Oscar — File Type Identification of Binary Data in Disk Clusters and RAM Pages

Edwards syndrome (trisomy 18) and Patau syndrome (trisomy 13) are the second and third most common autosomal trisomies after Down syndrome (trisomy 21). Most infants with a trisomy 18 or 13 die in utero and the others within the first year of life. Especially, in case of trisomy 13, there is an increased risk of severe and early onset pre-eclampsia (Boyd et al., 1987). To enable an early termination of trisomy 18 and 13 pregnancies, and to avoid maternal complications, screening for trisomy 18 and 13 seems a sensible option, especially since modelling has shown that current first trimester screening can detect both chromosomal anomalies with a high detection rate (DR) and low false positive rate (FPR) (Tul et al., 1999; Spencer et al., 2000). From January 2007 a governmentally approved national screening programme for Down syndrome has been implemented in the Netherlands, using the first trimester combined test [pregnancy-associated plasma protein A (PAPP-A), the free beta subunit of human choriongonadotrophin (fβ-hCG) and nuchal translucency (NT)]. The government license for this screening programme is strictly confined to screening for trisomy 21. Under the current license, it is not allowed to report on the risks for trisomy 18 and 13. However, since an increasing number of health care providers know the potential role of serum screening for trisomy 18 and 13, including some who already counsel their patient regarding these anomalies and since these trisomies are associated with early maternal complications it was recently decided to file a request to extend the government license to Edwards and Patau’s syndrome. This request is currently under review. The aim of this article is to predict the consequences for the Dutch screening programme in terms of DR and FPR if trisomy 18 and 13 screening is introduced, using an accepted algorithm and retrospective data of the Dutch programme.

### What you need to know A 36 year old woman attends her general practice at 8 weeks in her second pregnancy. She has heard there is a new blood...

With the great potential of internet of things (IoT) infrastructure in different domains, cyber-attacks are also rising commensurately. Distributed denials of service (DDoS) attacks are one of the cyber security threats. This paper will focus on DDoS attacks by adding the design of an intrusion detection system (IDS) tailored to IoT systems. Moreover, machine learning techniques will be investigated to distinguish the data representing flows of network traffic, which include both normal and DDoS traffic. In addition, these techniques will be used to help make a refined detection model for identifying different types of DDoS attacks. Furthermore, the performance of machine learning-based proposed solution is validated using N-BaIoT dataset and compared through different evaluation metrics. The experimental results show that the proposed IDS not only detects DDoS attacks types but also has a high detection rate and low false positive rate, which argues the usefulness of the proposed approach in comparison with several existing DDoS attacks detection techniques.

A cooperative modulation recognition: New paradigm for power line networks in smart grid

Traditional signature-based malware detection techniques have been used for many years owing to their high detection rates and low false positive rates. However, signature-based techniques are ineffective as they do not detect new, polymorphic or transient malware. To beat weaknesses in signature-detection techniques, researchers have turned to behaviour-based ones, which create a malware behaviour profile by capturing malicious API calls throughout execution. In this context, API matching techniques use API calls to calculate similarities between malware. However, API concatenation techniques need significant API call process resources, which makes these methods slow owing to process quality, and thus cannot scale to large API call sequences outside the lab. In this paper, we review present malware detection strategies supported by API call sequences.

Accurately positioning nodes in wireless and sensor networks is important because the location of sensors is a critical input to many higher-level networking tasks. However, the localization infrastructure can be subjected to non-cryptographic attacks, such as signal attenuation and amplification, that cannot be addressed by traditional security services. We propose several attack detection schemes for wireless localization systems. We first formulate a theoretical foundation for the attack detection problem using statistical significance testing. Next, we define test metrics for two broad localization approaches: multilateration and signal strength. We then derived both mathematical models and analytic solutions for attack detection for any system that utilizes those approaches. We also studied additional test statistics that are specific to a diverse set of algorithms. Our trace-driven experimental results provide strong evidence of the effectiveness of our attack detection schemes with high detection rates and low false positive rates across both an 802.11 (WiFi) network as well as an 802.15.4 (ZigBee) network in two real office buildings. Surprisingly, we found that of the several methods we describe, all provide qualitatively similar detection rates which indicate that the different localization systems all contain similar attack detection capability.

<span lang="EN-US">Cybersecurity is seriously threatened by Botnets, which are controlled networks of compromised computers. The evolving techniques used by botnet operators make it difficult for traditional methods of botnet identification to stay up. Machine learning has become increasingly effective in recent years as a means of identifying and reducing these hazards. The CTU-13 dataset, a frequently used dataset in the field of cybersecurity, is used in this study to offer a machine learning-based method for botnet detection. The suggested methodology makes use of the CTU-13, which is made up of actual network traffic data that was recorded in a network environment that had been attacked by a botnet. The dataset is used to train a variety of machine learning algorithms to categorize network traffic as botnet-related/benign, including decision tree, regression model, naïve Bayes, and neural network model. We employ a number of criteria, such as accuracy, precision, and sensitivity, to measure how well each model performs in categorizing both known and unidentified botnet traffic patterns. Results from experiments show how well the machine learning based approach detects botnet with accuracy. It is potential for use in actual world is demonstrated by the suggested system’s high detection rates and low false positive rates.</span>

It is widely accepted that loneliness is associated with health problems, but less is known about the predictors of loneliness. In this study, we constructed a model to predict individual risk of loneliness during adulthood. Data were from the prospective population-based FinHealth cohort study with 3444 participants (mean age 55.5 years, 53.4% women) who responded to a 81-item self-administered questionnaire and reported not to be lonely at baseline in 2017. The outcome was self-reported loneliness at follow-up in 2020. Predictive models were constructed using bootstrap enhanced LASSO regression (bolasso). The C-index from the final model including 11 predictors from the best bolasso -models varied between 0.65 (95% CI 0.61 to 0.70) and 0.71 (95% CI 0.67 to 0.75) the pooled C -index being 0.68 (95% CI 0.61 to 0.75). Although survey-based individualised prediction models for loneliness achieved a reasonable C-index, their predictive value was limited. High detection rates were associated with high false positive rates, while lower false positive rates were associated with low detection rates. These findings suggest that incident loneliness during adulthood.may be difficult to predict with standard survey data.

Password-based authentication system has been praised for its user-friendly, cost-effective, and easily deployable features. It is arguably the most commonly used security mechanism for various resources, services, and applications. On the other hand, it has well-known security flaws, including vulnerability to guessing attacks. Present state-of-the-art approaches have high overheads, as well as difficulties and unreliability during training, resulting in a poor user experience and a high false positive rate. As a result, a lightweight authentication compromise detection model that can make accurate detection with a low false positive rate is required.In this paper we propose – LOG-OFF – a behavior-based authentication compromise detection model. LOG-OFF is a lightweight model that can be deployed efficiently in practice because it does not include a labeled dataset. Based on the assumption that the behavioral pattern of a specific user does not suddenly change, we study the real-world authentication traffic data. The dataset contains more than 4 million records. We use two features to model the user behaviors, i.e., consecutive failures and login time, and develop a novel approach. LOG-OFF learns from the historical user behaviors to construct user profiles and makes probabilistic predictions of future login attempts for authentication compromise detection. LOG-OFF has a low false positive rate and latency, making it suitable for real-world deployment. In addition, it can also evolve with time and make more accurate detection as more data is being collected.

Insider threat represents a major cybersecurity challenge to companies, organizations, and government agencies. Insider threat detection involves many challenges, including unbalanced data, limited ground truth, and possible user behavior changes. This research presents an unsupervised learning based anomaly detection approach for insider threat detection. We employ four unsupervised learning methods with different working principles, and explore various representations of data with temporal information. Furthermore, different computational intelligence schemes are explored to combine these models to create anomaly detection ensembles for improving the detection performance. Evaluation results show that the approach allows learning from unlabelled data under challenging conditions for insider threat detection. Insider threats are detected with high detection and low false positive rates. For example, 60% of malicious insiders are detected under 0.1% investigation budget, and all malicious insiders are detected at less than 5% investigation budget. Furthermore, we explore the ability of the proposed approach to generalize for detecting new anomalous behaviors in different datasets, i.e., robustness. Finally, results demonstrate that a voting-based ensemble of anomaly detection can be used to improve detection performance as well as the robustness. Comparisons with the state-of-the-art confirm the effectiveness of the proposed approach.

ly, a port specifies the endpoint of a connection on a networked device. Ports are identified as numbers. Many port numbers are standardized14 and denote a specific network or application protocol (e.g. port number 80 for HTTP or 23 for Telnet). A lot of the software components serving the respective protocols contain well-known and well-documented vulnerabilities or weaknesses (for instance, a system with anonymous login enabled). Thus, it is only a matter of finding computers that make use of those vulnerable protocols in order to try and attack the affected systems. This search can be automated using a number of tools. One famous example is SATAN (Security Administrator Tool for Analyzing Networks). SATAN is downloadable at no charge and comes with an easy-to-use HTML-based user interface. The tool automatically and efficiently scans any given host (or the respective subnet) for a number of known vulnerabilities and produces a clear and readable report. This report can then be used as a basis to look for actual vulnerabilities.15 2.3. How to Write a Computer Virus Computer viruses and worms are a common way of accessing computer systems without authorization. The effects differ: some viruses merely cause annoyance and inconvenience; others affect the functionality and stability of computing environments or compromise the confidentiality or integrity of (sometimes valuable) information. Three major aspects are important if someone wants to write their own computer virus: ● Payload. What does the virus do once it has infected a system? The amount of damage to be caused by the virus is arbitrary and can be freely specified by the author; ● Delivery and Propagation. How does the virus reach the target systems? And, in case of a (selfpropagating) worm, how does the worm automatically spread to other computer systems? ● Execution. How is the virus payload executed on the target machine? Computer viruses are not dangerous as long as they are not executed. There are two generic methods of ensuring that a virus is executed: (1) The virus can be programmed to exploit one of the countless vulnerabilities that exist in many of today’s mail clients or operating system components. Consequently, these types of viruses are executed without any form of user interaction; (2) Alternatively, the virus can rely on user interaction, in which case the virus is typically delivered as a simple e-mail attachment with a subject heading and content that invites people to open the attachment. The virus is executed as soon as the attachment is opened. Short Analysis of the ILOVEYOU Worm This section gives a short overview of the infamous ILOVEYOU worm by exploring each of the three aspects identified above. The goal is to give some insights into the internals of a virus (or worm) and show how easy it is to create this digital germ. ● Payload: The ILOVEYOU worm is written in Visual Basic Script, an easy-to-learn and powerful programming language by Microsoft, which is often used in (dynamic) web pages or e-mails. The complete payload of the ILOVEYOU worm serves the purpose of selfpropagation exclusively, and no further damage is done. Among other activities,16 the worm searches for certain types of files on the target machine and modifies those files depending on the type of file. It will, for instance, replace all occurrences of JPEG files (a commonly used image format) with a copy of itself and add the .vbs extension (denoting a Visual Basic Script file). If the user later tries to open one of the modified JPEG files, he or she will not see the image but rather (re-)activate the worm. The respective excerpt from the worm’s source code is given in Figure 2:17

We introduce a social network analysis method as a new approach to build an Intrusion Detection System (SN-IDS) in ad hoc networks. The SN-IDS utilizes social relations as metrics-of-interest for anomaly detections, which is different from most traditional IDS approaches. To construct proper social networks, we first investigate ad hoc MAC and network layer data attributes and select relevant social feature sets; then we build up a set of socio-matrices based on these features. Social analysis methods are applied to these matrices to detect suspicious behaviors of mobile nodes. NS-2 simulation results show that this SN-IDS system can effectively detect common attacks with high detection rates and low false positive alarm rates. Furthermore, it has clear advantages over the conventional association rule based data mining IDS in terms of computation and system complexity.

Aiming at the problem that the detection of abnormal data in multidimensional data sets is not processed by dimensionality reduction, which leads to low detection accuracy, high false positive rate and long detection time, a method for detecting abnormal data in multidimensional data sets based on spectral clustering is proposed. Firstly, the data in the multidimensional data set is clustered by Laplacian matrix to preliminarily classify the data; secondly, the local linear embedding (LLE) algorithm is used to reduce the dimensionality of the classified data, and the high-dimensional data set is expressed by feature vectors to remove redundant information in the multidimensional data set; finally, the processed multidimensional data set is input into the support vector machine model, and the abnormal data is detected according to the calculation of regression estimation value. Experimental results show that the proposed algorithm has higher accuracy, lower false positive rate and shorter detection time for detecting abnormal data in multidimensional data sets.

The authors present a novel approach of using reconfigurable fabric to accelerate a face detection algorithm based on the Haar classifier. With highly pipelined architecture and utilising abundant parallel arithmetic units in FPGA, the authors have achieved real-time performance of face detection with very high detection rate and low false positives. The 1-classifier and 16-classifier realisations in an accelerator provide 10× and 72× speedups, respectively, over the software counterpart. Moreover, the authors', approach is scalable towards the resources available on FPGA and it will gain more momentum as the Geneseo Initiative is introduced in the market. This work also provides an understanding of using the reconfigurable fabric for accelerating non-systolic-based vision algorithms.

Host based Intrusion Detection Systems (HIDSs) analyze the sequence of system calls in the trace and audit log files to identify intrusive system processes. HIDSs use the frequency analysis of n-gram terms in the system call traces to identify intrusive processes. However, they are computation and resource intensive as they need to analyze a large number of n-gram input features to differentiate between normal and intrusive system processes. This put a severe limitation on their real time application while analyzing voluminous system call traces. To address this issue, we propose a computation efficient HIDS framework that initially transforms the system call traces to n-gram vector representational model and then uses a dimensionality reduction process to reduce the size of the input feature vectors. The dimensionality reduced n-gram feature vectors are finally analyzed by various machine learning based classifier models to identify intrusive processes. Performance evaluation of the proposed HIDS framework on the benchmark Australian Defense Force Academy Linux Dataset (ADFA-LD) shows that it effectively detects intrusive system processes with high accuracy and low false positive rate, while at the same time incur a minimum computational overhead.