HyBIS: Windows Guest Protection through Advanced Memory Introspection

Effectively protecting the Windows OS is a challenging task, since most implementation details are not publicly known. Windows has always been the main target of malwares that have exploited numerous bugs and vulnerabilities. Recent trusted boot and additional integrity checks have rendered the Windows OS less vulnerable to kernel-level rootkits. Nevertheless, guest Windows Virtual Machines are becoming an increasingly interesting attack target. In this work we introduce and analyze a novel Hypervisor-Based Introspection System (HyBIS) we developed for protecting Windows OSes from malware and rootkits. The HyBIS architecture is motivated and detailed, while targeted experimental results show its effectiveness. Comparison with related work highlights main HyBIS advantages such as: effective semantic introspection, support for 64-bit architectures and for latest Windows (8.x and 10), advanced malware disabling capabilities. We believe the research effort reported here will pave the way to further advances in the security of Windows OSes

NGBPA Next Generation BotNet Protocol Analysis

Abstract The command & control (c&c) protocols of botnets are moving away from plaintext IRC communicationt towards encrypted and obfuscated protocols. In gen-eral, these protocols are proprietary. Therefore, standard network monitoring tools are not able to extract the commands from the collected traffic. However, if we want to monitor these new botnets, we need to know how their protocol decryption works. In this paper we present a novel approach in malware analysis for locating the en-cryption and decryption functions in botnet programs. This information can be used to extract these functions for c&c protocols. We illustrate the applicability of our approach by a sample from the Kraken botnet. Using our approach, we were able to identify the encryption routine within minutes. We then extracted the c&c protocol encryption and decryption. Both are presented in this paper.

Security Analysis of Sensor Networks

Wireless sensor networks distribute a common sensing and computing task within the large number of participants that use wireless communication. Such networks require a self-organizing and energy-aware set of protocols. Several protocols have beed designed for such environments, however to make certain proof of their secureness, their formal analysis is required. In our article, we show an analysis framework capable of proving security properties of such protocols. Our methodology is based on the CSP process algebra. We will demonstrate its power by giving an attack possibility for an existing protocol, and the extensibility of the model will also be pointed

Exponential distribution of long heart beat intervals during atrial fibrillation and their relevance for white noise behaviour in power spectrum

The statistical properties of heart beat intervals of 130 long-term surface electrocardiogram recordings during atrial fibrillation (AF) are investigated. We find that the distribution of interbeat intervals exhibits a characteristic exponential tail, which is absent during sinus rhythm, as tested in a corresponding control study with 72 healthy persons. The rate of the exponential decay lies in the range 3-12 Hz and shows diurnal variations. It equals, up to statistical uncertainties, the level of the previously uncovered white noise part in the power spectrum, which is also characteristic for AF. The overall statistical features can be described by decomposing the intervals into two statistically independent times, where the first one is associated with a correlated process with 1/f noise characteristics, while the second one belongs to an uncorrelated process and is responsible for the exponential tail. It is suggested to use the rate of the exponential decay as a further parameter for a better classification of AF and for the medical diagnosis. The relevance of the findings with respect to a general understanding of AF is pointed out

‘O sibling, where art thou?’ – a review of avian sibling recognition with respect to the mammalian literature

Avian literature on sibling recognition is rare compared to that developed by mammalian researchers. We compare avian and mammalian research on sibling recognition to identify why avian work is rare, how approaches differ and what avian and mammalian researchers can learn from each other. Three factors: (1) biological differences between birds and mammals, (2) conceptual biases and (3) practical constraints, appear to influence our current understanding. Avian research focuses on colonial species because sibling recognition is considered adaptive where ‘mixing potential’ of dependent young is high; research on a wider range of species, breeding systems and ecological conditions is now needed. Studies of acoustic recognition cues dominate avian literature; other types of cues (e.g. visual, olfactory) deserve further attention. The effect of gender on avian sibling recognition has yet to be investigated; mammalian work shows that gender can have important influences. Most importantly, many researchers assume that birds recognise siblings through ‘direct familiarisation’ (commonly known as associative learning or familiarity); future experiments should also incorporate tests for ‘indirect familiarisation’ (commonly known as phenotype matching). If direct familiarisation proves crucial, avian research should investigate how periods of separation influence sibling discrimination. Mammalian researchers typically interpret sibling recognition in broad functional terms (nepotism, optimal outbreeding); some avian researchers more successfully identify specific and testable adaptive explanations, with greater relevance to natural contexts. We end by reporting exciting discoveries from recent studies of avian sibling recognition that inspire further interest in this topic

Perspective from a Younger Generation -- The Astro-Spectroscopy of Gisbert Winnewisser

Gisbert Winnewisser's astronomical career was practically coextensive with the whole development of molecular radio astronomy. Here I would like to pick out a few of his many contributions, which I, personally, find particularly interesting and put them in the context of newer results.Comment: 14 pages. (Co)authored by members of the MPIfR (Sub)millimeter Astronomy Group. To appear in the Proceedings of the 4th Cologne-Bonn-Zermatt-Symposium "The Dense Interstellar Medium in Galaxies" eds. S. Pfalzner, C. Kramer, C. Straubmeier, & A. Heithausen (Springer: Berlin

Matched sizes of activating and inhibitory receptor/ligand pairs are required for optimal signal integration by human Natural Killer cells

It has been suggested that receptor-ligand complexes segregate or co-localise within immune synapses according to their size, and this is important for receptor signaling. Here, we set out to test the importance of receptor-ligand complex dimensions for immune surveillance of target cells by human Natural Killer (NK) cells. NK cell activation is regulated by integrating signals from activating receptors, such as NKG2D, and inhibitory receptors, such as KIR2DL1. Elongating the NKG2D ligand MICA reduced its ability to trigger NK cell activation. Conversely, elongation of KIR2DL1 ligand HLA-C reduced its ability to inhibit NK cells. Whereas normal-sized HLA-C was most effective at inhibiting activation by normal-length MICA, only elongated HLA-C could inhibit activation by elongated MICA. Moreover, HLA-C and MICA that were matched in size co-localised, whereas HLA-C and MICA that were different in size were segregated. These results demonstrate that receptor-ligand dimensions are important in NK cell recognition, and suggest that optimal integration of activating and inhibitory receptor signals requires the receptor-ligand complexes to have similar dimensions

Amino acid classification based spectrum kernel fusion for protein subnuclear localization

<p>Abstract</p> <p>Background</p> <p>Prediction of protein localization in subnuclear organelles is more challenging than general protein subcelluar localization. There are only three computational models for protein subnuclear localization thus far, to the best of our knowledge. Two models were based on protein primary sequence only. The first model assumed homogeneous amino acid substitution pattern across all protein sequence residue sites and used BLOSUM62 to encode <it>k</it>-mer of protein sequence. Ensemble of SVM based on different <it>k</it>-mers drew the final conclusion, achieving 50% overall accuracy. The simplified assumption did not exploit protein sequence profile and ignored the fact of heterogeneous amino acid substitution patterns across sites. The second model derived the <it>PsePSSM </it>feature representation from protein sequence by simply averaging the profile PSSM and combined the <it>PseAA </it>feature representation to construct a kNN ensemble classifier <it>Nuc-PLoc</it>, achieving 67.4% overall accuracy. The two models based on protein primary sequence only both achieved relatively poor predictive performance. The third model required that GO annotations be available, thus restricting the model's applicability.</p> <p>Methods</p> <p>In this paper, we only use the amino acid information of protein sequence without any other information to design a widely-applicable model for protein subnuclear localization. We use <it>K</it>-spectrum kernel to exploit the contextual information around an amino acid and the conserved motif information. Besides expanding window size, we adopt various amino acid classification approaches to capture diverse aspects of amino acid physiochemical properties. Each amino acid classification generates a series of spectrum kernels based on different window size. Thus, (I) window expansion can capture more contextual information and cover size-varying motifs; (II) various amino acid classifications can exploit multi-aspect biological information from the protein sequence. Finally, we combine all the spectrum kernels by simple addition into one single kernel called <it>SpectrumKernel+ </it>for protein subnuclear localization.</p> <p>Results</p> <p>We conduct the performance evaluation experiments on two benchmark datasets: <it>Lei </it>and <it>Nuc-PLoc</it>. Experimental results show that <it>SpectrumKernel+ </it>achieves substantial performance improvement against the previous model <it>Nuc-PLoc</it>, with overall accuracy <it>83.47% </it>against <it>67.4%</it>; and <it>71.23% </it>against <it>50% </it>of <it>Lei SVM Ensemble</it>, against 66.50% of <it>Lei GO SVM Ensemble</it>.</p> <p>Conclusion</p> <p>The method <it>SpectrumKernel</it>+ can exploit rich amino acid information of protein sequence by embedding into implicit size-varying motifs the multi-aspect amino acid physiochemical properties captured by amino acid classification approaches. The kernels derived from diverse amino acid classification approaches and different sizes of <it>k</it>-mer are summed together for data integration. Experiments show that the method <it>SpectrumKernel</it>+ significantly outperforms the existing models for protein subnuclear localization.</p

Differential regulation of neurotrophin expression in human bronchial smooth muscle cells

BACKGROUND: Human bronchial smooth muscle cells (HBSMC) may regulate airway inflammation by secreting cytokines, chemokines and growth factors. The neurotrophins, including nerve growth factor (NGF), brain-derived neurotrophic factor (BDNF) and neurotrophin-3 (NT-3), have been shown to be elevated during airway inflammation and evoke airway hyperresponsiveness. We studied if HBSMC may be a source of NGF, BDNF and NT-3, and if so, how inflammatory cytokines may influence their production. METHODS: Basal and cytokine (IL-1β, IFN-γ, IL-4)-stimulated neurotrophin expression in HBSMC cultured in vitro was quantified. The mRNA expression was quantified by real-time RT-PCR and the protein secretion into the cell culture medium by ELISA. RESULTS: We observed a constitutive NGF, BDNF and NT-3 expression. IL-1β stimulated a transient increase of NGF, while the increase of BDNF had a later onset and was more sustained. COX-inhibitors (indomethacin and NS-398) markedly decreased IL-1β-stimulated secretion of BDNF, but not IL-1β-stimulated NGF secretion. IFN-γ increased NGF expression, down-regulated BDNF expression and synergistically enhanced IL-1β-stimulated NGF expression. In contrast, IL-4 had no effect on basal NGF and BDNF expression, but decreased IL-1β-stimulated NGF expression. NT-3 was not altered by the tested cytokines. CONCLUSION: Taken together, our data indicate that, in addition to the contractile capacity, HBSMC can express NGF, BDNF and NT-3. The expression of these neurotrophins may be differently regulated by inflammatory cytokines, suggesting a dynamic interplay that might have a potential role in airway inflammation

Alzheimer-associated cerebrospinal fluid fragments of neurogranin are generated by Calpain-1 and prolyl endopeptidase

BACKGROUND: Neurogranin (Ng) is a small 7.6 kDa postsynaptic protein that has been detected at elevated concentrations in cerebrospinal fluid (CSF) of patients with Alzheimer’s disease (AD), both as a full-length molecule and as fragments from its C-terminal half. Ng is involved in postsynaptic calcium (Ca) signal transduction and memory formation via binding to calmodulin in a Ca-dependent manner. The mechanism of Ng secretion from neurons to CSF is currently unknown, but enzymatic cleavage of Ng may be of relevance. Therefore, the aim of the study was to identify the enzymes responsible for the cleavage of Ng, yielding the Ng fragment pattern of C-terminal fragments detectable and increased in CSF of AD patients. METHODS: Fluorigenic quenched FRET probes containing sequences of Ng were utilized to identify Ng cleaving activities among enzymes known to have increased activity in AD and in chromatographically fractionated mouse brain extracts. RESULTS: Human Calpain-1 and prolyl endopeptidase were identified as the candidate enzymes involved in the formation of endogenous Ng peptides present in CSF, cleaving mainly in the central region of Ng, and between amino acids 75_76 in the Ng sequence, respectively. The cleavage by Calpain-1 affects the IQ domain of Ng, which may deactivate or change the function of Ng in Ca2+/calmodulin -dependent signaling for synaptic plasticity. While shorter Ng fragments were readily cleaved in vitro by prolyl endopeptidase, the efficiency of cleavage on larger Ng fragments was much lower. CONCLUSIONS: Calpain-1 and prolyl endopeptidase cleave Ng in the IQ domain and near the C-terminus, respectively, yielding specific fragments of Ng in CSF. These fragments may give clues to the roles of increased activities of these enzymes in the pathophysiology of AD, and provide possible targets for pharmacologic intervention