Malware in the Future? Forecasting of Analyst Detection of Cyber Events

There have been extensive efforts in government, academia, and industry to anticipate, forecast, and mitigate cyber attacks. A common approach is time-series forecasting of cyber attacks based on data from network telescopes, honeypots, and automated intrusion detection/prevention systems. This research has uncovered key insights such as systematicity in cyber attacks. Here, we propose an alternate perspective of this problem by performing forecasting of attacks that are analyst-detected and -verified occurrences of malware. We call these instances of malware cyber event data. Specifically, our dataset was analyst-detected incidents from a large operational Computer Security Service Provider (CSSP) for the U.S. Department of Defense, which rarely relies only on automated systems. Our data set consists of weekly counts of cyber events over approximately seven years. Since all cyber events were validated by analysts, our dataset is unlikely to have false positives which are often endemic in other sources of data. Further, the higher-quality data could be used for a number for resource allocation, estimation of security resources, and the development of effective risk-management strategies. We used a Bayesian State Space Model for forecasting and found that events one week ahead could be predicted. To quantify bursts, we used a Markov model. Our findings of systematicity in analyst-detected cyber attacks are consistent with previous work using other sources. The advanced information provided by a forecast may help with threat awareness by providing a probable value and range for future cyber events one week ahead. Other potential applications for cyber event forecasting include proactive allocation of resources and capabilities for cyber defense (e.g., analyst staffing and sensor configuration) in CSSPs. Enhanced threat awareness may improve cybersecurity.Comment: Revised version resubmitted to journa

Patient-Specific Injury Metrics Predict Early Biomarker Response in Multiply Injured Patients

poster abstractIntroduction: It is important to identify multiply injured patients (MIPs) that can tolerate high-magnitude procedures and those at risk for complications. Determining how injury leads to immunologic dysfunction could identify MIPs at risk for complications. We explored a new precision medicine approach in which we determined how patientspecific injury metrics corresponded to changes in cytokines in a prospective cohort of MIPs. Methods: This was a prospective observational cohort of 40 MIPs, 18-55 yo, admitted to surgical ICU having had full axial CTs done at admission. Mechanical tissue damage was quantified by calculating volumetric measures of injuries from CT scans into the Tissue Damage Volume score (TDV). Ischemic tissue damage was calculated by calculation of all abnormal Shock Volumes (SV) (heart rate/systolic blood pressure > 0.9) in the first 24hr after injury. TIMS was calculated by combining mechanical and ischemic tissue damage: TIMS = TDV+5*SV. Linear regression was performed between TIMS and 21 cytokines including interleukin (IL)-6; IL-8; IL-10; IL-1RA; IL-2RA; MCP-1 drawn at 0hr, 8hr, and 24hr after injury. Linear regression was also performed between the cytokines, Injury Severity Score (ISS) and minimum pH (day 1). Results: Mean and median ISS was 29 (range 9 – 66). Minimum pH demonstrated best correspondence to cytokine levels measured 0hr and 8hr after injury. TIMS demonstrated the best correspondence to cytokine levels 24hr after injury. ISS demonstrated minimal predictive value of cytokines at any timepoint. Discussion: A precision medicine approach using a patient-specific quantity of injury predicted trauma-associated changes in circulating cytokines at 0hr, 8 hr, and 24 hr after surgery. This corresponds favorably with timing of orthopaedic surgical decisions regarding staged fracture interventions. While clinical significance of these findings is unknown, computational data analyses of temporal cytokine changes have been shown to be predictive of adverse outcomes after injury

SHERLOCK: Experimental evaluation of a conversational agent for mobile information tasks

Abstract—Controlled Natural Language (CNL) has great potential to support human-machine interaction (HMI) because it provides an information representation that is both human readable and machine processable.We investigated the effectiveness of a CNL-based conversational interface for HMI in a behavioural experiment called Simple Human Experiment Regarding Locally Observed Collective Knowledge (SHERLOCK). In SHERLOCK, individuals acted in groups to discover and report information to the machine using natural language (NL), which the machine then processed into CNL. The machine fused responses from different users to form a common operating picture, a dashboard showing the level of agreement for distinct information. To obtain information to add to this dashboard, users explored the real world in a simulated crowd-sourced sensing scenario. This scenario represented a simplified, controlled analogue for tactical intelligence (i.e., direct intelligence of the environment), which is key for rapidly planning military, law enforcement, and emergency operations. Overall, despite close to zero training, 74% of the users inputted NL that was machine interpretable and addressed the assigned tasks. An experimental manipulation aimed to increase user-machine interaction, however, did not improve performance as hypothesised. Nevertheless, results indicate the conversational interface may be effective in assisting humans with collection and fusion of information in a crowd-sourcing context

Harnessing RNA sequencing for global, unbiased evaluation of two new adjuvants for dendritic-cell immunotherapy

Effective stimulation of immune cells is crucial for the success of cancer immunotherapies. Current approaches to evaluate the efficiency of stimuli are mainly defined by known flow cytometry-based cell activation or cell maturation markers. This method however does not give a complete overview of the achieved activation state and may leave important side effects unnoticed. Here, we used an unbiased RNA sequencing (RNA-seq)-based approach to compare the capacity of four clinical-grade dendritic cell (DC) activation stimuli used to prepare DC-vaccines composed of various types of DC subsets; the already clinically applied GM-CSF and Frühsommer meningoencephalitis (FSME) prophylactic vaccine and the novel clinical grade adjuvants protamine-RNA complexes (pRNA) and CpG-P. We found that GM-CSF and pRNA had similar effects on their target cells, whereas pRNA and CpG-P induced stronger type I interferon (IFN) expression than FSME. In general, the pathways most affected by all stimuli were related to immune activity and cell migration. GM-CSF stimulation, however, also induced a significant increase of genes related to nonsense-mediated decay, indicating a possible deleterious effect of this stimulus. Taken together, the two novel stimuli appear to be promising alternatives. Our study demonstrates how RNA-seq based investigation of changes in a large number of genes and gene groups can be exploited for fast and unbiased, global evaluation of clinical-grade stimuli, as opposed to the general limited evaluation of a pre-specified set of genes, by which one might miss important biological effects that are detrimental for vaccine efficacy

Harnessing RNA sequencing for global, unbiased evaluation of two new adjuvants for dendritic-cell immunotherapy

Effective stimulation of immune cells is crucial for the success of cancer immunotherapies. Current approaches to evaluate the efficiency of stimuli are mainly defined by known flow cytometry-based cell activation or cell maturation markers. This method however does not give a complete overview of the achieved activation state and may leave important side effects unnoticed. Here, we used an unbiased RNA sequencing (RNA-seq)-based approach to compare the capacity of four clinical-grade dendritic cell (DC) activation stimuli used to prepare DC-vaccines composed of various types of DC subsets; the already clinically applied GM-CSF and Frühsommer meningoencephalitis (FSME) prophylactic vaccine and the novel clinical grade adjuvants protamine-RNA complexes (pRNA) and CpG-P. We found that GM-CSF and pRNA had similar effects on their target cells, whereas pRNA and CpG-P induced stronger type I interferon (IFN) expression than FSME. In general, the pathways most affected by all stimuli were related to immune activity and cell migration. GMCSF stimulation, however, also induced a significant increase of genes related to nonsense-mediated decay, indicating a possible deleterious effect of this stimulus. Taken together, the two novel stimuli appear to be promising alternatives. Our study demonstrates how RNA-seq based investigation of changes in a large number of genes and gene groups can be exploited for fast and unbiased, global evaluation of clinicalgrade stimuli, as opposed to the general limited evaluation of a pre-specified set of genes, by which one might miss important biological effects that are detrimental for vaccine efficacy

The tumour microenvironment shapes dendritic cell plasticity in a human organotypic melanoma culture

Contains fulltext : 220729.pdf (publisher's version ) (Open Access)The tumour microenvironment (TME) forms a major obstacle in effective cancer treatment and for clinical success of immunotherapy. Conventional co-cultures have shed light onto multiple aspects of cancer immunobiology, but they are limited by the lack of physiological complexity. We develop a human organotypic skin melanoma culture (OMC) that allows real-time study of host-malignant cell interactions within a multicellular tissue architecture. By co-culturing decellularized dermis with keratinocytes, fibroblasts and immune cells in the presence of melanoma cells, we generate a reconstructed TME that closely resembles tumour growth as observed in human lesions and supports cell survival and function. We demonstrate that the OMC is suitable and outperforms conventional 2D co-cultures for the study of TME-imprinting mechanisms. Within the OMC, we observe the tumour-driven conversion of cDC2s into CD14(+) DCs, characterized by an immunosuppressive phenotype. The OMC provides a valuable approach to study how a TME affects the immune system

A Comparative Study of the T Cell Stimulatory and Polarizing Capacity of Human Primary Blood Dendritic Cell Subsets

Dendritic cells (DCs) are central players of immune responses; they become activated upon infection or inflammation and migrate to lymph nodes, where they can initiate an antigen-specific immune response by activating naive T cells. Two major types of naturally occurring DCs circulate in peripheral blood, namely, myeloid and plasmacytoid DCs (pDCs). Myeloid DCs (mDCs) can be subdivided based on the expression of either CD1c or CD141. These human DC subsets differ in surface marker expression, Toll-like receptor (TLR) repertoire, and transcriptional profile, suggesting functional differences between them. Here, we directly compared the capacity of human blood mDCs and pDCs to activate and polarize CD4 + T cells. CD141 + mDCs show an overall more mature phenotype over CD1c + mDC and pDCs; they produce less IL-10 and more IL-12 than CD1c + mDCs. Despite these differences, all subsets can induce the production of IFN-in naive CD4 + T cells. CD1c + and CD141 + mDCs especially induce a strong T helper 1 profile. Importantly, naive CD4 + T cells are not polarized towards regulatory T cells by any subset. These findings further establish all three human blood DCs-despite their differences-as promising candidates for immunostimulatory effectors in cancer immunotherapy

Semaglutide and cardiovascular outcomes in patients with obesity and prevalent heart failure: a prespecified analysis of the SELECT trial

Background: Semaglutide, a GLP-1 receptor agonist, reduces the risk of major adverse cardiovascular events (MACE) in people with overweight or obesity, but the effects of this drug on outcomes in patients with atherosclerotic cardiovascular disease and heart failure are unknown. We report a prespecified analysis of the effect of once-weekly subcutaneous semaglutide 2·4 mg on ischaemic and heart failure cardiovascular outcomes. We aimed to investigate if semaglutide was beneficial in patients with atherosclerotic cardiovascular disease with a history of heart failure compared with placebo; if there was a difference in outcome in patients designated as having heart failure with preserved ejection fraction compared with heart failure with reduced ejection fraction; and if the efficacy and safety of semaglutide in patients with heart failure was related to baseline characteristics or subtype of heart failure. Methods: The SELECT trial was a randomised, double-blind, multicentre, placebo-controlled, event-driven phase 3 trial in 41 countries. Adults aged 45 years and older, with a BMI of 27 kg/m2 or greater and established cardiovascular disease were eligible for the study. Patients were randomly assigned (1:1) with a block size of four using an interactive web response system in a double-blind manner to escalating doses of once-weekly subcutaneous semaglutide over 16 weeks to a target dose of 2·4 mg, or placebo. In a prespecified analysis, we examined the effect of semaglutide compared with placebo in patients with and without a history of heart failure at enrolment, subclassified as heart failure with preserved ejection fraction, heart failure with reduced ejection fraction, or unclassified heart failure. Endpoints comprised MACE (a composite of non-fatal myocardial infarction, non-fatal stroke, and cardiovascular death); a composite heart failure outcome (cardiovascular death or hospitalisation or urgent hospital visit for heart failure); cardiovascular death; and all-cause death. The study is registered with ClinicalTrials.gov, NCT03574597. Findings: Between Oct 31, 2018, and March 31, 2021, 17 604 patients with a mean age of 61·6 years (SD 8·9) and a mean BMI of 33·4 kg/m2 (5·0) were randomly assigned to receive semaglutide (8803 [50·0%] patients) or placebo (8801 [50·0%] patients). 4286 (24·3%) of 17 604 patients had a history of investigator-defined heart failure at enrolment: 2273 (53·0%) of 4286 patients had heart failure with preserved ejection fraction, 1347 (31·4%) had heart failure with reduced ejection fraction, and 666 (15·5%) had unclassified heart failure. Baseline characteristics were similar between patients with and without heart failure. Patients with heart failure had a higher incidence of clinical events. Semaglutide improved all outcome measures in patients with heart failure at random assignment compared with those without heart failure (hazard ratio [HR] 0·72, 95% CI 0·60-0·87 for MACE; 0·79, 0·64-0·98 for the heart failure composite endpoint; 0·76, 0·59-0·97 for cardiovascular death; and 0·81, 0·66-1·00 for all-cause death; all pinteraction>0·19). Treatment with semaglutide resulted in improved outcomes in both the heart failure with reduced ejection fraction (HR 0·65, 95% CI 0·49-0·87 for MACE; 0·79, 0·58-1·08 for the composite heart failure endpoint) and heart failure with preserved ejection fraction groups (0·69, 0·51-0·91 for MACE; 0·75, 0·52-1·07 for the composite heart failure endpoint), although patients with heart failure with reduced ejection fraction had higher absolute event rates than those with heart failure with preserved ejection fraction. For MACE and the heart failure composite, there were no significant differences in benefits across baseline age, sex, BMI, New York Heart Association status, and diuretic use. Serious adverse events were less frequent with semaglutide versus placebo, regardless of heart failure subtype. Interpretation: In patients with atherosclerotic cardiovascular diease and overweight or obesity, treatment with semaglutide 2·4 mg reduced MACE and composite heart failure endpoints compared with placebo in those with and without clinical heart failure, regardless of heart failure subtype. Our findings could facilitate prescribing and result in improved clinical outcomes for this patient group. Funding: Novo Nordisk