Tracking Cyber Adversaries with Adaptive Indicators of Compromise

A forensics investigation after a breach often uncovers network and host indicators of compromise (IOCs) that can be deployed to sensors to allow early detection of the adversary in the future. Over time, the adversary will change tactics, techniques, and procedures (TTPs), which will also change the data generated. If the IOCs are not kept up-to-date with the adversary's new TTPs, the adversary will no longer be detected once all of the IOCs become invalid. Tracking the Known (TTK) is the problem of keeping IOCs, in this case regular expressions (regexes), up-to-date with a dynamic adversary. Our framework solves the TTK problem in an automated, cyclic fashion to bracket a previously discovered adversary. This tracking is accomplished through a data-driven approach of self-adapting a given model based on its own detection capabilities. In our initial experiments, we found that the true positive rate (TPR) of the adaptive solution degrades much less significantly over time than the naive solution, suggesting that self-updating the model allows the continued detection of positives (i.e., adversaries). The cost for this performance is in the false positive rate (FPR), which increases over time for the adaptive solution, but remains constant for the naive solution. However, the difference in overall detection performance, as measured by the area under the curve (AUC), between the two methods is negligible. This result suggests that self-updating the model over time should be done in practice to continue to detect known, evolving adversaries.Comment: This was presented at the 4th Annual Conf. on Computational Science & Computational Intelligence (CSCI'17) held Dec 14-16, 2017 in Las Vegas, Nevada, US

Intensity standardization methods in magnetic resonance imaging of head and neck cancer

BACKGROUND AND PURPOSE: Conventional magnetic resonance imaging (MRI) poses challenges in quantitative analysis because voxel intensity values lack physical meaning. While intensity standardization methods exist, their effects on head and neck MRI have not been investigated. We developed a workflow based on healthy tissue region of interest (ROI) analysis to determine intensity consistency within a patient cohort. Through this workflow, we systematically evaluated intensity standardization methods for MRI of head and neck cancer (HNC) patients.MATERIALS AND METHODS: Two HNC cohorts (30 patients total) were retrospectively analyzed. One cohort was imaged with heterogenous acquisition parameters (HET cohort), whereas the other was imaged with homogenous acquisition parameters (HOM cohort). The standard deviation of cohort-level normalized mean intensity (SD NMI c), a metric of intensity consistency, was calculated across ROIs to determine the effect of five intensity standardization methods on T2-weighted images. For each cohort, a Friedman test followed by a post-hoc Bonferroni-corrected Wilcoxon signed-rank test was conducted to compare SD NMI c among methods. RESULTS: Consistency (SD NMI c across ROIs) between unstandardized images was substantially more impaired in the HET cohort (0.29 ± 0.08) than in the HOM cohort (0.15 ± 0.03). Consequently, corrected p-values for intensity standardization methods with lower SD NMI c compared to unstandardized images were significant in the HET cohort (p &lt; 0.05) but not significant in the HOM cohort (p &gt; 0.05). In both cohorts, differences between methods were often minimal and nonsignificant. CONCLUSIONS: Our findings stress the importance of intensity standardization, either through the utilization of uniform acquisition parameters or specific intensity standardization methods, and the need for testing intensity consistency before performing quantitative analysis of HNC MRI.</p

HacA-Independent Functions of the ER Stress Sensor IreA Synergize with the Canonical UPR to Influence Virulence Traits in Aspergillus fumigatus

Endoplasmic reticulum (ER) stress is a condition in which the protein folding capacity of the ER becomes overwhelmed by an increased demand for secretion or by exposure to compounds that disrupt ER homeostasis. In yeast and other fungi, the accumulation of unfolded proteins is detected by the ER-transmembrane sensor IreA/Ire1, which responds by cleaving an intron from the downstream cytoplasmic mRNA HacA/Hac1, allowing for the translation of a transcription factor that coordinates a series of adaptive responses that are collectively known as the unfolded protein response (UPR). Here, we examined the contribution of IreA to growth and virulence in the human fungal pathogen Aspergillus fumigatus. Gene expression profiling revealed that A. fumigatus IreA signals predominantly through the canonical IreA-HacA pathway under conditions of severe ER stress. However, in the absence of ER stress IreA controls dual signaling circuits that are both HacA-dependent and HacA-independent. We found that a ΔireA mutant was avirulent in a mouse model of invasive aspergillosis, which contrasts the partial virulence of a ΔhacA mutant, suggesting that IreA contributes to pathogenesis independently of HacA. In support of this conclusion, we found that the ΔireA mutant had more severe defects in the expression of multiple virulence-related traits relative to ΔhacA, including reduced thermotolerance, decreased nutritional versatility, impaired growth under hypoxia, altered cell wall and membrane composition, and increased susceptibility to azole antifungals. In addition, full or partial virulence could be restored to the ΔireA mutant by complementation with either the induced form of the hacA mRNA, hacAi, or an ireA deletion mutant that was incapable of processing the hacA mRNA, ireAΔ10. Together, these findings demonstrate that IreA has both HacA-dependent and HacA-independent functions that contribute to the expression of traits that are essential for virulence in A. fumigatus

Antiinflammatory Therapy with Canakinumab for Atherosclerotic Disease

Background: Experimental and clinical data suggest that reducing inflammation without affecting lipid levels may reduce the risk of cardiovascular disease. Yet, the inflammatory hypothesis of atherothrombosis has remained unproved. Methods: We conducted a randomized, double-blind trial of canakinumab, a therapeutic monoclonal antibody targeting interleukin-1β, involving 10,061 patients with previous myocardial infarction and a high-sensitivity C-reactive protein level of 2 mg or more per liter. The trial compared three doses of canakinumab (50 mg, 150 mg, and 300 mg, administered subcutaneously every 3 months) with placebo. The primary efficacy end point was nonfatal myocardial infarction, nonfatal stroke, or cardiovascular death. RESULTS: At 48 months, the median reduction from baseline in the high-sensitivity C-reactive protein level was 26 percentage points greater in the group that received the 50-mg dose of canakinumab, 37 percentage points greater in the 150-mg group, and 41 percentage points greater in the 300-mg group than in the placebo group. Canakinumab did not reduce lipid levels from baseline. At a median follow-up of 3.7 years, the incidence rate for the primary end point was 4.50 events per 100 person-years in the placebo group, 4.11 events per 100 person-years in the 50-mg group, 3.86 events per 100 person-years in the 150-mg group, and 3.90 events per 100 person-years in the 300-mg group. The hazard ratios as compared with placebo were as follows: in the 50-mg group, 0.93 (95% confidence interval [CI], 0.80 to 1.07; P = 0.30); in the 150-mg group, 0.85 (95% CI, 0.74 to 0.98; P = 0.021); and in the 300-mg group, 0.86 (95% CI, 0.75 to 0.99; P = 0.031). The 150-mg dose, but not the other doses, met the prespecified multiplicity-adjusted threshold for statistical significance for the primary end point and the secondary end point that additionally included hospitalization for unstable angina that led to urgent revascularization (hazard ratio vs. placebo, 0.83; 95% CI, 0.73 to 0.95; P = 0.005). Canakinumab was associated with a higher incidence of fatal infection than was placebo. There was no significant difference in all-cause mortality (hazard ratio for all canakinumab doses vs. placebo, 0.94; 95% CI, 0.83 to 1.06; P = 0.31). Conclusions: Antiinflammatory therapy targeting the interleukin-1β innate immunity pathway with canakinumab at a dose of 150 mg every 3 months led to a significantly lower rate of recurrent cardiovascular events than placebo, independent of lipid-level lowering. (Funded by Novartis; CANTOS ClinicalTrials.gov number, NCT01327846.

Effect of angiotensin-converting enzyme inhibitor and angiotensin receptor blocker initiation on organ support-free days in patients hospitalized with COVID-19

IMPORTANCE Overactivation of the renin-angiotensin system (RAS) may contribute to poor clinical outcomes in patients with COVID-19. Objective To determine whether angiotensin-converting enzyme (ACE) inhibitor or angiotensin receptor blocker (ARB) initiation improves outcomes in patients hospitalized for COVID-19. DESIGN, SETTING, AND PARTICIPANTS In an ongoing, adaptive platform randomized clinical trial, 721 critically ill and 58 non–critically ill hospitalized adults were randomized to receive an RAS inhibitor or control between March 16, 2021, and February 25, 2022, at 69 sites in 7 countries (final follow-up on June 1, 2022). INTERVENTIONS Patients were randomized to receive open-label initiation of an ACE inhibitor (n = 257), ARB (n = 248), ARB in combination with DMX-200 (a chemokine receptor-2 inhibitor; n = 10), or no RAS inhibitor (control; n = 264) for up to 10 days. MAIN OUTCOMES AND MEASURES The primary outcome was organ support–free days, a composite of hospital survival and days alive without cardiovascular or respiratory organ support through 21 days. The primary analysis was a bayesian cumulative logistic model. Odds ratios (ORs) greater than 1 represent improved outcomes. RESULTS On February 25, 2022, enrollment was discontinued due to safety concerns. Among 679 critically ill patients with available primary outcome data, the median age was 56 years and 239 participants (35.2%) were women. Median (IQR) organ support–free days among critically ill patients was 10 (–1 to 16) in the ACE inhibitor group (n = 231), 8 (–1 to 17) in the ARB group (n = 217), and 12 (0 to 17) in the control group (n = 231) (median adjusted odds ratios of 0.77 [95% bayesian credible interval, 0.58-1.06] for improvement for ACE inhibitor and 0.76 [95% credible interval, 0.56-1.05] for ARB compared with control). The posterior probabilities that ACE inhibitors and ARBs worsened organ support–free days compared with control were 94.9% and 95.4%, respectively. Hospital survival occurred in 166 of 231 critically ill participants (71.9%) in the ACE inhibitor group, 152 of 217 (70.0%) in the ARB group, and 182 of 231 (78.8%) in the control group (posterior probabilities that ACE inhibitor and ARB worsened hospital survival compared with control were 95.3% and 98.1%, respectively). CONCLUSIONS AND RELEVANCE In this trial, among critically ill adults with COVID-19, initiation of an ACE inhibitor or ARB did not improve, and likely worsened, clinical outcomes. TRIAL REGISTRATION ClinicalTrials.gov Identifier: NCT0273570

Genomic selection without own phenotypes exploits new mutational variance less than BLUP selection

De novo mutations (DNM) create new genetic variance and are an important driver for long-term selection response. We hypothesized that genomic selection without own phenotypes exploits new mutational variance less than pedigree-based BLUP selection. The objectives were to compare GBLUP selection without own phenotype (GBLUP), GBLUP selection with own phenotype (GBLUP_OP) and pedigree-based BLUP selection with own phenotype for 20 generations using Monte Carlo simulation. GBLUP resulted in the lowest genetic variance (24.7% of total genetic variance) and response due to DNM after 20 generations (9.4% of total response). GBLUP_OP had the highest genetic variance due to new DNM (47.8% of total genetic variance) and selection response due to DNM (30% of total response), while BLUP was in between with 27.1% of genetic variance due to DNM and 21.9% of response due to DNM. However, GBLUP_OP caused a rapid decline in total genetic variance, because the genetic variance due to old QTL rapidly eroded. GBLUP had very little selection pressure on DNM and as a consequence, GBLUP had the highest number of DNM with negative effects that were still segregating 10 generations after a DNM arose. Due to the decline in genetic variance for all selection strategies, selection limits are foreseen and these selection limits are lower for GBLUP (11.2 phenotypic SD from the base population mean) and GBLUP_OP (10.7 phenotypic SD) than for BLUP selection (11.8 phenotypic SD). It can be concluded that genomic selection without own phenotypes exploits new mutational variance less than BLUP selection with own phenotypes, it increases the probability of DNM with negative effects and it lowers selection limits. Sustainable breeding strategies should consider optimal ways to exploit DNM

Risk factors for HIV-1 infection in adults in a rural Ugandan community:A population study

Objective: To determine sociodemographic risk factors associated with HIV-1 infection in a rural Ugandan population. Design: A population-based survey. Methods: All adult residents (aged = 13 years) in a cluster of 15 neighbouring villages of the Masaka District of south-west Uganda were invited to participate in a sociodemographic and serological survey. Questions relating to sexual behaviour were asked separately in an accompanying case-control study. Socioeconomic data and an unambiguous HIV-1 serostatus were obtained by house-to-house survey for 3809 (72%) of the adult population. The association between serostatus and the following variables were analysed: age, sex, marital status, tribe, religion, education, occupational group, place and frequency of travel and recent history of sexually transmitted disease. Results: Women aged 13-21 years were at a much higher risk than men of the same age [odds ratio (OR), 8.6; 95% confidence interval (CI), 3.0-24.5]. Married people aged 25 years, women were at a lower risk than men (OR, 0.72; 95% CI, 0.52-0.98) as were those who were currently married compared with those who were not (OR, 0.47; 95% CI, 0.34-0.64). In both age groups those with a history of a recent genital ulcer were approximately three times more likely to be infected. Muslims had lower risks than non-Muslims (OR, 0.58 for both age groups). Conclusions: The people most at risk of HIV-1 infection in this rural Ugandan population are young married women who had, presumably, commenced sexual activity recently

Supplemental Material for Mulder et al., 2019

This file contains additional figures

The impact of genomic and traditional selection on the contribution of mutational variance to long-term selection response and genetic variance

De novo mutations (DNM) create new genetic variance and are an important driver for long-term selection response. We hypothesized that genomic selection exploits mutational variance less than traditional selection methods such as mass selection or selection on pedigree-based breeding values, because DNM in selection candidates are not captured when the selection candidates' own phenotype is not used in genomic selection, DNM are not on SNP chips and DNM are not in linkage disequilibrium with the SNP on the chip. We tested this hypothesis with Monte Carlo simulation. From whole-genome sequence data, a subset of ∼300,000 variants was used that served as putative markers, quantitative trait loci or DNM. We simulated 20 generations with truncation selection based on breeding values from genomic best linear unbiased prediction without (GBLUP_no_OP) or with own phenotype (GBLUP_OP), pedigree-based BLUP without (BLUP_no_OP) or with own phenotype (BLUP_OP), or directly on phenotype. GBLUP_OP was the best strategy in exploiting mutational variance, while GBLUP_no_OP and BLUP_no_OP were the worst in exploiting mutational variance. The crucial element is that GBLUP_no_OP and BLUP_no_OP puts no selection pressure on DNM in selection candidates. Genetic variance decreased faster with GBLUP_no_OP and GBLUP_OP than with BLUP_no_OP, BLUP_OP or mass selection. The distribution of mutational effects, mutational variance, number of DNM per individual and nonadditivity had a large impact on mutational selection response and mutational genetic variance, but not on ranking of selection strategies. We advocate that more sustainable genomic selection strategies are required to optimize long-term selection response and to maintain genetic diversity