Defending against cybercrime: advances in the detection of malicious servers and the analysis of client-side vulnerabilities

Esta tesis se centra en el análisis de dos aspectos complementarios de la ciberdelincuencia (es decir, el crimen perpetrado a través de la red para ganar dinero). Estos dos aspectos son las máquinas infectadas utilizadas para obtener beneficios económicos de la delincuencia a través de diferentes acciones (como por ejemplo, clickfraud, DDoS, correo no deseado) y la infraestructura de servidores utilizados para gestionar estas máquinas (por ejemplo, C & C, servidores explotadores, servidores de monetización, redirectores). En la primera parte se investiga la exposición a las amenazas de los ordenadores victimas. Para realizar este análisis hemos utilizado los metadatos contenidos en WINE-BR conjunto de datos de Symantec. Este conjunto de datos contiene metadatos de instalación de ficheros ejecutables (por ejemplo, hash del fichero, su editor, fecha de instalación, nombre del fichero, la versión del fichero) proveniente de 8,4 millones de usuarios de Windows. Hemos asociado estos metadatos con las vulnerabilidades en el National Vulnerability Database (NVD) y en el Opens Sourced Vulnerability Database (OSVDB) con el fin de realizar un seguimiento de la decadencia de la vulnerabilidad en el tiempo y observar la rapidez de los usuarios a remiendar sus sistemas y, por tanto, su exposición a posibles ataques. Hemos identificado 3 factores que pueden influir en la actividad de parches de ordenadores victimas: código compartido, el tipo de usuario, exploits. Presentamos 2 nuevos ataques contra el código compartido y un análisis de cómo el conocimiento usuarios y la disponibilidad de exploit influyen en la actividad de aplicación de parches. Para las 80 vulnerabilidades en nuestra base de datos que afectan código compartido entre dos aplicaciones, el tiempo entre el parche libera en las diferentes aplicaciones es hasta 118 das (con una mediana de 11 das) En la segunda parte se proponen nuevas técnicas de sondeo activos para detectar y analizar las infraestructuras de servidores maliciosos. Aprovechamos técnicas de sondaje activo, para detectar servidores maliciosos en el internet. Empezamos con el análisis y la detección de operaciones de servidores explotadores. Como una operación identificamos los servidores que son controlados por las mismas personas y, posiblemente, participan en la misma campaña de infección. Hemos analizado un total de 500 servidores explotadores durante un período de 1 año, donde 2/3 de las operaciones tenían un único servidor y 1/2 por varios servidores. Hemos desarrollado la técnica para detectar servidores explotadores a diferentes tipologías de servidores, (por ejemplo, C & C, servidores de monetización, redirectores) y hemos logrado escala de Internet de sondeo para las distintas categorías de servidores maliciosos. Estas nuevas técnicas se han incorporado en una nueva herramienta llamada CyberProbe. Para detectar estos servidores hemos desarrollado una novedosa técnica llamada Adversarial Fingerprint Generation, que es una metodología para generar un modelo único de solicitud-respuesta para identificar la familia de servidores (es decir, el tipo y la operación que el servidor apartenece). A partir de una fichero de malware y un servidor activo de una determinada familia, CyberProbe puede generar un fingerprint válido para detectar todos los servidores vivos de esa familia. Hemos realizado 11 exploraciones en todo el Internet detectando 151 servidores maliciosos, de estos 151 servidores 75% son desconocidos a bases de datos publicas de servidores maliciosos. Otra cuestión que se plantea mientras se hace la detección de servidores maliciosos es que algunos de estos servidores podrán estar ocultos detrás de un proxy inverso silente. Para identificar la prevalencia de esta configuración de red y mejorar el capacidades de CyberProbe hemos desarrollado RevProbe una nueva herramienta a través del aprovechamiento de leakages en la configuración de la Web proxies inversa puede detectar proxies inversos. RevProbe identifica que el 16% de direcciones IP maliciosas activas analizadas corresponden a proxies inversos, que el 92% de ellos son silenciosos en comparación con 55% para los proxies inversos benignos, y que son utilizado principalmente para equilibrio de carga a través de múltiples servidores. ABSTRACT In this dissertation we investigate two fundamental aspects of cybercrime: the infection of machines used to monetize the crime and the malicious server infrastructures that are used to manage the infected machines. In the first part of this dissertation, we analyze how fast software vendors apply patches to secure client applications, identifying shared code as an important factor in patch deployment. Shared code is code present in multiple programs. When a vulnerability affects shared code the usual linear vulnerability life cycle is not anymore effective to describe how the patch deployment takes place. In this work we show which are the consequences of shared code vulnerabilities and we demonstrate two novel attacks that can be used to exploit this condition. In the second part of this dissertation we analyze malicious server infrastructures, our contributions are: a technique to cluster exploit server operations, a tool named CyberProbe to perform large scale detection of different malicious servers categories, and RevProbe a tool that detects silent reverse proxies. We start by identifying exploit server operations, that are, exploit servers managed by the same people. We investigate a total of 500 exploit servers over a period of more 13 months. We have collected malware from these servers and all the metadata related to the communication with the servers. Thanks to this metadata we have extracted different features to group together servers managed by the same entity (i.e., exploit server operation), we have discovered that 2/3 of the operations have a single server while 1/3 have multiple servers. Next, we present CyberProbe a tool that detects different malicious server types through a novel technique called adversarial fingerprint generation (AFG). The idea behind CyberProbe’s AFG is to run some piece of malware and observe its network communication towards malicious servers. Then it replays this communication to the malicious server and outputs a fingerprint (i.e. a port selection function, a probe generation function and a signature generation function). Once the fingerprint is generated CyberProbe scans the Internet with the fingerprint and finds all the servers of a given family. We have performed a total of 11 Internet wide scans finding 151 new servers starting with 15 seed servers. This gives to CyberProbe a 10 times amplification factor. Moreover we have compared CyberProbe with existing blacklists on the internet finding that only 40% of the server detected by CyberProbe were listed. To enhance the capabilities of CyberProbe we have developed RevProbe, a reverse proxy detection tool that can be integrated with CyberProbe to allow precise detection of silent reverse proxies used to hide malicious servers. RevProbe leverages leakage based detection techniques to detect if a malicious server is hidden behind a silent reverse proxy and the infrastructure of servers behind it. At the core of RevProbe is the analysis of differences in the traffic by interacting with a remote server.

Classification and analysis of integrating frameworks in multiscale modelling

Chemical engineers are turning to multiscale modelling to extend traditional modelling approaches into new application areas and to achieve higher levels of detail and accuracy. There is, however, little advice available on the best strategy to use in constructing a multiscale model. This paper presents a starting point for the systematic analysis of multiscale models by defining several integrating frameworks for linking models at different scales. It briefly explores how the nature of the information flow between the models at the different scales is influenced by the choice of framework, and presents some restrictions on model-framework compatibility. The concepts are illustrated with reference to the modelling of a catalytic packed bed reactor. (C) 2004 Elsevier Ltd. All rights reserved.

Variation and change in the use of hesitation markers in Germanic languages

In this study, we investigate crosslinguistic patterns in the alternation between UM, a hesitation marker consisting of a neutral vowel followed by a final labial nasal, and UH, a hesitation marker consisting of a neutral vowel in an open syllable. Based on a quantitative analysis of a range of spoken and written corpora, we identify clear and consistent patterns of change in the use of these forms in various Germanic languages (English, Dutch, German, Norwegian, Danish, Faroese) and dialects (American English, British English), with the use of UM increasing over time relative to the use of UH. We also find that this pattern of change is generally led by women and more educated speakers. Finally, we propose a series of possible explanations for this surprising change in hesitation marker usage that is currently taking place across Germanic languages.

The 'Arc of prosperity' revisited: Homelessness policy change in north western Europe

This paper compares continuity and change in homelessness policy in Ireland, Scotland and Norway with a particular focus on the period of post-crisis austerity measures (2008-2016). The analytical approach draws on institutional theory and the notion of path dependency, which has rarely been applied to comparative homelessness research. The paper compares welfare and housing systems in the three countries prior to presenting a detailed analysis of the conceptualisation and measurement of homelessness; the institutions which address homelessness; and the evidence of change in the post-2008 period. The analysis demonstrates that challenges remain in comparing the nature of homelessness and policy responses across nation states, even where they have a number of similar characteristics, and despite some EU influence towards homelessness policy convergence. Similarly, national-level homelessness policy change could not be interpreted as entirely a result of the external shock of the 2008 general financial crisis, as existing national policy goals and programmes were also influential. Overall, embedded national frameworks and institutions were resilient, but sufficiently flexible to deliver longer term policy shifts in response to the changing nature of the homelessness problem and national policy goals. Institutionalism and path dependency were found to be useful in developing the comparative analysis of homelessness policy change and could be fruitfully applied in future longitudinal, empirical research across a wider range of countries.

Protein cutoff scanning: a comparative analysis of cutoff dependent and cutoff free methods for prospecting contacts in proteins.

In this study, we carried out a comparative analysis between two classical methodologies to prospect residue contacts in proteins: the traditional cutoff dependent (CD) approach and cutoff free Delaunay tessellation (DT). In addition, two alternative coarse-grained forms to represent residues were tested: using alpha carbon (CA) and side chain geometric center (GC). A database was built, comprising three top classes: all alpha, all beta, and alpha/beta. We found that the cutoff value? at about 7.0 A emerges as an important distance parameter.? Up to 7.0 A, CD and DT properties are unified, which implies that at this distance all contacts are complete and legitimate (not occluded). We also have shown that DT has an intrinsic missing edges problem when mapping the first layer of neighbors. In proteins, it may produce systematic errors affecting mainly the contact network in beta chains with CA. The almost-Delaunay (AD) approach has been proposed to solve this DT problem. We found that even AD may not be an advantageous solution. As a consequence, in the strict range up ? to 7.0 A, the CD approach revealed to be a simpler, more complete, and reliable technique than DT or AD. Finally, we have shown that coarse-grained residue representations may introduce bias in the analysis of neighbors in cutoffs up to ? 6.8 A, with CA favoring alpha proteins and GC favoring beta proteins. This provides an additional argument pointing to ? the value of 7.0 A as an important lower bound cutoff to be used in contact analysis of proteins.

All in Good Time: Exploring Change in Neanderthal Behavioural Complexity

Since their discovery 150 years ago, Neanderthals have been considered incapable of behavioural change and innovation. Traditional synchronic approaches to the study of Neanderthal behaviour have perpetuated this view and shaped our understanding of their lifeways and eventual extinction. In this thesis I implement an innovative diachronic approach to the analysis of Neanderthal faunal extraction, technology and symbolic behaviour as contained in the archaeological record of the critical period between 80,000 and 30,000 years BP. The thesis demonstrates patterns of change in Neanderthal behaviour which are at odds with traditional perspectives and which are consistent with an interpretation of increasing behavioural complexity over time, an idea that has been suggested but never thoroughly explored in Neanderthal archaeology. Demonstrating an increase in behavioural complexity in Neanderthals provides much needed new data with which to fuel the debate over the behavioural capacities of Neanderthals and the first appearance of Modern Human Behaviour in Europe. It supports the notion that Neanderthal populations were active agents of behavioural innovation prior to the arrival of Anatomically Modern Humans in Europe and, ultimately, that they produced an early Upper Palaeolithic cultural assemblage (the Châtelperronian) independent of modern humans. Overall, this thesis provides an initial step towards the development of a quantitative approach to measuring behavioural complexity which provides fresh insights into the cognitive and behavioural capabilities of Neanderthals.

Kinetics of photoacclimation in corals

Traditional models describing the relationship between photosynthesis (P) and irradiance (I) do not account for photoacclimation to short-term variation in irradiance. Here we develop and test a model that predicts the rate of photosynthesis under fluctuating irradiances at the scale of days to weeks. Using oxygen respirometry, we measured the rates of change in the P-I model parameters P-max (maximum rate of gross photosynthesis) and I-k (sub-saturation irradiance) of the photo-symbiotic coral Turbinaria mesenterina (Lamarck) following large and small increases and decreases in growth irradiance. We analyse the behaviour of the dynamic P-I model in turbid-water conditions using a dataset of 3-month continuous irradiance as the input variable. In response to upward or downward changes in experimental growth irradiance, I-k values decreased or increased exponentially, reaching new and stable levels within 5-10 days. I-k responded 4 times stronger than P-max to changes in growth irradiance. The kinetics of I-k did not show hysteresis, and changed in similar ways when irradiance was increased or decreased in small or large amounts. This suggests that mechanisms associated with photo-protection during increases in irradiance, and the maximisation of photosynthetic efficiency during decreases in irradiance, are equally potent. On the scale of months, the dynamic P-I model did not predict higher rates of photosynthesis than the static P-I model, but buffered the variation in photosynthesis during periods of reduced irradiance. Fourier analysis indicated that the kinetics of I-k closely matches the main periodicities in daily irradiance (1-2 weeks). The recorded kinetics of photoacclimation in the Turbinaria-zooxanthella symbiosis is comparable to that of free-living phytoplankton and faster than that of higher plants.

Patterns of change and stability in the gender division of household labour in Australia, 1986-1997

Recent research in Australia and overseas has suggested that we are witnessing a convergence of men's and women's time on domestic labour activities. But there is disagreement about whether this is due to women reducing their time on housework or men increasing their time on housework. This article addresses these issues using national survey data collected in Australia in 1986, 1993 and 1997. The results show some changes in the proportional responsibilities of men and women in the home with men reporting a greater share of traditional indoor activities. But overall both men and women are spending less time on housework. In particular, women's time on housework has declined by six hours per week since 1986. Hence, while the gender gap between men's and women's involvement in the home is getting smaller, it is not the result of men increasing their share of the load, but is due to the large decline in women's time spent on domestic labour. There is also evidence of change in the relationship. between paid and unpaid work for women. Women's hours of,paid labour had a greater impact on their involvement in domestic labour in 1997 compared to a decade earlier. The article concludes that women's increased labour force involvement in combination with changing patterns and styles, of consumption is leading to some changes in the gender-division:of household labour, but not in the direction anticipated by earlier commentators on the domestic division of labour.

Perinatal Outcome and Change in Body Mass Index in Mothers of Dichorionic Twins: a Longitudinal Cohort Study

We used a prospective cohort to analyze the effect of change in BMI rather than change in weight, in mothers carrying dichorionic twins from a population that did not receive any dietary intervention. A total of 269 mothers (150 nulliparas and 119 multiparas) were evaluated. The average change (%) from the pre-gravid BMI was 7.2+/-6.1, 17.4+/-8.2, and 28.7+/-10.8, at 12-14, 22-25, and 30-34 weeks, respectively, without difference between nulliparas and multiparas. The comparison between maternities below or above the average change from the pregravid BMI failed to demonstrate an advantage (in terms of total twin birthweight and gestational age) of an above average change from the pregravid BMI, even when the lower versus upper quartiles were compared. Our observations reached different conclusions regarding the recommended universal dietary intervention in twin gestations. A cautious approach is advocated towards seemingly harmless excess weight gain, as normal weight women may turn overweight, or even obese, by the end of pregnancy, and be exposed to the untoward effects of obesity on future health and body image.

Guidelines on how to assess the validity of results presented in subgroup analysis of clinical trials

In observational studies, identification of associations within particular subgroups is the usual method of investigation. As an exploratory method, it is the bread and butter of epidemiological research. Nearly everything that has been learned in epidemiology has been derived from the analysis of subgroups. In a randomized clinical trial, the entire purpose is the comparison of the test subjects and the controls, and when there is particular interest in the results of treatment in a certain section of trial participants, a subgroup analysis is performed. These subgroups are examined to see if they are liable to a greater benefit or risk from treatment. Thus, analyzing patient subsets is a natural part of the process of improving therapeutic knowledge through clinical trials. Nevertheless, the reliability of subgroup analysis can often be poor because of problems of multiplicity and limitations in the numbers of patients studied. The naive interpretation of the results of such examinations is a cause of great confusion in the therapeutic literature. We emphasize the need for readers to be aware that inferences based on comparisons between subgroups in randomized clinical trials should be approached more cautiously than those based on the main comparison. That is, subgroup analysis results derived from a sound clinical trial are not necessarily valid; one must not jump to conclusions and accept the validity of subgroup analysis results without an appropriate judgment.

Acute myocardial infarction in progressively elderly patients. A comparative analysis of immediate results in patients who underwent primary percutaneous coronary intervention

OBJECTIVE: Analysis of the in-hospital results, in progressively elderly patients who undergo primary percutaneous coronary intervention (PCI) in the first 24 hours of AMI. METHODS: The patients were divided into three different age groups (60/69, 70/79, and > or = 80 years) and were treated from 7/95 until 12/99. The primary success rate and the occurrence of major clinical events were analyzed at the end of the in-hospital phase. Coronary stent implantation and abciximab use were employed at the intervencionist discretion. RESULTS: We analyzed 201 patients with age ranging from 60 to 93 years, who underwent primary PCI. Patients with ages above 70 were more often female (p=.015). Those with ages above 80 were treated later with PCI (p=.054), and all of them presented with total occlusion of the infarct-related artery. Coronary stents were implanted in 30% of the patients. Procedural success was lower in > or = 80 year old patients (p=.022), and the death rate was higher in > or = 70 years olds (p=.019). Reinfarction and coronary bypass surgery were uncommon events. A trend occurred toward a higher combined incidence of major in-hospital events according to increased age (p=.064). CONCLUSION: Elderly patients ( > or = 70 years) presented with adverse clinical and angiographic profiles and patients > or = 80 years of age obtained reduced TIMI 3 flow success rates after primary PTCA, and those > or = 70 years had a higher death rate.

Longstanding health conditions among three-year-old children in the Republic of Ireland in 2011

Access audio, video and slides from the launch of the report The Institute of Public health in Ireland (IPH) produces population prevalence estimates and forecasts for a number of chronic conditions among adults. IPH has now applied the methodology to longstanding health conditions among young children across the island of Ireland. This report, based on a systematic analysis of data from the Growing Up in Ireland National Longitudinal Study of Children in the Republic of Ireland, is the first comprehensive look at longstanding health conditions among young children in Ireland. Estimated prevalence (per cent and number of cases) of longstanding health conditions among three-year-olds in the Republic of Ireland in 2011 by administrative counties/cities. The conditions are carer-reported: - "Longstanding illness, condition or disability” (where longstanding was defined as “anything that has troubled him/her over a period of time or that is likely to affect him/her over a period of time”) - Diagnosed asthma or asthma symptoms - Diagnosed eczema/any kind of skin allergy - Sight problem that required correction - Hearing problem that required correction - The estimates are based on data from the Growing Up in Ireland National Longitudinal Study of Children (www.growingup.ie) and population data. See the Chronic Conditions Hub for more details.  

Longstanding health conditions among three-year-old children in the Republic of Ireland in 2011: Executive Summary

Access audio, video and slides from the launch of the report The Institute of Public health in Ireland (IPH) produces population prevalence estimates and forecasts for a number of chronic conditions among adults. IPH has now applied the methodology to longstanding health conditions among young children across the island of Ireland. This report, based on a systematic analysis of data from the Growing Up in Ireland National Longitudinal Study of Children in the Republic of Ireland, is the first comprehensive look at longstanding health conditions among young children in Ireland. Estimated prevalence (per cent and number of cases) of longstanding health conditions among three-year-olds in the Republic of Ireland in 2011 by administrative counties/cities. The conditions are carer-reported: - "Longstanding illness, condition or disability” (where longstanding was defined as “anything that has troubled him/her over a period of time or that is likely to affect him/her over a period of time”) - Diagnosed asthma or asthma symptoms - Diagnosed eczema/any kind of skin allergy - Sight problem that required correction - Hearing problem that required correction - The estimates are based on data from the Growing Up in Ireland National Longitudinal Study of Children (www.growingup.ie) and population data. See the Chronic Conditions Hub for more details.    

Longstanding health conditions among three-year-old children in the Republic of Ireland in 2011: Factsheet

Access audio, video and slides from the launch of the report The Institute of Public health in Ireland (IPH) produces population prevalence estimates and forecasts for a number of chronic conditions among adults. IPH has now applied the methodology to longstanding health conditions among young children across the island of Ireland. This report, based on a systematic analysis of data from the Growing Up in Ireland National Longitudinal Study of Children in the Republic of Ireland, is the first comprehensive look at longstanding health conditions among young children in Ireland. Estimated prevalence (per cent and number of cases) of longstanding health conditions among three-year-olds in the Republic of Ireland in 2011 by administrative counties/cities. The conditions are carer-reported: - "Longstanding illness, condition or disability” (where longstanding was defined as “anything that has troubled him/her over a period of time or that is likely to affect him/her over a period of time”) - Diagnosed asthma or asthma symptoms - Diagnosed eczema/any kind of skin allergy - Sight problem that required correction - Hearing problem that required correction - The estimates are based on data from the Growing Up in Ireland National Longitudinal Study of Children (www.growingup.ie) and population data. See the Chronic Conditions Hub for more details.    

Traitement chirurgical de la diplopie secondaire à l'orbitopathie dysthyroïdienne [Surgical treatment of diplopia in Graves' orbitopathy]

BACKGROUND: The correction of oculomotor disorder in Grave's disease is applied on pathological extraocular muscles. Based on the global muscular restriction (bilateral forced duction test) and angular measurements, we have used a non-adjustable technique. PATIENTS AND METHODS: We performed a retrospective analysis of 21 patients (23 operations) with thyroid-associated orbitopathy operated for persisting diplopia. The angles of deviation in the 9 diagnostic directions of gaze and the field of binocular vision were measured with the Harm's tangent scale before and after surgery. Sixteen patients were operated only on vertical muscles. The mean follow-up was 45 months. RESULTS: 76 % of the patients (95 % confidence interval [CI], 58-94 %) obtained a large and centred field of binocular vision without prisms. 14 % (95 % CI, 0-29 %) had binocular vision with the use of prisms. Diplopia persisted in one patient despite 3 operations. Taking into consideration the interventions done before the patient was referred to us, the reintervention rate was 13 % (95 % CI, 0-28 %). CONCLUSIONS: A binocular field of vision can be successfully restored in the majority of patients with Graves' orbitopathy, using a non-adjustable surgical technique.