Signature Matching Research Articles

Genome Resource of Colletotrichum spaethianum, the Causal Agent of Leaf Anthracnose in Polygonatum falcatum

Genome Resource of <i>Colletotrichum spaethianum</i>, the Causal Agent of Leaf Anthracnose in <i>Polygonatum falcatum</i>

HEAVEN: A Hardware-Enhanced AntiVirus ENgine to accelerate real-time, signature-based malware detection

Antiviruses (AVs) are computing-intensive applications that rely on constant monitoring of OS events and on applying pattern matching procedures on binaries to detect malware. In this paper, we introduce HEAVEN, a framework for Intel x86/x86-64 and MS Windows that combines hardware and software to improve AVs performance. HEAVEN workflow consists of a hardware-assisted signature matching process as its first step (triage), which is fast, and only invokes the software-based AV when the software is suspicious, i.e., with an unknown hardware signature for malignity. We implement a PoC for HEAVEN by instrumenting Intel’s x86/x86-64 branch predictor, which allows for the generation of malware signatures based on branch pattern history. To validate our PoC, we evaluate HEAVEN with a dataset composed of 10,000 malware and 1,000 benign software samples from different categories and accomplished malware detection rates of 100% (no false-positives). The detection occurred before the execution of 10% of the samples’ code. HEAVEN is designed to be memory efficient: it identified unique 32-bit signatures for each sample at the storage cost of only 35KB of SRAM. HEAVEN is also designed with processing efficiency in mind: its hardware extensions present negligible performance overhead and reduces the average workload of the chosen software AV counterpart (ClamWin)—10% for CPU usage, 5.61% for memory throughput, 16.22% for disk writes, and 20.22% for disk reads. With HEAVEN, we may decrease the number of CPU cycles used for malware scanning by 87.5%, which is a promising result regarding the feasibility of our proposal: the combination of hardware-/software-based AVs for practical and effective malware detection that flags suspicious software while posing negligible performance overhead.

Analisa Keaslian Tanda Tangan Dengan Menerapkan Algoritma Ripemd160

Signature is one of the characteristics of every person. Signatures are widely used as a condition for ratifying legal documents. This becomes problematic if a transaction is problematic or fails due to signature forgery, of course this is very detrimental, so it is very important to verify the signature. One way to be able to identify a match signature is by utilizing image processing techniques. To get the identification of the signature match, the RIPEMD160 method is used which prioritizes processing the Hash value of a digital image to provide special characteristics for a digital image data, and at the same time as a data that will be used as a verifier for the authenticity of digital image data by processing the signature image and provides information that only the original signature would have. The result of this process will indicate that a signature matches or does not match and can distinguish itself from a signature that has an original verification and is not.

Results of the first implementation of RF phase signature matching at LANSCE

The LINAC at the Los Alamos Neutron Science Center (LANSCE) has been utilizing the Delta-t method to match the RF cavities to the design acceleration parameters since its commissioning in 1972. The differences in time-of-flight between two subsequent Beam Position and Phase Monitors (BPPMs) are measured with both accelerated and drifting beams, depending on the whether the module is set to on or off. The algorithm optimizes the module amplitude and phase via iterative measurements if the initial phase is in the vicinity of the design value. With an upgrade to a faster readout system, a scan over the whole RF cavity phase range requires relatively less time than the classical optimization procedure. The Phase Scan Signature Matching (PSSM) method provides a time-efficient method that ensures the phase selection lands on the bunching side and empowers future analyses to build module-specific models. The PSSM also utilizes a direct model to determine the correct amplitude to sub-percent level instead of using linearized matrices. Furthermore, lacking a reliable energy measurement method in the LINAC, we measure the beam phases at two downstream locations to increase the precision of energy measurements. In this letter, we also discuss the sensitivities of PSSM, error propagation, and the implementation results for the 2019 and 2020 beam cycles.

Prediction Models to Effectively Detect Malware Patterns in the IoT Systems

The Widespread use of the Internet of Things (IoT) has influenced many domains including smart cities, cameras, wearables, smart industrial equipment, and other aspects of our daily lives. On the other hand, the IoT environment deals with a massive volume of data that needs to be kept secure from tampering or theft. Detection of security attacks against IoT context requires intelligent techniques rather than relying on signature matching. Machine learning (ML) and Deep Learning (DL) approaches are efficient to detect these attacks and predicting intrusion behavior based on unknown patterns. This study proposes the application of five deep and ML techniques for identifying malware in network traffic based on the IoT-23 dataset. Random Forest, Catboost, XGBoost, Convolutional Neural Network, and Long Short-Term Memory (LSTM) models are among the classifiers utilized. These algorithms have been selected to provide lightweight security systems to be deployed in the IoT devices rather than a centralized approach. The dataset was preprocessed to remove unnecessary or missing data, and then the most significant features were extracted using a feature engineering technique. The highest overall accuracy achieved was 96% by applying all classifiers except LSTM which recorded a lower accuracy.

Diet or mobility? Multi-isotopic (C, N, and Sr) dietary modeling at Shamanka II, Cis-Baikal, Siberia

Dietary reconstructions increasingly rely on Bayesian techniques such as Food Reconstruction Using Isotopic Transferred Signals (FRUITS). These models benefit from the use of additional isotopic proxies (13C, 15N, and 87Sr/86Sr), which help refine proportional contributions of potentially overlapping reference groups. However, each new isotope comes with additional considerations and uncertainties. Strontium isotopes are typically discussed as recording primarily geographic information (place of origin) that can be used to infer the movements of individuals through different phases of their lives. Yet, strontium is incorporated into the body through the foods consume, as are 13C and 15N, raising the question of whether strontium ratios are informing primarily about movement of the individual or changes in the diet. Inferring human movement across landscape thus relies on demonstration that observed values could not have come from local sources and required inputs from other geographic regions. Contemporary biogeochemical records are necessary to resolve these possibilities. Refinements in the developmental age estimates for the specific sampling locations on human teeth enable the integration of additional isotopic data through matching of biochemical signatures obtained from dentin and enamel micro-samples. Using multi-isotopic dietary modeling allows better assessment of relative contributions to overall diet of food groups such as terrestrial large game, lake or riverine fish, seal, and plants (inner bark, willow shoots, mushrooms). Notable variability between human molars and adult bone strontium isotopic ratios has been inferred as representing the presence of non-locals at the Shamanka II cemetery. Dietary reconstruction suggests that plants are the primary variable responsible for this “mobility” indicator.

MR SIGnature MAtching (MRSIGMA) with retrospective self-evaluation for real-time volumetric motion imaging

Objective. MR SIGnature MAtching (MRSIGMA) is a real-time volumetric MRI technique to image tumor and organs at risk motion in real-time for radiotherapy applications, where a dictionary of high-resolution 3D motion states and associated motion signatures are computed first during offline training and real-time 3D imaging is performed afterwards using fast signature-only acquisition and signature matching. However, the lack of a reference image with similar spatial resolution and temporal resolution introduces significant challenges for in vivo validation. Approach. This work proposes a retrospective self-validation for MRSIGMA, where the same data used for real-time imaging are used to create a non-real-time reference for comparison. MRSIGMA with self-validation is tested in patients with liver tumors using quantitative metrics defined on the tumor and nearby organs-at-risk structures. The dice coefficient between contours defined on the real-time MRSIGMA and non-real-time reference was used to assess motion imaging performance. Main Results. Total latency (including signature acquisition and signature matching) was between 250 and 314 ms, which is sufficient for organs affected by respiratory motion. Mean ± standard deviation dice coefficient over time was 0.74 ± 0.03 for patients imaged without contrast agent and 0.87 ± 0.03 for patients imaged with contrast agent, which demonstrated high-performance real-time motion imaging. Signficance. MRSIGMA with self-evaluation provides a means to perform real-time volumetric MRI for organ motion tracking with quantitative performance measures.

A new algorithm for solving uncapacitated transportation problem with interval-defined demands and suppliers capacities

The uncapacitated transportation problem (UTP) deals with minimizing the transportation costs related to the delivery of a homogeneous product from multi-suppliers to multi-consumers. The application of the UTP can be extended to other areas of operations research, including inventory control, personnel assignment, signature matching, product distribution with uncertainty, multi-period production and inventory planning, employment scheduling, and cash management. Such a UTP with interval-defined demands and suppliers capacities (UTPIDS) is investigated in this paper. In UTPIDS, the demands and suppliers capacities may not be known exactly but vary within an interval due to variation in the economic conditions of the global economy. Following the variation, the minimal total cost of the transportation can also be varied within an interval and thus, the cost bounds can be obtained. Here, although the lower bound solution can be attained methodologically, the correct estimation of the worst case realization (the exact upper bound) on the minimal total transportation cost of the UTPIDS is an NP-hard problem. So, the decision-makers seek for minimizing the transportation costs and they are interested in the estimation of the worst case realization on these minimal costs for better decision making especially, for proper investment and return. In literature very few approaches are available to find this estimation of the worst case realization with some shortcomings. First, we demonstrate that the available heuristic methods fail to obtain the correct estimation of the worst case realization always. In this situation, development of a better heuristic method to find the better near optimal estimation of the worst case realization on the minimal total costs of the UTPIDS is desirable. Then this paper provides a new polynomial time algorithm that runs in O (N2) time (N, higher of the numbers of source and destination nodes) for better estimation. A comparative assessment on solutions of available benchmark instances, some randomly generated numerical example problems and a real-world application shows promising performance of the current technique. So, our new finding would definitely be benefited to practitioners, academics and decision makers who deal with such type of decision making instances.

Abstract 2079: Prediction of DDR and other mutation signatures using targeted panels for FFPE samples

Abstract Mutational processes can cause driver mutations and are considered the primary cause of tumorigenesis. Cosmic signatures classify environmental or intrinsic mutational processes. Identification of signatures including DNA Damage Response (DDR) signatures enables research into the origin of cancer mutagenesis and into treatment optimization. Typically, Mutation signatures are identified using Whole Genome Sequencing or Whole Exome Sequencing. We demonstrate signature prediction of mutation signatures with two amplification-based targeted panels, which have a high sequencing success rate for FFPE samples. ~2000 FFPE Samples from a pan-solid tumor cohort were sequenced with either of two AmpliSeq panels (OCAplus and OTMLA), sizes 1.4 Mb and 1.7 Mb, to optimize a method to identify mutation signatures. First, we identified somatic SNVs by filtering out likely population germline mutations, and used these to construct the single base change substitution (SBS) matrix. The COSMIC cancer signatures use properties of the whole genome: we normalized to extend signature detection to targeted panel data. We adjusted the mutation frequencies observed using the ratio of trinucleotide counts in the genome and the ratio in the panel. Next, we measured the cosine similarity between the normalized sample and the COSMIC signatures. We selected the signatures with a strong match (&amp;gt;0.7) to the normalized sample. We further impute the signatures using a reduced candidate set, to assess the signature fit in the sample and reduce false positives. These steps provide the optimized signatures. We detected optimized signatures in 33% of the samples. A single signature was detected in 9% of the samples, 2 signatures in 6%, and &amp;gt;2 signatures in 17% of the samples. ~3% of samples showed at least one MMR signatures (SBS6, SBS14, SBS15, SBS20, SBS21, SBS26 and SBS44). In all 10 OCAPlus samples with MMR signatures, we also detected mutation(s) in an MMR gene. APOBEC signatures, SBS2 and SBS13, were observed in 3% of samples sequenced with OCAPlus panel and TML panel. We found 3 samples showing HRR signature SBS3. We successfully identified the putative causal DDR mutation in a number of samples. For example, of 62 samples with NTHL1 mutations, 60 had NTHL1 related signature SBS30. A sample with MUTYH mutations was assigned the SBS36 signature. We sequenced matched Tumor/Normal pairs; in most cases, the tumor sample showed a stronger mutational signature, with their corresponding normal sample showing either no signature or a weaker matching signature. We assessed reproducibility of the mutational signature. Looking at duplicate and triplicate replicates, we found that replicates consistently displayed the same mutational signatures. We show identification of mutation signatures using targeted panels designed for FFPE samples. Citation Format: Fiona Hyland, Ajithavalli Chellappan, Chintan Vora, Shilpa Nair, Jagannath Patro, Ritika Raj, Rushikesh Kanap. Prediction of DDR and other mutation signatures using targeted panels for FFPE samples [abstract]. In: Proceedings of the American Association for Cancer Research Annual Meeting 2021; 2021 Apr 10-15 and May 17-21. Philadelphia (PA): AACR; Cancer Res 2021;81(13_Suppl):Abstract nr 2079.

Ant Colony Optimization based Light weight Binary Search for efficient signature matching to filter Ransomware

Ransomware is a form of malicious software which when deployed encrypts or locks the files and demands a ransom to have the files decrypted and accessible. In today’s digital world, devices connected to the network are vulnerable to ransomwares. Signature based methods are used to detect known ransomwares at an early stage to minimize the damage. This type of detection involves a predefined repository of static signatures which block the ransomwares based on the signatures in the repository. Fuzzy hashing method and Clam Av method for signature based ransomware detection have been proposed in literature. However, these methods raised false negatives and false positives respectively. Also, the speed of comparison in fuzzy hashing method was a limitation. In this paper an Ant Colony Optimization (ACO) based approach for filtering ransomwares by matching the incoming signature hash value with the signature database is proposed. Termed Ant Colony Optimization based Light weight Binary Search for Signature based Ransomware detection (ACOLBSR) algorithm, the ant agent finds the search space in the signature database. If a search space does not exist in the signature database, the incoming file is logged. If the search space exists in the database, the ant agent employs a binary search to match the incoming signature hash value with the signatures in the search space. If a match is found, the file is accepted or blocked if it is a goodware or ransomware respectively. If the incoming signature does not match with the signatures in the search space, the file is logged. The advantage of ACOLBSR algorithm is that the ransomwares are strictly filtered based on the signatures in the database. The computational complexity of ACOLBSR algorithm is less compared to binary search and sequential search. Also, it is shown that ACOLBSR algorithm do not generate false positives when compared to ClamAV, SplitScreen, fuzzy hashing and classification based approaches. Experimental results comparing the performance of the ACOLBSR scheme with the binary search scheme, sequential search scheme and classification based approaches are presented.

Signature-less ransomware detection and mitigation

Ransomware is a challenging threat that encrypts a user's files until some ransom is paid by the victim. This type of malware is a profitable business for attackers, generating millions of dollars annually. Several approaches based on signature matching have been proposed to detect ransomware intrusions but they fail to detect ransomware whose signature is unknown. We try to detect ransomware's behaviour with the help of a mini-filter driver using a signature-less detection method. The proposed technique combines the working of Shannon’s entropy and fuzzy hash to provide better results in detecting ransomware. Not only this technique has been practically tested but has been successful in detecting over 95% of the tested ransomware attacks on windows operating systems.

Learning metamorphic malware signatures from samples

Metamorphic malware are self-modifying programs which apply semantic preserving transformations to their own code in order to foil detection systems based on signature matching. Metamorphism impacts both software security and code protection technologies: it is used by malware writers to evade detection systems based on pattern matching and by software developers for preventing malicious host attacks through software diversification. In this paper, we consider the problem of automatically extracting metamorphic signatures from the analysis of metamorphic malware variants. We define a metamorphic signature as an abstract program representation that ideally captures all the possible code variants that might be generated during the execution of a metamorphic program. For this purpose, we developed MetaSign: a tool that takes as input a collection of metamorphic code variants and produces, as output, a set of transformation rules that could have been used to generate the considered metamorphic variants. MetaSign starts from a control flow graph representation of the input variants and agglomerates them into an automaton which approximates the considered code variants. The upper approximation process is based on the concept of widening automata, while the semantic preserving transformation rules, used by the metamorphic program, can be viewed as rewriting rules and modeled as grammar productions. In this setting, the grammar recognizes the language of code variants, while the production rules model the metamorphic transformations. In particular, we formalize the language of code variants in terms of pure context-free grammars, which are similar to context-free grammars with no terminal symbols. After the widening process, we create a positive set of samples from which we extract the productions of the grammar by applying a learning grammar technique. This allows us to learn the transformation rules used by the metamorphic engine to generate the considered code variants. We validate the results of MetaSign on some case studies.

Creation of a gene expression portrait of depression and its application for identifying potential treatments

Depression is a complex mental health disorder and the goal here was to identify a consistent underlying portrait of expression that ranks all genes from most to least dysregulated and indicates direction of change relative to controls. Using large-scale neural gene expression depression datasets, a combined portrait (for men and women) was created along with one for men and one for women only. The depressed brain was characterized by a “hypo” state, that included downregulation of activity-related genes, including EGR1, FOS, and ARC, and indications of a lower brain temperature and sleep-like state. MAP kinase and BDNF pathways were enriched with overlapping genes. Expression patterns suggested decreased signaling for GABA and for neuropeptides, CRH, SST, and CCK. GWAS depression genes were among depression portrait genes and common genes of interest included SPRY2 and PSEN2. The portraits were used with the drug repurposing approach of signature matching to identify treatments that could reverse depression gene expression patterns. Exercise was identified as the top treatment for depression for the combined and male portraits. Other non-traditional treatments that scored well were: curcumin, creatine, and albiflorin. Fluoxetine scored best among typical antidepressants. The creation of the portraits of depression provides new insights into the complex landscape of depression and a novel platform for evaluating and identifying potential new treatments.

Fine-Grained Compiler Identification With Sequence-Oriented Neural Modeling

Different compilers and optimization levels can be used to compile the source code. Revealed in reverse from the produced binaries, these compiler details facilitate essential binary analysis tasks, such as malware analysis and software forensics. Most existing approaches adopt a signature matching based or machine learning based strategy to identify the compiler details, showing limits in either the detection accuracy or granularity. In this work, we propose NeuralCI (Neural modeling-based Compiler Identification) to infer these compiler details including compiler family, optimization level and compiler version on individual functions. The basic idea is to formulate sequence-oriented neural networks to process normalized instruction sequences generated using a lightweight function abstraction strategy. To evaluate the performance of NeuralCI, a large dataset consisting of 854,858 unique functions collected from 19 widely used real-world projects is constructed. The experiments show that NeuralCI achieves averagely 98.6% accuracy in identifying the compiler family, 95.3% accuracy in identifying the optimization level, 88.7% accuracy in identifying the compiler version, 94.8% accuracy in identifying the compiler family and optimization level, and 83.0% accuracy in identifying all compiler components simultaneously, outperforming existing function level compiler identification methods in terms of both detection accuracy and comprehensiveness.

MBTree: Detecting Encryption RATs Communication Using Malicious Behavior Tree

Network trace signature matching is one reliable approach to detect active Remote Control Trojan, (RAT). Compared to statistical-based detection of malicious network traces in the face of known RATs, the signature-based method can achieve more stable performance and thus more reliability. However, with the development of encrypted technologies and disguise tricks, current methods suffer inaccurate signature descriptions and inflexible matching mechanisms. In this paper, we propose to tackle above problems by presenting MBTree, an approach to detect encryption RATs Command and Control (C&C) communication based on host-level network trace behavior. MBTree first models the RAT network behaviors as the malicious set by automatically building the multiple level tree, MLTree from distinctive network traces of each sample. Then, MBTree employs a detection algorithm to detect malicious network traces that are similar to any MLTrees in the malicious set. To illustrate the effectiveness of our proposed method, we adopt theoretical analysis of MBTree from the probability perspective. In addition, we have implemented MBTree to evaluate it on five datasets which are reorganized in a sophisticated manner for comprehensive assessment. The experimental results demonstrate the accurate and robust of MBTree, especially in the face of new emerging benign applications.

Drug Repurposing Approaches: Existing Leads For Novel Threats And Drug Targets.

Drug Repurposing (DR) is an alternative to the traditional drug discovery process. It is cost and time effective, with high returns and low risk process that can tackle the increasing need for interventions for varied diseases and new outbreaks. Repurposing of old drugs for other diseases has gained a wider attention, as there have been several old drugs approved by FDA for new diseases. In the global emergency of COVID19 pandemic, this is one of the strategies implemented in repurposing of old anti-infective, anti-rheumatic and anti-thrombotic drugs. The goal of the current review is to elaborate the process of DR, its advantages, repurposed drugs for a plethora of disorders, and the evolution of related academic publications. Further, detailed are the computational approaches: literature mining and semantic inference, network-based drug repositioning, signature matching, retrospective clinical analysis, molecular docking and experimental phenotypic screening. We discuss the legal and economical potential barriers in DR, existent collaborative models and recommendations for overcoming these hurdles and leveraging the complete potential of DR in finding new indications.

Towards blockchain-enabled single character frequency-based exclusive signature matching in IoT-assisted smart cities

With the increasing viability of Internet of Things (IoT), more devices are expected to be connected in a smart city environment. It can provide many benefits for people’s daily life, but is also susceptible to many security threats in practice. Intrusion detection systems (IDSs), especially signature-based IDSs, are one of the most commonly adopted security mechanisms to safeguard various network environments like IoT-assisted smart city against cyber attacks. The process of signature matching is a key limiting factor for a signature-based IDS, and the exclusive signature matching (ESM) was designed based on the observation that most network packets would not match any IDS signatures. However, exclusive signature matching like the single character frequency-based ESM may be vulnerable to some attacks in a hostile environment. To mitigate this issue, in this work, we propose a blockchain-enabled single character frequency-based ESM, which can build a verifiable database of malicious payloads via blockchains. In the evaluation, we investigate the performance of our approach under flooding and character padding attacks in both a simulated and a real IoT network environment. The results demonstrate the effectiveness of our approach in enhancing the robustness of single character frequency-based ESM against malicious traffic.

Signature Recognition using 2D Discrete Wavelet Transforms

Signature recognition is one of the most secure techniques used for person identification. Wavelet transforms possess an extra time localization property over Fourier transforms, despite both are frequency localized. That is why; it is more useful to analyze the one dimensional and two dimensional signals both. First of all the features of a signature are extracted and then matching is performed. We have proposed feature extraction technique using discrete wavelet transforms level-1 and matching of signatures are performed using some statistical parameters of discrete wavelet coefficients using matching percentage, sum of absolute difference, mean square error and city block distance.

Drug repurposing in Raynaud's phenomenon through adverse event signature matching in the World Health Organization pharmacovigilance database.

Several pharmacological treatments are recommended for Raynaud's phenomenon (RP) secondary to systemic sclerosis, but they only have modest efficacy. A way to efficiently identify new drugs is drug repurposing, which can be based on signature matching. The signature could be derived from chemical structures, pharmacological affinity or adverse event profiles. We propose to use the World Health Organization (WHO) pharmacovigilance database to generate repositioning hypotheses for treatments of RP through adverse event signature matching. We first screened all drugs associated with at least 1 case of erythromelalgia, an adverse effect opposite to RP. In parallel, to define the adverse event signature of drugs recommended in secondary RP from the WHO pharmacovigilance database, we selected the 14 most representative adverse drug reactions (ADRs). Lastly, we performed a hierarchical cluster analysis to identify drugs with similar ADR signature to vasodilatory drugs used in RP. In total, 179 drugs were associated with erythromelalgia; they were related to 860 334 adverse events representative of RP drugs in the WHO pharmacovigilance database. Hierarchical cluster analysis allowed identification of 6 clusters. The most stable cluster contained 7 drugs, among which 5 are recommended in secondary RP, or pertain to the same drug class: epoprostenol, nifedipine, nicardipine, lacidipine and israpidine. The 2 remaining drugs were alemtuzumab and fumaric acid. Our ADR signature matching approach suggests that alemtuzumab and fumaric acid could be effective treatments of secondary RP. The latter is currently being investigated as a treatment of pulmonary hypertension in systemic sclerosis.

Single-cell RNA-seq analysis of human CSF microglia and myeloid cells in neuroinflammation

ObjectiveTo identify and characterize myeloid cell populations within the CSF of patients with MS and anti-myelin oligodendrocyte glycoprotein (MOG) disorder by high-resolution single-cell gene expression analysis.MethodsSingle-cell RNA sequencing (scRNA-seq) was used to profile individual cells of CSF and blood from 2 subjects with relapsing-remitting MS (RRMS) and one with anti-MOG disorder. Publicly available scRNA-seq data from the blood and CSF of 2 subjects with HIV were also analyzed. An informatics pipeline was used to cluster cell populations by transcriptomic profiling. Based on gene expression by CSF myeloid cells, a flow cytometry panel was devised to examine myeloid cell populations from the CSF of 11 additional subjects, including individuals with RRMS, anti-MOG disorder, and control subjects without inflammatory demyelination.ResultsCommon myeloid populations were identified within the CSF of subjects with RRMS, anti-MOG disorder, and HIV. These included monocytes, conventional and plasmacytoid dendritic cells, and cells with a transcriptomic signature matching microglia. Microglia could be discriminated from other myeloid cell populations in the CSF by flow cytometry.ConclusionsHigh-resolution single-cell gene expression analysis clearly distinguishes distinct myeloid cell types present within the CSF of subjects with neuroinflammation. A population of microglia exists within the human CSF, which is detectable by surface protein expression. The function of these cells during immunity and disease requires further investigation.