Ict security: Defence strategies against targeted attacks

L’avanzare delle tecnologie ICT e l’abbattimento dei costi di produzione hanno portato ad un aumento notevole della criminalità informatica. Tuttavia il cambiamento non è stato solamente quantitativo, infatti si può assistere ad un paradigm-shift degli attacchi informatici da completamente opportunistici, ovvero senza un target specifico, ad attacchi mirati aventi come obiettivo una particolare persona, impresa o nazione. Lo scopo della mia tesi è quello di analizzare modelli e tassonomie sia di attacco che di difesa, per poi valutare una effettiva strategia di difesa contro gli attacchi mirati. Il lavoro è stato svolto in un contesto aziendale come parte di un tirocinio. Come incipit, ho effettuato un attacco mirato contro l’azienda in questione per valutare la validità dei sistemi di difesa. L’attacco ha avuto successo, dimostrando l’inefficacia di moderni sistemi di difesa. Analizzando i motivi del fallimento nel rilevare l’attacco, sono giunto a formulare una strategia di difesa contro attacchi mirati sotto forma di servizio piuttosto che di prodotto. La mia proposta è un framework concettuale, chiamato WASTE (Warning Automatic System for Targeted Events) il cui scopo è fornire warnings ad un team di analisti a partire da eventi non sospetti, ed un business process che ho nominato HAZARD (Hacking Approach for Zealot Attack Response and Detection), che modella il servizio completo di difesa contro i targeted attack. Infine ho applicato il processo all’interno dell’azienda per mitigare minacce ed attacchi informatici.

How should future building structure and emergency response cope with bushfire attack?

Bushfires are regular occurrences in the Australian landscape which can, under adverse weather conditions, give rise to losses of life, property, infrastructure, environmental and cultural values. Where property loss is involved, historical surveys of house losses have focussed on ember, radiant heat and flame contact as key bushfire attack mechanisms. Although often noted, little work has been done to quantify the impact of fire generated or fire enhanced wind and pyro-convective events on house loss and to improve construction practice within Australia. It is well known that strong winds are always associated with bushfire events. It is less well known, although increasingly shown through anecdotal evidence, that bushfires are not a passive companion of wind, but indeed they interact with winds and can together cause significant damages to exposed buildings and ecological structures. Previous studies have revealed the effects of wind, fire and structure interactions with the result of increased pressure coefficient distributions on the windward side of a building downstream of a fire front. This paper presents a further analysis of the result in relations to the relevant standards and fire weather conditions. A review of wind code and bushfire code was conducted. Based on the result of the current study, the authors believe it is necessary to consider wind as an attack mechanism in bushfire events. The results of the study will also have implications on bushfire emergency management, design of emergency shelters, perception of danger, emergency evacuation and on risk assessment.

Improving the Timeliness and Response to an Aerosolizedanthrax Attack in the Metropolitan Washington, D.C. Region

Our research was conducted to improve the timeliness, coordination, and communication during the detection, investigation and decision-making phases of the response to an aerosolized anthrax attack in the metropolitan Washington, DC, area with the goal of reducing casualties. Our research gathered information of the current response protocols through an extensive literature review and interviews with relevant officials and experts in order to identify potential problems that may exist in various steps of the detection, investigation, and response. Interviewing officials from private and government sector agencies allowed the development of a set of models of interactions and a communication network to identify discrepancies and redundancies that would elongate the delay time in initiating a public health response. In addition, we created a computer simulation designed to model an aerosol spread using weather patterns and population density to identify an estimated population of infected individuals within a target region depending on the virulence and dimensions of the weaponized spores. We developed conceptual models in order to design recommendations that would be presented to our collaborating contacts and agencies that would use such policy and analysis interventions to improve upon the overall response to an aerosolized anthrax attack, primarily through changes to emergency protocol functions and suggestions of technological detection and monitoring response to an aerosolized anthrax attack.

PRECYSE: Cyber-attack Detection and Response for Industrial Control Systems

In this short paper, we present an integrated approach to detecting and mitigating cyber-attacks to modern interconnected industrial control systems. One of the primary goals of this approach is that it is cost effective, and thus whenever possible it builds on open-source security technologies and open standards, which are complemented with novel security solutions that address the specific challenges of securing critical infrastructures.

Response of day-to-day home blood pressure variability by antihypertensive drug class after transient ischemic attack or nondisabling stroke.

BACKGROUND AND PURPOSE Visit-to-visit variability in systolic blood pressure (SBP) is associated with an increased risk of stroke and was reduced in randomized trials by calcium channel blockers and diuretics but not by renin-angiotensin system inhibitors. However, time of day effects could not be determined. Day-to-day variability on home BP readings predicts stroke risk and potentially offers a practical method of monitoring response to variability-directed treatment. METHODS SBP mean, maximum, and variability (coefficient of variation=SD/mean) were determined in 500 consecutive transient ischemic attack or minor stroke patients on 1-month home BP monitoring (3 BPs, 3× daily). Hypertension was treated to a standard protocol. Differences in SBP variability from 3 to 10 days before to 8 to 15 days after starting or increasing calcium channel blockers/diuretics versus renin-angiotensin system inhibitors versus both were compared by general linear models, adjusted for risk factors and baseline BP. RESULTS Among 288 eligible interventions, variability in SBP was reduced after increased treatment with calcium channel blockers/diuretics versus both versus renin-angiotensin system inhibitors (-4.0 versus 6.9 versus 7.8%; P=0.015), primarily because of effects on maximum SBP (-4.6 versus -1.0 versus -1.0%; P=0.001), with no differences in effect on mean SBP. Class differences were greatest for early-morning SBP variability (3.6 versus 17.0 versus 38.3; P=0.002) and maximum (-4.8 versus -2.0 versus -0.7; P=0.001), with no effect on midmorning (P=0.29), evening (P=0.65), or diurnal variability (P=0.92). CONCLUSIONS After transient ischemic attack or minor stroke, calcium channel blockers and diuretics reduced variability and maximum home SBP, primarily because of effects on morning readings. Home BP readings enable monitoring of response to SBP variability-directed treatment in patients with recent cerebrovascular events.

Design of a traumatic injury simulator for assessing lower limb response to high loading rates

Current military conflicts are characterized by the use of the improvised explosive device. Improvements in personal protection, medical care, and evacuation logistics have resulted in increasing numbers of casualties surviving with complex musculoskeletal injuries, often leading to lifelong disability. Thus, there exists an urgent requirement to investigate the mechanism of extremity injury caused by these devices in order to develop mitigation strategies. In addition, the wounds of war are no longer restricted to the battlefield; similar injuries can be witnessed in civilian centers following a terrorist attack. Key to understanding such mechanisms of injury is the ability to deconstruct the complexities of an explosive event into a controlled, laboratory-based environment. In this article, a traumatic injury simulator, designed to recreate in the laboratory the impulse that is transferred to the lower extremity from an anti-vehicle explosion, is presented and characterized experimentally and numerically. Tests with instrumented cadaveric limbs were then conducted to assess the simulator’s ability to interact with the human in two mounting conditions, simulating typical seated and standing vehicle passengers. This experimental device will now allow us to (a) gain comprehensive understanding of the load-transfer mechanisms through the lower limb, (b) characterize the dissipating capacity of mitigation technologies, and (c) assess the bio-fidelity of surrogates.

Security analysis of the non-aggressive challenge response of the DNP3 Protocol using a CPN Model

Distributed Network Protocol Version 3 (DNP3) is the de-facto communication protocol for power grids. Standard-based interoperability among devices has made the protocol useful to other infrastructures such as water, sewage, oil and gas. DNP3 is designed to facilitate interaction between master stations and outstations. In this paper, we apply a formal modelling methodology called Coloured Petri Nets (CPN) to create an executable model representation of DNP3 protocol. The model facilitates the analysis of the protocol to ensure that the protocol will behave as expected. Also, we illustrate how to verify and validate the behaviour of the protocol, using the CPN model and the corresponding state space tool to determine if there are insecure states. With this approach, we were able to identify a Denial of Service (DoS) attack against the DNP3 protocol.

Insight on how fishing bats discern prey and adjust their mechanic and sensorial features during the attack sequence

Several insectivorous bats have included fish in their diet, yet little is known about the processes underlying this trophic shift. We performed three field experiments with wild fishing bats to address how they manage to discern fish from insects and adapt their hunting technique to capture fish. We show that bats react only to targets protruding above the water and discern fish from insects based on prey disappearance patterns. Stationary fish trigger short and shallow dips and a terminal echolocation pattern with an important component of the narrowband and low frequency calls. When the fish disappears during the attack process, bats regulate their attack increasing the number of broadband and high frequency calls in the last phase of the echolocation as well as by lengthening and deepening their dips. These adjustments may allow bats to obtain more valuable sensorial information and to perform dips adjusted to the level of uncertainty on the location of the submerged prey. The observed ultrafast regulation may be essential for enabling fishing to become cost-effective in bats, and demonstrates the ability of bats to rapidly modify and synchronise their sensorial and motor features as a response to last minute stimulus variations.

Phenotypic variation in shell form in the intertidal acorn barnacle Chthamalus montagui: distribution, response to predators and life history trade-offs.

The acorn barnacle Chthamalus montagui can present strong variation in shell morphology, ranging from flat conic to a highly bent form, caused by a substantial overgrowth of the rostrum plate. Shell shape distribution was investigated between January and May 2004 from geographical to microhabitat spatial scales along the western coast of Britain. Populations studied in the north (Scotland and Isle of Man) showed a higher degree of shell variation compared to those in the south (Wales and south-west England). In the north, C. montagui living at lower tidal levels and in proximity to the predatory dogwhelk, Nucella lapillus, were more bent in profile. Laboratory experiments were conducted to examine behavioural responses, and vulnerability of bent and conic barnacles to predation by N. lapillus. Dogwhelks did not attack one morphotype more than the other, but only 15 % of attacks on bent forms were successful compared to 75 % in conic forms. Dogwhelk effluent reduced the time spent feeding by C. montagui (11 %), but there was no significant difference between conic and bent forms. Examination of barnacle morphology indicated a trade-off in investment in shell structure and feeding appendages associated with being bent, but none with egg or somatic tissue mass. These results are consistent with C. montagui showing an induced defence comparable to that found in its congeners Chthamalus anisopoma and Chthamalus fissus on the Pacific coast of North America, but further work to demonstrate inducibility is required.

The effect of probe interval estimation on attack detection performance of a WLAN independent intrusion detection system

A new niche of densely populated, unprotected networks is becoming more prevalent in public areas such as Shopping Malls, defined here as independent open-access networks, which have attributes that make attack detection more challenging than in typical enterprise networks. To address these challenges, new detection systems which do not rely on knowledge of internal device state are investigated here. This paper shows that this lack of state information requires an additional metric (The exchange timeout window) for detection of WLAN Denial of Service Probe Flood attacks. Variability in this metric has a significant influence on the ability of a detection system to reliably detect the presence of attacks. A parameter selection method is proposed which is shown to provide reliability and repeatability in attack detection in WLANs. Results obtained from ongoing live trials are presented that demonstrate the importance of accurately estimating probe request and probe response timeouts in future Independent Intrusion Detection Systems.

GABA accumulation and the hypersensitive response in isolated mesophyll cells treated with the G protein activator mastoparan

GABA (y-amino butyric acid) is a non-protein amino acid synthesized through the a-decarboxylation of L-glutamate. This reaction is catalyzed by L-glutamate decarboxylase (EC 4.1.1.15), a cytosolic Ca2+/calmodulin-stimulated enzyme. The purpose of this study is to determine whether or not GABA accumulation is associated with the hypersensitive response of isolated Asparagus sprengeri mesophyll cells. The addition of 25 J.lM mastoparan, a G protein activator, to suspensions of isolated asparagus mesophyll cells significantly increased GABA synthesis and cell death. Cell death was assessed using Evan's blue dye and fluorescein diacetate tests for cell viability. In addition, mastoparan stimulated pH-dependent alkalinization of the external medium, and a rapid and large 02 consumption followed by a loss of photosynthetic activity. The rate of 02 consumption and the net decrease in 02 in the dark was enhanced by light. The inactive mastoparan analogue Mas17 was ineffective in stimulating GABA accumulation, medium alkalinization, 02 uptake and cell death. Accumulation of H202 in response tomastoparan was not detected, however, mastoparan caused the cell-dependent degradation of added H202. The pH dependence of mastoparan-stimulated alkalinization suggests cellular electrolyte leakage, while the consumption of 02 corresponds to the oxidative burst in which 02 at the cell surface is reduced to form various active oxygen species. The results are indicative of the "hypersensitive response" of plants to pathogen attack, namely, the death of cells in the locality of pathogen invasion. The data are compatible with a model in which mastoparan triggers G protein activity, subsequent intracellular signal transduction pathway/s, and the hypersensitive response. It is postulated that the physiological elicitation of the hypersensitive response involves G protein signal transduction. The synthesis of GABA during the hypersensitive response has not been documented previously; however the role/s of GABA synthesis in the hypersensitive response, if any, remain unclear.

The costs and consequences of parasitoid attack for the predatory hoverfly, Episyrphus balteatus

Question: What are the life-history costs for a predatory insect of surviving parasitoid attack, and can parasitoid attack alter predator-prey interactions? Hypotheses: Survivorship is influenced by host age. Hosts that suffer parasitoid attack grow more slowly and consume fewer prey. Those that survive attack are smaller as adults and show reduced survivorship. Organisms: The aphidophagous hoverfly Episyrphus balteatus, its endoparasitoid wasp Diplazon laetatorius and its prey, the pea aphid, Acyrthosiphon pisum. Site of experiments: All experiments were conducted in controlled temperature rooms and chambers in the laboratory. Methods: Episyrphus balteatus larvae of each instar were exposed to attack by Diplazon laetatorius, then dissected to measure the encapsulation response (a measure of immunity). Second instar larvae were either attacked or not attacked by D. laetatorius. Their development rates and numbers of prey consumed were noted. The size and survivorship of surviving (immune) and control hoverflies were compared following eclosion. Conclusions: Successful immune response increased with larval age (first instar 0%, second instar 40%, third instar 100% survival). Second instar larvae that successfully resisted parasitoid attack were larger as pupae (but not as adults) and showed reduced adult survivorship. Female adult survivors were more likely than male survivors to have died within 16 days of eclosion, but there was no difference between unattacked male and female control hoverflies. Attacked larvae, irrespective of immune status, consumed fewer aphids than unattacked individuals. Episyrphus balteatus suffers significant costs of resisting parasitoid attack, and parasitoid attack can reduce the top-down effects of an insect predator, irrespective of whether the host mounts an immune response or not.

Influence of temperature on pea aphid Acyrthosiphon pisum (Hemiptera: Aphididae) resistance to natural enemy attack

The ability to resist or avoid natural enemy attack is a critically important insect life history trait, yet little is understood of how these traits may be affected by temperature. This study investigated how different genotypes of the pea aphid Acyrthosiphon pisum Harris, a pest of leguminous crops, varied in resistance to three different natural enemies (a fungal pathogen, two species of parasitoid wasp and a coccinellid beetle), and whether expression of resistance was influenced by temperature. Substantial clonal variation in resistance to the three natural enemies was found. Temperature influenced the number of aphids succumbing to the fungal pathogen Erynia neoaphidis Remaudiere & Hermebert, with resistance increasing at higher temperatures (18 vs. 28degreesC). A temperature difference of 5degreesC (18 vs. 23degreesC) did not affect the ability of A. pisum to resist attack by the parasitoids Aphidius ervi Haliday and A. eadyi Stary Gonzalez & Hall. Escape behaviour from foraging coccinellid beetles (Hippodamia convergens Guerin-Meneville) was not directly influenced by aphid clone or temperature (16 vs. 21degreesC). However, there were significant interactions between clone and temperature (while most clones did not respond to temperature, one was less likely to escape at 16degreesC), and between aphid clone and ladybird presence (some clones showed greater changes in escape behaviour in response to the presence of foraging coccinellids than others). Therefore, while larger temperature differences may alter interactions between Acyrthosiphon pisum and an entomopathogen, there is little evidence to suggest that smaller changes in temperature will alter pea aphid-natural enemy interactions.

Behavior of Leishmania major metacyclic promastigotes during the course of infection and immune response development in resistant versus susceptible hosts

Pouco se conhece sobre os epítopos derivados de promastigotas metacíclicos de Leishmania que são importantes para a regulação ou destruição do parasita, como alvos de ação imunológica no hospedeiro vertebrado. Neste estudo, nós investigamos um método alternativo para obter promastigotas metacíclicos de Leishmania major, pela avaliação do curso da infecção e reação de hipersensibilidade do tipo retardado (HTR) em hospedeiros resistentes e susceptíveis. Promastigotas não-infectantes (procíclicos) de L. major, recentemente isolados de amastigotas, foram selecionados pela adesão a colunas de lã de vidro negativamente carregadas, enquanto que promastigotas metacíclicos não se aderem à coluna e podem ser recuperados com facilidade. Condições ótimas de cromatografia foram validadas por análise estatística. O rendimento médio de parasitas obtidos após separação em colunas de lã de vidro e a viabilidade dos promastigotas foram estimados por microscopia óptica. Os promastigotas metacíclicos tiveram um rendimento médio de 43,5% a 57,5%. Camundongos BALB/c (susceptíveis) e camundongos C57BL/6 (resistentes) apresentaram padrões distintos de lesões cutâneas, os primeiros com lesões mais agressivas, induzidas por promastigotas metacíclicos. As respostas à reação de HTR foram maiores nos grupos de camundongos C57BL/6, submetidos à infecção com promastigotas metacíclicos. Estes resultados indicam que o novo método poderia ser integrado aos protocolos existentes para estudar a metaciclogênese de parasitas do gênero Leishmania in vivo.