Source Traceback Research Articles

Long-term persistence of diverse clones shapes the transmission landscape of invasive Listeria monocytogenes

BackgroundThe foodborne bacterium Listeria monocytogenes (Lm) causes a range of diseases, from mild gastroenteritis to invasive infections that have high fatality rate in vulnerable individuals. Understanding the population genomic structure of invasive Lm is critical to informing public health interventions and infection control policies that will be most effective especially in local and regional communities.MethodsWe sequenced the whole draft genomes of 936 Lm isolates from human clinical samples obtained in a two-decade active surveillance program across 58 counties in New York State, USA. Samples came mostly from blood and cerebrospinal fluid. We characterized the phylogenetic relationships, population structure, antimicrobial resistance genes, virulence genes, and mobile genetic elements.ResultsThe population is genetically heterogenous, consisting of lineages I–IV, 89 clonal complexes, 200 sequence types, and six known serogroups. In addition to intrinsic antimicrobial resistance genes (fosX, lin, norB, and sul), other resistance genes tetM, tetS, ermG, msrD, and mefA were sparsely distributed in the population. Within each lineage, we identified clusters of isolates with ≤ 20 single nucleotide polymorphisms in the core genome alignment. These clusters may represent isolates that share a most recent common ancestor, e.g., they are derived from the same contamination source or demonstrate evidence of transmission or outbreak. We identified 38 epidemiologically linked clusters of isolates, confirming eight previously reported disease outbreaks and the discovery of cryptic outbreaks and undetected chains of transmission, even in the rarely reported Lm lineage III (ST3171). The presence of animal-associated lineages III and IV may suggest a possible spillover of animal-restricted strains to humans. Many transmissible clones persisted over several years and traversed distant sites across the state.ConclusionsOur findings revealed the bacterial determinants of invasive listeriosis, driven mainly by the diversity of locally circulating lineages, intrinsic and mobile antimicrobial resistance and virulence genes, and persistence across geographical and temporal scales. Our findings will inform public health efforts to reduce the burden of invasive listeriosis, including the design of food safety measures, source traceback, and outbreak detection.

Unknown Attack Traffic Classification in SCADA Network Using Heuristic Clustering Technique

Attack Traffic Classification (ATC) technique is an essential tool for Industrial Control System (ICS) network security, which can be widely used in active defense, situational awareness, attack source traceback and so on. At present, the state-of-the-art ATC methods are usually based on traffic statistical features and machine learning techniques, including supervised classification methods and unsupervised clustering methods. However, it is difficult for these methods to overcome the problems of lack of attack samples and high real-time requirement in ATC in Supervisory Control and Data Acquisition (SCADA) networks. In order to address the above problems, we propose a self-growing ATC model based on a new density-based heuristic clustering method, which can continuously and automatically detect and distinguish different kinds of unknown attack traffic generated by various attack tools against SCADA networks in real time. An effective representation method of SCADA network traffic is proposed to further improve the performance of ATC. In addition, a large number of experiments are conducted on a compound dataset consisting of the SCADA network dataset, the attack tool dataset and the ICS honeypot dataset, to evaluate the proposed method. The experimental results show that the proposed method outperforms existing state-of-the-art ATC methods in the crucial situation of only normal SCADA network traffic.

ExtHT: A hybrid tracing method for cyber-attacks in power industrial control systems

Tracing the sources of cyber-attacks in Power Industrial Control Systems (PICS) can help the defense systems to block the attacks, and support the decision of the grid control policies. However, there has been no work on the cyber-attack source traceback for PICS, and the methods for the Internet are not suitable for PICS in terms of fineness, real-time performance, and supporting communication protocols. Therefore, a method for tracing cyber-attacks in PICS is proposed. First, the communication network architecture of PICS and the cyber security threats to PICS are analyzed. Then, an extended hybrid tracing method (ExtHT) based on packet marking and packet logging is proposed. This method involves all the devices working at the data link layer and upper layers to achieve more fine-grained attack tracing. At the same time, taking the costs of attack tracing into consideration, a coarse-grained tracing mode is presented to improve the tracing speed. In addition, a log database optimization scheme is provided to reduce storage costs. To facilitate the application of this method in practice, a cyber-attack source tracing system and its deployment architecture are designed for PICS. Further, the applicability and limitations of ExtHT are analyzed, theory ratiocinations are given to justify our ExtHT, and the performance of our ExtHT is compared with that of existing mainstream methods. Finally, two cyber-attack scenarios against PICS are constructed and the feasibility of ExtHT is verified on them.

Infection, genetics, and evolution of Trichinella: Historical insights and applications to molecular epidemiology

Genetic variation in pathogen populations provides the means to answer questions in disease ecology and transmission, illuminating interactions between genetic traits, environmental exposures, and disease. Such studies elucidate the phylogeny, evolution, transmission and pathogenesis of viruses, bacteria and parasites. Here, we review how such studies have fostered understanding of the biology and epidemiology of zoonotic nematode parasites in the genus Trichinella spp., which impose considerable economic and health burdens by infecting wildlife, livestock, and people. To use such data to define ongoing chains of local transmission and source traceback, researchers first must understand the extent and distribution of genetic variation resident in regional parasite populations. Thus, genetic variability illuminates a population's past as well as its present. Here we review how such data have helped define population dynamics of Trichinella spp. in wild and domesticated hosts, creating opportunities to harness genetic variation in the quest to prevent, track, and contain future outbreaks.

Feasible DDoS attack source traceback scheme by deterministic multiple packet marking mechanism

A main purpose of network security is to secure the system and its element parts from illegal access and misuse. Distributed denial of service (DDoS) attack is a crucial risk to the internet. A source traceback is a technology to control each and every computer crime. A feasible DDoS attack source traceback technique based on marking on demand (MOD) scheme is proposed to detect computer attack by using multiple packets for marking coding. In this proposed scheme, the MOD scheme is based on the deterministic multiple packet marking mechanism. Depending upon this finding, the proposed technique basically addresses the scalability issue of existing deterministic packet marking-based traceback schemes and perhaps to traceback to the individual cooperated computers more willingly than the present defined routers of attacking computers. Also, this technique is used to identify the malicious users who form the volume of traffic necessary to reject a service to computer user. To traceback the engaged attack source, there is a need to mark these engaged ingress routers by deterministic multiple packet marking mechanism. Simultaneously, the MOD server reports information of the marks and their connected requesting IP addresses. Once DDoS attack is proved, the victim will acquire attack sources through requesting MOD server by marks refined from attack packets. The confirmed DDoS attack is identified when it is higher than the tested threshold value. In this study, a mathematical model is established to prove the efficiency of the proposed source traceback technique in both real-world experiments and theoretical analysis. Extensive real-world experiments and theoretical analysis show that the proposed technique is efficient and feasible.

A Feasible IP Traceback Framework through Dynamic Deterministic Packet Marking

DDoS attack source traceback is an open and challenging problem. Deterministic packet marking (DPM) is a simple and effective traceback mechanism, but the current DPM based traceback schemes are not practical due to their scalability constraint. We noticed a factor that only a limited number of computers and routers are involved in an attack session. Therefore, we only need to mark these involved nodes for traceback purpose, rather than marking every node of the Internet as the existing schemes doing. Based on this finding, we propose a novel marking on demand (MOD) traceback scheme based on the DPM mechanism. In order to traceback to involved attack source, what we need to do is to mark these involved ingress routers using the traditional DPM strategy. Similar to existing schemes, we require participated routers to install a traffic monitor. When a monitor notices a surge of suspicious network flows, it will request a unique mark from a globally shared MOD server, and mark the suspicious flows with the unique marks. At the same time, the MOD server records the information of the marks and their related requesting IP addresses. Once a DDoS attack is confirmed, the victim can obtain the attack sources by requesting the MOD server with the marks extracted from attack packets. Moreover, we use the marking space in a round-robin style, which essentially addresses the scalability problem of the existing DPM based traceback schemes. We establish a mathematical model for the proposed traceback scheme, and thoroughly analyze the system. Theoretical analysis and extensive real-world data experiments demonstrate that the proposed traceback method is feasible and effective.

Multiple-locus variable-number tandem repeat analysis for strain discrimination of non-O157 Shiga toxin-producing Escherichia coli

Non-O157 Shiga toxin-producing Escherichia coli (STEC) are foodborne pathogens of growing concern worldwide that have been associated with several recent multistate and multinational outbreaks of foodborne illness. Rapid and sensitive molecular-based bacterial strain discrimination methods are critical for timely outbreak identification and contaminated food source traceback. One such method, multiple-locus variable-number tandem repeat analysis (MLVA), is being used with increasing frequency in foodborne illness outbreak investigations to augment the current gold standard bacterial subtyping technique, pulsed-field gel electrophoresis (PFGE). The objective of this study was to develop a MLVA assay for intra- and inter-serogroup discrimination of six major non-O157 STEC serogroups—O26, O111, O103, O121, O45, and O145—and perform a preliminary internal validation of the method on a limited number of clinical isolates. The resultant MLVA scheme consists of ten variable number tandem repeat (VNTR) loci amplified in three multiplex PCR reactions. Sixty-five unique MLVA types were obtained among 84 clinical non-O157 STEC strains comprised of geographically diverse sporadic and outbreak related isolates. Compared to PFGE, the developed MLVA scheme allowed similar discrimination among serogroups O26, O111, O103, and O121 but not among O145 and O45. To more fully compare the discriminatory power of this preliminary MLVA method to PFGE and to determine its epidemiological congruence, a thorough internal and external validation needs to be performed on a carefully selected large panel of strains, including multiple isolates from single outbreaks.

Multilayer collaborative traceback technique based on net-flow fingerprint

Aimed at loop fallacy, indeterminate serialisation of suspicious nodes and local overload problems of suspicious information source traceback in net-flow exchange, this paper proposes a multilayer collaborative traceback technique based on net-flow fingerprint. The traceback is divided into controllable inter-AS layer, intra-AS routing layer and controllable subnet layer. Based on the characteristics of each layer, it achieves efficient suspicious path extraction in controllable inter-AS layer by BGP protocol properties. In intra-AS routing layer, it solves loop fallacy by directed graph transformation and indeterminate serialisation of suspicious nodes by local time relationship approach. In controllable subnet layer, it achieves precise location by using forwarding tables. What is more, by proposing multilayer collaborative approach, it improves the efficiency of suspicious path extraction and reduces local overload of traceback servers without compromising the accuracy of traceback. Finally, the correctness and computational complexity of NFCMT are proved, and the feasibility and correctness of this scheme are discussed by experiments.

Multistate outbreak of Escherichia coli O157:H7 infections associated with a national fast-food chain, 2006: a study incorporating epidemiological and food source traceback results.

A multistate outbreak of Escherichia coli O157:H7 infections occurred in the USA in November-December 2006 in patrons of restaurant chain A. We identified 77 cases with chain A exposure in four states - Delaware, New Jersey, New York, and Pennsylvania. Fifty-one (66%) patients were hospitalized, and seven (9%) developed haemolytic uraemic syndrome; none died. In a matched analysis controlling for age in 31 cases and 55 controls, illness was associated with consumption of shredded iceberg lettuce [matched odds ratio (mOR) 8·0, 95% confidence interval (CI) 1·1-348·1] and shredded cheddar cheese (mOR 6·2, CI 1·7-33·7). Lettuce, an uncooked ingredient, was more commonly consumed (97% of patients) than cheddar cheese (84%) and a single source supplied all affected restaurants. A single source of cheese could not explain the regional distribution of outbreak cases. The outbreak highlights challenges in conducting rapid multistate investigations and the importance of incorporating epidemiological study results with other investigative findings.