An analysis of android malware classification services

The increasing number of Android malware forced antivirus (AV) companies to rely on automated classification techniques to determine the family and class of suspicious samples. The research community relies heavily on such labels to carry out prevalence studies of the threat ecosystem and to build datasets that are used to validate and benchmark novel detection and classification methods. In this work, we carry out an extensive study of the Android malware ecosystem by surveying white papers and reports from 6 key players in the industry, as well as 81 papers from 8 top security conferences, to understand how malware datasets are used by both. We, then, explore the limitations associated with the use of available malware classification services, namely VirusTotal (VT) engines, for determining the family of an Android sample. Using a dataset of 2.47 M Android malware samples, we find that the detection coverage of VT's AVs is generally very low, that the percentage of samples flagged by any 2 AV engines does not go beyond 52%, and that common families between any pair of AV engines is at best 29%. We rely on clustering to determine the extent to which different AV engine pairs agree upon which samples belong to the same family (regardless of the actual family name) and find that there are discrepancies that can introduce noise in automatic label unification schemes. We also observe the usage of generic labels and inconsistencies within the labels of top AV engines, suggesting that their efforts are directed towards accurate detection rather than classification. Our results contribute to a better understanding of the limitations of using Android malware family labels as supplied by common AV engines.This work has been supported by the “Ramon y Cajal” Fellowship RYC-2020-029401

Antimicrobial resistance among migrants in Europe: a systematic review and meta-analysis

BACKGROUND: Rates of antimicrobial resistance (AMR) are rising globally and there is concern that increased migration is contributing to the burden of antibiotic resistance in Europe. However, the effect of migration on the burden of AMR in Europe has not yet been comprehensively examined. Therefore, we did a systematic review and meta-analysis to identify and synthesise data for AMR carriage or infection in migrants to Europe to examine differences in patterns of AMR across migrant groups and in different settings. METHODS: For this systematic review and meta-analysis, we searched MEDLINE, Embase, PubMed, and Scopus with no language restrictions from Jan 1, 2000, to Jan 18, 2017, for primary data from observational studies reporting antibacterial resistance in common bacterial pathogens among migrants to 21 European Union-15 and European Economic Area countries. To be eligible for inclusion, studies had to report data on carriage or infection with laboratory-confirmed antibiotic-resistant organisms in migrant populations. We extracted data from eligible studies and assessed quality using piloted, standardised forms. We did not examine drug resistance in tuberculosis and excluded articles solely reporting on this parameter. We also excluded articles in which migrant status was determined by ethnicity, country of birth of participants' parents, or was not defined, and articles in which data were not disaggregated by migrant status. Outcomes were carriage of or infection with antibiotic-resistant organisms. We used random-effects models to calculate the pooled prevalence of each outcome. The study protocol is registered with PROSPERO, number CRD42016043681. FINDINGS: We identified 2274 articles, of which 23 observational studies reporting on antibiotic resistance in 2319 migrants were included. The pooled prevalence of any AMR carriage or AMR infection in migrants was 25·4% (95% CI 19·1-31·8; I2 =98%), including meticillin-resistant Staphylococcus aureus (7·8%, 4·8-10·7; I2 =92%) and antibiotic-resistant Gram-negative bacteria (27·2%, 17·6-36·8; I2 =94%). The pooled prevalence of any AMR carriage or infection was higher in refugees and asylum seekers (33·0%, 18·3-47·6; I2 =98%) than in other migrant groups (6·6%, 1·8-11·3; I2 =92%). The pooled prevalence of antibiotic-resistant organisms was slightly higher in high-migrant community settings (33·1%, 11·1-55·1; I2 =96%) than in migrants in hospitals (24·3%, 16·1-32·6; I2 =98%). We did not find evidence of high rates of transmission of AMR from migrant to host populations. INTERPRETATION: Migrants are exposed to conditions favouring the emergence of drug resistance during transit and in host countries in Europe. Increased antibiotic resistance among refugees and asylum seekers and in high-migrant community settings (such as refugee camps and detention facilities) highlights the need for improved living conditions, access to health care, and initiatives to facilitate detection of and appropriate high-quality treatment for antibiotic-resistant infections during transit and in host countries. Protocols for the prevention and control of infection and for antibiotic surveillance need to be integrated in all aspects of health care, which should be accessible for all migrant groups, and should target determinants of AMR before, during, and after migration. FUNDING: UK National Institute for Health Research Imperial Biomedical Research Centre, Imperial College Healthcare Charity, the Wellcome Trust, and UK National Institute for Health Research Health Protection Research Unit in Healthcare-associated Infections and Antimictobial Resistance at Imperial College London

Surgical site infection after gastrointestinal surgery in high-income, middle-income, and low-income countries: a prospective, international, multicentre cohort study

Background: Surgical site infection (SSI) is one of the most common infections associated with health care, but its importance as a global health priority is not fully understood. We quantified the burden of SSI after gastrointestinal surgery in countries in all parts of the world. Methods: This international, prospective, multicentre cohort study included consecutive patients undergoing elective or emergency gastrointestinal resection within 2-week time periods at any health-care facility in any country. Countries with participating centres were stratified into high-income, middle-income, and low-income groups according to the UN's Human Development Index (HDI). Data variables from the GlobalSurg 1 study and other studies that have been found to affect the likelihood of SSI were entered into risk adjustment models. The primary outcome measure was the 30-day SSI incidence (defined by US Centers for Disease Control and Prevention criteria for superficial and deep incisional SSI). Relationships with explanatory variables were examined using Bayesian multilevel logistic regression models. This trial is registered with ClinicalTrials.gov, number NCT02662231. Findings: Between Jan 4, 2016, and July 31, 2016, 13 265 records were submitted for analysis. 12 539 patients from 343 hospitals in 66 countries were included. 7339 (58·5%) patient were from high-HDI countries (193 hospitals in 30 countries), 3918 (31·2%) patients were from middle-HDI countries (82 hospitals in 18 countries), and 1282 (10·2%) patients were from low-HDI countries (68 hospitals in 18 countries). In total, 1538 (12·3%) patients had SSI within 30 days of surgery. The incidence of SSI varied between countries with high (691 [9·4%] of 7339 patients), middle (549 [14·0%] of 3918 patients), and low (298 [23·2%] of 1282) HDI (p < 0·001). The highest SSI incidence in each HDI group was after dirty surgery (102 [17·8%] of 574 patients in high-HDI countries; 74 [31·4%] of 236 patients in middle-HDI countries; 72 [39·8%] of 181 patients in low-HDI countries). Following risk factor adjustment, patients in low-HDI countries were at greatest risk of SSI (adjusted odds ratio 1·60, 95% credible interval 1·05–2·37; p=0·030). 132 (21·6%) of 610 patients with an SSI and a microbiology culture result had an infection that was resistant to the prophylactic antibiotic used. Resistant infections were detected in 49 (16·6%) of 295 patients in high-HDI countries, in 37 (19·8%) of 187 patients in middle-HDI countries, and in 46 (35·9%) of 128 patients in low-HDI countries (p < 0·001). Interpretation: Countries with a low HDI carry a disproportionately greater burden of SSI than countries with a middle or high HDI and might have higher rates of antibiotic resistance. In view of WHO recommendations on SSI prevention that highlight the absence of high-quality interventional research, urgent, pragmatic, randomised trials based in LMICs are needed to assess measures aiming to reduce this preventable complication

Global economic burden of unmet surgical need for appendicitis

Background: There is a substantial gap in provision of adequate surgical care in many low-and middle-income countries. This study aimed to identify the economic burden of unmet surgical need for the common condition of appendicitis. Methods: Data on the incidence of appendicitis from 170 countries and two different approaches were used to estimate numbers of patients who do not receive surgery: as a fixed proportion of the total unmet surgical need per country (approach 1); and based on country income status (approach 2). Indirect costs with current levels of access and local quality, and those if quality were at the standards of high-income countries, were estimated. A human capital approach was applied, focusing on the economic burden resulting from premature death and absenteeism. Results: Excess mortality was 4185 per 100 000 cases of appendicitis using approach 1 and 3448 per 100 000 using approach 2. The economic burden of continuing current levels of access and local quality was US $92 492 million using approach 1 and$73 141 million using approach 2. The economic burden of not providing surgical care to the standards of high-income countries was $95 004 million using approach 1 and$75 666 million using approach 2. The largest share of these costs resulted from premature death (97.7 per cent) and lack of access (97.0 per cent) in contrast to lack of quality. Conclusion: For a comparatively non-complex emergency condition such as appendicitis, increasing access to care should be prioritized. Although improving quality of care should not be neglected, increasing provision of care at current standards could reduce societal costs substantially

Pooled analysis of WHO Surgical Safety Checklist use and mortality after emergency laparotomy

Background The World Health Organization (WHO) Surgical Safety Checklist has fostered safe practice for 10 years, yet its place in emergency surgery has not been assessed on a global scale. The aim of this study was to evaluate reported checklist use in emergency settings and examine the relationship with perioperative mortality in patients who had emergency laparotomy. Methods In two multinational cohort studies, adults undergoing emergency laparotomy were compared with those having elective gastrointestinal surgery. Relationships between reported checklist use and mortality were determined using multivariable logistic regression and bootstrapped simulation. Results Of 12 296 patients included from 76 countries, 4843 underwent emergency laparotomy. After adjusting for patient and disease factors, checklist use before emergency laparotomy was more common in countries with a high Human Development Index (HDI) (2455 of 2741, 89.6 per cent) compared with that in countries with a middle (753 of 1242, 60.6 per cent; odds ratio (OR) 0.17, 95 per cent c.i. 0.14 to 0.21, P <0001) or low (363 of 860, 422 per cent; OR 008, 007 to 010, P <0.001) HDI. Checklist use was less common in elective surgery than for emergency laparotomy in high-HDI countries (risk difference -94 (95 per cent c.i. -11.9 to -6.9) per cent; P <0001), but the relationship was reversed in low-HDI countries (+121 (+7.0 to +173) per cent; P <0001). In multivariable models, checklist use was associated with a lower 30-day perioperative mortality (OR 0.60, 0.50 to 073; P <0.001). The greatest absolute benefit was seen for emergency surgery in low- and middle-HDI countries. Conclusion Checklist use in emergency laparotomy was associated with a significantly lower perioperative mortality rate. Checklist use in low-HDI countries was half that in high-HDI countries.Peer reviewe

Global variation in anastomosis and end colostomy formation following left-sided colorectal resection

Background End colostomy rates following colorectal resection vary across institutions in high-income settings, being influenced by patient, disease, surgeon and system factors. This study aimed to assess global variation in end colostomy rates after left-sided colorectal resection. Methods This study comprised an analysis of GlobalSurg-1 and -2 international, prospective, observational cohort studies (2014, 2016), including consecutive adult patients undergoing elective or emergency left-sided colorectal resection within discrete 2-week windows. Countries were grouped into high-, middle- and low-income tertiles according to the United Nations Human Development Index (HDI). Factors associated with colostomy formation versus primary anastomosis were explored using a multilevel, multivariable logistic regression model. Results In total, 1635 patients from 242 hospitals in 57 countries undergoing left-sided colorectal resection were included: 113 (6·9 per cent) from low-HDI, 254 (15·5 per cent) from middle-HDI and 1268 (77·6 per cent) from high-HDI countries. There was a higher proportion of patients with perforated disease (57·5, 40·9 and 35·4 per cent; P < 0·001) and subsequent use of end colostomy (52·2, 24·8 and 18·9 per cent; P < 0·001) in low- compared with middle- and high-HDI settings. The association with colostomy use in low-HDI settings persisted (odds ratio (OR) 3·20, 95 per cent c.i. 1·35 to 7·57; P = 0·008) after risk adjustment for malignant disease (OR 2·34, 1·65 to 3·32; P < 0·001), emergency surgery (OR 4·08, 2·73 to 6·10; P < 0·001), time to operation at least 48 h (OR 1·99, 1·28 to 3·09; P = 0·002) and disease perforation (OR 4·00, 2·81 to 5·69; P < 0·001). Conclusion Global differences existed in the proportion of patients receiving end stomas after left-sided colorectal resection based on income, which went beyond case mix alone

A critique of android malware classification systems

Mención Internacional en el título de doctorDado que Android lidera el mercado global de los sistemas operativos de móviles y también los de malware (software malicioso) de móviles, la automatización de los procesos de detección de malware se ha convertido en una necesidad. Del mismo modo, la clasificación de familias de malware requiere también de un procesado automático debido a la gran cantidad de muestras de malware que se detectan diariamente. A pesar de ello, el estudio de la clasificación de familias de malware en Android no ha recibido suficiente atención por parte de la comunidad científica. En esta tesis, nuestro objetivo es abordar distintos problemas relacionados con el área de clasificación de familias de malware en Android. Primero, realizamos un análisis global del diseño de sistemas de clasificación de familias de malware en Android. Para ello se define claramente las Aplicaciones Potencialmente Dañinas (PHA), Aplicaciones Potencialmente No-Deseadas (PUA) y las distintas formas de malware, y comparamos el concepto de familia de malware al concepto de comportamiento de malware en el ecosistema de Android. También estudiamos los cambios en la política de publicación de aplicaciones de Google a lo largo de los años y su impacto en estas definiciones. Además, estudiamos los fenómenos de PHA y PUA tanto en el mercado oficial desde el punto de vista de Google como fuera de él desde los puntos de vista de ambos, Google y la industria de Antivirus (AV) entre 2014 y 2018. Complementamos nuestro estudio con un análisis global sobre como deberían ser realmente los sistemas de clasificación de familias de malware de Android. En esta tarea, examinamos cada componente de la arquitectura de análisis, describimos los factores que les afectan y las limitaciones que pueden introducir en el diseño del sistema. Para entender cómo se usa cada componente, estudiamos la literatura para identificar los sistemas de clasificación existentes y discutimos las posibles limitaciones y los métodos para mejorar estos sistemas o cualquier sistema con objetivos similares. A continuación estudiamos el problema del etiquetado de malware tanto en el ámbito académico como en la industria. Comenzamos con un análisis de las publicaciones (81) que utilizan etiquetas de malware en los mejores congresos de seguridad informática (2011-2020) y hacemos lo mismo con los informes (24) de la industria (2012-2020). Esto nos permite saber cuáles áreas de invectigación dependen de los sistemas de clasificación de familias para lograr su objetivo. Con objeto de analizar la calidad de este proceso, analizamos una dataset de etiquetas de 2,5 milliones de aplicaciones e identificamos las inconsistencias de etiquetado entre distintos programas AV. Este análisis nos permite explorar coincidencias y divergencias entre dichos programas en cuanto a la familia de cada muestra. La falta de consenso es un factor clave en la introducción de ruido a los sistemas de clasificación que dependen de herramientas de unificación de etiquetas que usan voto mayoritario. Basándonos en nuestros resultados, recomendamos distintas acciones en relación con el diseño de conjuntos de muestras que ayuden en la reducción de ruido y sesgos. Finalmente, comparamos los estudios llevados a cabo en esta tesis con trabajos recientes en el mismo área.With Android being the market leader of mobile operating systems, as well as mobile malware, automating the pipeline of malware detection became a necessity. In a similar fashion, malware family classification requires automation due to the large amount of malware samples that are detected on a daily basis. However, malware family classification in Android is a less explored area by the scientific community. The key goal of this dissertation is to address several concerns about the Android malware family classification problem. We first carry out a comprehensive analysis of the design of Android malware family classification systems. To do so, we focus on clearly defining Potentially Harmful Apps (PHA), Potentially Unwanted Apps (PUA) and malware forms in addition to comparing the concept of malware family to that of malware behavior in the Android ecosystem. We also study Google’s policy changes over the years and how they impact these definitions. Besides, we study the PHA and PUA phenomena from the perspective of Google inside the official store (Play Store) as well as both Google’s and the AntiVirus (AV) industry’s view of these phenomena in the wild between 2014 and 2018. Our study is complemented with an overall view of how malware family classification systems in the Android context shall look like. We thoroughly look at each of the components and discuss the factors that affect it and the limitations that these factors might introduce in the system design. To understand how each component is applied and used, we survey published works and analyze existing classification systems. We discuss the possible limitations and means of improvement for these systems or any would-be system that is based on them. We subsequently investigate the problem of malware labeling in both academia and industry. We look into research papers from top computer security conferences between 2011 and 2020 (81 papers) and do the same with regards to industry reports between 2012 and 2020 (28 reports). Additionally, we study how each of these two relies on family classification systems to reach its objectives. Furthermore, we analyze the labels of a dataset of 2.5 million app hashes and identify the labeling inconsistencies between different AV Engines. This analysis helps demonstrate the extremely limited agreement between those engines. The lack of consensus is an important factor in introducing noise into classification systems that rely on label unification tools that use majority voting. Based on these findings, we recommend a series of actions with regards to dataset design as a means to reduce biases and noise in the set of samples. Finally, we compare the studies carried out in this thesis to recent work in the same area.Programa de Doctorado en Ciencia y Tecnología Informática por la Universidad Carlos III de MadridPresidente: Ricardo Julio Rodríguez Fernández.- Secretaria: Ana Isabel González-Tablas Ferreres.- Vocal: Pablo Picazo Sánche

Surgical site infection after gastrointestinal surgery in children : an international, multicentre, prospective cohort study

Introduction Surgical site infection (SSI) is one of the most common healthcare-associated infections (HAIs). However, there is a lack of data available about SSI in children worldwide, especially from low-income and middle-income countries. This study aimed to estimate the incidence of SSI in children and associations between SSI and morbidity across human development settings. Methods A multicentre, international, prospective, validated cohort study of children aged under 16 years undergoing clean-contaminated, contaminated or dirty gastrointestinal surgery. Any hospital in the world providing paediatric surgery was eligible to contribute data between January and July 2016. The primary outcome was the incidence of SSI by 30 days. Relationships between explanatory variables and SSI were examined using multilevel logistic regression. Countries were stratified into high development, middle development and low development groups using the United Nations Human Development Index (HDI). Results Of 1159 children across 181 hospitals in 51 countries, 523 (45 center dot 1%) children were from high HDI, 397 (34 center dot 2%) from middle HDI and 239 (20 center dot 6%) from low HDI countries. The 30-day SSI rate was 6.3% (33/523) in high HDI, 12 center dot 8% (51/397) in middle HDI and 24 center dot 7% (59/239) in low HDI countries. SSI was associated with higher incidence of 30-day mortality, intervention, organ-space infection and other HAIs, with the highest rates seen in low HDI countries. Median length of stay in patients who had an SSI was longer (7.0 days), compared with 3.0 days in patients who did not have an SSI. Use of laparoscopy was associated with significantly lower SSI rates, even after accounting for HDI. Conclusion The odds of SSI in children is nearly four times greater in low HDI compared with high HDI countries. Policies to reduce SSI should be prioritised as part of the wider global agenda.Peer reviewe

Global economic burden of unmet surgical need for appendicitis

Background There is a substantial gap in provision of adequate surgical care in many low- and middle-income countries. This study aimed to identify the economic burden of unmet surgical need for the common condition of appendicitis. Methods Data on the incidence of appendicitis from 170 countries and two different approaches were used to estimate numbers of patients who do not receive surgery: as a fixed proportion of the total unmet surgical need per country (approach 1); and based on country income status (approach 2). Indirect costs with current levels of access and local quality, and those if quality were at the standards of high-income countries, were estimated. A human capital approach was applied, focusing on the economic burden resulting from premature death and absenteeism. Results Excess mortality was 4185 per 100 000 cases of appendicitis using approach 1 and 3448 per 100 000 using approach 2. The economic burden of continuing current levels of access and local quality was US $92 492 million using approach 1 and$73 141 million using approach 2. The economic burden of not providing surgical care to the standards of high-income countries was $95 004 million using approach 1 and$75 666 million using approach 2. The largest share of these costs resulted from premature death (97.7 per cent) and lack of access (97.0 per cent) in contrast to lack of quality. Conclusion For a comparatively non-complex emergency condition such as appendicitis, increasing access to care should be prioritized. Although improving quality of care should not be neglected, increasing provision of care at current standards could reduce societal costs substantially

Exploring the cost-effectiveness of high versus low perioperative fraction of inspired oxygen in the prevention of surgical site infections among abdominal surgery patients in three low- and middle-income countries

Background: This study assessed the potential cost-effectiveness of high (80–100%) vs low (21–35%) fraction of inspired oxygen (FiO2) at preventing surgical site infections (SSIs) after abdominal surgery in Nigeria, India, and South Africa. Methods: Decision-analytic models were constructed using best available evidence sourced from unbundled data of an ongoing pilot trial assessing the effectiveness of high FiO2, published literature, and a cost survey in Nigeria, India, and South Africa. Effectiveness was measured as percentage of SSIs at 30 days after surgery, a healthcare perspective was adopted, and costs were reported in US dollars ($). Results: High FiO2 may be cost-effective (cheaper and effective). In Nigeria, the average cost for high FiO2 was$216 compared with $222 for low FiO2 leading to a −$6 (95% confidence interval [CI]: −$13 to −$1) difference in costs. In India, the average cost for high FiO2 was $184 compared with$195 for low FiO2 leading to a −$11 (95$15 to −$6) difference in costs. In South Africa, the average cost for high FiO2 was$1164 compared with $1257 for low FiO2 leading to a −$93 (95% CI: −$132 to −$65) difference in costs. The high FiO2 arm had few SSIs, 7.33% compared with 8.38% for low FiO2, leading to a −1.05 (95% CI: −1.14 to −0.90) percentage point reduction in SSIs. Conclusion: High FiO2 could be cost-effective at preventing SSIs in the three countries but further data from large clinical trials are required to confirm this