Systematic approach towards Analysis and Mitigation of Advanced Evasion Techniques

Advanced Evasion Techniques (AETs) can successfully evade most network security devices and execute attack on target system. This is still an occurring problem, even after 20 years since the disclosure of evasion techniques and how they can be used to bypass network security. Network security solutions, such as Intrusion Detection and Prevention Systems (IDPS) still struggle and are vulnerable to most of the evasions techniques mentioned identified in 1998. In this thesis, a systematic analysis of advanced evasion techniques (AETs) is presented in the first two phases. Based on the results of the analysis, new mitigation methods against AETs are proposed in the third phase. Four experiments were executed in each of three different phases using advanced evasion techniques to masquerade the attack. The target of this analysis was to first recognize which combinations of evasions are most effective and which individual/ single evasion techniques are effective by itself. The final phase was to implement proposed mitigation methods and test the results. The results from the analysis showed that 4-6 % of AETs, can successfully masquerade attacks and bypass one of the most modern and updated network security solution. Proposed mitigation methods are capable of normalizing traffic much better while improving the results significantly. In many cases 100 % attack techniques were mitigated and some particular techniques exploiting headers of protocol were also mitigated completely. Nonetheless, when evasion techniques are used in complex combinations, results become concerning and it is important to note that the danger from AETs may still persist

Ubiquitin Specific Protease 21 Is Dispensable for Normal Development, Hematopoiesis and Lymphocyte Differentiation

<div><p>USP21 is a ubiquitin specific protease that catalyzes protein deubiquitination, however the identification of its physiological substrates remains challenging. USP21 is known to deubiquitinate transcription factor GATA3 and death-domain kinase RIPK1 <i>in vitro</i>, however the <i>in vivo</i> settings where this regulation plays a biologically significant role remain unknown. In order to determine whether USP21 is an essential and non-redundant regulator of GATA3 or RIPK1 activity <i>in vivo</i>, we characterized <i>Usp21</i>-deficient mice, focusing on mouse viability and development, hematopoietic stem cell function, and lymphocyte differentiation. The <i>Usp21</i>-knockout mice were found to be viable and fertile, with no significant dysmorphology, in contrast to the GATA3 and RIPK1 knockout lines that exhibit embryonic or perinatal lethality. Loss of USP21 also had no effect on hematopoietic stem cell function, lymphocyte development, or the responses of antigen presenting cells to TLR and TNFR stimulation. GATA3 levels in hematopoietic stem cells or T lymphocytes remained unchanged. We observed that aged <i>Usp21</i>-knockout mice exhibited spontaneous T cell activation, however this was not linked to altered GATA3 levels in the affected cells. The contrast in the phenotype of the <i>Usp21</i>-knockout line with the previously characterized GATA3 and RIPK1 knockout mice strongly indicates that USP21 is redundant for the regulation of GATA3 and RIPK1 activity during mouse development, in hematopoietic stem cells, and in lymphocyte differentiation. The <i>Usp21</i>-deficient mouse line characterized in this study may serve as a useful tool for the future characterization of USP21 physiological functions.</p></div

Intracellular Flow Cytometry Analysis of GATA3 levels in the <i>Usp21</i>-knockout mice.

<p>(A) Representative flow cytometry histograms of hematopoietic stem cells (HSCs, Lin^-cKit⁺Sca1⁺Flt3^-), multipotent progenitors (MPPs, Lin^-cKit⁺Sca1⁺Flt3⁺), as well as CD4 and CD8 T cells from mouse spleen, stained with an isotype control antibody (top panel) or GATA3-specific antibody (bottom panels). (B) Mean fluorescence intensity (MFI) of GATA3-staining of HSCs (Lin^-cKit⁺Sca1⁺Flt3^- or Lin^-cKit⁺Sca1⁺CD150⁺), MPPs (Lin^-cKit⁺Sca1⁺Flt3⁺ or Lin^-cKit⁺Sca1⁺CD150^-), and T cells from <i>Usp21</i>^-/- and wild type mice. Bars represent mean ± SEM; data is from 10 mice per group, acquired in 2 independent experiments. There are no statistically significant differences in GATA3 MFI between the <i>Usp21</i>^-/- and wild type cells.</p

Normal Hematopoietic Stem Cell Numbers and Function in the <i>Usp21</i>-deficient mice.

<p>(A) Flow cytometry profiles of the mouse bone marrow, stained for lineage markers, cKit and Sca1, and gated on the lineage negative cells (CD11b^-B220^-TER119^-CD4-CD8^-). Lin^-cKit⁺Sca1⁺ (LKS) population that contains hematopoietic stem cells and multipotent progenitors is highlighted. (B) Absolute numbers of hematopoietic stem cells (HSCs Lin^-cKit⁺Sca1⁺Flt3^-) and multipotent progenitors (MPPs, Lin^-cKit⁺Sca1⁺Flt3⁺). Bars represent mean ± SEM, the presented data is from 4 mice per group, and is representative of 3 independent experiments with 14 mice per group analyzed in total; differences between wild type (+/+) and <i>Usp21</i>-knockout (-/-) mice are not statistically significant. (C-D) Competitive bone marrow chimeras: lethally irradiated mice transplanted with a 50:50 mix of <i>Usp21</i>^-/- (CD45.2⁺) and wild type (CD45.1⁺) bone marrow cells, and analyzed at 20 weeks after the reconstitution. (C) Representative histograms showing the relative contribution of <i>Usp21</i>^-/- (CD45.2⁺, left-peaks) and wild type (CD45.1⁺, right-peak) HSCs to the different hematopoietic lineages in the chimeras; and (D) data quantification. Bars represent means ± SEM, from 5 mice per group. Long-term HSCs are gated as Lin^-cKit⁺Sca1⁺Flt3^-CD34^-, short-term HSCs as Lin^-cKit⁺Sca1⁺Flt3^-CD34⁺, and MPPs as Lin^-cKit⁺Sca1⁺Flt3⁺CD34⁺; DN—double negative thymocytes (CD4^-CD8^-), DP—double positive thymocytes (CD4⁺CD8⁺). The contribution of <i>Usp21</i>^-/- cells to all the lineages is not significantly different from 50%, indicating no defect in <i>Usp21</i>^-/- stem cell function in direct competition with wild type cells.</p

Normal resistance of <i>Usp21</i>^-/- mice to <i>Salmonella typhimurium</i> infection.

<p>(A) Percent change in mouse body weight over the 28 day time-course of infection for <i>Usp21</i>^-/- mice (-/-) and wild type control mice (+/+). (B) Bacterial counts (Log10 CFU/organ) at days 14 and 28 post-infection in spleen and liver. (C) Anti-TetC serum antibody titres at day 28 of infection, including total IgG, IgG1, and IgG2a isotypes. Bars show (A, C) mean ± SEM or (B) geometric mean ± SD.</p

The responses of <i>Usp21</i>^-/- (-/-) and control wild type (+/+) bone marrow derived macrophages and dendritic cells to TLR and TNFR stimulation.

<p>(A-B)The cells were stimulated over 18 hours with LPS at 10 and 100ng/ml, poly(IC) at 5 and 25 μg/ml, or TNFα at either 5 or 10ng/ml. (A) Production of cytokine TNFα was assessed by intracellular staining and flow cytometry, with the addition of Brefeldin A at 3μg/ml at 2 hours following the beginning of the stimulation. (B) Production of cytokines IL-6 and TNFα was assessed by ELISA. (C) Bone marrow derived macrophages from <i>Usp21</i>^-/- (-/-, dashed line) and control wild type (+/+, solid line) mice were stimulated over 1.5 hours with LPS 100ng/ml, poly(IC) 25 μg/ml, or TNFα 10ng/ml, and analyzed by flow cytometry for IκBα levels and p65 NFκB S536 phosphorylation; data is presented as fold change in MFI over the untreated sample. Bars represent means ± SEM, datasets are from 4–5 mice per group with the cells from each mouse stimulated and analyzed in duplicate; MFI-mean fluorescence intensity; statistical analysis by ANOVA with Bonferroni post-hoc test, ** p<0.01, * p<0.05, and non-significant if no p-value is provided. All datasets were acquired however only datasets with a significant difference between stimulated and unstimulated samples are presented.</p