Search

Background: Fanconi anemia (FA) is a rare inherited DNA instability disorder with a remarkably elevated risk of oral squamous cell carcinoma. These cancers can be detected with oral brush biopsy-based cytology even at early stages. This study aims to determine the diagnostic accuracy of a new multi-color fluorescent in situ hybridization (FISH) assay consisting of probes for CCND1, TERC, MYC and centromere of chromosome 6, as well as a 9p21 FISH assay consisting of probes for CDKN2A and centromere of chromosome 9 for the detection of oral (pre) malignant lesions in FA. Methods: (I) Cutoffs for the dichotomization of positive or negative multi-color FISH results are determined and (II) retrospectively validated by using archived oral brush biopsy specimens from individuals with Fanconi anemia. In addition, the specimens for cutoff determination were re-hybridized with the 9p21 FISH assay. Results: A cutoff of six or more chromosomal aneuploid cells for a positive FISH result was determined in the cutoff study on 160 biopsy specimens. The validating of this cutoff on 152 specimens showed at best a sensitivity of 87% and a specificity of 82.9%. Conclusion: Multi-color FISH is a sufficient tool to detect chromosomal aneuploidy in oral (pre) malignant lesions of individuals with Fanconi anemia. However, some false positive results may hamper the application as an adjuvant method to oral brush biopsy-based cytology in an oral cancer surveillance program.

Future-oriented networking infrastructures are characterized by highly dynamic Streaming Data (SD) whose volume, speed and number of dimensions increased significantly over the past couple of years, energized by trends such as Software-Defined Networking or Artificial Intelligence. As an essential core component of network security, Intrusion Detection Systems (IDS) help to uncover malicious activity. In particular, consecutively applied alert correlation methods can aid in mining attack patterns based on the alerts generated by IDS. However, most of the existing methods lack the functionality to deal with SD data affected by the phenomenon called concept drift and are mainly designed to operate on the output from signature-based IDS. Although unsupervised Outlier Detection (OD) methods have the ability to detect yet unknown attacks, most of the alert correlation methods cannot handle the outcome of such anomaly-based IDS. In this paper, we introduce a novel framework called Streaming Outlier Analysis and Attack Pattern Recognition, denoted as SOAAPR, which is able to process the output of various online unsupervised OD methods in a streaming fashion to extract information about novel attack patterns. Three different privacy-preserving, fingerprint-like signatures are computed from the clustered set of correlated alerts by SOAAPR, which characterizes and represents the potential attack scenarios with respect to their communication relations, their manifestation in the data's features and their temporal behavior. Beyond the recognition of known attacks, comparing derived signatures, they can be leveraged to find similarities between yet unknown and novel attack patterns. The evaluation, which is split into two parts, takes advantage of attack scenarios from the widely-used and popular CICIDS2017 and CSE‐CIC‐IDS2018 datasets. Firstly, the streaming alert correlation capability is evaluated on CICIDS2017 and compared to a state-of-the-art offline algorithm, called Graph-based Alert Correlation (GAC), which has the potential to deal with the outcome of anomaly-based IDS. Secondly, the three types of signatures are computed from attack scenarios in the datasets and compared to each other. The discussion of results, on the one hand, shows that SOAAPR can compete with GAC in terms of alert correlation capability leveraging four different metrics and outperforms it significantly in terms of processing time by an average factor of 70 in 11 attack scenarios. On the other hand, in most cases, all three types of signatures seem to reliably characterize attack scenarios such that similar ones are grouped together, with up to 99.05% similarity between the FTP and SSH Patator attack.intrusion detection, alert analysis, alert correlation, outlier detection, attack scenario, streaming data, network security

V posledních letech se detekce anomálií v počítačových sítích reálného světa stala stále obtížnější kvůli trvalému nárůstu vysoce objemných, rychlých a dimenzionálních průběžně přicházejících dat, pro která nejsou k dispozici obecně uznané a pravdivé informace o anomalitě. Účinná detekční schémata pro vestavěná síťová zařízení musejí být rychlá a paměťově nenáročná a musejí být schopna se potýkat se změnami konceptu, když se vyskytnou. Pro online detekci anomálií bez učitele byly navrženy různé přístupy, které za těchto podmínek spolehlivě identifikují zlovolnou aktivitu. V tomto příspěvku představujeme nový aplikační rámec nazvaný PCB-iForest, jenž je obecně schopen využít jakoukoliv online metodu pro detekci extrémních hodnot založenou na množinách dat tak, aby fungovala na průběžně přicházejících datech. Pečlivě zformulované požadavky srovnáváme s nejpopulárnějšími stávajícími uznávanými online metodami se zvláštním zřetelem na varianty široce přijímaného algoritmu izolovaného lesa a ukazujeme při tom, že dosud neexistovalo flexibilní a výkonné řešení, které přináší až algoritmus PCB-iForest. Proto do tohoto algoritmu integrujeme dvě varianty – zlepšení izolovaného lesa, jež se nazývá rozšířený izolovaný les, a klasickou variantu izolovaného lesa vybavenou funkcionalitou k ohodnocení vlastností podle jejich přispění k anomalitě datového vzorku. Provádíme rozsáhlé experimenty na 23 multidisciplinárních datových sadách týkajících se bezpečnostní problematiky reálného světa za účelem podrobného srovnání naší implementace s již existujícími metodami. Diskuse našich výsledků zahrnující indikátory AUC, F1 a průměrnou dobu zpracování ukazuje, že PCB-iForest jasně překonává už zavedené konkurenční metody v 61 % případů a dokonce dosahuje ještě slibnějších výsledků co do vyváženosti mezi výpočetními náklady na klasifikaci a její úspěšností. In recent years, detecting anomalies in real-world computer networks has become a more and more challenging task due to the steady increase of high-volume, high-speed and high-dimensional streaming data, for which ground truth information is not available. Efficient detection schemes applied on networked embedded devices need to be fast and memory-constrained and must be capable of dealing with concept drifts when they occur. Different approaches for unsupervised online outlier detection have been designed to deal with these circumstances in order to reliably detect malicious activity. In this paper, we introduce a novel framework called PCB-iForest, which generalized, is able to incorporate any ensemble-based online OD method to function on streaming data. Carefully engineered requirements are compared to the most popular state-of-the-art online methods with an in-depth focus on variants based on the widely accepted isolation forest algorithm, thereby highlighting the lack of a flexible and efficient solution which is satisfied by PCB-iForest. Therefore, we integrate two variants into PCB-iForest—an isolation forest improvement called extended isolation forest and a classic isolation forest variant equipped with the functionality to score features according to their contributions to a sample’s anomalousness. Extensive experiments were performed on 23 different multi-disciplinary and security-related real-world datasets in order to comprehensively evaluate the performance of our implementation compared with off-the-shelf methods. The discussion of results, including AUC, F1 score and averaged execution time metric, shows that PCB-iForest clearly outperformed the state-of-the-art competitors in 61% of cases and even achieved more promising results in terms of the tradeoff between classification and computational costs.