Detecting and characterizing lateral phishing at scale

We present the first large-scale characterization of lateral phishing attacks, based on a dataset of 113 million employee-sent emails from 92 enterprise organizations. In a lateral phishing attack, adversaries leverage a compromised enterprise account to send phishing emails to other users, benefit-ting from both the implicit trust and the information in the hijacked user's account. We develop a classifier that finds hundreds of real-world lateral phishing emails, while generating under four false positives per every one-million employee-sent emails. Drawing on the attacks we detect, as well as a corpus of user-reported incidents, we quantify the scale of lateral phishing, identify several thematic content and recipient targeting strategies that attackers follow, illuminate two types of sophisticated behaviors that attackers exhibit, and estimate the success rate of these attacks. Collectively, these results expand our mental models of the 'enterprise attacker' and shed light on the current state of enterprise phishing attacks

Fast and Compact Distributed Verification and Self-Stabilization of a DFS Tree

We present algorithms for distributed verification and silent-stabilization of a DFS(Depth First Search) spanning tree of a connected network. Computing and maintaining such a DFS tree is an important task, e.g., for constructing efficient routing schemes. Our algorithm improves upon previous work in various ways. Comparable previous work has space and time complexities of $O(n\log \Delta)$ bits per node and $O(nD)$ respectively, where $\Delta$ is the highest degree of a node, $n$ is the number of nodes and $D$ is the diameter of the network. In contrast, our algorithm has a space complexity of $O(\log n)$ bits per node, which is optimal for silent-stabilizing spanning trees and runs in $O(n)$ time. In addition, our solution is modular since it utilizes the distributed verification algorithm as an independent subtask of the overall solution. It is possible to use the verification algorithm as a stand alone task or as a subtask in another algorithm. To demonstrate the simplicity of constructing efficient DFS algorithms using the modular approach, We also present a (non-sielnt) self-stabilizing DFS token circulation algorithm for general networks based on our silent-stabilizing DFS tree. The complexities of this token circulation algorithm are comparable to the known ones

Transform-domain analysis of packet delay in network nodes with QoS-aware scheduling

In order to differentiate the perceived QoS between traffic classes in heterogeneous packet networks, equipment discriminates incoming packets based on their class, particularly in the way queued packets are scheduled for further transmission. We review a common stochastic modelling framework in which scheduling mechanisms can be evaluated, especially with regard to the resulting per-class delay distribution. For this, a discrete-time single-server queue is considered with two classes of packet arrivals, either delay-sensitive (1) or delay-tolerant (2). The steady-state analysis relies on the use of well-chosen supplementary variables and is mainly done in the transform domain. Secondly, we propose and analyse a new type of scheduling mechanism that allows precise control over the amount of delay differentiation between the classes. The idea is to introduce N reserved places in the queue, intended for future arrivals of class 1

Comparing Presenting Clinical Features in 48 Children With Microscopic Polyangiitis to 183 Children Who Have Granulomatosis With Polyangiitis (Wegener's) : an ARChiVe Cohort Study

OBJECTIVE: To uniquely classify children with microscopic polyangiitis (MPA), to describe their demographic characteristics, presenting clinical features, and initial treatments in comparison to patients with granulomatosis with polyangiitis (Wegener's) (GPA). METHODS: The European Medicines Agency (EMA) classification algorithm was applied by computation to categorical data from patients recruited to the ARChiVe (A Registry for Childhood Vasculitis: e-entry) cohort, with the data censored to November 2015. The EMA algorithm was used to uniquely distinguish children with MPA from children with GPA, whose diagnoses had been classified according to both adult- and pediatric-specific criteria. Descriptive statistics were used for comparisons. RESULTS: In total, 231 of 440 patients (64% female) fulfilled the classification criteria for either MPA (n\u2009=\u200948) or GPA (n\u2009=\u2009183). The median time to diagnosis was 1.6 months in the MPA group and 2.1 months in the GPA group (ranging to 39 and 73 months, respectively). Patients with MPA were significantly younger than those with GPA (median age 11 years versus 14 years). Constitutional features were equally common between the groups. In patients with MPA compared to those with GPA, pulmonary manifestations were less frequent (44% versus 74%) and less severe (primarily, hemorrhage, requirement for supplemental oxygen, and pulmonary failure). Renal pathologic features were frequently found in both groups (75% of patients with MPA versus 83% of patients with GPA) but tended toward greater severity in those with MPA (primarily, nephrotic-range proteinuria, requirement for dialysis, and end-stage renal disease). Airway/eye involvement was absent among patients with MPA, because these GPA-defining features preclude a diagnosis of MPA within the EMA algorithm. Similar proportions of patients with MPA and those with GPA received combination therapy with corticosteroids plus cyclophosphamide (69% and 78%, respectively) or both drugs in combination with plasmapheresis (19% and 22%, respectively). Other treatments administered, ranging in decreasing frequency from 13% to 3%, were rituximab, methotrexate, azathioprine, and mycophenolate mofetil. CONCLUSION: Younger age at disease onset and, perhaps, both gastrointestinal manifestations and more severe kidney disease seem to characterize the clinical profile in children with MPA compared to those with GPA. Delay in diagnosis suggests that recognition of these systemic vasculitides is suboptimal. Compared with adults, initial treatment regimens in children were comparable, but the complete reversal of female-to-male disease prevalence ratios is a provocative finding