Novel Alert Visualization: The Development of a Visual Analytics Prototype for Mitigation of Malicious Insider Cyber Threats

Cyber insider threat is one of the most difficult risks to mitigate in organizations. However, innovative validated visualizations for cyber analysts to better decipher and react to detected anomalies has not been reported in literature or in industry. Attacks caused by malicious insiders can cause millions of dollars in losses to an organization. Though there have been advances in Intrusion Detection Systems (IDSs) over the last three decades, traditional IDSs do not specialize in anomaly identification caused by insiders. There is also a profuse amount of data being presented to cyber analysts when deciphering big data and reacting to data breach incidents using complex information systems. Information visualization is pertinent to the identification and mitigation of malicious cyber insider threats. The main goal of this study was to develop and validate, using Subject Matter Experts (SME), an executive insider threat dashboard visualization prototype. Using the developed prototype, an experimental study was conducted, which aimed to assess the perceived effectiveness in enhancing the analysts’ interface when complex data correlations are presented to mitigate malicious insiders cyber threats. Dashboard-based visualization techniques could be used to give full visibility of network progress and problems in real-time, especially within complex and stressful environments. For instance, in an Emergency Room (ER), there are four main vital signs used for urgent patient triage. Cybersecurity vital signs can give cyber analysts clear focal points during high severity issues. Pilots must expeditiously reference the Heads Up Display (HUD), which presents only key indicators to make critical decisions during unwarranted deviations or an immediate threat. Current dashboard-based visualization techniques have yet to be fully validated within the field of cybersecurity. This study developed a visualization prototype based on SME input utilizing the Delphi method. SMEs validated the perceived effectiveness of several different types of the developed visualization dashboard. Quantitative analysis of SME’s perceived effectiveness via self-reported value and satisfaction data as well as qualitative analysis of feedback provided during the experiments using the prototype developed were performed. This study identified critical cyber visualization variables and identified visualization techniques. The identifications were then used to develop QUICK.v™ a prototype to be used when mitigating potentially malicious cyber insider threats. The perceived effectiveness of QUICK.v™ was then validated. Insights from this study can aid organizations in enhancing cybersecurity dashboard visualizations by depicting only critical cybersecurity vital signs

Exploring the motivation behind cybersecurity insider threat and proposed research agenda

Cyber exploitation and malicious activities have become more sophisticated. Insider threat is one of the most significant cyber security threat vector, while posing a great concern to corporations and governments. An overview of the fundamental motivating forces and motivation theory are discussed. Such overview is provided to identify motivations that lead trusted employees to become insider threats in the context of cyber security. A research agenda with two sequential experimental research studies are outlined to address the challenge of insider threat mitigation by a prototype development. The first proposed study will classify data intake feeds, as recognized and weighted by cyber security experts, in an effort to establish predictive analytics of novel correlations of activities that may lead to cyber security incidents. It will also develop approach to identify how user activities can be compared against an established baseline, the user’s network cyber security pulse, with visualization of simulated users’ activities. Additionally, the second study will explain the process of assessing the usability of a developed visualization prototype that intends to present correlated suspicious activities requiring immediate action. Successfully developing the proposed prototype via feeds aggregation and an advanced visualization from the proposed research could assist in the mitigation of malicious insider threat

Co-ordinated multidisciplinary intervention to reduce time to successful extubation for children on mechanical ventilation: the SANDWICH cluster stepped-wedge RCT

BACKGROUND: Daily assessment of patient readiness for liberation from invasive mechanical ventilation can reduce the duration of ventilation. However, there is uncertainty about the effectiveness of this in a paediatric population. OBJECTIVES: To determine the effect of a ventilation liberation intervention in critically ill children who are anticipated to have a prolonged duration of mechanical ventilation (primary objective) and in all children (secondary objective). DESIGN: A pragmatic, stepped-wedge, cluster randomised trial with economic and process evaluations. SETTING: Paediatric intensive care units in the UK. PARTICIPANTS: Invasively mechanically ventilated children (aged < 16 years). INTERVENTIONS: The intervention incorporated co-ordinated multidisciplinary care, patient-relevant sedation plans linked to sedation assessment, assessment of ventilation parameters with a higher than usual trigger for undertaking an extubation readiness test and a spontaneous breathing trial on low levels of respiratory support to test extubation readiness. The comparator was usual care. Hospital sites were randomised sequentially to transition from control to intervention and were non-blinded. MAIN OUTCOME MEASURES: The primary outcome measure was the duration of invasive mechanical ventilation until the first successful extubation. The secondary outcome measures were successful extubation, unplanned extubation and reintubation, post-extubation use of non-invasive ventilation, tracheostomy, post-extubation stridor, adverse events, length of intensive care and hospital stay, mortality and cost per respiratory complication avoided at 28 days. RESULTS: The trial included 10,495 patient admissions from 18 paediatric intensive care units from 5 February 2018 to 14 October 2019. In children with anticipated prolonged ventilation (n = 8843 admissions: control, n = 4155; intervention, n = 4688), the intervention resulted in a significantly shorter time to successful extubation [cluster and time-adjusted median difference -6.1 hours (interquartile range -8.2 to -5.3 hours); adjusted hazard ratio 1.11, 95% confidence interval 1.02 to 1.20; p = 0.02] and a higher incidence of successful extubation (adjusted relative risk 1.01, 95% confidence interval 1.00 to 1.02; p = 0.03) and unplanned extubation (adjusted relative risk 1.62, 95% confidence interval 1.05 to 2.51; p = 0.03), but not reintubation (adjusted relative risk 1.10, 95% confidence interval 0.89 to 1.36; p = 0.38). In the intervention period, the use of post-extubation non-invasive ventilation was significantly higher (adjusted relative risk 1.22, 95% confidence interval 1.01 to 1.49; p = 0.04), with no evidence of a difference in intensive care length of stay or other harms, but hospital length of stay was longer (adjusted hazard ratio 0.89, 95% confidence interval 0.81 to 0.97; p = 0.01). Findings for all children were broadly similar. The control period was associated with lower, but not statistically significantly lower, total costs (cost difference, mean £929.05, 95% confidence interval -£516.54 to £2374.64) and significantly fewer respiratory complications avoided (mean difference -0.10, 95% confidence interval -0.16 to -0.03). LIMITATIONS: The unblinded intervention assignment may have resulted in performance or detection bias. It was not possible to determine which components were primarily responsible for the observed effect. Treatment effect in a more homogeneous group remains to be determined. CONCLUSIONS: The intervention resulted in a statistically significant small reduction in time to first successful extubation; thus, the clinical importance of the effect size is uncertain. FUTURE WORK: Future work should explore intervention sustainability and effects of the intervention in other paediatric populations

Effectiveness of a childhood obesity prevention programme delivered through schools, targeting 6 and 7 year olds: cluster randomised controlled trial (WAVES study).

OBJECTIVE: To assess the effectiveness of a school and family based healthy lifestyle programme (WAVES intervention) compared with usual practice, in preventing childhood obesity. DESIGN: Cluster randomised controlled trial. SETTING: UK primary schools from the West Midlands. PARTICIPANTS: 200 schools were randomly selected from all state run primary schools within 35 miles of the study centre (n=980), oversampling those with high minority ethnic populations. These schools were randomly ordered and sequentially invited to participate. 144 eligible schools were approached to achieve the target recruitment of 54 schools. After baseline measurements 1467 year 1 pupils aged 5 and 6 years (control: 28 schools, 778 pupils) were randomised, using a blocked balancing algorithm. 53 schools remained in the trial and data on 1287 (87.7%) and 1169 (79.7%) pupils were available at first follow-up (15 month) and second follow-up (30 month), respectively. INTERVENTIONS: The 12 month intervention encouraged healthy eating and physical activity, including a daily additional 30 minute school time physical activity opportunity, a six week interactive skill based programme in conjunction with Aston Villa football club, signposting of local family physical activity opportunities through mail-outs every six months, and termly school led family workshops on healthy cooking skills. MAIN OUTCOME MEASURES: The protocol defined primary outcomes, assessed blind to allocation, were between arm difference in body mass index (BMI) z score at 15 and 30 months. Secondary outcomes were further anthropometric, dietary, physical activity, and psychological measurements, and difference in BMI z score at 39 months in a subset. RESULTS: Data for primary outcome analyses were: baseline, 54 schools: 1392 pupils (732 controls); first follow-up (15 months post-baseline), 53 schools: 1249 pupils (675 controls); second follow-up (30 months post-baseline), 53 schools: 1145 pupils (621 controls). The mean BMI z score was non-significantly lower in the intervention arm compared with the control arm at 15 months (mean difference -0.075 (95% confidence interval -0.183 to 0.033, P=0.18) in the baseline adjusted models. At 30 months the mean difference was -0.027 (-0.137 to 0.083, P=0.63). There was no statistically significant difference between groups for other anthropometric, dietary, physical activity, or psychological measurements (including assessment of harm). CONCLUSIONS: The primary analyses suggest that this experiential focused intervention had no statistically significant effect on BMI z score or on preventing childhood obesity. Schools are unlikely to impact on the childhood obesity epidemic by incorporating such interventions without wider support across multiple sectors and environments. TRIAL REGISTRATION: Current Controlled Trials ISRCTN97000586.This study was funded by the National Institute for Health Research (NIHR) Health Technology Assessment Programme (project reference No 06/85/11)

Rapid research needs appraisal methodology

The aim is to develop a rigorous, transparent and replicable methodology for researchers and clinicians to conduct an accelerated evidence review at the early stages of an epidemic to identify key knowledge gaps to prioritise patient-centred clinical research

A rapid research needs appraisal methodology to identify evidence gaps to inform clinical research priorities in response to outbreaks-results from the Lassa fever pilot

Abstract Background: Infectious disease epidemics are a constant threat, and while we can strengthen preparedness in advance, inevitably, we will sometimes be caught unaware by novel outbreaks. To address the challenge of rapidly identifying clinical research priorities in those circumstances, we developed and piloted a protocol for carrying out a systematic, rapid research needs appraisal (RRNA) of existing evidence within 5 days in response to outbreaks globally, with the aim to inform clinical research prioritization. Methods: The protocol was derived from rapid review methodologies and optimized through effective use of predefined templates and global time zones. It was piloted using a Lassa fever (LF) outbreak scenario. Databases were searched from 1969 to July 2017. Systematic reviewers based in Canada, the UK, and the Philippines screened and extracted data using a systematic review software. The pilot was evaluated through internal analysis and by comparing the research priorities identified from the data, with those identified by an external LF expert panel. Results: The RRNA pilot was completed within 5 days. To accommodate the high number of articles identified, data extraction was prioritized by study design and year, and the clinical research prioritization done post-day 5. Of 118 potentially eligible articles, 52 met the data extraction criteria, of which 46 were extracted within the 5-day time frame. The RRNA team identified 19 clinical research priorities; the expert panel independently identified 21, of which 11 priorities overlapped. Each method identified a unique set of priorities, showing that combining both methods for clinical research prioritization is more robust than using either method alone. Conclusions: This pilot study shows that it is feasible to carry out a systematic RRNA within 5 days in response to a (re-) emerging outbreak to identify gaps in existing evidence, as long as sufficient resources are identified, and reviewers are experienced and trained in advance. Use of an online systematic review software and global time zones effectively optimized resources. Another 3 to 5 days are recommended for review of the extracted data and to formulate clinical research priorities. The RRNA can be used for a “Disease X” scenario and should optimally be combined with an expert panel to ensure breadth and depth of coverage of clinical research priorities. Keywords: Emerging infectious diseases, Clinical research priorities, Outbreak response, Lassa fever, Rapid research needs appraisal methodolog

Effects of antiplatelet therapy on stroke risk by brain imaging features of intracerebral haemorrhage and cerebral small vessel diseases: subgroup analyses of the RESTART randomised, open-label trial

Background Findings from the RESTART trial suggest that starting antiplatelet therapy might reduce the risk of recurrent symptomatic intracerebral haemorrhage compared with avoiding antiplatelet therapy. Brain imaging features of intracerebral haemorrhage and cerebral small vessel diseases (such as cerebral microbleeds) are associated with greater risks of recurrent intracerebral haemorrhage. We did subgroup analyses of the RESTART trial to explore whether these brain imaging features modify the effects of antiplatelet therapy

Global health trials methodological research agenda: results from a priority setting exercise

Background Methodological research into the design, conduct, analysis and reporting of trials is essential to optimise the process. UK specialists in the field have established a set of top priorities in aid of this research. These priorities, however, may not be reflected in the needs of similar research in low- to middle-income countries (LMICs) with different healthcare provision, resources and research infrastructure. The aim of the study was to identify the top priorities for methodological research in LMICs to inform further research and ultimately to improve clinical trials in these regions. Methods An online, two-round survey was conducted from December 2016 to April 2017 amongst researchers and methodologists working on trials in LMICs. The first round required participants to suggest between three and six topics which they felt were priorities for trial methodological research in LMICs. The second round invited participants to grade the importance of a compulsory list of topics suggested by four or more individuals, and an optional list of the remaining topics. Findings Rounds 1 and 2 were completed by 412 and 314 participants, respectively. A wide spread of years of experience, discipline, current country of residence, origin of trials training and area of involvement in trials was reported. The topics deemed most important for methodological research were: choosing appropriate outcomes to measure and training of research staff. Conclusion By presenting these top priorities we have the foundations of a global health trials methodological research agenda which we hope will foster future research in specific areas in order to increase and improve trials in LMICs.</p

Effects of antiplatelet therapy after stroke due to intracerebral haemorrhage (RESTART): a randomised, open-label trial

Background: Antiplatelet therapy reduces the risk of major vascular events for people with occlusive vascular disease, although it might increase the risk of intracranial haemorrhage. Patients surviving the commonest subtype of intracranial haemorrhage, intracerebral haemorrhage, are at risk of both haemorrhagic and occlusive vascular events, but whether antiplatelet therapy can be used safely is unclear. We aimed to estimate the relative and absolute effects of antiplatelet therapy on recurrent intracerebral haemorrhage and whether this risk might exceed any reduction of occlusive vascular events. Methods: The REstart or STop Antithrombotics Randomised Trial (RESTART) was a prospective, randomised, open-label, blinded endpoint, parallel-group trial at 122 hospitals in the UK. We recruited adults (≥18 years) who were taking antithrombotic (antiplatelet or anticoagulant) therapy for the prevention of occlusive vascular disease when they developed intracerebral haemorrhage, discontinued antithrombotic therapy, and survived for 24 h. Computerised randomisation incorporating minimisation allocated participants (1:1) to start or avoid antiplatelet therapy. We followed participants for the primary outcome (recurrent symptomatic intracerebral haemorrhage) for up to 5 years. We analysed data from all randomised participants using Cox proportional hazards regression, adjusted for minimisation covariates. This trial is registered with ISRCTN (number ISRCTN71907627). Findings: Between May 22, 2013, and May 31, 2018, 537 participants were recruited a median of 76 days (IQR 29–146) after intracerebral haemorrhage onset: 268 were assigned to start and 269 (one withdrew) to avoid antiplatelet therapy. Participants were followed for a median of 2·0 years (IQR [1·0– 3·0]; completeness 99·3%). 12 (4%) of 268 participants allocated to antiplatelet therapy had recurrence of intracerebral haemorrhage compared with 23 (9%) of 268 participants allocated to avoid antiplatelet therapy (adjusted hazard ratio 0·51 [95% CI 0·25–1·03]; p=0·060). 18 (7%) participants allocated to antiplatelet therapy experienced major haemorrhagic events compared with 25 (9%) participants allocated to avoid antiplatelet therapy (0·71 [0·39–1·30]; p=0·27), and 39 [15%] participants allocated to antiplatelet therapy had major occlusive vascular events compared with 38 [14%] allocated to avoid antiplatelet therapy (1·02 [0·65–1·60]; p=0·92). Interpretation: These results exclude all but a very modest increase in the risk of recurrent intracerebral haemorrhage with antiplatelet therapy for patients on antithrombotic therapy for the prevention of occlusive vascular disease when they developed intracerebral haemorrhage. The risk of recurrent intracerebral haemorrhage is probably too small to exceed the established benefits of antiplatelet therapy for secondary prevention

Effects of antiplatelet therapy after stroke due to intracerebral haemorrhage (RESTART): a randomised, open-label trial

Background: Antiplatelet therapy reduces the risk of major vascular events for people with occlusive vascular disease, although it might increase the risk of intracranial haemorrhage. Patients surviving the commonest subtype of intracranial haemorrhage, intracerebral haemorrhage, are at risk of both haemorrhagic and occlusive vascular events, but whether antiplatelet therapy can be used safely is unclear. We aimed to estimate the relative and absolute effects of antiplatelet therapy on recurrent intracerebral haemorrhage and whether this risk might exceed any reduction of occlusive vascular events. Methods: The REstart or STop Antithrombotics Randomised Trial (RESTART) was a prospective, randomised, open-label, blinded endpoint, parallel-group trial at 122 hospitals in the UK. We recruited adults (≥18 years) who were taking antithrombotic (antiplatelet or anticoagulant) therapy for the prevention of occlusive vascular disease when they developed intracerebral haemorrhage, discontinued antithrombotic therapy, and survived for 24 h. Computerised randomisation incorporating minimisation allocated participants (1:1) to start or avoid antiplatelet therapy. We followed participants for the primary outcome (recurrent symptomatic intracerebral haemorrhage) for up to 5 years. We analysed data from all randomised participants using Cox proportional hazards regression, adjusted for minimisation covariates. This trial is registered with ISRCTN (number ISRCTN71907627). Findings: Between May 22, 2013, and May 31, 2018, 537 participants were recruited a median of 76 days (IQR 29–146) after intracerebral haemorrhage onset: 268 were assigned to start and 269 (one withdrew) to avoid antiplatelet therapy. Participants were followed for a median of 2·0 years (IQR [1·0– 3·0]; completeness 99·3%). 12 (4%) of 268 participants allocated to antiplatelet therapy had recurrence of intracerebral haemorrhage compared with 23 (9%) of 268 participants allocated to avoid antiplatelet therapy (adjusted hazard ratio 0·51 [95% CI 0·25–1·03]; p=0·060). 18 (7%) participants allocated to antiplatelet therapy experienced major haemorrhagic events compared with 25 (9%) participants allocated to avoid antiplatelet therapy (0·71 [0·39–1·30]; p=0·27), and 39 [15%] participants allocated to antiplatelet therapy had major occlusive vascular events compared with 38 [14%] allocated to avoid antiplatelet therapy (1·02 [0·65–1·60]; p=0·92). Interpretation: These results exclude all but a very modest increase in the risk of recurrent intracerebral haemorrhage with antiplatelet therapy for patients on antithrombotic therapy for the prevention of occlusive vascular disease when they developed intracerebral haemorrhage. The risk of recurrent intracerebral haemorrhage is probably too small to exceed the established benefits of antiplatelet therapy for secondary prevention