Using honeypots to analyse anomalous Internet activities

Monitoring Internet traffic is critical in order to acquire a good understanding of threats to computer and network security and in designing efficient computer security systems. Researchers and network administrators have applied several approaches to monitoring traffic for malicious content. These techniques include monitoring network components, aggregating IDS alerts, and monitoring unused IP address spaces. Another method for monitoring and analyzing malicious traffic, which has been widely tried and accepted, is the use of honeypots. Honeypots are very valuable security resources for gathering artefacts associated with a variety of Internet attack activities. As honeypots run no production services, any contact with them is considered potentially malicious or suspicious by definition. This unique characteristic of the honeypot reduces the amount of collected traffic and makes it a more valuable source of information than other existing techniques. Currently, there is insufficient research in the honeypot data analysis field. To date, most of the work on honeypots has been devoted to the design of new honeypots or optimizing the current ones. Approaches for analyzing data collected from honeypots, especially low-interaction honeypots, are presently immature, while analysis techniques are manual and focus mainly on identifying existing attacks. This research addresses the need for developing more advanced techniques for analyzing Internet traffic data collected from low-interaction honeypots. We believe that characterizing honeypot traffic will improve the security of networks and, if the honeypot data is handled in time, give early signs of new vulnerabilities or breakouts of new automated malicious codes, such as worms. The outcomes of this research include: • Identification of repeated use of attack tools and attack processes through grouping activities that exhibit similar packet inter-arrival time distributions using the cliquing algorithm; • Application of principal component analysis to detect the structure of attackers’ activities present in low-interaction honeypots and to visualize attackers’ behaviors; • Detection of new attacks in low-interaction honeypot traffic through the use of the principal component’s residual space and the square prediction error statistic; • Real-time detection of new attacks using recursive principal component analysis; • A proof of concept implementation for honeypot traffic analysis and real time monitoring.

Mineralized human primary osteoblast matrices as a model system to analyse interactions of prostate cancer cells with the bone microenvironment

Prostate cancer metastasis is reliant on the reciprocal interactions between cancer cells and the bone niche/micro-environment. The production of suitable matrices to study metastasis, carcinogenesis and in particular prostate cancer/bone micro-environment interaction has been limited to specific protein matrices or matrix secreted by immortalised cell lines that may have undergone transformation processes altering signaling pathways and modifying gene or receptor expression. We hypothesize that matrices produced by primary human osteoblasts are a suitable means to develop an in vitro model system for bone metastasis research mimicking in vivo conditions. We have used a decellularized matrix secreted from primary human osteoblasts as a model for prostate cancer function in the bone micro-environment. We show that this collagen I rich matrix is of fibrillar appearance, highly mineralized, and contains proteins, such as osteocalcin, osteonectin and osteopontin, and growth factors characteristic of bone extracellular matrix (ECM). LNCaP and PC3 cells grown on this matrix, adhere strongly, proliferate, and express markers consistent with a loss of epithelial phenotype. Moreover, growth of these cells on the matrix is accompanied by the induction of genes associated with attachment, migration, increased invasive potential, Ca2+ signaling and osteolysis. In summary, we show that growth of prostate cancer cells on matrices produced by primary human osteoblasts mimics key features of prostate cancer bone metastases and thus is a suitable model system to study the tumor/bone micro-environment interaction in this disease.

The association between MC1R genotype and BRAF mutation status in cutaneous melanoma : findings from an Australian population

There is increasing epidemiological and molecular evidence that cutaneous melanomas arise through multiple causal pathways. The purpose of this study was to explore the relationship between germline and somatic mutations in a population-based series of melanoma patients to reshape and refine the divergent pathway model for melanoma. Melanomas collected from 123 Australian patients were analyzed for melanocortin-1 receptor (MC1R) variants and mutations in the BRAF and NRAS genes. Detailed phenotypic and sun exposure data were systematically collected from all patients. We found that BRAF-mutant melanomas were significantly more likely from younger patients and those with high nevus counts, and were more likely in melanomas with adjacent neval remnants. Conversely, BRAF-mutant melanomas were significantly less likely in people with high levels of lifetime sun exposure. We observed no association between germline MC1R status and somatic BRAF mutations in melanomas from this population. BRAF-mutant melanomas have different origins from other cutaneous melanomas. These data support the divergent pathways hypothesis for melanoma, which may require a reappraisal of targeted cancer prevention activities.

CDKN2A mutation in a non-FAMMM kindred with cancers at multiple sites results in a functionally abnormal protein

The CDKN2A gene encodes p16 (CDKN2A), a cell-cycle inhibitor protein which prevents inappropriate cell cycling and, hence, proliferation. Germ-line mutations in CDKN2A predispose to the familial atypical multiple-mole melanoma (FAMMM) syndrome but also have been seen in rare families in which only 1 or 2 individuals are affected by cutaneous malignant melanoma (CMM). We therefore sequenced exons 1alpha and 2 of CDKN2A using lymphocyte DNA isolated from index cases from 67 families with cancers at multiple sites, where the patterns of cancer did not resemble those attributable to known genes such as hMLH1, hMLH2, BRCA1, BRCA2, TP53 or other cancer susceptibility genes. We found one mutation, a mis-sense mutation resulting in a methionine to isoleucine change at codon 53 (M531) of exon 2. The individual tested had developed 2 CMMs but had no dysplastic nevi and lacked a family history of dysplastic nevi or CMM. Other family members had been diagnosed with oral cancer (2 persons), bladder cancer (1 person) and possibly gall-bladder cancer. While this mutation has been reported in Australian and North American melanoma kindreds, we did not observe it in 618 chromosomes from Scottish and Canadian controls. Functional studies revealed that the CDKN2A variant carrying the M531 change was unable to bind effectively to CDK4, showing that this mutation is of pathological significance. Our results have confirmed that CDKN2A mutations are not limited to FAMMM kindreds but also demonstrate that multi-site cancer families without melanoma are very unlikely to contain CDKN2A mutations.

Mutation analysis of the CDKN2A promoter in Australian melanoma families

Approximately 50% of all melanoma families worldwide show linkage to 9p21-22, but only about half of these have been shown to contain germ line CDKN2A mutations. It has been hypothesized that a proportion of these families carry mutations in the noncoding regions of CDKN2A. Several Canadian families have been reported to carry a mutation in the 5' UTR, at position -34 relative to the start site, which gives rise to a novel AUG translation initiation codon that markedly decreases translation from the wild-type AUG (Liu et al., 1999). Haplotype sharing in these Canadian families suggested that this mutation is of British origin. We sequenced 1,327 base pairs (bp) of CDKN2A, making up 1,116 bp of the 5' UTR and promoter, all of exon 1, and 61 bp of intron 1, in at least one melanoma case from 110 Australian families with three or more affected members known not to carry mutations within the p16 coding region. In addition, 431 bp upstream of the start codon was sequenced in an additional 253 affected probands from two-case melanoma families for which the CDKN2A mutation status was unknown. Several known polymorphisms at positions -33, -191, -493, and -735 were detected, in addition to four novel variants at positions 120, -252, -347, and -981 relative to the start codon. One of the probands from a two-case family was found to have the previously reported Q50R mutation. No family member was found to carry the mutation at position -34 or any other disease-associated mutation. For further investigation of noncoding CDKN2A mutations that may affect transcription, allele-specific expression analysis was carried out in 31 of the families with at least three affected members who showed either complete or "indeterminate" 9p haplotype sharing without CDKN2A exonic mutations. Reverse transcription polymerase chain reaction and automated sequencing showed expression of both CDKN2A alleles in all family members tested. The lack of CDKN2A promoter mutations and the absence of transcriptional silencing in the germ line of this cohort of families suggest that mutations in the promoter and 5' UTR play a very limited role in melanoma predisposition.

Microarray expression profiling in melanoma reveals a BRAF mutation signature

We have used microarray gene expression profiling and machine learning to predict the presence of BRAF mutations in a panel of 61 melanoma cell lines. The BRAF gene was found to be mutated in 42 samples (69%) and intragenic mutations of the NRAS gene were detected in seven samples (11%). No cell line carried mutations of both genes. Using support vector machines, we have built a classifier that differentiates between melanoma cell lines based on BRAF mutation status. As few as 83 genes are able to discriminate between BRAF mutant and BRAF wild-type samples with clear separation observed using hierarchical clustering. Multidimensional scaling was used to visualize the relationship between a BRAF mutation signature and that of a generalized mitogen-activated protein kinase (MAPK) activation (either BRAF or NRAS mutation) in the context of the discriminating gene list. We observed that samples carrying NRAS mutations lie somewhere between those with or without BRAF mutations. These observations suggest that there are gene-specific mutation signals in addition to a common MAPK activation that result from the pleiotropic effects of either BRAF or NRAS on other signaling pathways, leading to measurably different transcriptional changes.

Three-dimensional geological modelling and multivariate statistical analysis of water chemistry data to analyse and visualise aquifer structure and groundwater composition in the Wairau Plain, Marlborough District, New Zealand

Concerns regarding groundwater contamination with nitrate and the long-term sustainability of groundwater resources have prompted the development of a multi-layered three dimensional (3D) geological model to characterise the aquifer geometry of the Wairau Plain, Marlborough District, New Zealand. The 3D geological model which consists of eight litho-stratigraphic units has been subsequently used to synthesise hydrogeological and hydrogeochemical data for different aquifers in an approach that aims to demonstrate how integration of water chemistry data within the physical framework of a 3D geological model can help to better understand and conceptualise groundwater systems in complex geological settings. Multivariate statistical techniques(e.g. Principal Component Analysis and Hierarchical Cluster Analysis) were applied to groundwater chemistry data to identify hydrochemical facies which are characteristic of distinct evolutionary pathways and a common hydrologic history of groundwaters. Principal Component Analysis on hydrochemical data demonstrated that natural water-rock interactions, redox potential and human agricultural impact are the key controls of groundwater quality in the Wairau Plain. Hierarchical Cluster Analysis revealed distinct hydrochemical water quality groups in the Wairau Plain groundwater system. Visualisation of the results of the multivariate statistical analyses and distribution of groundwater nitrate concentrations in the context of aquifer lithology highlighted the link between groundwater chemistry and the lithology of host aquifers. The methodology followed in this study can be applied in a variety of hydrogeological settings to synthesise geological, hydrogeological and hydrochemical data and present them in a format readily understood by a wide range of stakeholders. This enables a more efficient communication of the results of scientific studies to the wider community.

A boundary preserving numerical algorithm for the Wright-Fisher model with mutation

The Wright-Fisher model is an Itô stochastic differential equation that was originally introduced to model genetic drift within finite populations and has recently been used as an approximation to ion channel dynamics within cardiac and neuronal cells. While analytic solutions to this equation remain within the interval [0,1], current numerical methods are unable to preserve such boundaries in the approximation. We present a new numerical method that guarantees approximations to a form of Wright-Fisher model, which includes mutation, remain within [0,1] for all time with probability one. Strong convergence of the method is proved and numerical experiments suggest that this new scheme converges with strong order 1/2. Extending this method to a multidimensional case, numerical tests suggest that the algorithm still converges strongly with order 1/2. Finally, numerical solutions obtained using this new method are compared to those obtained using the Euler-Maruyama method where the Wiener increment is resampled to ensure solutions remain within [0,1].

A three-nucleotide mutation altering the Maize streak virus Rep pRBR-interaction motif reduces symptom severity in maize and partially reverts at high frequency without restoring pRBR-Rep binding

Geminivirus infectivity is thought to depend on interactions between the virus replication-associated proteins Rep or RepA and host retinoblastoma-related proteins (pRBR), which control cell-cycle progression. It was determined that the substitution of two amino acids in the Maize streak virus (MSV) RepA pRBR-interaction motif (LLCNE to LLCLK) abolished detectable RepA-pRBR interaction in yeast without abolishing infectivity in maize. Although the mutant virus was infectious in maize, it induced less severe symptoms than the wild-type virus. Sequence analysis of progeny viral DNA isolated from infected maize enabled detection of a high-frequency single-nucleotide reversion of C(601)A in the 3 nt mutated sequence of the Rep gene. Although it did not restore RepA-pRBR interaction in yeast, sequence-specific PCR showed that, in five out of eight plants, the C(601)A reversion appeared by day 10 post-inoculation. In all plants, the C(601)A revertant eventually completely replaced the original mutant population, indicating a high selection pressure for the single-nucleotide reversion. Apart from potentially revealing an alternative or possibly additional function for the stretch of DNA that encodes the apparently non-essential pRBR-interaction motif of MSV Rep, the consistent emergence and eventual dominance of the C(601)A revertant population might provide a useful tool for investigating aspects of MSV biology, such as replication, mutation and evolution rates, and complex population phenomena, such as competition between quasispecies and population turnover. © 2005 SGM.

A deletion and point mutation study of the human papillomavirus type 16 major capsid gene

Recombinant human papillomavirus (HPV) virus-like particles (VLPs) made from the major capsid protein L1 are promising vaccine candidates for use as vaccines against genital and other HPV infections, and particularly against HPV-16. However, HPV-16 genotype variants have different binding affinities for neutralising mouse Mabs raised against HPV-16 L1 VLPs. This paper analyses, using a panel of well-characterised Mabs, the effects on the antigenicity of various C- and N-terminal deletants of HPV-16 L1 made in insect cells via recombinant baculovirus, of an A → T mutation at residue 266 (A266T), and of a C → G mutation at conserved position 428 (C428G). The effects of these changes on assembly of the variant L1s were studied by electron microscopy. Binding of Mab H16:E70 to A266T was reduced by almost half in comparison to wild type L1. Retention of the C-terminal region 428-483 was critical for the binding of conformation-specific Mabs (H16:V5, H16:E70, H16:U4 and H16:9A) whereas deletion of the nuclear localisation signal (NLS) or the C428G mutation or an N-terminal deletion (residues 2-9) did not affect the antigenicity. The N-terminal deletion resulted in a mixed population of 30 and 55 nm VLPs, which differs from the same construct expressed in Escherichia coli, whereas pentamer aggregates resulted from deletion of the 428-465 region or the C428G mutation. The results have implications both for considering use of single-genotype HPV vaccines, and for design of novel second-generation vaccines. © 2006 Elsevier B.V. All rights reserved.

Design of an experimental apparatus to analyse bagasse behaviour in a chute

Pressure feeder chutes are pieces of equipment used in sugar cane crushing to increase the amount of cane that can be put through a mill. The continuous pressure feeder was developed with the objective to provide a constant feed of bagasse under pressure to the mouth of the crushing mills. The pressure feeder chute is used in a sugarcane milling unit to transfer bagasse from one set of crushing rolls to a second set of crushing rolls. There have been many pressure feeder chute failures in the past. The pressure feeder chute is quite vulnerable and if the bagasse throughput is blocked at the mill rollers, the pressure build-up in the chute can be enormous, which can ultimately result in failure. The result is substantial damage to the rollers, mill and chute construction, and downtimes of up to 48 hours can be experienced. Part of the problem is that the bagasse behaviour in the pressure feeder chute is not understood well. If the pressure feeder chute behaviour was understood, then the chute geometry design could be modified in order to minimise risk of failure. There are possible avenues for changing pressure feeder chute design and operations with a view to producing more reliable pressure feeder chutes in the future. There have been previous attempts to conduct experimental work to determine the causes of pressure feeder chute failures. There are certain guidelines available, however pressure feeder chute failures continue. Pressure feeder chute behaviour still remains poorly understood. This thesis contains the work carried out between April 14th 2009 and October 10th 2012 that focuses on the design of an experimental apparatus to measure forces and visually observe bagasse behaviour in an attempt to understand bagasse behaviour in pressure feeder chutes and minimise the risk of failure.