Tracking Cyber Adversaries with Adaptive Indicators of Compromise

A forensics investigation after a breach often uncovers network and host indicators of compromise (IOCs) that can be deployed to sensors to allow early detection of the adversary in the future. Over time, the adversary will change tactics, techniques, and procedures (TTPs), which will also change the data generated. If the IOCs are not kept up-to-date with the adversary's new TTPs, the adversary will no longer be detected once all of the IOCs become invalid. Tracking the Known (TTK) is the problem of keeping IOCs, in this case regular expressions (regexes), up-to-date with a dynamic adversary. Our framework solves the TTK problem in an automated, cyclic fashion to bracket a previously discovered adversary. This tracking is accomplished through a data-driven approach of self-adapting a given model based on its own detection capabilities. In our initial experiments, we found that the true positive rate (TPR) of the adaptive solution degrades much less significantly over time than the naive solution, suggesting that self-updating the model allows the continued detection of positives (i.e., adversaries). The cost for this performance is in the false positive rate (FPR), which increases over time for the adaptive solution, but remains constant for the naive solution. However, the difference in overall detection performance, as measured by the area under the curve (AUC), between the two methods is negligible. This result suggests that self-updating the model over time should be done in practice to continue to detect known, evolving adversaries.Comment: This was presented at the 4th Annual Conf. on Computational Science & Computational Intelligence (CSCI'17) held Dec 14-16, 2017 in Las Vegas, Nevada, US

A Riemann solver at a junction compatible with a homogenization limit

We consider a junction regulated by a traffic lights, with n incoming roads and only one outgoing road. On each road the Phase Transition traffic model, proposed in [6], describes the evolution of car traffic. Such model is an extension of the classic Lighthill-Whitham-Richards one, obtained by assuming that different drivers may have different maximal speed. By sending to infinity the number of cycles of the traffic lights, we obtain a justification of the Riemann solver introduced in [9] and in particular of the rule for determining the maximal speed in the outgoing road.Comment: 19 page

Co-occurring protein phosphorylation are functionally associated

<div><p>Post-translational modifications (PTMs) add a further layer of complexity to the proteome and regulate a wide range of cellular protein functions. With the increasing number of known PTM sites, it becomes imperative to understand their functional interplays. In this study, we proposed a novel analytical strategy to explore functional relationships between PTM sites by testing their tendency to be modified together (co-occurrence) under the same condition, and applied it to proteome-wide human phosphorylation data collected under 88 different laboratory or physiological conditions. Co-occurring phosphorylation occurs significantly more frequently than randomly expected and include many known examples of cross-talk or functional connections. Such pairs, either within the same phosphoprotein or between interacting partners, are more likely to be in sequence or structural proximity, be phosphorylated by the same kinases, participate in similar biological processes, and show residue co-evolution across vertebrates. In addition, we also found that their co-occurrence states tend to be conserved in orthologous phosphosites in the mouse proteome. Together, our results support that the co-occurring phosphorylation are functionally associated. Comparison with existing methods further suggests that co-occurrence analysis can be a useful complement to uncover novel functional associations between PTM sites.</p></div

Comparison between the original and randomly permuted data in which the total number of phosphorylations at each condition kept fixed across different p-value threshold.

<p>Comparison between the original and randomly permuted data in which the total number of phosphorylations at each condition kept fixed across different p-value threshold.</p

Comparison between the positive and negative sets between interacting proteins across different p-value thresholds.

<p>The positive set is defined as phosphosite pairs in which both sites are located within phosphorylation enriched protein complexes [<a href="http://www.ploscompbiol.org/article/info:doi/10.1371/journal.pcbi.1005502#pcbi.1005502.ref015" target="_blank">15</a>]. The negative set is defined as phosphosite pairs in which at least one site cannot be mapped to those complexes.</p

Characterization of co-occurring phosphorylation pairs between interacting proteins in the CCSB PPI set.

<p>(A) Co-occurring pairs located in phosphorylation enriched protein complexes [<a href="http://www.ploscompbiol.org/article/info:doi/10.1371/journal.pcbi.1005502#pcbi.1005502.ref015" target="_blank">15</a>] are enriched with small FET p-values. Compared with control pairs, co-occurring pairs are more likely to co-localize in the PPI interfaces (B), and be catalyzed by the same predicted kinases (C). (D) The mouse orthologous phosphosites of human co-occurring pairs also show the tendency of being modified under same conditions.</p

Co-occurrence of phosphorylation status can reflect known functional associations.

<p>(A) An example co-occurrence analysis on transcription factor c-Jun. There are four phosphosites (S58, T239, S243 and S249) on c-Jun. Their phosphorylation status (red: on, green: off) across 88 conditions are shown. For each pairwise combination of phosphosites, their joint phosphorylation status is summarized into a contingency table with four entries <i>n</i>_<i>ij</i> (<i>i,j</i> ∈ {0,1}), where <i>n</i>_<i>ij</i> denotes the number of times the site 1 is in state <i>i</i> site 2 is in state <i>j</i>. One-sided FET is used to test if two sites are phosphorylated together more often than expected. Consistent with the previous study that three sites (T239, S243 and S249) tend to be phosphorylated together to inhibit c-Jun’s activity in epithelial resting cells, their pairwise FET p-values are lower than their combination with S58. The most significant co-occurring pair is highlighted. (B) Cumulative distribution of co-occurrence FET p-values for 22 known cross-talk examples (red) are superimposed onto the p-values of all within-protein phosphosite pairs (blue). (C) Comparing the distribution co-occurrence FET p-values between 380 homo-functional pairs and 35 hetero-functional pairs.</p

Comparison between known cross-talk/homo-functional pairs (positive set) and hetero-functional pairs (negative set) across different p-value threshold.

<p>Comparison between known cross-talk/homo-functional pairs (positive set) and hetero-functional pairs (negative set) across different p-value threshold.</p

Characterization of the co-occurring phosphorylation pairs within proteins.

<p>The co-occurring and control phosphorylation pairs identified within proteins are compared on their sequence distances (A), 3D structural distances (B), scores that measure sharing annotations of biological processes (C), molecular functions (D), and catalytic kinases (E), and residue co-evolution (nMI) (F). To control for the sequence distance in comparing annotation sharing and co-evolution, co-occurring pairs were also compared with a subset of control pairs with matched distribution of sequence distances (<a href="http://www.ploscompbiol.org/article/info:doi/10.1371/journal.pcbi.1005502#pcbi.1005502.s013" target="_blank">S2 Fig</a>).</p

Image_2_Trans-Ethnic Polygenic Analysis Supports Genetic Overlaps of Lumbar Disc Degeneration With Height, Body Mass Index, and Bone Mineral Density.pdf

<p>Lumbar disc degeneration (LDD) is age-related break-down in the fibrocartilaginous joints between lumbar vertebrae. It is a major cause of low back pain and is conventionally assessed by magnetic resonance imaging (MRI). Like most other complex traits, LDD is likely polygenic and influenced by both genetic and environmental factors. However, genome-wide association studies (GWASs) of LDD have uncovered few susceptibility loci due to the limited sample size. Previous epidemiology studies of LDD also reported multiple heritable risk factors, including height, body mass index (BMI), bone mineral density (BMD), lipid levels, etc. Genetics can help elucidate causality between traits and suggest loci with pleiotropic effects. One such approach is polygenic score (PGS) which summarizes the effect of multiple variants by the summation of alleles weighted by estimated effects from GWAS. To investigate genetic overlaps of LDD and related heritable risk factors, we calculated the PGS of height, BMI, BMD and lipid levels in a Chinese population-based cohort with spine MRI examination and a Japanese case-control cohort of lumbar disc herniation (LDH) requiring surgery. Because most large-scale GWASs were done in European populations, PGS of corresponding traits were created using weights from European GWASs. We calibrated their prediction performance in independent Chinese samples, then tested associations with MRI-derived LDD scores and LDH affection status. The PGS of height, BMI, BMD and lipid levels were strongly associated with respective phenotypes in Chinese, but phenotype variances explained were lower than in Europeans which would reduce the power to detect genetic overlaps. Despite of this, the PGS of BMI and lumbar spine BMD were significantly associated with LDD scores; and the PGS of height was associated with the increased the liability of LDH. Furthermore, linkage disequilibrium score regression suggested that, osteoarthritis, another degenerative disorder that shares common features with LDD, also showed genetic correlations with height, BMI and BMD. The findings suggest a common key contribution of biomechanical stress to the pathogenesis of LDD and will direct the future search for pleiotropic genes.</p