Tracking Cyber Adversaries with Adaptive Indicators of Compromise

A forensics investigation after a breach often uncovers network and host indicators of compromise (IOCs) that can be deployed to sensors to allow early detection of the adversary in the future. Over time, the adversary will change tactics, techniques, and procedures (TTPs), which will also change the data generated. If the IOCs are not kept up-to-date with the adversary's new TTPs, the adversary will no longer be detected once all of the IOCs become invalid. Tracking the Known (TTK) is the problem of keeping IOCs, in this case regular expressions (regexes), up-to-date with a dynamic adversary. Our framework solves the TTK problem in an automated, cyclic fashion to bracket a previously discovered adversary. This tracking is accomplished through a data-driven approach of self-adapting a given model based on its own detection capabilities. In our initial experiments, we found that the true positive rate (TPR) of the adaptive solution degrades much less significantly over time than the naive solution, suggesting that self-updating the model allows the continued detection of positives (i.e., adversaries). The cost for this performance is in the false positive rate (FPR), which increases over time for the adaptive solution, but remains constant for the naive solution. However, the difference in overall detection performance, as measured by the area under the curve (AUC), between the two methods is negligible. This result suggests that self-updating the model over time should be done in practice to continue to detect known, evolving adversaries.Comment: This was presented at the 4th Annual Conf. on Computational Science & Computational Intelligence (CSCI'17) held Dec 14-16, 2017 in Las Vegas, Nevada, US

A Riemann solver at a junction compatible with a homogenization limit

We consider a junction regulated by a traffic lights, with n incoming roads and only one outgoing road. On each road the Phase Transition traffic model, proposed in [6], describes the evolution of car traffic. Such model is an extension of the classic Lighthill-Whitham-Richards one, obtained by assuming that different drivers may have different maximal speed. By sending to infinity the number of cycles of the traffic lights, we obtain a justification of the Riemann solver introduced in [9] and in particular of the rule for determining the maximal speed in the outgoing road.Comment: 19 page

Additional file 2: of Psychometric validation of the EuroQoL 5-Dimension 5-Level (EQ-5D-5L) in Chinese patients with adolescent idiopathic scoliosis

SRS-22r Questionnaire. (DOC 137 kb

Additional file 1: of Reproducibility of thoracic kyphosis measurements in patients with adolescent idiopathic scoliosis

Original primary data. (XLSX 29 kb

Bar graph illustrating the number of levels saved in relation to the mean fulcrum bending radiograph (FBR) flexibility percentage.

<p>Bar graph illustrating the number of levels saved in relation to the mean fulcrum bending radiograph (FBR) flexibility percentage.</p

Fulcrum bending radiograph.

<p>The patient is positioned on the lateral decubitus position. A padded cylinder (fulcrum) of appropriate size is placed on the side of the curve at the level of the rib corresponding to the apex of the curve. For example, if the apex vertebra of the curve is at T9, the fulcrum should be placed at the T9 rib. The fulcrum should be positioned to allow the shoulder and the pelvis to be lifted off the table.</p

Saved distal fusion levels.

<p>A case where one level was saved. <b>(A)</b> A male AIS patient with a preoperative standing coronal Cobb angle of 61.6 degrees from T5-T12. <b>(B)</b> His standing sagittal Cobb angle from T5-T12 was 5.1 degrees. <b>(C)</b> Fulcrum bending radiograph demonstrated a curve of 31.3 degrees. Last follow-up <b>(D)</b> standing coronal Cobb angle was 26.8 degrees and <b>(E)</b> standing sagittal Cobb angle was 4.5 degrees.</p

Mapping the SRS-22r questionnaire onto the EQ-5D-5L utility score in patients with adolescent idiopathic scoliosis

<div><p>This is a prospective study to establish prediction models that map the refined Scoliosis Research Society 22-item (SRS-22r) onto EuroQoL-5 dimension 5-level (EQ-5D-5L) utility scores in adolescent idiopathic scoliosis (AIS) patients. Comparison of treatment outcomes in AIS can be determined by cost-utility analysis. However, the mainstay spine-specific health-related quality of life outcome measure, the SRS-22r questionnaire does not provide utility assessment. In this study, AIS patients were prospectively recruited to complete both the EQ-5D-5L and SRS-22r questionnaires by trained interviewers. Ordinary least squares regression was undertaken to develop mapping models, which the validity and robustness were assessed by using the 10-fold cross-validation procedure. EQ-5D-5L utility scores were regressed on demographics, Cobb angle, curve types, treatment modalities, and five domains of the SRS-22r questionnaire. Three models were developed using stepwise selection method. EQ-5D-5L scores were regressed on 1) main effects of SRS-22r subscale scores, 2) as per 1 plus squared and interaction terms, and 3) as per 2 plus demographic and clinical characteristics. Model goodness-of-fit was assessed using R-square, adjusted R-square, and information criteria; whereas the predictive performance was evaluated using root mean square error (RMSE), mean absolute error (MAE), and the proportion of absolute error within the threshold of 0.05 and 0.10. A total of 227 AIS patients with mean age of 15.6 years were recruited. The EQ-5D-5L scores were predicted by four domains of SRS-22r (main effects of ‘Function’, ‘Pain’, ‘Appearance’ and ‘Mental Health’, and squared term of ‘Function’ and ‘Pain’), and Cobb angle in Model 3 with the best goodness-of-fit (R-square/adjusted R-square: 62.1%/60.9%). Three models demonstrated an acceptance predictive performance in error analysis applying 10-fold cross-validation to three models where RMSE and MAE were between 0.063–0.065 and between 0.039–0.044, respectively. Model 3 was therefore recommended out of three mapping models established in this paper. To our knowledge, this is the first study to map a spine-specific health-related quality of life measure onto EQ-5D-5L for AIS patients. With the consideration and incorporation of demographic and clinical characteristics, over 60% variance explained by mapping model 3 enabled the satisfactory prediction of EQ-5D-5L utility scores from existing SRS-22r data for health economic appraisal of different treatment options.</p></div

Means (95% confidence intervals) of adiposity measures, classified by disc degeneration sum score.

a<p>From one-way ANOVA.</p

Flow-chart of study population.

<p>The Study population consisted of the members of the Northern Finland Birth Cohort 1986 (NFBC 1986) in the two northernmost provinces of Finland (n = 9479) who lived within 100 km of the city of Oulu in 2003 (n = 2969). Those who participated in the physical examination at 19 years of age were invited to lumbar magnetic resonance imaging (MRI), which was performed between November 2005 and February 2008 at a mean participant age of 21 years. LBP = low back pain.</p