The 8th SafeConfig Workshop is held in Denver, Colorado USA on October 12, 2015 and being run with the conjunction of the 22nd ACM Conference on Computer and Communications Security (CCS). The title of this year's SafeConfig is "Automated Decision Making for Cyber Security". Today, the use of cyber technology is evolving rapidly. The computing and networking is everywhere, public to private organizations, large enterprises to individuals, and data centers to smart phones and Internet-of-Things. The highly growing use of the Internet also leads to newly evolving security threats. The automated decision making should be able to determine the security and resiliency of networked information systems and services. The integration of security requirements, capabilities, and deployment constraints in a unified framework will enable intelligent response, automated defense, and network resiliency.

Many phenomena that we wish to discover are comprised of sequences of events or event primitives. Often signatures are constructed to identify such phenomena using either distributions or frequencies of attributes, or specific subsequences that are known to correlate to the phenomena. Distribution-based identification does not capture the essence of the sequence of behaviors and therefore may suffer from lack of specificity. At the other extreme, using specific subsequences to identify target phenomena is often too specific and suffers from lower sensitivity when natural variations arise in the phenomena, measuring process, or data analysis. We introduce here a method for discovering signatures for phenomena that are well characterized by sequences of event primitives. In this paper, we describe the steps taken and lessons learned in generalizing a sequence analysis method, BLAST, for use on non-biological datasets including expressing and operating on alphabets of varying length, constructing a reward/penalty model for arbitrary datasets, and discovering low complexity segments in sequence data by extending BLAST's native low-complexity estimating algorithms. We also present high-level overviews of several case studies that demonstrate the utility of this method to discovering signatures in a wide array of applications including network traffic, software analysis, server characterization, and others. Finally, we demonstrate how signatures discovered using this method can be expressed using a variety of model formalisms, each having its own relative benefit.

Abstract Motivation: BLAST remains one of the most widely used tools in computational biology. The rate at which new sequence data is available continues to grow exponentially, driving the emergence of new fields of biological research. At the same time, multicore systems and conventional clusters are more accessible. ScalaBLAST has been designed to run on conventional multiprocessor systems with an eye to extreme parallelism, enabling parallel BLAST calculations using >16 000 processing cores with a portable, robust, fault-resilient design that introduces little to no overhead with respect to serial BLAST. Availability: ScalaBLAST 2.0 source code can be freely downloaded from http://omics.pnl.gov/software/ScalaBLAST.php. Contact: [email protected]

Biological sequences contain low-complexity regions (LCRs) which produce superfluous matches in homology searches, and lead to slow execution of database search algorithms such as BLAST. These regions are efficiently identified by low-complexity filtering algorithms such as SDUST and SEG, which are included in the BLAST tool-suite. These algorithms target differing notions of complexity, so an algorithm which combines their sensitivities is pursued. A variety of features are derived from these algorithms, as well as a new filtering algorithm based on Lempel-Ziv complexity. Artificial sequences with known LCRs are used to train and evaluate an SVM classifier, which significantly outperforms the standalone filtering algorithms.

Abstract Motivation: The standard approach to identifying peptides based on accurate mass and elution time (AMT) compares profiles obtained from a high resolution mass spectrometer to a database of peptides previously identified from tandem mass spectrometry (MS/MS) studies. It would be advantageous, with respect to both accuracy and cost, to only search for those peptides that are detectable by MS (proteotypic). Results: We present a support vector machine (SVM) model that uses a simple descriptor space based on 35 properties of amino acid content, charge, hydrophilicity and polarity for the quantitative prediction of proteotypic peptides. Using three independently derived AMT databases (Shewanella oneidensis, Salmonella typhimurium, Yersinia pestis) for training and validation within and across species, the SVM resulted in an average accuracy measure of ∼0.83 with an SD of <0.038. Furthermore, we demonstrate that these results are achievable with a small set of 13 variables and can achieve high proteome coverage. Availability: http://omics.pnl.gov/software/STEPP.php Contact: [email protected] Supplementary information: Supplementary data are available at Bioinformatics online.

BACKGROUND: The challenge of remote homology detection is that many evolutionarily related sequences have very little similarity at the amino acid level. Kernel-based discriminative methods, such as support vector machines (SVMs), that use vector representations of sequences derived from sequence properties have been shown to have superior accuracy when compared to traditional approaches for the task of remote homology detection. RESULTS: We introduce a new method for feature vector representation based on the physicochemical properties of the primary protein sequence. A distribution of physicochemical property scores are assembled from 4-mers of the sequence and normalized based on the null distribution of the property over all possible 4-mers. With this approach there is little computational cost associated with the transformation of the protein into feature space, and overall performance in terms of remote homology detection is comparable with current state-of-the-art methods. We demonstrate that the features can be used for the task of pairwise remote homology detection with improved accuracy versus sequence-based methods such as BLAST and other feature-based methods of similar computational cost. CONCLUSIONS: A protein feature method based on physicochemical properties is a viable approach for extracting features in a computationally inexpensive manner while retaining the sensitivity of SVM protein homology detection. Furthermore, identifying features that can be used for generic pairwise homology detection in lieu of family-based homology detection is important for applications such as large database searches and comparative genomics.

Reducing the dimension of vectors used in training support vector machines (SVMs) results in a proportional speedup in training time. For large-scale problems this can make the difference between tractable and intractable training tasks. However, it is critical that classifiers trained on reduced datasets perform as reliably as their counterparts trained on high-dimensional data. We assessed principal component analysis (PCA) and sequential project pursuit (SPP) as dimension reduction strategies in the biology application of classifying proteins into well-defined functional ‘families’ (SVM-based protein family classification) by their impact on run-time, sensitivity and selectivity. Homology vectors of 4352 elements were reduced to approximately 2% of the original data size using PCA and SPP without significantly affecting accuracy, while leading to approximately a 28-fold speedup in run-time.

MOTIVATION: As the amount of biological sequence data continues to grow exponentially we face the increasing challenge of assigning function to this enormous molecular 'parts list'. The most popular approaches to this challenge make use of the simplifying assumption that similar functional molecules, or proteins, sometimes have similar composition, or sequence. However, these algorithms often fail to identify remote homologs (proteins with similar function but dissimilar sequence) which often are a significant fraction of the total homolog collection for a given sequence. We introduce a Support Vector Machine (SVM)-based tool to detect homology using semi-supervised iterative learning (SVM-HUSTLE) that identifies significantly more remote homologs than current state-of-the-art sequence or cluster-based methods. As opposed to building profiles or position specific scoring matrices, SVM-HUSTLE builds an SVM classifier for a query sequence by training on a collection of representative high-confidence training sets, recruits additional sequences and assigns a statistical measure of homology between a pair of sequences. SVM-HUSTLE combines principles of semi-supervised learning theory with statistical sampling to create many concurrent classifiers to iteratively detect and refine, on-the-fly, patterns indicating homology. RESULTS: When compared against existing methods for identifying protein homologs (BLAST, PSI-BLAST, COMPASS, PROF_SIM, RANKPROP and their variants) on two different benchmark datasets SVM-HUSTLE significantly outperforms each of the above methods using the most stringent ROC(1) statistic with P-values less than 1e-20. SVM-HUSTLE also yields results comparable to HHSearch but at a substantially reduced computational cost since we do not require the construction of HMMs. AVAILABILITY: The software executable to run SVM-HUSTLE can be downloaded from http://www.sysbio.org/sysbio/networkbio/svm_hustle

MOTIVATION: The standard approach to identifying peptides based on accurate mass and elution time (AMT) compares profiles obtained from a high resolution mass spectrometer to a database of peptides previously identified from tandem mass spectrometry (MS/MS) studies. It would be advantageous, with respect to both accuracy and cost, to only search for those peptides that are detectable by MS (proteotypic). RESULTS: We present a support vector machine (SVM) model that uses a simple descriptor space based on 35 properties of amino acid content, charge, hydrophilicity and polarity for the quantitative prediction of proteotypic peptides. Using three independently derived AMT databases (Shewanella oneidensis, Salmonella typhimurium, Yersinia pestis) for training and validation within and across species, the SVM resulted in an average accuracy measure of 0.8 with a SD of <0.025. Furthermore, we demonstrate that these results are achievable with a small set of 12 variables and can achieve high proteome coverage. AVAILABILITY: http://omics.pnl.gov/software/STEPP.php. SUPPLEMENTARY INFORMATION: Supplementary data are available at Bioinformatics online.

Mass spectrometry (MS)-based proteomics is a powerful and popular high-throughput process for characterizing the global protein content of a sample. In shotgun proteomics, typically proteins are digested into fragments (peptides) prior to mass analysis, and the presence of a protein in inferred from the identification of its constituent peptides. Thus, accurate proteome characterization is dependent upon the accuracy of this peptide identification step. Database search routines generate predicted spectra for all peptides derived from the known genome information, and thus, identify a peptide by 'matching' an experimental to a predicted spectrum. However, due to many problems, such as incomplete fragmentation, this process results in a large number of false positives. We present a new scoring algorithm that integrates probabilistic database scoring metrics (from the MSPolygraph program) with physico-chemical properties in a support vector machine (SVM). We demonstrate that this peptide identification classifier SVM (PICS) score is not only more accurate than the single best database scoring metric, but is also significantly more accurate than models derived using a linear discriminant analysis, decision tree, or artificial neural network.

UNLABELLED: The visual Platform for Proteomics Peptide and Protein data exploration (PQuad) is a multi-resolution environment that visually integrates genomic and proteomic data for prokaryotic systems, overlays categorical annotation and compares differential expression experiments. PQuad requires Java 1.5 and has been tested to run across different operating systems. AVAILABILITY: http://ncrr.pnl.gov/software.

n order to overcome the limitations of traditional monolithic firewalls, Pacific Northwest National Laboratory (PNNL) has implemented a Secure Collaboration Zone (SCZ) to provide high performance connectivity using a host-based security model where the network firewall is replaced by a centrally managed host-based firewall on each system in the SCZ. This approach, coupled with intrusion detection capabilities and tight system configuration management controls, eliminates the firewall bottleneck and creates a layered security model that enables secure data transfer at rates which scale to today's system and network capabilities. For SC06 we will be using Polygraph, a high-performance implementation of a statistical and physical model-based feature matching algorithm, to run identification calculations on spectral data resulting from tandem mass-spectrometry experiments. In particular, a compute cluster at SC06 will run Polygraph to access a preprocessed information archive of spectral data located at PNNL in the SCZ.

For the SC|06 analytics challenge, we demonstrate an end-to-end solution for processing data produced by high-throughput mass spectrometry (MS)-based proteomics so biological hypotheses can be explored. This approach is based on a tool called the Bioinformatics Resource Manager (BRM) which will interact with high-performance architecture and experimental data sources to provide high-throughput analytics to a specific experimental dataset. Peptide identification was achieved by a high-performance code, Polygraph, which has been shown to scale well beyond 1000 processors. Visual analytics applications such as PQuad, Cytoscape, or others may be used to visualize protein identities in the context of pathways using data from public repositories such as Kyoto Encyclopedia of Genes and Genomes (KEGG). The end result was that a user can go from experimental spectra to pathway data in a single workflow reducing time-to-solution for analyzing biological data from weeks to minutes.

Genes in an organism's DNA (genome) have embedded in them information about proteins, which are the molecules that do most of a cell's work. A typical bacterial genome contains on the order of 5,000 genes. Mammalian genomes can contain tens of thousands of genes. For each genome sequenced, the challenge is to identify protein components (proteome) being actively used for a given set of conditions. Fundamentally, sequence alignment is a sequence matching problem focused on unlocking protein information embedded in the genetic code, making it possible to assemble a "tree of life” by comparing new sequences against all sequences from known organisms. But, the memory footprint of sequence data is growing more rapidly than per-node core memory. Despite years of research and development, high-performance sequence alignment applications either do not scale well, cannot accommodate very large databases in core, or require special hardware. We have developed a high-performance sequence alignment application, ScalaBLAST, which accommodates very large databases and which scales linearly to as many as thousands of processors on both distributed memory and shared memory architectures, representing a substantial improvement over the current state-of-the-art in high-performance sequence alignment with scaling and portability. ScalaBLAST relies on a collection of techniques—distributing the target database over available memory, multilevel parallelism to exploit concurrency, parallel I/O, and latency hiding through data prefetching—to achieve high-performance and scalability. This demonstrated approach of database sharing combined with effective task scheduling should have broad ranging applications to other informatics-driven sciences.