Tracking Cyber Adversaries with Adaptive Indicators of Compromise

A forensics investigation after a breach often uncovers network and host indicators of compromise (IOCs) that can be deployed to sensors to allow early detection of the adversary in the future. Over time, the adversary will change tactics, techniques, and procedures (TTPs), which will also change the data generated. If the IOCs are not kept up-to-date with the adversary's new TTPs, the adversary will no longer be detected once all of the IOCs become invalid. Tracking the Known (TTK) is the problem of keeping IOCs, in this case regular expressions (regexes), up-to-date with a dynamic adversary. Our framework solves the TTK problem in an automated, cyclic fashion to bracket a previously discovered adversary. This tracking is accomplished through a data-driven approach of self-adapting a given model based on its own detection capabilities. In our initial experiments, we found that the true positive rate (TPR) of the adaptive solution degrades much less significantly over time than the naive solution, suggesting that self-updating the model allows the continued detection of positives (i.e., adversaries). The cost for this performance is in the false positive rate (FPR), which increases over time for the adaptive solution, but remains constant for the naive solution. However, the difference in overall detection performance, as measured by the area under the curve (AUC), between the two methods is negligible. This result suggests that self-updating the model over time should be done in practice to continue to detect known, evolving adversaries.Comment: This was presented at the 4th Annual Conf. on Computational Science & Computational Intelligence (CSCI'17) held Dec 14-16, 2017 in Las Vegas, Nevada, US

A Riemann solver at a junction compatible with a homogenization limit

We consider a junction regulated by a traffic lights, with n incoming roads and only one outgoing road. On each road the Phase Transition traffic model, proposed in [6], describes the evolution of car traffic. Such model is an extension of the classic Lighthill-Whitham-Richards one, obtained by assuming that different drivers may have different maximal speed. By sending to infinity the number of cycles of the traffic lights, we obtain a justification of the Riemann solver introduced in [9] and in particular of the rule for determining the maximal speed in the outgoing road.Comment: 19 page

Understanding the Reactivity of Enol Ether Radical Cations: Investigation of Anodic Four-Membered Carbon Ring Formation

The reactivity of enol ether radical cations was investigated in anodic four-membered carbon ring formations, advancing the mechanistic understanding of these reactions. The mono-ring-containing aromatic cations were reduced through inter- or intramolecular electron transfer to give mono- or bis-ring-containing compounds, respectively. Small structural changes in the hydrocarbon linkers tethering two aromatic rings exerted a powerful effect on the efficiency of such electron transfer events

Hydrogen-Bonding-Induced Fluorescence: Water-Soluble and Polarity-Independent Solvatochromic Fluorophores

Fluorophores with emission wavelengths that shift depending on their hydrogen-bonding microenvironment in water would be fascinating tools for the study of biological events. Herein we describe the design and synthesis of a series of water-soluble solvatochromic fluorophores, 2,5-bis­(oligoethylene glycol)­oxybenzaldehydes (<b>8</b>–<b>11</b>) and 2,5-bis­(oligoethylene glycol)­oxy-1,4-dibenzaldehydes (<b>14</b>–<b>17</b>), based on a push–pull strategy. Unlike typical examples in this class of fluorophores, the fluorescence properties of these compounds are independent of solvent polarity and become fluorescent upon intermolecular hydrogen-bonding, exhibiting high quantum yields (up to ϕ = 0.55) and large Stokes shifts (up to 134 nm). Furthermore, their emission wavelengths change depending on their hydrogen-bonding environment. The described fluorophores provide a starting point for unprecedented applications in the fields of chemical biology and medicinal chemistry

Soluble Tag-Assisted Peptide Head-to-Tail Cyclization: Total Synthesis of Mahafacyclin B

A soluble tag-assisted liquid-phase method was successfully applied to peptide head-to-tail cyclization, leading to the total synthesis of antimalarial cyclic heptapeptide, mahafacyclin B (<b>1</b>). The cyclization was carried out in the liquid phase with the tag remaining, which allowed rapid reaction workup and product isolation

Total Synthesis of Elastin Peptide Using High Pressure–Liquid Phase Synthesis Assisted by a Soluble Tag Strategy

A highly aggregating elastin peptide was prepared efficiently using a high pressure–liquid phase synthesis approach assisted by a soluble tag strategy. Two standard syringes were connected to each other to construct a reactor. This simple reactor was used to apply high pressure to the highly viscous reaction mixture thereby maintaining its fluidity. The reactions were completely inhibited due to aggregation when conducted in a standard flask reactor, whereas our high pressure approach accelerated the couplings to realize complete conversion within 5–7 min. All steps were conducted at 0.10 M concentration, affording grams of the desired product

Mahafcyclin B alters the morphology of CHO-K1 cells.

<p>Morphology was measured using continuous boxplots for eccentricity, major-axis length, and minor-axis length of each cell in response to mahafacyclin B.</p

Synthetic Method for Oligonucleotide Block by Using Alkyl-Chain-Soluble Support

A straightforward method for the synthesis of oligonucleotide blocks using a Cbz-type alkyl-chain-soluble support (Z-ACSS) attached to the 3′-OH group of 3′-terminal nucleosides was developed. The Z-ACSS allowed for the preparation of fully protected deoxyribo- and ribo-oligonucleotides without chromatographic purification and released dimer- to tetramer-size oligonucleotide blocks via hydrogenation using a Pd/C catalyst without significant loss or migration of protective groups such as 5′-end 4,4′-dimethoxtrityl, 2-cyanoethyl on internucleotide bonds, or 2′-TBS

Mahafacyclin B alters the expression of a subset of genes in CHO-K1 cells.

<p>Genes marked in purple were detected as differentially expressed at the 5% false-discovery rate (FDR) using TCC. (A) Scatter plot of differentially expressed genes in response to 0 or 0.22 μM mahafacyclin B. (B) Scatter plot of differentially expressed genes in response to 0 or 22 μM mahafacyclin B.</p

Purity of synthesized mahafacyclin B.

<p>(A) UV–Visible spectrum of LC-MS analysis of the sample (0%–100% 0.1%TFA CH₃CN in 45 min). Peak purity was calculated using the peak area percentage. RT = 33.12 min was characterized as mahafacyclin B (96.8%) and RT = 30.69 min was found to be the epimerized variant (0.82%), the existence of which was determined by mass chromatogram (<i>m/z</i> 803–810, data not shown). (B) Mass spectrometry of the main peak in the UV–Visible spectrum of the LC-MS analysis of mahafacyclin B. <i>m/z</i> 804.2249 was characterized as [M+H], and <i>m/z</i> 1608.4589 (<i>m/z</i> 1607.4438 for the monoisotopic ion) as [2M+H].</p