Searching System Call Information for Clues: The Effects of Intrusions of Processes

The United States Air Force extensively uses information systems as a tool managing and maintaining its information. The increased dependence on these systems in recent years has necessitated the need for protection front threats of information warfare and cyber terrorism. One type of protection utilizes intrusion detection systems to provide indications that intrusive behavior has occurred. Other types of protection may include packet filtering, cryptography and strong user authentication. Traditional approaches toward intrusion detection rely on features that are external to computer processes. By treating processes as black-boxes, intrusion detection systems may miss a wealth of information that could be useful for detecting intrusions. This thesis effort investigate the effectiveness of anomaly-based intrusion detection using system call information from a computational process. Previous work uses sequences of system calls to identity anomalies in processes. Instead of sequences of system calls, information associated with each system call is used to build a profile of normality that may be used to detect a process deviation. Such information includes parameters passed, results returned and the instruction pointer associated with the system call. Three methods of detecting deviations are evaluated for this problem. These include direct matching, relaxed matching and artificial immune system matching techniques. The test data used includes stack-based buffer overflows, heap-based buffer overflows and file binding race conditions. Results from this effort show that although attempted exploits were difficult to detect, certain actual exploits were easily detectable from system call information. In addition, each of the matching approaches provides some indication of anomalous behavior, however each has strengths and limitations. This effort is considered a piece of the defense-in- depth model of intrusion detection

Coherent resonant tunneling in ac fields

We have analyzed the tunneling transmission probability and electronic current density through resonant heterostructures in the presence of an external electromagnetic field. In this work, we compare two different models for a double barrier : In the first case the effect of the external field is taken into account by spatially dependent AC voltages and in the second one the electromagnetic field is described in terms of a photon field that irradiates homogeneously the whole sample. While in the first description the tunneling takes place mainly through photo sidebands in the case of homogeneous illumination the main effective tunneling channels correspond to the coupling between different electronic states due to photon absorption and emission. The difference of tunneling mechanisms between these configurations is strongly reflected in the transmission and current density which present very different features in both cases. In order to analyze these effects we have obtained, within the Transfer Hamiltonian framework, a general expression for the transition probability for coherent resonant tunneling in terms of the Green's function of the system.Comment: 16 pages,Figures available upon request,to appear in Phys.Rev B (15 April 1996

Domain Restriction Zones: An Evolution of the Military Exclusion Zone

Since the early part of the twenty-first century, US adversaries have expanded their military capabilities within and their access to new warfighting domains. When faced with the growth of adversaries’ asymmetric capabilities, the means, tactics, and strategies previously used by the US military lose their proportional effectiveness. To avoid such degradation of capability, the operational concept of the military exclusion zone (MEZ) should be revised to suit the modern battlespace while also addressing the shifts in national policy that encourage diplomacy over military force. The concept and development of domain restriction zones (DRZs) increase the relevancy of traditional MEZs in the modern battlespace, allowing them to address problems associated with cross-domain and multidomain capabilities. The growth of adversary capabilities provides a clear rationale for the implementation of DRZs through all levels of force application within the competition continuum

Bacterial Deposition of Gold on Hair: Archeological, Forensic and Toxicological Implications

Trace metal analyses in hair are used in archeological, forensic and toxicological investigations as proxies for metabolic processes. We show metallophilic bacteria mediating the deposition of gold (Au), used as tracer for microbial activity in hair post mortem after burial, affecting results of such analyses. Methodology/Principal Findings Human hair was incubated for up to six months in auriferous soils, in natural soil columns (Experiment 1), soils amended with mobile Au(III)-complexes (Experiment 2) and the Au-precipitating bacterium Cupriavidus metallidurans (Experiment 3), in peptone-meat-extract (PME) medium in a culture of C. metallidurans amended with Au(III)-complexes (Experiment 4), and in non-auriferous soil (Experiment 5). Hair samples were analyzed using scanning electron microscopy, confocal microscopy and inductively coupled plasma-mass spectrometry. In Experiments 1–4 the Au content increased with time (P = 0.038). The largest increase was observed in Experiment 4 vs. Experiment 1 (mean = 1188 vs. 161 µg Kg−1, Fisher's least significance 0.001). The sulfur content, a proxy for hair metabolism, remained unchanged. Notably, the ratios of Au-to-S increased with time (linear trend P = 0.02) and with added Au and bacteria (linear trend, P = 0.005), demonstrating that larger populations of Au-precipitating bacteria and increased availability of Au increased the deposition of Au on the hair. Conclusion/Significance Interactions of soil biota with hair post mortem may distort results of hair analyses, implying that metal content, microbial activities and the duration of burial must be considered in the interpretation of results of archeological, forensic and toxicological hair analyses, which have hitherto been proxies for pre-mortem metabolic processesGenevieve Phillips, Frank Reith, Clifford Qualls, Abdul-Mehdi Ali, Mike Spilde and Otto Appenzelle

Battlespace Next™: Developing a Serious Game to Explore Multi-domain Operations

Changes in the geopolitical landscape and increasing technological complexity have prompted the U.S. Military to coin the terms Multi-Domain Operations (MDO) and Joint All-Domain Command and Control (JADC2) as over-arching strategy to frame the complexity of warfare across both traditional and emerging warfighting domains. Teaching new concepts associated with these terms requires both innovation as well as distinct education and training tools in order to realize the cultural change advocated by senior military leaders. Battlespace Next™ (BSN) is a serious game designed to teach concepts integral to MDO and initiate discussion on military strategy while conserving time, money, and manpower. BSN, a Collectable Card Game (CCG), is engineered to provide an engaging learning tool that educates on capabilities in a multi-domain conflict. This paper proposes an extensible game framework for modeling and reasoning about MDO concepts and presents our empirical feedback from over 120 military play testers evaluating a moderate to difficult version of the game. Results reveal the game teaches MDO concepts and delivers an engaging, hands-on learning experience. Specifically, we provide evidence it improved military readiness in seven areas of MDO in at least 62% of participants and 76% of respondents reported they enjoyed playing the game

A whole-cell biosensor for the detection of gold

Geochemical exploration for gold (Au) is becoming increasingly important to the mining industry. Current processes for Au analyses require sampling materials to be taken from often remote localities. Samples are then transported to a laboratory equipped with suitable analytical facilities, such as Inductively Coupled Plasma-Mass Spectrometry (ICP-MS) or Instrumental Neutron Activation Analysis (INAA). Determining the concentration of Au in samples may take several weeks, leading to long delays in exploration campaigns. Hence, a method for the on-site analysis of Au, such as a biosensor, will greatly benefit the exploration industry. The golTSB genes from Salmonella enterica serovar typhimurium are selectively induced by Au(I/III)-complexes. In the present study, the golTSB operon with a reporter gene, lacZ, was introduced into Escherichia coli. The induction of golTSB::lacZ with Au(I/III)-complexes was tested using a colorimetric β-galactosidase and an electrochemical assay. Measurements of the β-galactosidase activity for concentrations of both Au(I)- and Au(III)-complexes ranging from 0.1 to 5 µM (equivalent to 20 to 1000 ng g⁻¹ or parts-per-billion (ppb)) were accurately quantified. When testing the ability of the biosensor to detect Au(I/III)-complexes(aq) in the presence of other metal ions (Ag(I), Cu(II), Fe(III), Ni(II), Co(II), Zn, As(III), Pb(II), Sb(III) or Bi(III)), cross-reactivity was observed, i.e. the amount of Au measured was either under- or over-estimated. To assess if the biosensor would work with natural samples, soils with different physiochemical properties were spiked with Au-complexes. Subsequently, a selective extraction using 1 M thiosulfate was applied to extract the Au. The results showed that Au could be measured in these extracts with the same accuracy as ICP-MS (P<0.05). This demonstrates that by combining selective extraction with the biosensor system the concentration of Au can be accurately measured, down to a quantification limit of 20 ppb (0.1 µM) and a detection limit of 2 ppb (0.01 µM).Carla M. Zammit, Davide Quaranta, Shane Gibson, Anita J. Zaitouna, Christine Ta, Joël Brugger, Rebecca Y. Lai, Gregor Grass, Frank Reit

Edging your bets: advantage play, gambling, crime and victimisation

Consumerism, industrial development and regulatory liberalisation have underpinned the ascendance of gambling to a mainstream consumption practice. In particular, the online gambling environment has been marketed as a site of ‘safe risks’ where citizens can engage in a multitude of different forms of aleatory consumption. This paper offers a virtual ethnography of an online ‘advantage play’ subculture. It demonstrates how advantage players have reinterpreted the online gambling landscape as an environment saturated with crime and victimisation. In this virtual world, advantage play is no longer simply an instrumental act concerned with profit accumulation to finance consumer desires. Rather, it acts as an opportunity for individuals to engage in a unique form of edgework, whereby the threat to one’s well-being is tested through an ability to avoid crime and victimisation. This paper demonstrates how mediated environments may act as sites for edgeworking and how the potential for victimisation can be something that is actively engaged with

Problem gambling: a suitable case for social work?

Problem gambling attracts little attention from health and social care agencies in the UK. Prevalence surveys suggest that 0.6% of the population are problem gamblers and it is suggested that for each of these individuals, 10–17 other people, including children and other family members, are affected. Problem gambling is linked to many individual and social problems including: depression, suicide, significant debt, bankruptcy, family conflict, domestic violence, neglect and maltreatment of children and offending. This makes the issue central to social work territory. Yet, the training of social workers in the UK has consistently neglected issues of addictive behaviour. Whilst some attention has been paid in recent years to substance abuse issues, there has remained a silence in relation to gambling problems. Social workers provide more help for problems relating to addictions than other helping professions. There is good evidence that treatment, and early intervention for gambling problems, including psycho-social and public health approaches, can be very effective. This paper argues that problem gambling should be moved onto the radar of the social work profession, via inclusion on qualifying and post-qualifying training programmes and via research and dissemination of good practice via institutions such as the Social Care Institute for Excellence (SCIE). Keywords: problem gambling; addictive behaviour; socia

Impact of Type II LRRK2 inhibitors on signaling and mitophagy

Much effort has been devoted to the development of selective inhibitors of the LRRK2 as a potential treatment for LRRK2 driven Parkinson's disease. In this study, we first compare the properties of Type I (GSK3357679A and MLi-2) and Type II (GZD-824, Rebastinib and Ponatinib) kinase inhibitors that bind to the closed or open conformations of the LRRK2 kinase domain, respectively. We show that Type I and Type II inhibitors suppress phosphorylation of Rab10 and Rab12, key physiological substrates of LRRK2 and also promote mitophagy, a process suppressed by LRRK2. Type II inhibitors also display higher potency towards wild-type LRRK2 compared with pathogenic mutants. Unexpectedly, we find that Type II inhibitors, in contrast with Type I compounds, fail to induce dephosphorylation of a set of well-studied LRRK2 biomarker phosphorylation sites at the N-terminal region of LRRK2, including Ser935. These findings emphasize that the biomarker phosphorylation sites on LRRK2 are likely reporting on the open vs closed conformation of LRRK2 kinase and that only inhibitors which stabilize the closed conformation induce dephosphorylation of these biomarker sites. Finally, we demonstrate that the LRRK2[A2016T] mutant which is resistant to MLi-2 Type 1 inhibitor, also induces resistance to GZD-824 and Rebastinib suggesting this mutation could be exploited to distinguish off target effects of Type II inhibitors. Our observations provide a framework of knowledge to aid with the development of more selective Type II LRRK2 inhibitors

T Cell Priming by Activated Nlrc5-Deficient Dendritic Cells Is Unaffected despite Partially Reduced MHC Class I Levels.

NLRC5, a member of the NOD-like receptor (NLR) protein family, has recently been characterized as the master transcriptional regulator of MHCI molecules in lymphocytes, in which it is highly expressed. However, its role in activated dendritic cells (DCs), which are instrumental to initiate T cell responses, remained elusive. We show in this study that, following stimulation of DCs with inflammatory stimuli, not only did NLRC5 level increase, but also its importance in directing MHCI transcription. Despite markedly reduced mRNA and intracellular H2-K levels, we unexpectedly observed nearly normal H2-K surface display in Nlrc5(-/-) DCs. Importantly, this discrepancy between a strong intracellular and a mild surface defect in H2-K levels was observed also in DCs with H2-K transcription defects independent of Nlrc5. Hence, alongside with demonstrating the importance of NLRC5 in MHCI transcription in activated DCs, we uncover a general mechanism counteracting low MHCI surface expression. In agreement with the decreased amount of neosynthesized MHCI, Nlrc5(-/-) DCs exhibited a defective capacity to display endogenous Ags. However, neither T cell priming by endogenous Ags nor cross-priming ability was substantially affected in activated Nlrc5(-/-) DCs. Altogether, these data show that Nlrc5 deficiency, despite significantly affecting MHCI transcription and Ag display, is not sufficient to hinder T cell activation, underlining the robustness of the T cell priming process by activated DCs