Search

Physical memory acquisition is a prerequisite when performing memory forensics, referring to a set of techniques for acquiring and analyzing traces associated with user activity information, malware analysis, cyber incident response, and similar areas when the traces remain in the physical RAM. However, certain types of malware have applied anti-memory forensics techniques to evade memory analysis strategies or to make the acquisition process impossible. To disturb the acquisition process of physical memory, an attacker hooks the kernel API, which returns a map of the physical memory spaces, and modifies the return value of the API, specifically that typically used by memory acquisition tools. Moreover, an attacker modifies the kernel object referenced by the kernel API. This causes the system to crash during the memory acquisition process or causes the memory acquisition tools to incorrectly proceed with the acquisition. Even with a modification of one byte, called a one-byte modification attack, some tools fail to acquire memory. Therefore, specialized countermeasure techniques are needed for these anti-memory forensics techniques. In this paper, we propose a memory layout acquisition method which is robust to kernel API hooking and the one-byte modification attack on NumberOfRuns, the kernel object used to construct the memory layout in Windows. The proposed acquisition method directly accesses the memory, extracts the byte array, and parses it in the form of a memory layout. When we access the memory, we extract the _PHYSICAL_MEMORY_DESCRIPTOR structure, which is the basis of the memory layout without using the existing memory layout acquisition API. Furthermore, we propose a verification method that selects a reliable memory layout. We realize the verification method by comparing NumberOfRuns and the memory layout acquired via the kernel API, the registry, and the proposed method. The proposed verification method guarantees the reliability of the memory layout and helps secure memory image acquisition through a comparative verification with existing memory layout acquisition methods. We also conduct experiments to prove that the proposed method is resistant to anti-memory forensics techniques, confirming that there are no significant differences in time compared to the existing tools.

OBJECTIVES: Inadequate food intake is associated with mortality in hospitalized patients. Even with the emphasis on malnutrition-related dangers, investigating all hospitalized patients in Korea for food intake and factors affecting food intake is difficult but we need to food intake in hospitalized patients for efficient nutrition management. Therefore, A large-scale nutrition investigation was conducted to examine food intake in all hospitalized patients. We aimed to examine food intakes in hospitalized patients in Korea, to evaluate the relationship between inadequate food intake and mortality, and to ascertain mortality-related risk factors. METHODS: A one-day cross-sectional study on food intake and mortality was conducted on 1074 hospitalized adult patients on June 23, 2011. Food intake, assessed using questionnaires, was divided into four categories: 0%, 25%, 50%, and 100%. We collected disease-related factors and meal-related factors from electronic medical records. We also evaluated "length of hospital stay" and "probability of death in hospital" using a post-survey after 60 days. We identified risk factors for mortality using multivariate analysis. Gray's test was adopted for survival analysis of “probability of death in hospital” according to food intake. RESULTS: We included 1074 patients from 56 wards, including the intensive care unit. The following characteristics were observed: average age, 57 years; average body mass index, 22.8 kg/m2; and sex ratio, 55.2% male. On survey day, 35.4% patients ate a whole meal, 56.4% ate half of the meal, 20.2% ate quarter of the meal, and 8.2% ate nothing. Patients who consumed nothing had a 7.2-times higher mortality risk (HR) than patients who consumed a whole meal (P = 0.001). The mortality risk increased by 2.9 (P = 0.056) and 2.6 times (P = 0.102) in patients who consumed 50% and 25% of the meal, respectively. Risk factors contributing to mortality risk included heart/circulation (HR 18.026, P = 0.005), cancer (HR 17.990, P

Chronic exposure to methamphetamine causes adaptive changes in brain, which underlie dependence symptoms. We have found that the transmembrane protein 168 (TMEM168) is overexpressed in the nucleus accumbens of mice upon repeated methamphetamine administration. Here, we firstly demonstrate the inhibitory effect of TMEM168 on methamphetamine-induced behavioral changes in mice, and attempt to elucidate the mechanism of this inhibition. We overexpressed TMEM168 in the nucleus accumbens of mice by using an adeno-associated virus vector (NAc-TMEM mice). Methamphetamine-induced hyperlocomotion and conditioned place preference were attenuated in NAc-TMEM mice. Additionally, methamphetamine-induced extracellular dopamine elevation was suppressed in the nucleus accumbens of NAc-TMEM mice. Next, we identified extracellular matrix protein osteopontin as an interacting partner of TMEM168, by conducting immunoprecipitation in cultured COS-7 cells. TMEM168 overexpression in COS-7 cells induced the enhancement of extracellular and intracellular osteopontin. Similarly, osteopontin enhancement was also observed in the nucleus accumbens of NAc-TMEM mice, in in vivo studies. Furthermore, the infusion of osteopontin proteins into the nucleus accumbens of mice was found to inhibit methamphetamine-induced hyperlocomotion and conditioned place preference. Our studies suggest that the TMEM168-regulated osteopontin system is a novel target pathway for the therapy of methamphetamine dependence, via regulating the dopaminergic function in the nucleus accumbens.

As is the case with other organisms, plants respond to genotoxic stresses by expressing DNA repair genes upon DNA damage. To uncover the mechanisms involved in regulated expression of the DNA damage-responsive gene, we investigated the tissue specific expression and DNA damage-responsiveness of the Arabidopsis RAD51 (AtRAD51) gene promoter in Arabidopsis and tobacco. Transgenic Arabidopsis and tobacco plants harboring AtRAD51 promoter- b- glucuronidase (GUS) were used to study the detailed expression pattern of the AtRAD51 gene. A histochemical GUS assay of bleomycin- or UV-treated plants showed that the AtRAD51 promoter in young tissues is actively expressed particularly in meristematic cells of the root and shoot apex of seedlings. In the absence of genotoxic stress, GUS activities were detected only at very low levels in these same organs. In mature plants, the AtRAD51 promoter is mainly expressed in flower bud, sepal, stigma, later anther, pedicel when treating with DNA damaging agent. The expression patterns of reporter assays were consistent with the AtRAD51 mRNA accumulation pattern. These results suggest that the regulated expression of the AtRAD51 gene is controlled mainly at the level of transcription directed primarily by the promoter function of the gene.

AtRAD51 gene encodes an Arabidopsis homologue of E. coli RecA protein that catalyzes homologous recombination and repair of chromosomal DNA. The AtRAD51 mRNA expression is regulated by DNA damage and cell cycle, but the mechanisms and signal transduction pathway involved in the AtRAD51 transcriptional regulation are largely unknown. In order to investigate regulatory mechanisms of DNA-damage induced gene expression in plants, we carried out functional analysis of the AtRAD51 gene promoter. A 0.7 kb fragment of the 5′-upstream region of AtRAD51 genomic DNA was fused to the firefly luciferase reporter gene and introduced into tobacco cells by microprojectile bombardment and Agrobacterium-mediated transformation. Induction experiment using bleomycin indicated that the AtRAD51 promoter is able to direct gene expression in tobacco cells in response to DNA damage.

The single nucleotide polymorphism (SNP) rs13438494 in intron 24 of PCLO was significantly associated with bipolar disorder in a meta-analysis of genome-wide association studies. In this study, we performed functional minigene analysis and bioinformatics prediction of splicing regulatory sequences to characterize the deep intronic SNP rs13438494. We constructed minigenes with A and C alleles containing exon 24, intron 24, and exon 25 of PCLO to assess the genetic effect of rs13438494 on splicing. We found that the C allele of rs13438494 reduces the splicing efficiency of the PCLO minigene. In addition, prediction analysis of enhancer/silencer motifs using the Human Splice Finder web tool indicated that rs13438494 induces the abrogation or creation of such binding sites. Our results indicate that rs13438494 alters splicing efficiency by creating or disrupting a splicing motif, which functions by binding of splicing regulatory proteins, and may ultimately result in bipolar disorder in affected people.