Integrity-Based Kernel Malware Detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.

Improved clonality assessment in germinal centre/post-germinal centre non-Hodgkin's lymphomas with high rates of somatic hypermutation.

BACKGROUND: PCR detects clonal rearrangements of the Ig gene in lymphoproliferative disorders. False negativity occurs in germinal centre/post-germinal centre lymphomas (GC/PGCLs) as they display a high rate of somatic hypermutation (SHM), which causes primer mismatching when detecting Ig rearrangements by PCR. AIMS: To investigate the degree of SHM in a group of GC/PGCLs and assess the rate of false negativity when using BIOMED-2 PCR when compared with previously published strategies. METHODS: DNA was isolated from snap-frozen tissue from 49 patients with GC/PGCL (23 diffuse large B cell lymphomas (DLBCLs), 26 follicular lymphomas (FLs)) and PCR-amplified for complete (VDJH), incomplete (DJH) and Ig kappa/lambda rearrangements using the BIOMED-2 protocols, and compared with previously published methods using consensus primers. Germinal centre phenotype was defined by immunohistochemistry based on CD10, Bcl-6 and MUM-1. RESULTS: Clonality detection by amplifying Ig rearrangements using BIOMED-2 family-specific primers was considerably higher than that found using consensus primers (74% DLBCL and 96% FL vs 69% DLBCL and 73% FL). Addition of BIOMED-2 DJH rearrangements increased detection of clonality by 22% in DLBCL. SHM was present in VDJH rearrangements from all patients with DLBCL (median (range) 5.7% (2.5-13.5)) and FL (median (range) 5.3% (2.3-11.9)) with a clonal rearrangement. CONCLUSIONS: Use of BIOMED-2 primers has significantly reduced the false negative rate associated with GC/PGCL when compared with consensus primers, and the inclusion of DJH rearrangements represents a potential complementary target for clonality assessment, as SHM is thought not to occur in these types of rearrangements.

Detection rate of FNA cytology in medullary thyroid carcinoma: a meta-analysis.

BACKGROUND: The early detection of medullary thyroid carcinoma (MTC) can improve patient prognosis, because histological stage and patient age at diagnosis are highly relevant prognostic factors. As a consequence, delay in the diagnosis and/or incomplete surgical treatment should correlate with a poorer prognosis for patients. Few papers have evaluated the specific capability of fine-needle aspiration cytology (FNAC) to detect MTC, and small series have been reported. This study conducts a meta-analysis of published data on the diagnostic performance of FNAC in MTC to provide more robust estimates. RESEARCH DESIGN AND METHODS: A comprehensive computer literature search of the PubMed/MEDLINE, Embase and Scopus databases was conducted by searching for the terms 'medullary thyroid' AND 'cytology', 'FNA', 'FNAB', 'FNAC', 'fine needle' or 'fine-needle'. The search was updated until 21 March 2014, and no language restrictions were used. RESULTS: Fifteen relevant studies and 641 MTC lesions that had undergone FNAC were included. The detection rate (DR) of FNAC in patients with MTC (diagnosed as 'MTC' or 'suspicious for MTC') on a per lesion-based analysis ranged from 12·5% to 88·2%, with a pooled estimate of 56·4% (95% CI: 52·6-60·1%). The included studies were statistically heterogeneous in their estimates of DR (I-square >50%). Egger's regression intercept for DR pooling was 0·03 (95% CI: -3·1 to 3·2, P = 0·9). The study that reported the largest MTC series had a DR of 45%. Data on immunohistochemistry for calcitonin in diagnosing MTC were inconsistent for the meta-analysis. CONCLUSIONS: The presented meta-analysis demonstrates that FNAC is able to detect approximately one-half of MTC lesions. These findings suggest that other techniques may be needed in combination with FNAC to diagnose MTC and avoid false negative results.

Increasing detection rate of user-to-root attacks using genetic algorithms

An extensive set of machine learning and pattern classification techniques trained and tested on KDD dataset failed in detecting most of the user-to-root attacks. This paper aims to provide an approach for mitigating negative aspects of the mentioned dataset, which led to low detection rates. Genetic algorithm is employed to implement rules for detecting various types of attacks. Rules are formed of the features of the dataset identified as the most important ones for each attack type. In this way we introduce high level of generality and thus achieve high detection rates, but also gain high reduction of the system training time. Thenceforth we re-check the decision of the user-to- root rules with the rules that detect other types of attacks. In this way we decrease the false-positive rate. The model was verified on KDD 99, demonstrating higher detection rates than those reported by the state- of-the-art while maintaining low false-positive rate.

Different fever definitions and the rate of fever and neutropenia diagnosed in children with cancer: a retrospective two-center cohort study

Background. The definition of fever, and thus fever and neutropenia (FN), varies between different pediatric oncology centers. Higher temperature limit should reduce FN rates, but may increase rates of FN with complications by delaying therapy. This study determined if different fever definitions are associated with different FN rates. Procedure. Two pediatric oncology centers had used three fever definitions in 2004–2011: ear temperature >=38.5°C persisting >=2 hours (low definition); axillary temperature >=38.5°C >=2 hours or >=39.0°C once (middle); and ear temperature >=39.0°C once (high). Clinical information was retrospectively extracted from charts. FN rates were compared using mixed Poisson regression. Results. In 521 pediatric patients with cancer, 783 FN were recorded during 6,009 months cumulative chemotherapy exposure time (501 years; rate, 0.13/month [95% CI, 0.12–0.14]), 124 of them with bacteremia (16%; 0.021/month [0.017–0.025]). In univariate analysis, the high versus low fever definition was associated with a lower FN rate (0.10/month [0.08–0.11] vs. 0.15/month [0.13–0.16]; rate ratio, 0.66 [0.45–0.97]; P ¼ 0.036), the middle definition was intermediate (0.13/month [0.11–0.15]). This difference was not confirmed in multivariate analysis (rate ratio, 0.94 [0.67–1.33]; P ¼ 0.74). The high versus low definition was not associated with an increased rate of FN with bacteremia (multivariate rate ratio, 1.39 [0.53–3.62]; P ¼ 0.50). Conclusion. A higher fever definition was not associated with a lower FN rate, nor with an increased rate of FN with bacteremia. These may be false negative findings due to methodological limitations. These questions, with their potential impact on health-related quality of life, and on costs, need to be assessed in prospective studies.

False -positives and false-negatives in tests for trend

False-positive and false-negative values were calculated for five different designs of the trend test and it was demonstrated that a design suggested by Portier and Hoel in 1984 for a different problem produced the lowest false-positive and false-negative rates when applied to historical spontaneous tumor rate data for Fischer Rats. ^

Fine needle aspiration biopsy in the oral cavity and head and neck region

The objective of the current study was to evaluate the sensitivity, specificity and accuracy of fine needle aspiration biopsy (FNAB) of submucous nodules from the oral cavity and head and neck region as an auxiliary diagnostic tool. Fifty patients with nodule lesions in the oral cavity and the head and neck region were selected. All of them were submitted to FNAB and to either incisional or excisional biopsy. The diagnoses from the FNABs were compared with the biopsy diagnosis as the gold standard. All the cases of FNAB were analyzed by a single oral pathologist prior to the biopsy diagnosis. The results showed that the sensitivity of FNAB was 75%, its specificity was 96% and its accuracy was 58.8%. The false positive and false negative rates were 6.7% and 13.3%, respectively. The positive predictive value was 86% and the negative predictive value was 93%. The inconclusive rate was 16/50. FNAB displayed a high success rate for identifying both malignant and benign lesions, but a low accuracy for making a final diagnosis.

Coronary CT angiography using 64 detector rows: methods and design of the multi-centre trial CORE-64

Multislice computed tomography (MSCT) for the noninvasive detection of coronary artery stenoses is a promising candidate for widespread clinical application because of its non-invasive nature and high sensitivity and negative predictive value as found in several previous studies using 16 to 64 simultaneous detector rows. A multi-centre study of CT coronary angiography using 16 simultaneous detector rows has shown that 16-slice CT is limited by a high number of nondiagnostic cases and a high false-positive rate. A recent meta-analysis indicated a significant interaction between the size of the study sample and the diagnostic odds ratios suggestive of small study bias, highlighting the importance of evaluating MSCT using 64 simultaneous detector rows in a multi-centre approach with a larger sample size. In this manuscript we detail the objectives and methods of the prospective ""CORE-64"" trial (""Coronary Evaluation Using Multidetector Spiral Computed Tomography Angiography using 64 Detectors""). This multi-centre trial was unique in that it assessed the diagnostic performance of 64-slice CT coronary angiography in nine centres worldwide in comparison to conventional coronary angiography. In conclusion, the multi-centre, multi-institutional and multi-continental trial CORE-64 has great potential to ultimately assess the per-patient diagnostic performance of coronary CT angiography using 64 simultaneous detector rows.

Parathyroid hormone venous sampling prior to reoperation for primary hyperparathyroidism

Background: The surgical cure rate for primary hyperparathyroidism is greater than 95%. For those who have recurrent or persistent disease, preoperative localization improves reoperation success rates. Selective parathyroid venous sampling (SPVS) for intact parathyroid hormone is particularly useful when non-invasive localization techniques are negative or inconclusive. Methods: We present all known cases (n = 13) between 1994 and 2002 who had venous sampling for localization at our institution prior to reoperation for recurrent or persistent primary hyperparathyroidism. Comparison was made with non-invasive localization procedures. Results of invasive and non-invasive localization were correlated with surgical findings. Results: Of the nine reoperated cases, eight had positive correlations between SPVS and operative findings and histopathology. SPVS did not reveal the parathyroid hormone source in one case with negative non-invasive localization procedures. Comparisons between SPVS, computerized tomography (CT), and parathyroid scintigraphy (MIBI) as expressed in terms of true positive (TP), false positive (FP) and false negative (FN) were: SPVS - TP 88.8%, FP 0%, FN 11.1%; CT - TP 22.2%, FP 22.2%, FN 55.5%; and MIBI - TP 33.3%, FP 0%, FN 66.6%. At least seven of the nine operated cases have been cured; another remained normocalcaemic 2 weeks after subtotal parathyroidectomy. Conclusion: In our institution SPVS has proven to be a valuable tool in cases with recurrent or persistent primary hyperparathyroidism and negative non-invasive localization procedures.

Therapeutical evaluation of different dose regimens of praziquantel in schistosomiasis mansoni, based on the quantitative oogram technique

A clinical trial involving 80 patients of both sexes, from ages 15 to 55, with chronic intestinal or hepatointestinal schistosomiasis mansoni, was carried out to evaluate the therapeutical efficacy of different dose regimens of praziquantel. The patients were randomly allocated into four groups with an equal number of cases and were then treated with one of the following dosages: 60 mg/kg for 1 day; 60 mg/kg daily for 2 days; 60 mg/kg daily for 3 days; and 30 mg/kg daily for 6 days. The assessment of parasitological cure was based on the quantitative oogram technique through rectal mucosa biopsies which were undertaken prior to, as well as, 1,2,4 and 6 months post-treatment. Concurrently, stool examinations according to the qualitative Hoffman, Pons & Janer (HPJ) and the quantitative Kato-Katz (K-K) methods were also performed. The best tolerability was observed with 30 mg/kg daily for 6 days whereas the highest incidence of side-effects (mainly dizziness and nausea) was found with 60 mg/kg daily for 3 days. No serious adverse drug reaction has occurred. The achieved cure rates were: 25% with 60 mg/kg for 1 day; 60% with 60 mg/kg daily for 2 days; 89.5% with 60 mg/kg daily for 3 days; and 90% with 30 mg/kg daily for 6 days. At the same time there has been a downfall of 64%, 73%, 87% and 84% respectively, in the median number of viable S. mansoni ova per gram of tissue. Thus, a very clear direct correlation between dose and effect could be seen. The corresponding cure rates according to stool examinations by HPJ were 39%, 80%, 100% and 95%; by K-K 89%, 100%, 100% and 100%. This discrepancy in results amongst the three parasitological methods is certainly due to their unequal accuracy. In fact, when the number of viable eggs per gram of tissue fell below 5,000 the difference in the percentage of false negative findings between HPJ (28%) and K-K (80%) became significative. When this number dropped to less than 2,000 the percentage of false negative results obtained with HPJ (49%) turned significant in relation to the oogram as well. In conclusion, it has been proven that praziquantel is a highly efficacious agent against S. mansoni infections. If administered at a total dose of 180 mg/kg divided into either 3 or 6 days, it yields a 90% cure rate. Possibly, one could reach 100% by increasing the total dose to 240 mg/kg. Furthermore, it was confirmed that the quantitative oogram technique is the most reliable parasitological method when evaluating the efficacy of new drugs in schistosomiasis mansoni.

Sarcosine oxidase composite screen-printed electrode for sarcosine determination in biological samples

XIX Meeting of the Portuguese Electrochemical Society - XVI Iberic Meeting of Electrochemistry

Using the Number of Pores on Fingerprint Images to Detect Spoofing Attacks

Abstract-Due to the growing use of biometric technologies inour modern society, spoofing attacks are becoming a seriousconcern. Many solutions have been proposed to detect the use offake "fingerprints" on an acquisition device. In this paper, wepropose to take advantage of intrinsic features of friction ridgeskin: pores. The aim of this study is to investigate the potential ofusing pores to detect spoofing attacks.Results show that the use of pores is a promising approach. Fourmajor observations were made: First, results confirmed that thereproduction of pores on fake "fingerprints" is possible. Second,the distribution of the total number of pores between fake andgenuine fingerprints cannot be discriminated. Third, thedifference in pore quantities between a query image and areference image (genuine or fake) can be used as a discriminatingfactor in a linear discriminant analysis. In our sample, theobserved error rates were as follows: 45.5% of false positive (thefake passed the test) and 3.8% of false negative (a genuine printhas been rejected). Finally, the performance is improved byusing the difference of pore quantity obtained between adistorted query fingerprint and a non-distorted referencefingerprint. By using this approach, the error rates improved to21.2% of false acceptation rate and 8.3% of false rejection rate.

Incomplete excision of basal cell carcinoma in the subunits of the nose.

Reconstructive procedures after resection of nasal basal cell carcinoma (BCC) vary depending on the subunit involved. The aim of the present study was to assess the influence of the location of the BCC on the rate of incomplete excisions, so we made a retrospective analysis of all nasal BCC excised at our hospital between 2002 and 2005. The incomplete excision rate was 24/148 (16%). More incomplete excision occurred on the alae (n=13) when compared to the dorsum (n=2) of the nose (p<0.05). Eight two-staged procedures resulted in incomplete resection, whereas 9 (6%) frozen section analyses were false-negative. BCC were most likely to be incompletely excised on the nasal tip and alae, and both subunits required more elaborate reconstructions. This, however, was not the result of poor estimation of the extent of the tumour and reluctance to excise more challenging areas widely for reconstruction, but to the method chosen to eradicate the tumour.

Comparative Study of a Real-Time PCR Assay Targeting senX3-regX3 versus Other Molecular Strategies Commonly Used in the Diagnosis of Tuberculosis.

BACKGROUND Nucleic acid amplification tests are increasingly used for the rapid diagnosis of tuberculosis. We undertook a comparative study of the efficiency and diagnostic yield of a real-time PCR senX3-regX3 based assay versus the classical IS6110 target and the new commercial methods. METHODS This single-blind prospective comparative study included 145 consecutive samples: 76 from patients with culture-confirmed tuberculosis (86.8% pulmonary and 13.2% extrapulmonary tuberculosis: 48.7% smear-positive and 51.3% smear-negative) and 69 control samples (24 from patients diagnosed with non-tuberculous mycobacteria infections and 45 from patients with suspected tuberculosis which was eventually ruled out). All samples were tested by two CE-marked assays (Xpert®MTB/RIF and AnyplexTM plus MTB/NTM) and two in-house assays targeting senX3-regX3 and the IS6110 gene. RESULTS The detection limit ranged from 1.00E+01 fg for Anyplex, senX3-regX3 and IS6110 to 1.00E+04 fg for Xpert. All three Xpert, senX3-regX3 and IS6110 assays detected all 37 smear-positive cases. Conversely, Anyplex was positive in 34 (91.9%) smear-positive cases. In patients with smear-negative tuberculosis, differences were observed between the assays; Xpert detected 22 (56.41%) of the 39 smear-negative samples, Anyplex 24 (61.53%), senX3-regX3 28 (71.79%) and IS6110 35 (89.74%). Xpert and senX3-regX3 were negative in all control samples; however, the false positive rate was 8.7% and 13% for Anyplex and IS6110, respectively. The overall sensitivity was 77.6%, 85.7%, 77.3% and 94.7% and the specificity was 100%, 100%, 90.8% and 87.0% for the Xpert, senX3-regX3, Anyplex and IS6110 assays, respectively. CONCLUSION Real-time PCR assays targeting IS6110 lack the desired specificity. The Xpert MTB/RIF and in-house senX3-regX3 assays are both sensitive and specific for the detection of MTBC in both pulmonary and extrapulmonary samples. Therefore, the real time PCR senX3-regX3 based assay could be a useful and complementary tool in the diagnosis of tuberculosis.

A statistical methodology for the comparison of blue gel pen inks analyzed by laser desorption/ionization mass spectrometry

A statistical methodology for the objective comparison of LDI-MS mass spectra of blue gel pen inks was evaluated. Thirty-three blue gel pen inks previously studied by RAMAN were analyzed directly on the paper using both positive and negative mode. The obtained mass spectra were first compared using relative areas of selected peaks using the Pearson correlation coefficient and the Euclidean distance. Intra-variability among results from one ink and inter-variability between results from different inks were compared in order to choose a differentiation threshold minimizing the rate of false negative (i.e. avoiding false differentiation of the inks). This yielded a discriminating power of up to 77% for analysis made in the negative mode. The whole mass spectra were then compared using the same methodology, allowing for a better DP in the negative mode of 92% using the Pearson correlation on standardized data. The positive mode results generally yielded a lower differential power (DP) than the negative mode due to a higher intra-variability compared to the inter-variability in the mass spectra of the ink samples.