848 research outputs found

    Anagram: A Content Anomaly Detector Resistant to Mimicry Attack

    Get PDF
    In this paper, we present Anagram, a content anomaly detector that models a mixture of high-order n-grams (n > 1) designed to detect anomalous and suspicious network packet payloads. By using higher- order n-grams, Anagram can detect significant anomalous byte sequences and generate robust signatures of validated malicious packet content. The Anagram content models are implemented using highly efficient Bloom filters, reducing space requirements and enabling privacy-preserving cross-site correlation. The sensor models the distinct content flow of a network or host using a semi- supervised training regimen. Previously known exploits, extracted from the signatures of an IDS, are likewise modeled in a Bloom filter and are used during training as well as detection time. We demonstrate that Anagram can identify anomalous traffic with high accuracy and low false positive rates. Anagram’s high-order n-gram analysis technique is also resilient against simple mimicry attacks that blend exploits with normal appearing byte padding, such as the blended polymorphic attack recently demonstrated in. We discuss randomized n-gram models, which further raises the bar and makes it more difficult for attackers to build precise packet structures to evade Anagram even if they know the distribution of the local site content flow. Finally, Anagram-’s speed and high detection rate makes it valuable not only as a standalone sensor, but also as a network anomaly flow classifier in an instrumented fault-tolerant host-based environment; this enables significant cost amortization and the possibility of a symbiotic feedback loop that can improve accuracy and reduce false positive rates over time

    Quantification of LPS Eluate from Coated Microelectrode Devices

    Get PDF
    Penetrating microelectrode arrays have a great potential to be used as control and communication interfaces for neuroprosthetics. A persistent obstacle in the clinical implementation of microelectrode arrays is the chronic degradation of these devices, putatively due to the foreign body response. Though researchers have studied the progression of the foreign body response and the effect of anti-inflammatory drugs on the efficacy of the implant, the exact biological mechanisms of implant degradation are not fully understood. To more closely investigate the effect of the foreign body response on device degradation, neuroinflammation can be exacerbated by coating dummy electrodes implanted into mice brains with lipopolysaccharide (LPS) – a cell wall component of bacteria which induces inflammation. Quantifying the amount of LPS released from a coated electrode is crucial in performing such an experiment. Using a Limulus amebocyte lysate (LAL) test – a test based on the extract of the blood from horseshoe crab which reacts with LPS – the concentration of LPS can be accurately quantified, allowing for a more careful characterization of the inflammatory response. In particular, the devices coated in 1 mg/ml concentration of LPS eluted a mean mass of 4.55 EU with a standard deviation of .51, where 1 endotoxin unit (EU) ≈ 1 ng. A linear regression of the standard concentrations resulted in an r2 of .9806, indicating a reliable model for calculating the concentration of LPS present in a sample. These results suggest that LPS elution can be accurately and precisely measured using the LAL assay

    Intrusion and Anomaly Detection Model Exchange for Mobile Ad-Hoc Networks

    Get PDF
    Mobile Ad-hoc NETworks (MANETs) pose unique security requirements and challenges due to their reliance on open, peer-to-peer models that often don't require authentication between nodes. Additionally, the limited processing power and battery life of the devices used in a MANET also prevent the adoption of heavy-duty cryptographic techniques. While traditional misuse-based Intrusion Detection Systems (IDSes) may work in a MANET, watching for packet dropouts or unknown outsiders is difficult as both occur frequently in both malicious and non-malicious traffic. Anomaly detection approaches hold out more promise, as they utilize learning techniques to adapt to the wireless environment and flag malicious data. The anomaly detection model can also create device behavior profiles, which peers can utilize to help determine its trustworthiness. However, computing the anomaly model itself is a time-consuming and processor-heavy task. To avoid this, we propose the use of model exchange as a device moves between different networks as a means to minimize computation and traffic utilization. Any node should be able to obtain peers' model(s) and evaluate it against its own model of "normal" behavior. We present this model, discuss scenarios in which it may be used, and provide preliminary results and a framework for future implementation

    Local moment formation in quantum point contacts

    Full text link
    Spin-density-functional theory of quantum point contacts (QPCs) reveals the formation of a local moment with a net of one electron spin in the vicinity of the point contact - supporting the recent report of a Kondo effect in a QPC. The hybridization of the local moment to the leads decreases as the QPC becomes longer, while the onsite Coulomb-interaction energy remains almost constant.Comment: 10 pages, 3 figures, accepted for publication in Physical Review Letter

    Lever Insertion as a Salient Stimulus Promoting Insensitivity to Outcome Devaluation

    Get PDF
    Flexible and efficient decision-making in complex environments can be achieved through constant interactions between the goal-directed and habitual systems. While goal-directed behavior is considered dependent upon Response-Outcome (R-O) associations, habits instead rely on Stimulus-Response (S-R) associations. However, the stimuli that support the S-R association underlying habitual responding in typical instrumental procedures are poorly defined. To resolve this issue, we designed a discrete-trials procedure, in which rats must wait for lever insertion and complete a sequence of five lever presses to obtain a reward (20% sucrose or grain-based pellets). Lever insertion thus constituted an audio-visual stimulus signaling the opportunity for reward. Using sensory-specific satiety-induced devaluation, we found that rats trained with grain-based pellets remained sensitive to outcome devaluation over the course of training with this procedure whereas rats trained with a solution of 20% sucrose rapidly developed habit, and that insensitivity to outcome devaluation in rats trained with sucrose did not result from a bias in general satiety. Importantly, although rats trained with pellets were sensitive to satiety-induced devaluation, their performance was not affected by degradation of instrumental contingency and devaluation by conditioned taste aversion (CTA), suggesting that these rats may also have developed habitual responding. To test whether the discrete-trials procedure biases subjects towards habitual responding, we compared discrete-trials to free-running instrumental responding, and found that rats trained with sucrose in a fixed-ratio 5 (FR5) procedure with continuous presentation of the lever were goal-directed. Together, these results demonstrate that discrete presentations of a stimulus predictive of reward availability promoted the formation of S-R habit in rats trained with liquid sucrose. Further research is necessary to explain inconsistencies in sensitivity to outcome devaluation when rats are trained with grain-based pellets
    corecore