A Signal-Processing View on Packet Sampling and Anomaly Detection

International audienceAnomaly detection methods typically operate on preprocessed traffic traces. Firstly, most traffic capturing devices today employ random packet sampling, where each packet is selected with a certain probability, to cope with increasing link speeds. Secondly, temporal aggregation, where all packets in a measurement interval are represented by their temporal mean, is applied to transform the traffic trace to the observation timescale of interest for anomaly detection. These preprocessing steps affect the temporal correlation structure of traffic that is used by anomaly detection methods such as Kalman filtering or PCA, and have thus an impact on anomaly detection performance. Prior work has analyzed how packet sampling degrades the accuracy of anomaly detection methods; however, neither theoretical explanations nor solutions to the sampling problem have been provided. This paper makes the following key contributions: (i) It provides a thorough analysis and quantification of how random packet sampling and temporal aggregation modify the signal properties by introducing noise, distortion and aliasing. (ii) We show that aliasing introduced by the aggregation step has the largest impact on the correlation structure. (iii) We further propose to replace the aggregation step with a specifically designed low-pass filter that reduces the aliasing effect. (iv) Finally, we show that with our solution applied, the performance of anomaly detection systems can be considerably improved in the presence of packet sampling

Applying PCA for Traffic Anomaly Detection: Problems and Solutions

International audienceSpatial Principal Component Analysis (PCA) has been proposed for network-wide anomaly detection. A recent work has shown that PCA is very sensitive to calibration settings. Unfortunately, the authors did not provide further explanations for this observation. In this paper, we fill this gap and provide the reasoning behind the found discrepancies. We revisit PCA for anomaly detection and evaluate its performance on our data. We develop a slightly modified version of PCA that uses only data from a single router. Instead of correlating data across different spatial measurement points, we correlate the data across different metrics. With the help of the analyzed data, we explain the pitfalls of PCA and underline our argumentation with measurement results. We show that the main problem is that PCA fails to capture temporal correlation. We propose a solution to deal with this problem by replacing PCA with the Karhunen-Loeve transform. We find that when we consider temporal correlation, anomaly detection results are significantly improved

Automated Pattern-Based Service Deployment in Programmable Networks

This paper presents a flexible service deployment architecture for the automated, on-demand deployment of distributed services in programmable networks. The novelty of our approach is (a) the customization of the deployment protocol by utilizing modular building blocks, namely navigation patterns, aggregation patterns, and capability functions, and (b) the definition of a corresponding service descriptor. A customizable deployment protocol has several important advantages: It supports a multitude of services, and it allows for an ad hoc optimization of the protocol according to the specific needs of a service and the current network conditions. Moreover, our architecture provides an environment for studying new patterns which aim at reducing deployment latency and bandwidth for certain services. We demonstrate how the developed architecture can be used to setup a virtual private network, and we present measurements conducted with our prototype in the PlanetLab test network. Furthermore, a comparison of a distributed pattern with a centralized pattern illustrates the performance trade-off for different deployment strategie

Impact of EMG Changes in Continuous Vagal Nerve Monitoring in High-Risk Endocrine Neck Surgery

Background: Continuous vagal intraoperative neuromonitoring (CIONM) of the recurrent laryngeal nerve (RLN) may reduce the risk of RLN lesions during high-risk endocrine neck surgery such as operation for large goiter potentially requiring transsternal surgery, advanced thyroid cancer, and recurrence. Methods: Fifty-five consecutive patients (41 female, median age 61 years, 87 nerves at risk) underwent high-risk endocrine neck surgery. CIONM was performed using the commercially available NIM-Response 3.0 nerve monitoring system with automatic periodic stimulation (APS) and matching endotracheal tube electrodes (Medtronic Inc.). All CIONM events (decreased amplitude/increased latency) were recorded. Results: APS malfunction occurred on three sides (3 %). A total of 138 CIONM events were registered on 61 sides. Of 138, 47 (34 %) events were assessed as imminent (13 events) or potentially imminent (34 events) lesions, whereas 91 (66 %) were classified as artifacts. Loss of signal was observed in seven patients. Actions to restore the CIONM baseline were undertaken in 58/138 (42 %) events with a median 60 s required per action. Four RLN palsies (3 transient, 1 permanent) occurred: one in case of CIONM malfunction, two sudden without any significant previous CIONM event, and one without any CIONM event. The APS vagus electrode led to temporary damage to the vagus nerve in two patients. Conclusions: CIONM may prevent RLN palsies by timely recognition of imminent nerve lesions. In high-risk endocrine neck surgery, CIONM may, however, be limited in its utility by system malfunction, direct harm to the vagus nerve, and particularly, inability to indicate RLN lesions ahead in time.publishedVersio

High cardiac background activity limits 99mTc-MIBI radioguided surgery in aortopulmonary window parathyroid adenomas

Background: Radioguided surgery using 99m-Technetium-methoxyisobutylisonitrile (99mTc-MIBI) has been recommended for the surgical treatment of mediastinal parathyroid adenomas. However, high myocardial 99mTc-MIBI uptake may limit the feasibility of radioguided surgery in aortopulmonary window parathyroid adenoma. Case presentation: Two female patients aged 72 (#1) and 79 years (#2) with primary hyperparathyroidism caused by parathyroid adenomas in the aortopulmonary window were operated by transsternal radioguided surgery. After intravenous injection of 370 MBq 99mTc-MIBI at start of surgery, the maximum radioactive intensity (as counts per second) was measured over several body regions using a gamma probe before and after removal of the parathyroid adenoma. Relative radioactivity was calculated in relation to the measured ex vivo radioactivity of the adenoma, which was set to 1.0. Both patients were cured by uneventful removal of aortopulmonary window parathyroid adenomas of 4400 (#1) and 985 mg (#2). Biochemical cure was documented by intraoperative measurement of parathyroid hormone as well as follow-up examination. Ex vivo radioactivity over the parathyroid adenomas was 196 (#1) and 855 counts per second (#2). Before parathyroidectomy, relative radioactivity over the aortopulmonary window versus the heart was found at 1.3 versus 2.6 (#1) and 1.8 versus 4.8 (#2). After removal of the adenomas, radioactivity within the aortopulmonary window was only slightly reduced. Conclusion: High myocardial uptake of 99mTc-MIBI limits the feasibility of radioguided surgery in aortopulmonary parathyroid adenoma.publishedVersio

Making wise decisions for completion thyroidectomies

Unilateral differentiated thyroid cancer (DTC) <4 cm can be treated with thyroid lobectomy or total thyroidectomy (TT), depending on the presence of high-risk features. Information about some of these features, such as micrometastasis in lymph nodes or microscopic extrathyroidal extension (ETE), are usually incidental findings that only become available after histological assessment from the first surgery. If such features or risk factors are present, physicians face the dilemma of suggesting completion thyroidectomy or not. There is often considerable room for clinical judgement in these cases, even though thyroid cancer guidelines generally say that completion thyroidectomy should be offered as if the information were available before the initial surgery. In this issue of Gland Surgery, Choi and coworkers (1) provide data that may help clinicians making their wise decisions when faced with this situation. The authors looked at patients whose American Thyroid Association (ATA) risk classification was upstaged from low to intermediate after incidental findings of lymph node micrometastasis or microscopic ETE. The authors present data from 2,830 patients treated for assumed low risk DTC with lobectomy and prophylactic ipsilateral central compartment neck dissection (CCND). Patients with lymph node metastasis >2 mm or gross ETE of the cancer were treated with TT and not included in the study. Thus, patient selection included only “the better part” of intermediate risk patients. The presence of micrometastasis or microscopic ETE, two features that according to ATA guidelines (2) would add to the argument for completion thyroidectomy, did not change the treatment strategy at the author’s clinic. This allowed the unique opportunity for the authors to compare long-term oncological outcomes for patients with micrometastasis in the central lymph nodes or microscopic ETE, to those who had not, without further surgical or radioiodine treatment

A Signal Processing View on Packet Sampling and Anomaly Detection

This find is registered at Portable Antiquities of the Netherlands with number PAN-0002837

Proteintemplat-katalysierte Reaktionen von Peptidliganden

Molekulare Template erlauben die Vororientierung gewünschter Reaktanten und erhöhen deren effektive Konzentration, wodurch die Bildung korrespondierender Produkte beschleunigt wird. Innerhalb der heutigen Forschung spielen Templat-unterstützte Reaktionen eine wichtige Rolle und kommen bei der Bearbeitung diverser biochemischer Fragestellungen zum Einsatz. Insbesondere handelt es sich dabei um Nukleinsäure-vermittelte Reaktionen, wohingegen enzymatisch inaktive Proteindomänen bisher kaum verwendet wurden. Im ersten Teil der vorliegenden Arbeit wurde ein Modellsystem zur selektiven Verknüpfung zweier Peptidliganden (A und B) unter Verwendung eines Proteintemplats T erstellt. Dabei binden A und B kooperativ an T und bilden einen trimären Komplex (A∙T∙B). Beide Peptide wurden N-terminal mit reaktiven Gruppen ausgestattet, die bei korrekter Orientierung eine Nachbarschafts-induzierte Umsetzung zum Verknüpfungsprodukt ermöglichen. Die untersuchten Reaktionen zeigten hohe Templat-bedingte Beschleunigungen (a > 140), wobei ein Maleimid-modifiziertes Peptid (a = 6200) sämtliche bekannten Reaktionsbeschleunigungen Templat-basierter Peptidverknüpfungen übertraf (a = 81 - 1800). Aufgrund der hohen Reaktionsraten und -spezifitäten wurde das Modelsystem bereits erfolgreich zur selektiven Markierung eines Zielproteins innerhalb zellulären Lysats eingesetzt. Im zweiten Teil dieser Arbeit wurde die Austauschrate der Produkte und Edukte am Templat erhöht, indem eine Transferreaktion statt einer Verknüpfung eingesetzt wurde. Mit dem Wissen um die hohe Chemoselektivität und Effizienz der nativen chemischen Ligation konnte das Modellsystem derart modifiziert werden, dass ein Templat-vermittelter Transfer einer Reportergruppe (F) von einem Donor- D auf den Akzeptorligand A möglich war. Unter Verwendung eines am Akzeptor befindlichen Fluoreszenzlöschers konnte der Transfer von F in Echtzeit verfolgt werden. Dies erlaubt eine katalytische Reaktionsführung mit bis zu 5 Umsetzungen pro Templatmolekül. Final wurde das Konzept erfolgreich zur spezifischen Markierung eines Zielproteins verwendet.Molecular templates are often used for the specific pre-orientation of reactants to increase their effective concentrations and thereby accelerate the desired reaction. Today, the concept of templated reactions has already been applied to a multitude of chemical problems including self-replicating peptides and nucleic acids and the generation of DNA-based or dynamic combinatorial compound libraries. So far applications of templated reactions for a use within biological environments and the selective labeling of entire proteins are not known. In the first part of this doctoral thesis a protein-templated peptide ligation has been designed involving the selective coupling of two peptides (A and B) by the use of a protein template T. The two peptide ligands A and B cooperatively bind to T resulting in the formation of the trimeric complex A∙T∙B. Both peptides were modified with appropriate reactive groups allowing proximity-induced ligations. The reactions exhibit magnificent rate accelerations (a > 140) with a maleimide-derivatized peptide (a = 6200) overtop accelerations of known ligations that use foldamers, peptides or nucleic acids as matrices (a = 81 - 1800). The protein-templated peptide ligation model shows high reaction rates and template specificity and has proven useful for the selective labeling of a protein in crude cell lysate. In the second part this dissertation product inhibition caused by the ligation reaction has been reduced by the utilization of a transfer reaction. Taking advantage of the selectivity and efficiency of the native chemical ligation a donor peptide D and an acceptor peptide A were composed. For measuring the template-mediated transfer reaction in real time, a convenient fluorescent label F has been designed which was transferred from D to a quencher molecule (Q) containing variant of A. By measuring the florescence decay caused by the transfer of F to the vicinity of Q, the protein-templated transfer system A∙T∙D generates up to five catalytic turn over. Finally the templated transfer reaction has been successfully applied for the specific labeling of a desired protein