Detecting Motifs in System Call Sequences

The search for patterns or motifs in data represents an area of key interest to many researchers. In this paper we present the Motif Tracking Algorithm, a novel immune inspired pattern identification tool that is able to identify unknown motifs which repeat within time series data. The power of the algorithm is derived from its use of a small number of parameters with minimal assumptions. The algorithm searches from a completely neutral perspective that is independent of the data being analysed and the underlying motifs. In this paper the motif tracking algorithm is applied to the search for patterns within sequences of low level system calls between the Linux kernel and the operating system’s user space. The MTA is able to compress data found in large system call data sets to a limited number of motifs which summarise that data. The motifs provide a resource from which a profile of executed processes can be built. The potential for these profiles and new implications for security research are highlighted. A higher level system call language for measuring similarity between patterns of such calls is also suggested.

A truncation in the Aryl Hydrocarbon Receptor of the CRL:WI(Han) rat does not affect the developmental toxicity of TCDD

The Aryl Hydrocarbon Receptor (AhR) is required for the toxicity of TCDD, and so the AhR of CRL:WI and CRL:WI(Han) rats was characterised. Western blot showed AhR proteins of ~110 and ~97 kDa in individual rats from both strains. The AhR cDNA from a CRL:WI(Han) rat with the ~110kDa protein revealed a sequence that was identical to that of the CRL:WI and SD rat. However, cloning of the AhR from a rat with the ~97kDa protein revealed a point mutation, and five variants encoding two C-terminally truncated variants of the AhR protein, arising from a point mutation in the intron/exon junction and consequent differential splicing. These C-terminally truncated variants were expressed and shown to give rise to a protein of ~97kDa; the recombinant AhR bound TCDD with an affinity that was not statistically different from the full-length protein. A single-nucleotide polymorphism (SNP) assay was developed, and showed that both alleles were represented in a Hardy-Weinberg equilibrium in samples of CRL:WI and CRL:WI(Han) populations; both alleles are abundant. Rats from two studies of TCDD developmental toxicity were genotyped, and the association with toxicity investigated using statistical analysis. There was no plausible evidence that the AhR allele had a significant effect on the toxic endpoints examined. These data show that the two AhR alleles are common in two strains of Wistar rat, and that the AhR alleles had no effect on TCDD-induced developmental toxicity in two independent studies.