Orientador: Luís Gustavo Modelli de Andrade / Resumo: RESUMO Bruder R. Redução da Incidência de Citomegalovírus no esquema Sirolimo associado à Tacrolimo em paciente idoso transplantado renal. Tese (Doutorado). Faculdade de Medicina de Botucatu. Universidade Estadual Paulista, 2018. Introdução: O transplante renal é considerado uma opção de terapia renal substitutiva segura para pacientes acima de 60 anos, entretanto, não há consenso sobre o melhor esquema imunossupressor para o paciente transplantado renal idoso. Objetivo: Avaliar a incidência de infecção por citomegalovírus na combinação de tacrolimo e sirolimo em doses reduzidas comparada com a associação tacrolimo e micofenolato. Métodos: Estudo prospectivo randomizado de centro único comparando a combinação de tacrolimo e sirolimo em dose reduzida (grupo sirolimo) contra tacrolimo e micofenolato (grupo micofenolato). Foram incluídos todos os pacientes transplantados renais maiores de 60 anos. Foram avaliadas a incidência de infecção por citomegalovírus (CMV), a sobrevida do paciente e enxerto, taxas de rejeição e função renal em 12 meses de seguimento. Resultados: Foram randomizados 46 pacientes e analisados 44 casos (dois casos excluídos por não terem sido transplantados). As características basais dos grupos foram semelhantes sendo todos os casos transplantados com doador falecido e a maioria induzida com basiliximab. O grupo micofenolato (n=23) e o grupo sirolimo (n=21) apresentaram sobrevida do paciente e enxerto censurado óbito respectivamente de 95,7% e 100% para o mi... (Resumo completo, clicar acesso eletrônico abaixo) / Abstract: ABSTRACT Bruder R. Reduced incidence of cytomegalovirus in the Sirolimus associated with tacrolimus in elderly kidney transplant patient. Tese (Doutorado). Faculdade de Medicina de Botucatu. Universidade Estadual Paulista, 2018. Introduction: Renal transplantation is considered safe for patients over 60 years, however, there is no consensus on the best immunosuppressive regimen in elderly. Objective: To evaluate the incidence of cytomegalovirus infection in the combination of tacrolimus and sirolimus in reduced doses compared to the combination tacrolimus and mycophenolate. Methods: A single-center prospective randomized study comparing the combination of tacrolimo and sirolimo in reduced dose (sirolimo group) against tacrolimo and mycophenolate (mycophenolate group). We included all kidney transplant patients over 60 years of age. The incidence of cytomegalovirus (CMV) infection, patient survival and graft, rejection rates and renal function were evaluated at 12 months of follow-up. Results: 46 patients were randomized and we analyzed 44 cases (two cases excluded because they were not transplanted). Baseline characteristics were similar between groups, all patients were transplanted with deceased donor, and the majority were induced with basiliximab. Mycophenolate group (n = 23) and sirolimo group (n = 21) had patient survival, and death censored graft survival respectively 95.7% and 100% for mycophenolate and 87,3% e 90,5% for the sirolimo without statistical differences. T... (Complete abstract click electronic access below) / Doutor

The focus of this work is crypto-ransomware; a variant of malware, an analysis of this malware’s network communication, and the identification of means by which it may be detected in the network. The thesis describes the methodology and environment in which the malware’s network communications were studied. The first part of the thesis provides a network traffic analysis of this type of malware with a focus on HTTP and DNS communication, including anomalies that can be observed in the network during this malware’s activity. The thesis also includes a discussion of the user behavior of devices infected by this type of malware. The resulting data was used to identify and describe four detection methods that are able to recognize the malware from its network communication using the HTTP protocol. Finally, a description of several signatures that can be used as indicators of a possible infection by this malware are provided.

In recent years, whistleblowing has lead to big headlines aroundthe world. This thesis looks at whistleblower systems, which are systems specically created for whistleblowers to submit tips anonymously. The problem is how to engineer such a system asto maximize the anonymity for the whistleblower whilst at the same time remain usable.The thesis evaluates existing implementations for the whistle-blowing problem. Eleven Swedish newspapers are evaluated for potential threats against their whistleblowing service.I suggest a new system that tries to improve on existing systems. New features includes the introduction of JavaScript cryptography to lessen the reliance of trust for a hosted server. Use of anonymous encryption and cover traffic to partially anonymize the recipient, size and timing metadata on submissions sent by the whistleblowers. I explore the implementations of these features and the viability to address threats against JavaScript integrity by use of cover traffic.The results show that JavaScript encrypted submissions are viable. The tamper detection system can provide some integrity for the JavaScript client. Cover traffic for the initial submissions to the journalists was also shown to be feasible. However, cover traffic for replies sent back-and-forth between whistleblower and journalist consumed too much data transfer and was too slow to be useful.

Tor is a Privacy-Enhancing Technology based on onion routing which lets its users browse the web anonymously. Even though the traffic is encrypted in multiple layers, traffic analysis can still be used to gather information from meta-data such as time, size, and direction of the traffic. A Website Fingerprinting (WF) attack is characterized by monitoring traffic locally to the user in order to predict the destination website based on the observed patterns. TrafficSliver is a proposed defence against WF attacks which splits the traffic on multiple paths in the Tor network. This way, a local attacker is assumed to only be able to observe a subset of all the user's total traffic. The initial evaluation of TrafficSliver against Deep Fingerprinting (DF), the state-of-the-art WF attack, showed promising results for the defence, reducing the accuracy of DF from over 98% down to less than 7% without adding artificial delays or dummy traffic. In this thesis, we further evaluate TrafficSliver against DF beyond what was done in the original work by De la Cadena et al. by using a richer data representation and finding out whether it is possible to utilize simulated training data to improve the accuracy of the attack. By introducing directional time as a richer data representation and increasing the size of the training dataset using a simulator, the accuracy of DF was improved against TrafficSliver on three different datasets. Against the original dataset provided by the authors of TrafficSliver, the accuracy was initially 7.1% and then improved to 49.9%. The results were confirmed by using two additional datasets with TrafficSliver, where the accuracy was improved from 5.4% to 44.9% and from 9.8% to 37.7%. / Tor är ett personlig-integritetsverktyg baserat på onion routing som låter sina användare anonymnt besöka hemsidor på internet. Även om trafiken är enkrypterad i flera lager, kan trafikanalys användas för att utvinna information från metadata som exempelvis: tid, storlek och riktning av trafik. En Website Fingerprinting (WF)-attack karaktäriseras av att övervaka trafik nära användaren för att sedan avgöra vilken hemsida som besökts utifrån mönster. TrafficSliver är ett föreslaget försvar mot WF-attacker genom att dela upp trafiken på flera vägar genom nätverket. Detta gör att en attackerare antas endast kunna se en delmängd av användarens totala trafik. Den första utvärderingen av TrafficSliver mot Deep Fingerprinting (DF), spjutspetsen inom WF-attacker, visade lovande resultat för försvaret genom att reducera träffsäkerheten av DF från över 98% till mindre än 7% utan att lägga till artificiella fördröjningar eller falsk trafik. I denna uppsats strävar vi att fortsätta utvärderingen av TrafficSliver mot DF utöver vad som redan har gjorts av De la Cadena et al. med en rikare datarepresentation och en undersökning huruvida det går att använda simulerad data för att träna attacker mot försvaret. Genom att introducera riktad tid och öka mängden data för att träna attacken, ökades träffsäkerheten av DF mot TrafficSliver på tre distinkta dataset. Mot det dataset som samlades in av TrafficSliver var träffsäkerheten inledelsevis 7.1% och sedan förbättrad med hjälp av riktad tid och större mängder av simulerad träningsdata till 49.9%. Dessa resultat bekräftades även för två ytterligare dataset med TrafficSliver, där träffsäkerheten blev förbättrad från 5.4% till 44.9% och från 9.8% till 37.7%.

Background. With increased Internet usage occurring across the world journalists, dissidents and criminals have moved their operations online, and in turn, governments and law enforcement have increased their surveillance of their country’s networks. This has increased the popularity of programs masking users’ identities online such as the Tor Project. By encrypting and routing the traffic through several nodes, the users’ identity is hidden. But how are Tor users utilizing the network, and is any of it in the plain text despite the dangers of it? How has the usage of Tor changed compared to 11 years ago? Objectives. The thesis objective is to analyze captured Tor network traffic that reveals what data is sent through the network. The collected data helps draw conclusions about Tor usage and is compared with previous studies. Methods. Three Tor exit nodes are set up and operated for one week in the US, Germany, and Japan. We deploy packet sniffers performing a deep packet inspection on each traffic flow to identify attributes such as application protocol, number of bytes sent in a flow, and content-type if the traffic was sent in plain text. All stored data is anonymized. Results. The results show that 100.35 million flows were recorded, with 32.47%of them sending 4 or fewer packets in total. The most used application protocol was TLS with 55.03% of total traffic. The HTTP usage was 15.91% and 16% was unknown protocol(s). The countries receiving the most traffic were the US with over45% of all traffic, followed by the Netherlands, UK, and Germany with less than 10%of recorded traffic as its destination. The most frequently used destination ports were 443 at 49.5%, 5222 at 12.7%, 80 with 11.9%, and 25 at 9.3%.Conclusions. The experiment shows that it is possible to perform traffic analysis on the Tor network and acquire significant data. It shows that the Tor network is widely used in the world but with the US and Europe accounting for most of the traffic. As expected there has been a shift from HTTP to HTTPS traffic when compared to previous research. However, there is still unencrypted traffic on the network, where some of the traffic could be explained by automated tools like web crawlers. Tor users need to increase their awareness in what traffic they are sending through the network, as a user with malicious intent can perform the same experiment and potentially acquire unencrypted sensitive data.

Tor hidden services are anonymous servers of unknown location and ownership who can be accessed through any Tor-enabled web browser. They have gained popularity over the years, but still suer from major usability challenges due to their cryptographicallygenerated non-memorable addresses. In response to this difficulty, in this work we introduce the Onion Name System (OnioNS), a privacy-enhanced distributed DNS that allows users to reference a hidden service by a meaningful globally-unique veriable domain name chosen by the hidden service operator. We introduce a new distributed self-healing public ledger and construct OnioNS as an optional backwards-compatible plugin for Tor on top of existing hidden service infrastructure. We simplify our design and threat model by embedding OnioNS within the Tor network and provide mechanisms for authenticated denial-of-existence with minimal networking costs. Our reference implementation demonstrates that OnioNS successfully addresses the major usability issue that has been with Tor hidden services since their introduction in 2002.

京都大学 / 0048 / 新制・課程博士 / 博士(医学) / 甲第20991号 / 医博第4337号 / 新制||医||1027(附属図書館) / 京都大学大学院医学研究科医学専攻 / (主査)教授 小川 誠司, 教授 野田 亮, 教授 江藤 浩之 / 学位規則第4条第1項該当 / Doctor of Medical Science / Kyoto University / DFAM

The ability to access the Internet while remaining anonymous is a necessity in today's society. Whistleblowers need it to establish contact with journalists, and individuals living under repressive regimes need it to access essential resources. Anonymity also allows malicious actors to evade identification from law enforcement and share ill-intentioned resources. Therefore, digital forensics is an area that needs to stay up to date with these developments. We investigate what artefacts can be discovered by conducting acquisition and analysis of a Windows 11 computer that has used the Tor browser to browse the Dark Web. Our results identify a variety of artefacts acquired from Windows Registry, active memory, storage, and network traffic. Furthermore, we discuss how these can be used in a digital forensic investigation.

Cryphonectria parasitica is the causal agent of chestnut blight, which devastated the American Chestnut tree population in the early 20th century. The discovery of hypoviruses that reduce the severity of the chestnut blight infection offers the potential for biological control. However, the spread of the hypoviruses is hampered by a diverse genetically controlled nonself-recognition system, vegetative incompatibility (vic). CPVIB-1 was identified as a transcription regulator playing an important role in the programmed cell death response to this stimulus. In this study, we have found that CPVIB-1 is ubiquitin-decorated which might lead to its degradation in the proteasome pathway. RNA-Seq and ChIP-Seq were used to further explore the downstream targets of CPVIB-1 that mediate the various metabolic changes that lead to the altered phenotype of the Δcpvib-1 mutant. Due to inaccuracies in the prior annotation, we performed a genome re-annotation to improve the accuracy using a MAKER2-two-pass pipeline. To validate the improvement a second pipeline, PEPA, was developed to compare quality metrics between the old and new annotations. Approximately 1/3 of the original annotations from 2009 were found to be inaccurate. Experimental confirmation by testing 27 predicted genes using a diagnostic PCR protocol to differentiate between prior and new transcript structures showed that over 80 % of tested genome locations supported for the new annotation. Using rapamycin treatment to mimic stimulation of the vic response and applying the RNA-seq and ChIP-seq data to this new information, we found that CPVIB-1 is related to TOR signaling pathways, promoting autophagy and the proteasome pathway, but repressing carbon metabolism, protein and lipid biosynthesis. In depth analysis of CPVIB-1-bound DNA targets showed that this protein is a member of the GAGA regulator family, a group of multifaceted transcription factors with diverse roles in gene activation and repression, maintenance of mitosis, and cell development. Following treatment with rapamycin the recognition sequence bound by CPBVIB-1 was altered leading to the regulation of different suite of genes with diverse metabolic functions. Ultimately, we have developed a revised model of TOR signaling pathway where TORC1 and TORC2 signaling pathways are connected by the action of CPVIB1.

Indiana University-Purdue University Indianapolis (IUPUI) / Two important nutrient sensing and regulatory pathways, the general amino acid control (GAAC) and the target of rapamycin (TOR), participate in the control of yeast growth and metabolism in response to changes in nutrient availability. Starvation for amino acids activates the GAAC through Gcn2p phosphorylation of the translation initiation factor eIF2 and preferential translation of GCN4, a transcription activator. TOR senses nitrogen availability and regulates transcription factors, such as Gln3p. We used microarray analyses to address the integration of the GAAC and TOR pathways in directing the yeast transcriptome during amino acid starvation and rapamycin treatment. We found that the GAAC is a major effector of the TOR pathway, with Gcn4p and Gln3p each inducing a similar number of genes during rapamycin treatment. While Gcn4p activates a common core of 57 genes, the GAAC directs significant variations in the transcriptome during different stresses. In addition to inducing amino acid biosynthetic genes, Gcn4p activates genes required for assimilation of secondary nitrogen sources, such as -amino-butyric acid (GABA). Gcn2p activation upon shifting to secondary nitrogen sources is suggested to occur by means of a dual mechanism. First, Gcn2p is induced by the release of TOR repression through a mechanism involving Sit4p protein phosphatase. Second, this eIF2 kinase is activated by select uncharged tRNAs, which were shown to accumulate during the shift to GABA medium. This study highlights the mechanisms by which the GAAC and TOR pathways are integrated to recognize changing nitrogen availability and direct the transcriptome for optimal growth adaptation.