be expanded by further analytic actions. They include, among others, the study of the impact of the procedurally generated activities  on the cyber defence tools target of evaluation, a wider description of the fictitious attack scenarios implemented  or additional details of the supportive infrastructure . Potential future research steps may explore alternative simulated attack scenarios and simulated joint missions, where the impact of cyber threats/risks could be propagated to other domains  and even to hybrid conflict situations . Other interesting research lines come from the following challenges: