Tracking Cyber Adversaries with Adaptive Indicators of Compromise

A forensics investigation after a breach often uncovers network and host indicators of compromise (IOCs) that can be deployed to sensors to allow early detection of the adversary in the future. Over time, the adversary will change tactics, techniques, and procedures (TTPs), which will also change the data generated. If the IOCs are not kept up-to-date with the adversary's new TTPs, the adversary will no longer be detected once all of the IOCs become invalid. Tracking the Known (TTK) is the problem of keeping IOCs, in this case regular expressions (regexes), up-to-date with a dynamic adversary. Our framework solves the TTK problem in an automated, cyclic fashion to bracket a previously discovered adversary. This tracking is accomplished through a data-driven approach of self-adapting a given model based on its own detection capabilities. In our initial experiments, we found that the true positive rate (TPR) of the adaptive solution degrades much less significantly over time than the naive solution, suggesting that self-updating the model allows the continued detection of positives (i.e., adversaries). The cost for this performance is in the false positive rate (FPR), which increases over time for the adaptive solution, but remains constant for the naive solution. However, the difference in overall detection performance, as measured by the area under the curve (AUC), between the two methods is negligible. This result suggests that self-updating the model over time should be done in practice to continue to detect known, evolving adversaries.Comment: This was presented at the 4th Annual Conf. on Computational Science & Computational Intelligence (CSCI'17) held Dec 14-16, 2017 in Las Vegas, Nevada, US

M. tuberculosis genotypic diversity and drug susceptibility pattern in HIV- infected and non-HIV-infected patients in northern Tanzania

Contains fulltext : 53004.pdf (publisher's version ) (Open Access)BACKGROUND: Tuberculosis (TB) is a major health problem and HIV is the major cause of the increase in TB. Sub-Saharan Africa is endemic for both TB and HIV infection. Determination of the prevalence of M. tuberculosis strains and their drug susceptibility is important for TB control.TB positive culture, BAL fluid or sputum samples from 130 patients were collected and genotyped. The spoligotypes were correlated with anti-tuberculous drug susceptibility in HIV-infected and non-HIV patients from Tanzania. RESULTS: One-third of patients were TB/HIV co-infected. Forty-seven spoligotypes were identified.Fourteen isolates (10.8%) had new and unique spoligotypes while 116 isolates (89.2%) belonged to 33 known spoligotypes. The major spoligotypes contained nine clusters: CAS1-Kili 30.0%, LAM11- ZWE 14.6%, ND 9.2%, EAI 6.2%, Beijing 5.4%, T-undefined 4.6%, CAS1-Delhi 3.8%, T1 3.8% and LAM9 3.8%. Twelve (10.8%) of the 111 phenotypically tested strains were resistant to anti-TB drugs. Eight (7.2%) were monoresistant strains: 7 to isoniazid (INH) and one to streptomycin. Four strains (3.5%) were resistant to multiple drugs: one (0.9%) was resistant to INH and streptomycin and the other three (2.7%) were MDR strains: one was resistant to INH, rifampicin and ethambutol and two were resistant to all four anti-TB drugs. Mutation in the katG gene codon 315 and the rpoB hotspot region showed a low and high sensitivity, respectively, as predictor of phenotypic drug resistance. CONCLUSION: CAS1-Kili and LAM11-ZWE were the most common families. Strains of the Beijing family and CAS1-Kili were not or least often associated with resistance, respectively. HIV status was not associated with spoligotypes, resistance or previous TB treatment

The general population cohort in rural south-western Uganda: a platform for communicable and non-communicable disease studies.

The General Population Cohort (GPC) was set up in 1989 to examine trends in HIV prevalence and incidence, and their determinants in rural south-western Uganda. Recently, the research questions have included the epidemiology and genetics of communicable and non-communicable diseases (NCDs) to address the limited data on the burden and risk factors for NCDs in sub-Saharan Africa. The cohort comprises all residents (52% aged ≥13years, men and women in equal proportions) within one-half of a rural sub-county, residing in scattered houses, and largely farmers of three major ethnic groups. Data collected through annual surveys include; mapping for spatial analysis and participant location; census for individual socio-demographic and household socioeconomic status assessment; and a medical survey for health, lifestyle and biophysical and blood measurements to ascertain disease outcomes and risk factors for selected participants. This cohort offers a rich platform to investigate the interplay between communicable diseases and NCDs. There is robust infrastructure for data management, sample processing and storage, and diverse expertise in epidemiology, social and basic sciences. For any data access enquiries you may contact the director, MRC/UVRI, Uganda Research Unit on AIDS by email to [email protected] or the corresponding author

Intensity standardization methods in magnetic resonance imaging of head and neck cancer

BACKGROUND AND PURPOSE: Conventional magnetic resonance imaging (MRI) poses challenges in quantitative analysis because voxel intensity values lack physical meaning. While intensity standardization methods exist, their effects on head and neck MRI have not been investigated. We developed a workflow based on healthy tissue region of interest (ROI) analysis to determine intensity consistency within a patient cohort. Through this workflow, we systematically evaluated intensity standardization methods for MRI of head and neck cancer (HNC) patients.MATERIALS AND METHODS: Two HNC cohorts (30 patients total) were retrospectively analyzed. One cohort was imaged with heterogenous acquisition parameters (HET cohort), whereas the other was imaged with homogenous acquisition parameters (HOM cohort). The standard deviation of cohort-level normalized mean intensity (SD NMI c), a metric of intensity consistency, was calculated across ROIs to determine the effect of five intensity standardization methods on T2-weighted images. For each cohort, a Friedman test followed by a post-hoc Bonferroni-corrected Wilcoxon signed-rank test was conducted to compare SD NMI c among methods. RESULTS: Consistency (SD NMI c across ROIs) between unstandardized images was substantially more impaired in the HET cohort (0.29 ± 0.08) than in the HOM cohort (0.15 ± 0.03). Consequently, corrected p-values for intensity standardization methods with lower SD NMI c compared to unstandardized images were significant in the HET cohort (p &lt; 0.05) but not significant in the HOM cohort (p &gt; 0.05). In both cohorts, differences between methods were often minimal and nonsignificant. CONCLUSIONS: Our findings stress the importance of intensity standardization, either through the utilization of uniform acquisition parameters or specific intensity standardization methods, and the need for testing intensity consistency before performing quantitative analysis of HNC MRI.</p

Physiological-based cord clamping in very preterm infants:the Aeration, Breathing, Clamping 3 (ABC3) trial—statistical analysis plan for a multicenter randomized controlled trial

Background: Mortality, cerebral injury, and necrotizing enterocolitis (NEC) are common complications of very preterm birth. An important risk factor for these complications is hemodynamic instability. Pre-clinical studies suggest that the timing of umbilical cord clamping affects hemodynamic stability during transition. Standard care is time-based cord clamping (TBCC), with clamping irrespective of lung aeration. It is unknown whether delaying cord clamping until lung aeration and ventilation have been established (physiological-based cord clamping, PBCC) is more beneficial. This document describes the statistical analyses for the ABC3 trial, which aims to assess the efficacy and safety of PBCC, compared to TBCC. Methods: The ABC3 trial is a multicenter, randomized trial investigating PBCC (intervention) versus TBCC (control) in very preterm infants. The trial is ethically approved. Preterm infants born before 30 weeks of gestation are randomized after parental informed consent. The primary outcome is intact survival, defined as the composite of survival without major cerebral injury and/or NEC. Secondary short-term outcomes are co-morbidities and adverse events assessed during NICU admission, parental reported outcomes, and long-term neurodevelopmental outcomes assessed at a corrected age of 2 years. To test the hypothesis that PBCC increases intact survival, a logistic regression model will be estimated using generalized estimating equations (accounting for correlation between siblings and observations in the same center) with treatment and gestational age as predictors. This plan is written and submitted without knowledge of the data. Discussion: The findings of this trial will provide evidence for future clinical guidelines on optimal cord clamping management at birth. Trial registration: ClinicalTrials.gov NCT03808051. Registered on 17 January 2019.</p

Stearoyl-CoA desaturase-1 impairs the reparative properties of macrophages and microglia in the brain

Failure of remyelination underlies the progressive nature of demyelinating diseases such as multiple sclerosis. Macrophages and microglia are crucially involved in the formation and repair of demyelinated lesions. Here we show that myelin uptake temporarily skewed these phagocytes toward a disease-resolving phenotype, while sustained intracellular accumulation of myelin induced a lesion-promoting phenotype. This phenotypic shift was controlled by stearoyl-CoA desaturase-1 (SCD1), an enzyme responsible for the desaturation of saturated fatty acids. Monounsaturated fatty acids generated by SCD1 reduced the surface abundance of the cholesterol efflux transporter ABCA1, which in turn promoted lipid accumulation and induced an inflammatory phagocyte phenotype. Pharmacological inhibition or phagocyte-specific deficiency of Scd1 accelerated remyelination ex vivo and in vivo. These findings identify SCD1 as a novel therapeutic target to promote remyelination

Prevalence and risk factors for HIV-1 infection in rural Kilimanjaro region of Tanzania: Implications for prevention and treatment

BACKGROUND: Variability in stages of the HIV-1 epidemic and hence HIV-1 prevalence exists in different areas in sub-Saharan Africa. The purpose of this study was to investigate the magnitude of HIV-1 infection and identify HIV-1 risk factors that may help to develop preventive strategies in rural Kilimanjaro, Tanzania. METHODS: A cross-sectional study was conducted between March and May of 2005 involving all individuals aged between 15–44 years having an address in Oria Village. All eligible individuals were registered and invited to participate. Participants were interviewed regarding their demographic characteristics, sexual behaviors, and medical history. Following a pre-test counseling, participants were offered an HIV test. RESULTS: Of the 2 093 eligible individuals, 1 528 (73.0%) participated. The overall age and sex adjusted HIV-1 prevalence was 5.6%. Women had 2.5 times higher prevalence (8.0% vs. 3.2%) as compared to men. The age group 25–44 years, marriage, separation and low education were associated with higher risk of HIV-1 infection for both sexes. HIV-1 infection was significantly associated with >2 sexual partners in the past 12 months (women: Adjusted odds ratio [AOR], 2.5 (95%CI: 1.3–4.7), and past 5 years, [(men: AOR, 2.2 (95%CI:1.2–5.6); women: AOR, 2.5 (95%CI: 1.4–4.0)], unprotected casual sex (men: AOR,1.8 95%CI: 1.2–5.8), bottled alcohol (Men: AOR, 5.9 (95%CI:1.7–20.1) and local brew (men: AOR, 3.7 (95%CI: 1.5–9.2). Other factors included treatment for genital ulcers and genital discharge in the past 1 month. Health-related complaints were more common among HIV-1 seropositive as compared to seronegative participants and predicted the presence of HIV-1 infection. CONCLUSION: HIV-1 infection was highly prevalent in this population. As compared to our previous findings, a shift of the epidemic from a younger to an older age group and from educated to uneducated individuals was observed. Women and married or separated individuals remained at higher risk of infection. To prevent further escalation of the HIV epidemic, efforts to scale up HIV prevention programmes addressing females, people with low education, lower age at marriage, alcohol consumption, condom use and multiple sexual partners for all age groups remains a top priority. Care and treatment are urgently needed for those infected in rural areas

HacA-Independent Functions of the ER Stress Sensor IreA Synergize with the Canonical UPR to Influence Virulence Traits in Aspergillus fumigatus

Endoplasmic reticulum (ER) stress is a condition in which the protein folding capacity of the ER becomes overwhelmed by an increased demand for secretion or by exposure to compounds that disrupt ER homeostasis. In yeast and other fungi, the accumulation of unfolded proteins is detected by the ER-transmembrane sensor IreA/Ire1, which responds by cleaving an intron from the downstream cytoplasmic mRNA HacA/Hac1, allowing for the translation of a transcription factor that coordinates a series of adaptive responses that are collectively known as the unfolded protein response (UPR). Here, we examined the contribution of IreA to growth and virulence in the human fungal pathogen Aspergillus fumigatus. Gene expression profiling revealed that A. fumigatus IreA signals predominantly through the canonical IreA-HacA pathway under conditions of severe ER stress. However, in the absence of ER stress IreA controls dual signaling circuits that are both HacA-dependent and HacA-independent. We found that a ΔireA mutant was avirulent in a mouse model of invasive aspergillosis, which contrasts the partial virulence of a ΔhacA mutant, suggesting that IreA contributes to pathogenesis independently of HacA. In support of this conclusion, we found that the ΔireA mutant had more severe defects in the expression of multiple virulence-related traits relative to ΔhacA, including reduced thermotolerance, decreased nutritional versatility, impaired growth under hypoxia, altered cell wall and membrane composition, and increased susceptibility to azole antifungals. In addition, full or partial virulence could be restored to the ΔireA mutant by complementation with either the induced form of the hacA mRNA, hacAi, or an ireA deletion mutant that was incapable of processing the hacA mRNA, ireAΔ10. Together, these findings demonstrate that IreA has both HacA-dependent and HacA-independent functions that contribute to the expression of traits that are essential for virulence in A. fumigatus

Episodic river flooding events revealed by palynological assemblages in Jurassic deposits of the Brent Group, North Sea

Spore and pollen (sporomorph) assemblages from Middle Jurassic marine deposits of the Brent Group in the northern North Sea are investigated to assess temporal and spatial variations in vegetation and depositional processes. Four wells were sampled for palynology from the Penguins Cluster and the Don North East fields through the Rannoch Formation shoreface succession. Hyperpycnite deposits occur throughout, but are concentrated within the lower part of the section. These are expressed by sand-prone beds displaying waxing and waning current motifs, normally graded muddy beds and structureless mudstones. Hyperpycnal/hypopycnal deposits resulting from episodic river flooding represent important sedimentary features as they may be preserved below fair weather wave base in more offshore settings and potentially be the only record of the former presence of a nearby river mouth. The hyperpycnites typically contain abundant Botryoccocus spp., Amorphous Organic Matter (AOM) and hinterland sporomorph taxa with relatively few marine components compared to associated marine shoreface facies. Variations in palynofacies assemblages and Botryococcus spp. abundances indicate frequent river mouth avulsion. Ordination of samples using non-metric multidimensional scaling (NMDS) indicates that shoreface samples of the sampled wells are relatively distinct, but hyperpycnite samples are highly similar regardless of their sampled well. This suggests that depositional processes and spore/pollen sources (i.e. catchment zones) were similar among hyperpycnite events across different wells. Abundant bisaccate pollen, Botryococcus spp. and AOM within interpreted hyperpycnites suggest sediment mixing along the fluvial drainage path during flooding events. The terrestrial signature of hyperpycnite sporomorph assemblages demonstrates that underflows remained coherent as they descended the shoreface profile with little turbulent mixing with ambient marine waters. Sporomorph assemblages display few large changes through time suggesting vegetation on the adjacent coastal plain was relatively static through the studied interval

Physiological-based cord clamping in very preterm infants: the Aeration, Breathing, Clamping 3 (ABC3) trial—statistical analysis plan for a multicenter randomized controlled trial

Background: Mortality, cerebral injury, and necrotizing enterocolitis (NEC) are common complications of very preterm birth. An important risk factor for these complications is hemodynamic instability. Pre-clinical studies suggest that the timing of umbilical cord clamping affects hemodynamic stability during transition. Standard care is time-based cord clamping (TBCC), with clamping irrespective of lung aeration. It is unknown whether delaying cord clamping until lung aeration and ventilation have been established (physiological-based cord clamping, PBCC) is more beneficial. This document describes the statistical analyses for the ABC3 trial, which aims to assess the efficacy and safety of PBCC, compared to TBCC. Methods: The ABC3 trial is a multicenter, randomized trial investigating PBCC (intervention) versus TBCC (control) in very preterm infants. The trial is ethically approved. Preterm infants born before 30 weeks of gestation are randomized after parental informed consent. The primary outcome is intact survival, defined as the composite of survival without major cerebral injury and/or NEC. Secondary short-term outcomes are co-morbidities and adverse events assessed during NICU admission, parental reported outcomes, and long-term neurodevelopmental outcomes assessed at a corrected age of 2 years. To test the hypothesis that PBCC increases intact survival, a logistic regression model will be estimated using generalized estimating equations (accounting for correlation between siblings and observations in the same center) with treatment and gestational age as predictors. This plan is written and submitted without knowledge of the data. Discussion: The findings of this trial will provide evidence for future clinical guidelines on optimal cord clamping management at birth. Trial registration: ClinicalTrials.gov NCT03808051. Registered on 17 January 2019