Tracking Cyber Adversaries with Adaptive Indicators of Compromise

A forensics investigation after a breach often uncovers network and host indicators of compromise (IOCs) that can be deployed to sensors to allow early detection of the adversary in the future. Over time, the adversary will change tactics, techniques, and procedures (TTPs), which will also change the data generated. If the IOCs are not kept up-to-date with the adversary's new TTPs, the adversary will no longer be detected once all of the IOCs become invalid. Tracking the Known (TTK) is the problem of keeping IOCs, in this case regular expressions (regexes), up-to-date with a dynamic adversary. Our framework solves the TTK problem in an automated, cyclic fashion to bracket a previously discovered adversary. This tracking is accomplished through a data-driven approach of self-adapting a given model based on its own detection capabilities. In our initial experiments, we found that the true positive rate (TPR) of the adaptive solution degrades much less significantly over time than the naive solution, suggesting that self-updating the model allows the continued detection of positives (i.e., adversaries). The cost for this performance is in the false positive rate (FPR), which increases over time for the adaptive solution, but remains constant for the naive solution. However, the difference in overall detection performance, as measured by the area under the curve (AUC), between the two methods is negligible. This result suggests that self-updating the model over time should be done in practice to continue to detect known, evolving adversaries.Comment: This was presented at the 4th Annual Conf. on Computational Science & Computational Intelligence (CSCI'17) held Dec 14-16, 2017 in Las Vegas, Nevada, US

A Riemann solver at a junction compatible with a homogenization limit

We consider a junction regulated by a traffic lights, with n incoming roads and only one outgoing road. On each road the Phase Transition traffic model, proposed in [6], describes the evolution of car traffic. Such model is an extension of the classic Lighthill-Whitham-Richards one, obtained by assuming that different drivers may have different maximal speed. By sending to infinity the number of cycles of the traffic lights, we obtain a justification of the Riemann solver introduced in [9] and in particular of the rule for determining the maximal speed in the outgoing road.Comment: 19 page

Schematic representation of the PCR DNA fragments ThyA-F, ThyA-Δ3′, ΔThyA and X-thyAΔ3′-X′

<p><b>Copyright information:</b></p><p>Taken from "Efficient and seamless DNA recombineering using a thymidylate synthase A selection system in "</p><p>Nucleic Acids Research 2005;33(6):e59-e59.</p><p>Published online 30 Mar 2005</p><p>PMCID:PMC1072810.</p><p>© The Author 2005. Published by Oxford University Press. All rights reserved</p> () PCR amplification using primers thyA-F1 and thyA-R1 () amplifies a 1470 bp fragment (thyA-FL) of the gene containing the promoter, Factor Sigma 54 binding site and the transcription termination flanking the start and stop codons for translation. The 1124 bp product, thyA-Δ3′, amplified using primers thyA-F1 and thyA-R3 (), lacks 347 bp 3′ of the transcription terminator. ΔthyA is a 744 bp product generated by overlapping PCR (see Materials and Methods for details) with most of the coding sequence deleted (+123 to +848; relative to the translational start site), and Δ in the diagram represents the deleted region. X-thyAΔ3′-X′ is a fusion product amplified using primers ColX-thyAF and ColX-thyAR with 5′ and 3′ overhang sequences for the regions of the gene for homologous recombination. () Schematic representation of the strategy for the generation of the ColX-G18D fragment. Two PCR products were first generated using primer sets, ColX-F/ColX-mR and ColX-mF/ColX-R. These products, containing complementary sequences from primers ColX-mF and ColX-mR, were used in an overlapping PCR to produce ColX-G18G using primers ColX-F and ColX-R. () Schematic representation for the amplification of a PCR product from a plasmid, pG18D-Flag, using primers ColX-F and ColX-R. pG18D-Flag contains mutations (bold and underlined) around the signal peptide cleavage site of collagen X, and a Flag sequence inserted at the 3′ region of exon 2 (shaded region)

The Signal for the Altered Differentiation of 13del HCs Is Cell Autonomous

<div><p>Analyses of EGFP/wt and EGFP/13del chimeras.</p> <p>(A, B, and C) In EGFP/13del chimeras, normal (wt) cells express EGFP.</p> <p>(D, E, and F) 13del cells are identified by in situ hybridization with a 64-bp probe specific for the <i>13del</i> transcripts. (D′) shows expression of <i>Col10a1</i> in the normal EGFP/wt chimera (consecutive section).</p> <p>(G–I) Immunohistochemical detection for BiP.</p> <p>(J–L) Immunohistochemical detection for p57^Kip2.</p> <p>(M–O) In situ hybridization for <i>Ppr</i>. The insets in (M) and (N) show regions in the LHZ containing wt and 13del cells, respectively, at higher magnification. (N) shows marked re-expression of <i>Ppr</i> in 13del cells.</p> <p>Chondro-osseous junctions are traced using a red or yellow line. Color contrast of (A–C) and (G–L) was adjusted as described in Materials and Methods. Bar indicates 100 μm.</p></div

Intracellular Accumulation of 13del Proteins

<div><p>(A) In situ hybridization for wt <i>Col10a1</i> or <i>13del</i> transcripts at 10-d-old proximal tibial growth plates.</p> <p>(B) Immunofluorescence of cryosections immunostained with a 13del-specific antibody (13del Ab, green fluorescence). Absence of staining in the HZ of wt littermates showed the antibody is specific for 13del protein (<a href="http://www.plosbiology.org/article/info:doi/10.1371/journal.pbio.0050044#pbio-0050044-g001" target="_blank">Figure 1</a>G, wt panel). Red fluorescence signal marks concanavalin A (ConA) in the ER. Localization of 13del proteins within the ER (yellow) is shown by the overlapping green and red fluorescence signals. Insets show extracellular immunostaining for normal collagen X in wt and 13del mice.</p> <p>(C) Immunohistochemistry using 13del-specific antibody on paraffin-embedded proximal tibial growth plate sections. Specific staining (brown) was seen only in 13del HZ. The sections were not counterstained in order to access the intensity of staining more easily. Bar indicates 100 μm.</p></div

ERSS in <i>cmd/cmd</i> Mutant and a Model for Surviving ER Stress

<div><p>(A) ERSS and disrupted chondrocyte differentiation in the growth plate of the <i>cmd/cmd</i> mutant. Immunohistochemical detection of BiP, P57^Kip2, PCNA, and collagen X (ColX) in the tibial growth plates of 18.5 dpc fetus. Color contrast of these images was adjusted as described in Materials and Methods. Bar indicates 100 μm.</p> <p>(B) Comparative summary of expression pattern for molecular markers in the growth plate in wt and 13del mice.</p> <p>(C) Model for the reprogramming of HCs in 13del transgenic mice expressing unfolded collagen X.</p> <p>AC, zone containing abnormal chondrocytes; p53(c), cytoplasmic localized p53.</p></div

Impaired Collagen X Assembly and Growth Plate Abnormality

<div><p>(A) Cell-free translation demonstrating normal assembly of wt α-chains into α1(X)₃ homotrimers, but impaired assembly of 13del α-chains into trimers. Heterotrimers, which would migrate slightly faster than the α1(X)₃ homotrimers, are absent.</p> <p>(B) Diagram of the 10.4-kb <i>Col10a1-13del</i> transgene. The NC1-encoding domain is indicated by the shaded region.</p> <p>(C) Ten-week-old wt and 13del mice.</p> <p>(D) Left: histology of the proximal tibial growth plates of 10-d-old (10d) and 4-wk-old (4wk) wt and 13del mice. Right: differences in the total height of the growth plate and in the heights of the RZ, PZ, and HZ between wt and 13del mice in each age group (10 d [<i>n</i> = 6] and 4 wk [<i>n</i> = 13]). Bar indicates 100 μm.</p> <p>(E) Retarded longitudinal bone growth in 13del mice. Calcein (10 mg/kg body weight) was injected intraperitoneally into 5-d-old mice that were sacrificed 5 d later. Sections of proximal tibia were examined in an incident-light fluorescence microscope. The distances at different positions between the zone of vascular invasion at the growth plate and the proximal endpoint of the calcein label in the trabecular bone were determined using a micrometric eyepiece. The mean distance represented the rate of longitudinal bone growth over 5 d. Error bars represent ±1 standard deviation (SD). Longitudinal growth was retarded in 13del mice over 5–10 d, being only about half that in wt littermates (0.498 ± 0.013 mm for wt and 0.277 ± 0.025 mm for 13del; <i>n</i> = 3 for each genotype; <i>p</i> = 5.2 × 10⁻⁶).</p> <p>(F) RNase protection assay. The protected fragments of [α-³³P]UTP-labeled probes when hybridized with wt <i>Col10a1</i> transcript are 354 bases; whereas hybridization with 13del transcripts gives two fragments of 201 bases and 140 bases (the unpaired 13 bases are digested by RNase).</p> <p>PS, primary spongiosa.</p></div

The Dynamics of Transgene and <i>BiP</i> Expression, HZ Expansion, and Altered Differentiation during Prenatal Growth

<p>Gene expression analyses on the proximal tibial growth plates from 14.5 (A1–A5 and A1′–A5′), 15.5 (B1–B5 and B1′–B5′), and 17.5 dpc (C1–C5 and C1′–C5′) mice. In situ hybridization was performed on paraffin sections using probes detecting <i>Col10a1</i> (first column in both 13del and wt sections), <i>13del</i> (second column in each section), <i>BiP</i> (third column in each section), <i>Ppr</i> (fourth column in each section), and <i>Opn</i> (fifth column in each section). Brackets indicate HZ. Bar indicates 100 μm.</p

PPI-network analysis.

<p>Significant PPI-network (p-value <0.0001) containing 17 proteins associated with disc degeneration (red circles) and 76 interaction partners (white circles).</p

Altered Differentiation of HCs to “PreHC-Like” Cells

<div><p>Analyses of the proximal tibial growth plate of 10-day-old mice.</p> <p>(A–D and F) In situ hybridization using specific markers for resting, proliferating chondrocytes, and preHCs <i>(Col2a1)</i> (A), preHCs <i>(Ppr)</i> (B), preHCs and HCs <i>(Ihh)</i> (C), proliferating chondrocytes <i>(Ptc)</i> (D), and terminal HCs <i>(Opn)</i> (F). The chondro-osseous junction is depicted by a yellow line).</p> <p>(E) To show that altered differentiation took place after the initiation of hypertrophy, X-gal staining was performed on 10-d-old <i>Col10a1-Cre</i>/ROSA26 Cre reporter (R26R) mice with or without the <i>13del</i> transgene. Positive staining appears as pink under dark field. The inset in the 13del panel shows co-localized X-gal staining (pink) and <i>Ppr</i> in situ hybridization signal (white dots) in mid-lower HZ of the triple mutant.</p> <p>(G) In situ hybridization for <i>Opn</i> and <i>Ppr</i> in consecutive sections. In some HCs of 13del mice, <i>Opn</i> and <i>Ppr</i> are co-expressed (yellow-circled cells). In wt mice, the expression profiles of <i>Opn</i> and <i>Ppr</i> are mutually exclusive (see red- and green-circled cells). Bar indicates 100 μm.</p></div