An Alternative Approach To Computer System Security Monitoring And Enhancement Through System Call Sequence Analysis

Modern computer systems are plagued with stability and security problems: applications lose data, web servers are hacked, and systems crash under heavy load. Many of these problems or anomalies arise from rare program behavior caused by attacks or errors. A substantial percentage of the web-based attacks are due to buffer overflows. Many methods have been devised to detect and prevent anomalous situations that arise from buffer overflows. The current state-of-art of anomaly detection systems is relatively primitive and mainly depend on static code checking to take care of buffer overflow attacks. For protection, Stack Guards and I-leap Guards are also used in wide varieties.This dissertation proposes an anomaly detection system, based on frequencies of system calls in the system call trace. System call traces represented as frequency sequences are profiled using sequence sets. A sequence set is identified by the starting sequence and frequencies of specific system calls. The deviations of the current input sequence from the corresponding normal profile in the frequency pattern of system calls is computed and expressed as an anomaly score. A simple Bayesian model is used for an accurate detection.Experimental results are reported which show that frequency of system calls represented using sequence sets, captures the normal behavior of programs under normal conditions of usage. This captured behavior allows the system to detect anomalies with a low rate of false positives. Data are presented which show that Bayesian Network on frequency variations responds effectively to induced buffer overflows. It can also help administrators to detect deviations in program flow introduced due to errors.

Sequence analysis of the cupin gene family in Synechocystis PCC6803

The recently described cupin superfamily of proteins includes the germin and germinlike proteins, of which the cereal oxalate oxidase is the best characterized. This superfamily also includes seed storage proteins, in addition to several microbial enzymes and proteins with unknown function. All these proteins are characterized by the conservation of two central motifs, usually containing two or three histidine residues presumed to be involved with metal binding in the catalytic active site. The present study on the coding regions of Synechocystis PCC6803 identifies a previously unknown group of 12 related cupins, each containing the characteristic two-motif signature. This group comprises 11 single-domain proteins, ranging in length from 104 to 289 residues, and includes two phosphomannose isomerases and two epimerases involved in cell wall synthesis, a member of the pirin group of nuclear proteins, a possible transcriptional regulator, and a close relative-of a cytochrome c551 from Rhodococcus. Additionally, there is a duplicated, two-domain protein that has close similarity to an oxalate decarboxylase from the fungus Collybia velutipes and that is a putative progenitor of the storage proteins of land plants.

Isolation of culturable yeasts from market wines and evaluation of the 5 center dot 8S-ITS rDNA sequence analysis for identification purposes

Aims: To test the possibility that wines available in the marketplace may contain culturable yeasts and to evaluate the 5.8S-ITS rDNA sequence analysis as adequate means for the identification of isolates. Methods and Results: As a case study, typical Greek wines were surveyed. Sequence analysis of the 5.8S-ITS rDNA was tested for its robustness in species or strain identification. Sixteen isolates could be assigned into the species Brettanomyces bruxellensis, Saccharomyces cerevisiae and Rhodotorula pinicola, whereas four isolates could not be safely identified. B. bruxellensis was the dominant species present in house wines, while non-Saccharomyces sp. were viable in aged wines of high alcohol content. Conclusions: Yeast population depends on postfermentation procedures or storage conditions. Although 5.8S-ITS rDNA sequence analysis is generally a rapid method to identify wine yeast isolates at the species level, or even below that, it may not be sufficient for some genera. Significance and Impact of the Study: This is the first report to show that commercial wines may possess diverse and potentially harmful yeast populations. The knowledge of yeasts able to reside in this niche environment is essential towards integrated quality assurance programmes. For selected species, the 5.8S-ITS rDNA sequence analysis is a rapid and accurate means.

Sequence analysis and distribution of an IS3-like insertion element isolated from Salmonella enteritidis

The nucleotide sequence of a 3 kb region immediately upstream of the sef operon operon of Salmonella enteritidis was determined. A 1230 base pair insertion sequence which shared sequence identity (> 75%) with members of the IS3 family was revealed. This element, designated IS1230, had almost identical (90% identity) terminal inverted repeats to Escherichia coli IS3 but unlike other IS3-like sequences lacked the two characteristic open reading frames which encode the putative transposase. S. enteritidis possessed only one copy of this insertion sequence although Southern hybridisation analysis of restriction digests of genomic DNA revealed another fragment located in a region different from the sef operon which hybridised weakly which suggested the presence of an IS1230 homologue. The distribution of IS1230 and IS1230-like elements was shown to be widespread amongst salmonellas and the patterns of restriction fragments which hybridised differed significantly between Salmonella serotypes and it is suggested that IS1230 has potential for development as a differential diagnostic tool.

Sequence analysis and distribution in Salmonella enterica serovars of IS3-like elements

The genome of Salmonella enterica serovar Enteritidis was shown to possess three IS3-like insertion elements, designated IS1230A, B and C, and each was cloned and their respective deoxynucleotide sequences determined. Mutations in elements IS1230A and B resulted in frameshifts in the open reading frames that encoded a putative transposase to be inactive. IS1230C was truncated at nucleotide 774 relative to IS1230B and therefore did not possess the 3' terminal inverted repeat. The three IS1230 derivatives were closely related to each other based on nucleotide sequence similarity. IS1230A was located adjacent to the sef operon encoding SEF14 fimbriae located at minute 97 of the genome of S. Enteritidis. IS1230B was located adjacent to the umuDC operon at minute 42.5 on the genome, itself located near to one terminus of an 815-kb genome inversion of S. Enteritidis relative to S. Typhimurium. IS1230C was located next to attB, the bacteriophage P22 attachment site, and proB, encoding gamma-glutamyl phosphate reductase. A truncated 3' remnant of IS1230, designated IS1230T, was identified in a clinical isolate of S. Typhimurium DT193 strain 2391. This element was located next to attB adjacent to which were bacteriophage P22-like sequences. Southern hybridisation of total genomic DNA from eighteen phage types of S. Enteritidis and eighteen definitive types of S. Typhimurium showed similar, if not identical, restriction fragment profiles in the respective serovars when probed with IS1230A.

Sequence analysis of a CTX-M-1 IncI1 plasmid found in Salmonella enterica 4,5,12,i:-, Escherichia coli and Klebsiella pneumoniae on a single UK pig farm

OBJECTIVES: In 2009, CTX-M Enterobacteriaceae and Salmonella isolates were recovered from a UK pig farm, prompting studies into the dissemination of the resistance and to establish any relationships between the isolates. METHODS: PFGE was used to elucidate clonal relationships between isolates whilst plasmid profiling, restriction analysis, sequencing and PCR were used to characterize the CTX-M-harbouring plasmids. RESULTS: Escherichia coli, Klebsiella pneumoniae and Salmonella 4,5,12:i:- and Bovismorbificans resistant to cefotaxime (n = 65) were recovered and 63 were shown by PCR to harbour a group 1 CTX-M gene. The harbouring hosts were diverse, but the group 1 CTX-M plasmids were common. Three sequenced CTX-M plasmids from E. coli, K. pneumoniae and Salmonella enterica serotype 4,5,12:i:- were identical except for seven mutations and highly similar to IncI1 plasmid ColIb-P9. Two antimicrobial resistance regions were identified: one inserted upstream of yacABC harbouring ISCR2 transposases, sul2 and floR; and the other inserted within shfB of the pilV shufflon harbouring the ISEcp1 transposase followed by blaCTX-M-1. CONCLUSIONS: These data suggest that an ST108 IncI1 plasmid encoding a blaCTX-M-1 gene had disseminated across multiple genera on this farm, an example of horizontal gene transfer of the blaCTX-M-1 gene.

Prevalence and microbiological diversity of Archaea in peri-implantitis subjects by 16S ribosomal RNA clonal analysis

Background and Objective: This study evaluated the prevalence and the molecular diversity of Archaea in the subgingival biofilm samples of subjects with peri-implantitis. Material and Methods: Fifty subjects were assigned into two groups: Control (n = 25), consisting of subjects with healthy implants; and Test (n = 25), consisting of subjects with peri-implantitis sites, as well as a healthy implant. In the Test group, subgingival biofilm samples were taken from the deepest sites of the diseased implant. In both groups, subgingival biofilm was collected from one site with a healthy implant and from one site with a periodontally healthy tooth. DNA was extracted and the 16S ribosomal RNA gene was amplified with universal primer pairs for Archaea. Amplified genes were cloned and sequenced, and the phylotypes were identified by comparison with known 16S ribosomal RNA sequences. Results: In the Control group, Archaea were detected in two and three sites of the implant and the tooth, respectively. In the Test group, Archaea were detected in 12, 4 and 2 sites of diseased implants, healthy implants and teeth, respectively. Diseased implants presented a significantly higher prevalence of Archaea in comparison with healthy implants and natural teeth, irrespective of group. Over 90% of the clone libraries were formed by Methanobrevibacter oralis, which was detected in both groups. Methanobacterium congelense/curvum was detected in four subjects from the Test group and in two subjects from the Control group. Conclusion: Although M. oralis was the main species of Archaea associated with both healthy and diseased implant sites, the data indicated an increased prevalence of Archaea in peri-implantitis sites, and their role in pathogenesis should be further investigated.

Structure, Dynamics, and RNA Interaction Analysis of the Human SBDS Protein

Shwachman-Bodian-Diamond syndrome is an autosomal recessive genetic syndrome with pleiotropic phenotypes, including pancreatic deficiencies, bone marrow dysfunctions with increased risk of myelodysplasia or leukemia, and skeletal abnormalities. This syndrome has been associated with mutations in the SBDS gene, which encodes a conserved protein showing orthologs in Archaea and eukaryotes. The Shwachman-Bodian-Diamond syndrome pleiotropic phenotypes may be an indication of different cell type requirements for a fully functional SBDS protein. RNA-binding activity has been predicted for archaeal and yeast SBDS orthologs, with the latter also being implicated in ribosome biogenesis. However, full-length SBDS orthologs function in a species-specific manner, indicating that the knowledge obtained from model systems may be of limited use in understanding major unresolved issues regarding SBDS function, namely, the effect of mutations in human SBDS on its biochemical function and the specificity of RNA interaction. We determined the solution structure and backbone dynamics of the human SBDS protein and describe its RNA binding site using NMR spectroscopy. Similarly to the crystal structures of Archaea, the overall structure of human SBDS comprises three well-folded domains. However, significant conformational exchange was observed in NMR dynamics experiments for the flexible linker between the N-terminal domain and the central domain, and these experiments also reflect the relative motions of the domains. RNA titrations monitored by heteronuclear correlation experiments and chemical shift mapping analysis identified a classic RNA binding site at the N-terminal FYSH (fungal, Yhr087wp, Shwachman) domain that concentrates most of the mutations described for the human SBDS. (C) 2010 Elsevier Ltd. All rights reserved.

Trypanosoma cruzi: establishment of permeable cells for RNA processing analysis with drugs

Pre-mRNA maturation in trypanosomatids occurs through a process called trans-splicing which involves excision of introns and union of exons in two independent transcripts. For the first time, we present the standardization of Trypanosoma cruzi permeable cells (Y strain) as a model for trans-splicing study of mRNAs in trypanosomes, following by RNase protection reaction, which localizes the SL exon and intron. This trans-splicing reaction in vitro was also used to analyze the influence of NFOH-121, a nitrofurazone-derivative, on this mechanism. The results suggested that the prodrug affects the RNA processing in these parasites, but the trans-splicing reaction still occurred.

Molecular approaches for structural characterization of Bothrops L-amino acid oxidases with antiprotozoal activity: cDNA cloning, comparative sequence analysis, and molecular modeling

Two L-amino acid oxidases (LAAOs) were identified by random sequencing of cDNA libraries from the venom glands of Bothrops moojeni (BmooLAAO) and Bothrops jararacussu (Bjussu LAAO). Phylogenetic analysis involving other SV-LAAOs showed sequence identities within the range 83-87% being closely related to those from Agkistrodon and Trimeresurus. Molecular modeling experiments indicated the FAD-binding, substrate-binding, and helical domains of Bmoo and Bjussu LAAOs. The RMS deviations obtained by the superposition of those domains and that from Calloselasma rhodostoma LAAO crystal structure confirm the high degree of structural similarity between these enzymes. Purified BjussuLAAO-I and BmooLAAO-I exhibited antiprotozoal activities which were demonstrated to be hydrogen-peroxide mediated. This is the first report on the isolation and identification of cDNAs encoding LAAOs from Bothrops venom. The findings here reported contribute to the overall structural elucidation of SV-LAAOs and will advance the understanding on their mode of action. (c) 2006 Elsevier B.V. All rights reserved.

PRP8 intein in Ajellomycetaceae family pathogens: Sequence analysis, splicing evaluation and homing endonuclease activity

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)