An Effective Threat Detection Framework for Advanced Persistent Cyberattacks

Recently, with the normalization of non-face-to-face online environments in response to the COVID-19 pandemic, the possibility of cyberattacks through endpoints has increased. Numerous endpoint devices are managed meticulously to prevent cyberattacks and ensure timely responses to potential security threats. In particular, because telecommuting, telemedicine, and tele-education are implemented in uncontrolled environments, attackers typically target vulnerable endpoints to acquire administrator rights or steal authentication information, and reports of endpoint attacks have been increasing considerably. Advanced persistent threats (APTs) using various novel variant malicious codes are a form of a sophisticated attack. However, conventional commercial antivirus and anti-malware systems that use signature-based attack detection methods cannot satisfactorily respond to such attacks. In this paper, we propose a method that expands the detection coverage in APT attack environments. In this model, an open-source threat detector and log collector are used synergistically to improve threat detection performance. Extending the scope of attack log collection through interworking between highly accessible open-source tools can efficiently increase the detection coverage of tactics and techniques used to deal with APT attacks, as defined by MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK). We implemented an attack environment using an APT attack scenario emulator called Carbanak and analyzed the detection coverage of Google Rapid Response (GRR), an open-source threat detection tool, and Graylog, an open-source log collector. The proposed method expanded the detection coverage against MITRE ATT&CK by approximately 11% compared with that conventional methods. © 2023 Tech Science Press. All rights reserved.

LUNG INVOLVEMENT in VEXAS SYNDROME

Background: Vacuoles, E1 enzyme, X-linked, autoinfammatory, somatic (VEXAS) syndrome is a recently identifed disorder caused by somatic mutations in the UBA1 gene of myeloid cells. Various manifestations of pulmonary involvement have been reported, but a detailed description of lung involvement and radiologic fndings is lacking. Objectives: To describe lung involvement in VEXAS syndrome. Methods: A retrospective cohort study was conducted of all patients iden-tifed at the Mayo Clinic with VEXAS syndrome since October 2020. Clinical records and chest high resolution computed tomography (HRCT) scans were reviewed. Results: Our cohort comprised 22 white men with a median age of 69 years (IQR 62-74, range 57-84). Hematologic disorders including multiple myeloma, myelodysplastic syndrome and pancytopenia were present in 10 patients (45%), rheumatologic diseases including granulomatosis with poly-angiitis, IgG4-related disease, polyarteritis nodosa, relapsing polychondritis, and rheumatoid arthritis were found in 10 patients (45%), and 4 patients had dermatologic presentations including Sweet syndrome, Schnitzer-like syndrome or drug rash with eosinophilia skin syndrome (DRESS). VEXAS syndrome-related features included fever (18, 82%), skin lesions (20, 91%), lung infiltrates (12, 55%), chondritis (10, 45%), venous thromboembolism (12, 55%), macrocytic anemia (21, 96%), and bone marrow vacuoles (21, 96%). Other manifestations observed were arthritis, scleritis, hoarseness and hearing loss. Median erythrocyte sedimentation rate (ESR) was 69 mm/1st hour (IQR 34.3-118.8) and median C-reactive protein (CRP) of 55.5 mg/dL (IQR 11.4-98.8). The somatic mutations affecting methionine-41 (p.Met41) in UBA1 gene were: 11 (50%) p.Met41Thr, 7 (32%) p.Met41Val, 2 (9%) p.Met41Leu, and 2 (9%) in the splice site. All patients received glu-cocorticoids (GC) (median duration of treatment was 2.6 years);21 (96%) received conventional immunosuppressive agents (methotrexate, aza-thioprine, mycophenolate, leflunomide, cyclosporin, hydroxychloroquine, tofacitinib, ruxolitinib) and 9 (41%) received biologic agents (rituximab, tocilizumab, infliximab, etanercept, adalimumab, golimumab, abatacept). Respiratory symptoms included dyspnea and cough present in 21 (95%) and 12 (55%), respectively, and were documented prior to VEXAS diagnosis. Most of the patients were non-smokers (14, 64%) and obstructive sleep apnea (OSA) was present in 11 patients (50%). Seven patients (32%) used non-invasive ventilation, 6 used C-PAP, and 1 used Bi-PAP. Bronchoalveolar lavage (BAL) was available in 4 patients, and the findings were compatible with neutrophilic alveolitis in 3. Two patients had lung biopsies (2 transbronchial and 1 surgical) that showed ATTR amyloidosis and organizing pneumonia with lymphoid interstitial pneumonia, respectively. Pulmonary function tests were available in 9 (41%) patients and showed normal results in 5;3 patients had isolated reduction in DLCO and 1 with mild restriction. On chest HRCT, 16 patients (73%) had parenchymal changes including ground-glass opacities in 9, septal thickening in 4, and nodules in 3;pleural effusions were present in 3 patients, air-trapping in 3 patients and tracheomalacia in 1 patient. Follow-up chest HRCT was available for 8 patients (36%), the ground-glass opacities resolved in 5 patients, 3 patients manifested new or increased ground-glass opacities, and 1 patient had increased interlobular septal thickening. After 1 year of follow-up, 4 patients (17%) had died;3 due to pneumonia (2 COVID-19,1 bacterial) and 1 due to heart failure. VEXAS flares occurred in 18 patients (82%), the maximum number of relapses was 7, and they were mainly managed with GC and with changes in the immuno-suppressive regimen. Conclusion: Pulmonary involvement was documented by chest HRCT in most patients with VEXAS syndrome. Respiratory symptoms occurred in over one half of patients and about 20% had PFT abnormalities. The pulmonary manifestations of VEXAS are nonspecifc and characterized predominantly by infamma-tory parenchymal involvement.