Tracking Cyber Adversaries with Adaptive Indicators of Compromise

A forensics investigation after a breach often uncovers network and host indicators of compromise (IOCs) that can be deployed to sensors to allow early detection of the adversary in the future. Over time, the adversary will change tactics, techniques, and procedures (TTPs), which will also change the data generated. If the IOCs are not kept up-to-date with the adversary's new TTPs, the adversary will no longer be detected once all of the IOCs become invalid. Tracking the Known (TTK) is the problem of keeping IOCs, in this case regular expressions (regexes), up-to-date with a dynamic adversary. Our framework solves the TTK problem in an automated, cyclic fashion to bracket a previously discovered adversary. This tracking is accomplished through a data-driven approach of self-adapting a given model based on its own detection capabilities. In our initial experiments, we found that the true positive rate (TPR) of the adaptive solution degrades much less significantly over time than the naive solution, suggesting that self-updating the model allows the continued detection of positives (i.e., adversaries). The cost for this performance is in the false positive rate (FPR), which increases over time for the adaptive solution, but remains constant for the naive solution. However, the difference in overall detection performance, as measured by the area under the curve (AUC), between the two methods is negligible. This result suggests that self-updating the model over time should be done in practice to continue to detect known, evolving adversaries.Comment: This was presented at the 4th Annual Conf. on Computational Science & Computational Intelligence (CSCI'17) held Dec 14-16, 2017 in Las Vegas, Nevada, US

Head Size of Male and Female Lizards Increases with Population Density Across Island Populations in the Bahamas

In polygynous lizards, male–male competition is an important driver of morphologic and behavioral traits associated with intraspecific dominance. The extent to which females engage in aggressive behavior and thus contribute to competition-driven morphologic variation is not well studied. We used injury frequencies of brown anoles (Anolis sagrei) in 16 island populations to test the hypothesis that injury-inducing aggressive encounters increase with population density in both male and female lizards. We further asked whether intraspecific competition is a potential driver of phenotypic traits related to dominance by using population density as proxy for intraspecific competition. We found that the proportion of individuals with injuries was greater in populations with higher densities, suggesting that agonistic competitive interactions increase with population density. Size-adjusted head length of male and female lizards increased with population density, suggesting that larger heads might be advantageous when intraspecific competition is strong. We detected differences in morphology and injury frequency among islands for both males and females, which suggests that agonistic competitive interactions among females may be stronger than previously appreciated. Further research is needed to determine whether aggressive encounters involving females are restricted to intrasexual competition or whether they also involve males, and how morphologic traits of females are related to competitive dominance and reproductive success

SDSSJ103913.70+533029.7: A Super Star Cluster in the Outskirts of a Galaxy Merger

We describe the serendipitous discovery in the spectroscopic data of the Sloan Digital Sky Survey of a star-like object, SDSSJ103913.70+533029.7, at a heliocentric radial velocity of +1012 km/s. Its proximity in position and velocity to the spiral galaxy NGC 3310 suggests an association with the galaxy. At this distance, SDSSJ103913.70+533029.7 has the luminosity of a super star cluster and a projected distance of 17 kpc from NGC 3310. Its spectroscopic and photometric properties imply a mass of > 10^6 solar masses and an age close to that of the tidal shells seen around NGC 3310, suggesting that it formed in the event which formed the shells.Comment: Accepted by AJ: 4 figures (1 color

The Genetic Signature of Sex-Biased Migration in Patrilocal Chimpanzees and Humans

A large body of theoretical work suggests that analyses of variation at the maternally inherited mitochondrial (mt)DNA and the paternally inherited non-recombining portion of the Y chromosome (NRY) are a potentially powerful way to reveal the differing migratory histories of men and women across human societies. However, the few empirical studies comparing mtDNA and NRY variation and known patterns of sex-biased migration have produced conflicting results. Here we review some methodological reasons for these inconsistencies, and take them into account to provide an unbiased characterization of mtDNA and NRY variation in chimpanzees, one of the few mammalian taxa where males routinely remain in and females typically disperse from their natal groups. We show that patterns of mtDNA and NRY variation are more strongly contrasting in patrilocal chimpanzees compared with patrilocal human societies. The chimpanzee data we present here thus provide a valuable comparative benchmark of the patterns of mtDNA and NRY variation to be expected in a society with extremely female-biased dispersal

A Role for the Unfolded Protein Response (UPR) in Virulence and Antifungal Susceptibility in Aspergillus fumigatus

Filamentous fungi rely heavily on the secretory pathway, both for the delivery of cell wall components to the hyphal tip and the production and secretion of extracellular hydrolytic enzymes needed to support growth on polymeric substrates. Increased demand on the secretory system exerts stress on the endoplasmic reticulum (ER), which is countered by the activation of a coordinated stress response pathway termed the unfolded protein response (UPR). To determine the contribution of the UPR to the growth and virulence of the filamentous fungal pathogen Aspergillus fumigatus, we disrupted the hacA gene, encoding the major transcriptional regulator of the UPR. The ΔhacA mutant was unable to activate the UPR in response to ER stress and was hypersensitive to agents that disrupt ER homeostasis or the cell wall. Failure to induce the UPR did not affect radial growth on rich medium at 37°C, but cell wall integrity was disrupted at 45°C, resulting in a dramatic loss in viability. The ΔhacA mutant displayed a reduced capacity for protease secretion and was growth-impaired when challenged to assimilate nutrients from complex substrates. In addition, the ΔhacA mutant exhibited increased susceptibility to current antifungal agents that disrupt the membrane or cell wall and had attenuated virulence in multiple mouse models of invasive aspergillosis. These results demonstrate the importance of ER homeostasis to the growth and virulence of A. fumigatus and suggest that targeting the UPR, either alone or in combination with other antifungal drugs, would be an effective antifungal strategy

Genome sequence of the tsetse fly (Glossina morsitans):Vector of African trypanosomiasis

Tsetse flies are the sole vectors of human African trypanosomiasis throughout sub-Saharan Africa. Both sexes of adult tsetse feed exclusively on blood and contribute to disease transmission. Notable differences between tsetse and other disease vectors include obligate microbial symbioses, viviparous reproduction, and lactation. Here, we describe the sequence and annotation of the 366-megabase Glossina morsitans morsitans genome. Analysis of the genome and the 12,308 predicted protein-encoding genes led to multiple discoveries, including chromosomal integrations of bacterial (Wolbachia) genome sequences, a family of lactation-specific proteins, reduced complement of host pathogen recognition proteins, and reduced olfaction/chemosensory associated genes. These genome data provide a foundation for research into trypanosomiasis prevention and yield important insights with broad implications for multiple aspects of tsetse biology.IS

Effect of angiotensin-converting enzyme inhibitor and angiotensin receptor blocker initiation on organ support-free days in patients hospitalized with COVID-19

IMPORTANCE Overactivation of the renin-angiotensin system (RAS) may contribute to poor clinical outcomes in patients with COVID-19. Objective To determine whether angiotensin-converting enzyme (ACE) inhibitor or angiotensin receptor blocker (ARB) initiation improves outcomes in patients hospitalized for COVID-19. DESIGN, SETTING, AND PARTICIPANTS In an ongoing, adaptive platform randomized clinical trial, 721 critically ill and 58 non–critically ill hospitalized adults were randomized to receive an RAS inhibitor or control between March 16, 2021, and February 25, 2022, at 69 sites in 7 countries (final follow-up on June 1, 2022). INTERVENTIONS Patients were randomized to receive open-label initiation of an ACE inhibitor (n = 257), ARB (n = 248), ARB in combination with DMX-200 (a chemokine receptor-2 inhibitor; n = 10), or no RAS inhibitor (control; n = 264) for up to 10 days. MAIN OUTCOMES AND MEASURES The primary outcome was organ support–free days, a composite of hospital survival and days alive without cardiovascular or respiratory organ support through 21 days. The primary analysis was a bayesian cumulative logistic model. Odds ratios (ORs) greater than 1 represent improved outcomes. RESULTS On February 25, 2022, enrollment was discontinued due to safety concerns. Among 679 critically ill patients with available primary outcome data, the median age was 56 years and 239 participants (35.2%) were women. Median (IQR) organ support–free days among critically ill patients was 10 (–1 to 16) in the ACE inhibitor group (n = 231), 8 (–1 to 17) in the ARB group (n = 217), and 12 (0 to 17) in the control group (n = 231) (median adjusted odds ratios of 0.77 [95% bayesian credible interval, 0.58-1.06] for improvement for ACE inhibitor and 0.76 [95% credible interval, 0.56-1.05] for ARB compared with control). The posterior probabilities that ACE inhibitors and ARBs worsened organ support–free days compared with control were 94.9% and 95.4%, respectively. Hospital survival occurred in 166 of 231 critically ill participants (71.9%) in the ACE inhibitor group, 152 of 217 (70.0%) in the ARB group, and 182 of 231 (78.8%) in the control group (posterior probabilities that ACE inhibitor and ARB worsened hospital survival compared with control were 95.3% and 98.1%, respectively). CONCLUSIONS AND RELEVANCE In this trial, among critically ill adults with COVID-19, initiation of an ACE inhibitor or ARB did not improve, and likely worsened, clinical outcomes. TRIAL REGISTRATION ClinicalTrials.gov Identifier: NCT0273570

Lost But Not Forgotten: Mhc Genotypes Predict Overwinter Survival Despite Depauperate Mhc Diversity In A Declining Frog

The amphibian disease chytridiomycosis, caused by the fungus Batrachochytrium dendrobatidis (Bd), has contributed to the decline of Chiricahua leopard frogs (Rana chiricahuensis), a federally threatened species native to the Southwestern United States. We characterized immunogenetic variability in R. chiricahuensis by sequencing an expressed Major Histocompatibility Complex (MHC) class IIβ gene across 13 natural populations in Arizona, USA, as well as 283 individuals that were captive reared from two egg masses. We recovered a total of five class IIβ MHC alleles compared to 84 alleles previously characterized in eight natural populations of the Arizona congener R. yavapaiensis, demonstrating reduced MHC diversity in R. chiricahuensis. One allele was fixed in five populations but none of the R. chiricahuensis alleles were closely related to R. yavapaiensis allele Q, which is significantly associated with chytridiomycosis resistance in laboratory trials. Nine of 13 R. chiricahuensis population localities were Bd positive, and bearing allele RachDRB*04 was the best genetic predictor of an individual being infected with Bd. A total of three class IIβ alleles were recovered from captive reared individuals, which were released to two natural population localities followed by recapture surveys to assess MHC-based survival over winter, the time when chytridiomycosis outbreaks are most severe. At one site, all released animals were fixed for a single allele and MHC-based survival could not be assessed. At the second site, fewer than half of the released but all of the recaptured individuals were homozygous for RachDRB*05, indicating that MHC genotype is important in determining Bd survival under natural field conditions. We conclude that the limited MHC variation in R. chiricahuensis is likely the consequence rather than the cause of natural selection favoring alleles that promote survival in the face of Bd. Our study highlights that preserving even low levels of functional genetic variation may be essential for population persistence, and that local disease adaptation may present as a reduction in genetic diversity. These finding also suggest that for populations that have declined due to a specific infectious pathogen, MHC-based genetically-informed reintroduction approaches may enhance species recovery efforts