A Grammatical Inference Approach to Language-Based Anomaly Detection in XML

False-positives are a problem in anomaly-based intrusion detection systems. To counter this issue, we discuss anomaly detection for the eXtensible Markup Language (XML) in a language-theoretic view. We argue that many XML-based attacks target the syntactic level, i.e. the tree structure or element content, and syntax validation of XML documents reduces the attack surface. XML offers so-called schemas for validation, but in real world, schemas are often unavailable, ignored or too general. In this work-in-progress paper we describe a grammatical inference approach to learn an automaton from example XML documents for detecting documents with anomalous syntax. We discuss properties and expressiveness of XML to understand limits of learnability. Our contributions are an XML Schema compatible lexical datatype system to abstract content in XML and an algorithm to learn visibly pushdown automata (VPA) directly from a set of examples. The proposed algorithm does not require the tree representation of XML, so it can process large documents or streams. The resulting deterministic VPA then allows stream validation of documents to recognize deviations in the underlying tree structure or datatypes.Comment: Paper accepted at First Int. Workshop on Emerging Cyberthreats and Countermeasures ECTCM 201

Towards an approach for analysing external representations created during sensemaking using generative grammar

During sensemaking, users often create external representations to help them make sense of what they know, and what they need to know. In doing so, they necessarily adopt or construct some form of representational language using the tools at hand. By describing such languages implicit in representations we believe that we are better able to describe and differentiate what users do and better able to describe and differentiate interfaces that might support them. Drawing on approaches to the analysis of language, and in particular, Mann and Thompson’s Rhetorical Structure Theory, we analyse the representations that users create to expose their underlying ‘visual grammar’. We do this in the context of a user study involving evidential reasoning. Participants were asked to address an adapted version of IEEE VAST 2011 mini challenge 3 (interpret a potential terrorist plot implicit in a set of news reports). We show how our approach enables the unpacking of the heterogeneous and embedded nature of user-generated representations and allows us to show how visual grammars evolve and become more complex over time in response to evolving sensemaking needs

Hipster: Integrating Theory Exploration in a Proof Assistant

This paper describes Hipster, a system integrating theory exploration with the proof assistant Isabelle/HOL. Theory exploration is a technique for automatically discovering new interesting lemmas in a given theory development. Hipster can be used in two main modes. The first is exploratory mode, used for automatically generating basic lemmas about a given set of datatypes and functions in a new theory development. The second is proof mode, used in a particular proof attempt, trying to discover the missing lemmas which would allow the current goal to be proved. Hipster's proof mode complements and boosts existing proof automation techniques that rely on automatically selecting existing lemmas, by inventing new lemmas that need induction to be proved. We show example uses of both modes

Discovering Restricted Regular Expressions with Interleaving

Discovering a concise schema from given XML documents is an important problem in XML applications. In this paper, we focus on the problem of learning an unordered schema from a given set of XML examples, which is actually a problem of learning a restricted regular expression with interleaving using positive example strings. Schemas with interleaving could present meaningful knowledge that cannot be disclosed by previous inference techniques. Moreover, inference of the minimal schema with interleaving is challenging. The problem of finding a minimal schema with interleaving is shown to be NP-hard. Therefore, we develop an approximation algorithm and a heuristic solution to tackle the problem using techniques different from known inference algorithms. We do experiments on real-world data sets to demonstrate the effectiveness of our approaches. Our heuristic algorithm is shown to produce results that are very close to optimal.Comment: 12 page

Ubiquitination and sumoylation of the HTLV-2 Tax-2B protein regulate its NF-κB activity: a comparative study with the HTLV-1 Tax-1 protein.

BACKGROUND:Retroviruses HTLV-1 and HTLV-2 have homologous genomic structures but differ significantly in pathogenicity. HTLV-1 is associated with Adult T cell Leukemia (ATL), whereas infection by HTLV-2 has no association with neoplasia. Transformation of T lymphocytes by HTLV-1 is linked to the capacity of its oncoprotein Tax-1 to alter cell survival and cell cycle control mechanisms. Among these functions, Tax-1-mediated activation of cellular gene expression via the NF-κB pathway depends on Tax-1 post-translational modifications by ubiquitination and sumoylation. The Tax-2 protein of HTLV-2B (Tax-2B) is also modified by ubiquitination and sumoylation and activates the NF-κB pathway to a level similar to that of Tax-1. The present study aims to understand whether ubiquitination and sumoylation modifications are involved in Tax-2B-mediated activation of the NF-κB pathway.RESULTS:The comparison of Tax-1 and Tax-2B lysine to arginine substitution mutants revealed conserved patterns and levels of ubiquitination with notable difference in the lysine usage for sumoylation. Neither Tax-1 nor Tax-2B ubiquitination and sumoylation deficient mutants could activate the NF-κB pathway and fusion of ubiquitin or SUMO-1 to the C-terminus of the ubiquitination and sumoylation deficient Tax-2B mutant strikingly restored transcriptional activity. In addition, ubiquitinated forms of Tax-2B colocalized with RelA and IKKγ in prominent cytoplasmic structures associated with the Golgi apparatus, whereas colocalization of Tax-2B with the RelA subunit of NF-κB and the transcriptional coactivator p300 in punctate nuclear structures was dependent on Tax-2B sumoylation, as previously observed for Tax-1.CONCLUSIONS:Both Tax-1 and Tax-2 activate the NF-κB pathway via similar mechanisms involving ubiquitination and sumoylation. Therefore, the different transforming potential of HTLV-1 and HTLV-2 is unlikely to be related to different modes of activation of the canonical NF-κB pathway

Deletion of a Single beta-Catenin Allele in Osteocytes Abolishes the Bone Anabolic Response to Loading

The Wnt/β-catenin signaling pathway is essential for bone cell viability and function and for skeletal integrity. To determine if β-catenin in osteocytes plays a role in the bone anabolic response to mechanical loading, 18- to 24-week-old osteocyte β-catenin haploinsufficient mice (Dmp1-Cre × β-catenin fl/ + ; HET cKO) were compared with their β-catenin fl/fl (control) littermates. Trabecular bone volume (BV/TV) was significantly less (58.3%) in HET cKO females versus controls, whereas male HET cKO and control mice were not significantly different. Trabecular number was significantly less in HET cKO mice compared with controls for both genders, and trabecular separation was greater in female HET cKO mice. Osteoclast surface was significantly greater in female HET cKO mice. Cortical bone parameters in males and females showed subtle or no differences between HET cKO and controls. The right ulnas were loaded in vivo at 100 cycles, 2 Hz, 2500 µϵ, 3 days per week for 3 weeks, and the left ulnas served as nonloaded controls. Calcein and alizarin complexone dihydrate were injected 10 days and 3 days before euthanization, respectively. Micro-computed tomography (µCT) analysis detected an 8.7% and 7.1% increase in cortical thickness in the loaded right ulnas of male and female control mice, respectively, compared with their nonloaded left ulnas. No significant increase in new cortical bone formation was observed in the HET cKO mice. Histomorphometric analysis of control mice showed a significant increase in endocortical and periosteal mineral apposition rate (MAR), bone-formation rate/bone surface (BFR/BS), BFR/BV, and BFR/TV in response to loading, but no significant increases were detected in the loaded HET cKO mice. These data show that deleting a single copy of β-catenin in osteocytes abolishes the anabolic response to loading, that trabecular bone in females is more severely affected and suggest that a critical threshold of β-catenin is required for bone formation in response to mechanical loading

Move or Die: the Fate of the Tax Oncoprotein of HTLV-1

The HTLV-1 Tax protein both activates viral replication and is involved in HTLV-1-mediated transformation of T lymphocytes. The transforming properties of Tax include altering the expression of select cellular genes via activation of cellular pathways and perturbation of both cell cycle control mechanisms and apoptotic signals. The recent discovery that Tax undergoes a hierarchical sequence of posttranslational modifications that control its intracellular localization provides provocative insights into the mechanisms regulating Tax transcriptional and transforming activities

ArguBlogging:an application for the Argument Web

In this paper, we present a software tool for ‘ArguBlogging’, which allows users to construct debate and discussions across blogs, linking existing and new online resources to form distributed, structured conversations. Arguments and counterarguments can be posed by giving opinions on one’s own blog and replying to other bloggers’ posts. The resulting argument structure is connected to the Argument Web, in which argumentative structures are made semantically explicit and machine-processable. We discuss the ArguBlogging tool and the underlying infrastructure and ontology of the Argument Web

On Incomplete XML Documents with Integrity Constraints

Abstract. We consider incomplete specifications of XML documents in the presence of schema information and integrity constraints. We show that integrity constraints such as keys and foreign keys affect consistency of such specifications. We prove that the consistency problem for incomplete specifications with keys and foreign keys can always be solved in NP. We then show a dichotomy result, classifying the complexity of the problem as NP-complete or PTIME, depending on the precise set of features used in incomplete descriptions.