Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Recent years have seen the rise of more sophisticated attacks including advanced persistent threats (APTs) which pose severe risks to organizations and governments by targeting confidential proprietary information. Additionally, new malware strains are appearing at a higher rate than ever before. Since many of these malware are designed to evade existing security products, traditional defenses deployed by most enterprises today, e.g., anti-virus, firewalls, intrusion detection systems, often fail at detecting infections at an early stage. We address the problem of detecting early-stage infection in an enterprise setting by proposing a new framework based on belief propagation inspired from graph theory. Belief propagation can be used either with "seeds" of compromised hosts or malicious domains (provided by the enterprise security operation center -- SOC) or without any seeds. In the latter case we develop a detector of C&C communication particularly tailored to enterprises which can detect a stealthy compromise of only a single host communicating with the C&C server. We demonstrate that our techniques perform well on detecting enterprise infections. We achieve high accuracy with low false detection and false negative rates on two months of anonymized DNS logs released by Los Alamos National Lab (LANL), which include APT infection attacks simulated by LANL domain experts. We also apply our algorithms to 38TB of real-world web proxy logs collected at the border of a large enterprise. Through careful manual investigation in collaboration with the enterprise SOC, we show that our techniques identified hundreds of malicious domains overlooked by state-of-the-art security products

Boosting Factual Consistency and High Coverage in Unsupervised Abstractive Summarization

Abstractive summarization has gained attention because of the positive performance of large-scale, pretrained language models. However, models may generate a summary that contains information different from the original document. This phenomenon is particularly critical under the abstractive methods and is known as factual inconsistency. This study proposes an unsupervised abstractive method for improving factual consistency and coverage by adopting reinforcement learning. The proposed framework includes (1) a novel design to maintain factual consistency with an automatic question-answering process between the generated summary and original document, and (2) a novel method of ranking keywords based on word dependency, where keywords are used to examine the coverage of the key information preserved in the summary. The experimental results show that the proposed method outperforms the reinforcement learning baseline on both the evaluations for factual consistency and coverage

Distributed Training Large-Scale Deep Architectures

Scale of data and scale of computation infrastructures together enable the current deep learning renaissance. However, training large-scale deep architectures demands both algorithmic improvement and careful system configuration. In this paper, we focus on employing the system approach to speed up large-scale training. Via lessons learned from our routine benchmarking effort, we first identify bottlenecks and overheads that hinter data parallelism. We then devise guidelines that help practitioners to configure an effective system and fine-tune parameters to achieve desired speedup. Specifically, we develop a procedure for setting minibatch size and choosing computation algorithms. We also derive lemmas for determining the quantity of key components such as the number of GPUs and parameter servers. Experiments and examples show that these guidelines help effectively speed up large-scale deep learning training

Psychometric evaluation of the Farsi version of the diabetes foot self-care bahavior scale

Background: Diabetes foot self-care is one of the self-management behaviors of diabetic patients leading to a reduction in the incidence of pressure ulcers and amputation. Having a valid, reliable, simple and comprehensive tool is essential in measuring the self-care behavior of diabetic patients. The aim of this study was to evaluate the psychometric properties of the Farsi version of the diabetes foot self-care bahavior scale (DFSBS) in Iran. Methods: In this cross-sectional and methodological study, 500 patients with type 2 diabetes were recruited by convenience sampling. Construct validity was assessed by exploratory factor analysis (over 300 patients) and confirmatory factor analysis (over 200 patients). Internal consistency was calculated by Cronbach’s alpha coefficient and its stability was calculated by intraclass correlation coefficient (ICC). Results: In the exploratory factor analysis, two self-care factors related to feet and shoes were extracted which had specific values of 38.49 and 1.24, respectively, and were able to account for 56.22% of the total self-care variance of diabetes foot. Confirmatory factor analysis had excellent fit model. The internal consistency and ICC of the whole instrument were 0.83 and 0.791 (95% CI: 0.575–0.925; P < 0.001), respectively. Conclusions: The Farsi version of DFSBS (F-DFSBS) has good validity and reliability, and due to its appropriate psychometric properties, this tool can be used in future studie

Long-term administration of olanzapine induces adiposity and increases hepatic fatty acid desaturation protein in female C57BL/6J mice

Objective(s): Weight gain and metabolic disturbances such as dyslipidemia, are frequent side effects of second-generation antipsychotics, including olanzapine. This study examined the metabolic effects of chronic olanzapine exposure. In addition, we investigated the hepatic fatty acid effects of olanzapine in female C57BL/6J mice fed a normal diet.Materials and Methods: Female C57BL/6J mice orally received olanzapine or normal saline for 7 weeks. The effects of long-term olanzapine exposure on body weight changes, food efficiency, blood glucose, triglyceride (TG), insulin, and leptin levels were observed. Hepatic TG and abdominal fat mass were investigated, and fat cell morphology was analyzed through histopathological methods. The levels of protein markers of fatty acid regulation in the liver, namely fatty acid synthase (FAS) and stearoyl-CoA desaturase-1 (SCD-1), were measured.Results: Olanzapine treatment increased the food intake of the mice as well as their body weight. Biochemical analyses showed that olanzapine increased blood TG, insulin, leptin, and hepatic TG. The olanzapine group exhibited increased abdominal fat mass and fat cell enlargement in abdominal fat tissue. Western blotting of the mouse liver revealed significantly higher (1.6-fold) levels of SCD-1 in the olanzapine group relative to the control group; by contrast, FAS levels in the two groups did not differ significantly.Conclusion: Enhanced lipogenesis triggered by increased hepatic SCD-1 activity might be a probable peripheral mechanism of olanzapine-induced dyslipidemia. Some adverse metabolic effects of olanzapine may be related to the disturbance of lipid homeostasis in the liver

Imaging of Renal Tuberculosis in Eastern Taiwan: Correlation with Clinical Course and Different Communities

Hualien, located in eastern Taiwan, is a relatively isolated district. The population is composed of different ethnic communities. Our hospital is the only medical center in eastern Taiwan, so is the most important referral hospital for epidemic diseases. After reviewing our collected cases of renal tuberculosis (TB), we observed a great diversity in staging and outcomes. The aim of this study was to classify different imaging presentations and clinical outcomes in the ethnic communities represented by these cases (non-aboriginal and aboriginal). We retrospectively reviewed 22 cases from 1991 to 2001. We reviewed laboratory data, radiologic reports, and clinical outcomes. Before TB was proved by biopsy or culture, patients were not treated with an anti-TB regimen. Roentgenography showed that 68% of patients had renal calcification, 59% had dilated calyces, 55% had lung involvement, and 41% had auto-nephrectomy. The proportion of mild and severe forms was significantly different between aboriginal and non-aboriginal groups (0.05 > p ≥ 0.00409). From this series, we recommend routine plain film roentgenography, including chest roentgenography and kidney, ureter, and bladder or abdominal roentgenography, followed by intravenous urography or computerized tomography as investigative tools for renal TB. Based on the significantly different outcomes of the disease between aboriginal and non-aboriginal groups, a stronger health education program for the isolated district in eastern Taiwan is necessary

Patients Infected with CRF07_BC Have Significantly Lower Viral Loads than Patients with HIV-1 Subtype B: Mechanism and Impact on Disease Progression

The circulating recombinant form (CRF) 07_BC is the most prevalent HIV-1 strain among injection drug users (IDUs) in Taiwan. It contains a 7 amino-acid deletion in its p6gag. We conducted a cohort study to compare viral loads and CD4 cell count changes between patients infected with subtype B and CRF07_BC and to elucidate its mechanism. Twenty-one patients infected with CRF07_BC and 59 patients with subtype B were selected from a cohort of 667 HIV-1/AIDS patients whom have been followed up for 3 years. Generalized estimated equation was used to analyze their clinical data and the results showed that patients infected with CRF07_BC had significantly lower viral loads (about 58,000 copies per ml less) than patients with subtype B infection (p = 0.002). The replicative capacity of nine CRF07_BC and four subtype B isolates were compared and the results showed that the former had significantly lower replicative capacity than the latter although all of them were CCR5- tropic and non-syncytium inducing viruses. An HIV-1-NL4-3 mutant virus which contains a 7 amino-acid deletion in p6gag (designated as 7d virus) was generated and its live cycle was investigated. The results showed that 7d virus had significantly lower replication capacity, poorer protease-mediated processing and viral proteins production. Electron microscopic examination of cells infected with wild-type or 7d virus demonstrated that the 7d virus had poorer and slower viral maturation processes: more viruses attached to the cell membrane and higher proportion of immature virions outside the cells. The interaction between p6gag and Alix protein was less efficient in cells infected with 7d virus. In conclusion, patients infected with CRF07_BC had significantly lower viral loads than patients infected with subtype B and it may due to the deletion of 7 amino acids which overlaps with Alix protein-binding domain of the p6gag

Low Cost Seismic Network Practical Applications for Producing Quick Shaking Maps in Taiwan

Two major earthquakes of ML greater than 6.0 occurred in Taiwan in the first half of 2013. The vibrant shaking brought landslides, falling rocks and casualties. This paper presents a seismic network developed by National Taiwan University (NTU) with 401 Micro-Electro Mechanical System (MEMS) accelerators. The network recorded high quality strong motion signals from the two events and produced delicate shaking maps within one minute after the earthquake occurrence. The high shaking regions of the intensity map produced by the NTU system suggest damage and casualty locations. Equipped with a dense array of MEMS accelerometers, the NTU system is able to accommodate 10% signals loss from part of the seismic stations and maintain its normal functions for producing shaking maps. The system also has the potential to identify the rupture direction which is one of the key indices used to estimate possible damage. The low cost MEMS accelerator array shows its potential in real-time earthquake shaking map generation and damage avoidance