Do you want to learn how to trade stocks and cryptocurrency? Join our community of traders, go to richpicksdaily.com and find the next 10-Bagger. What are you doing today? I'm your host Rich here on behalf of Rich TV Live with our very special guest Aiden Mills, the CEO of Northstar Clean Technologies. How are you doing today Aiden? Great Rich, how are you? I'm doing fantastic. Very excited to learn more about your company Symbol Roof R-O-O-F and I have a few questions for you today. First of all, I'd like to ask Northstar Clean Technologies is a clean technology company dedicated to the processing, extraction and recovery of single-use asphalt shingles. Can you tell us a little bit more about the company? Sure, so our company basically takes single-use asphalt tiles and reprocesses them into their individual component parts to a sales quality specification and so let's step back and talk about what a asphalt shingle looks like. So a shingle tile is basically made up of three different things. So 50% of the tile is sand, 25% is fiber, the older tiles the fiber will be paper and the newer tiles the fiber is fiberglass and then the remaining 25% is asphalt oil. So basically we have developed a completely proprietary technology. We believe we're the only people in the world who have the technology to be able to split that shingle up into its individual component parts. Wow, that's incredible. Now what fueled the company's decision to focus primarily on solving the asphalt shingle waste problem? Well look, if you think about the industry of repurposing waste either back into products that can be used or products that can be used in heat or mobility etc, the technology emerged about 10 years ago from Lafarge. Lafarge decided to look at this because essentially because of, if you think as we said before, 25% of everything that's going into a landfill as a shingle tile is asphalt oil. So Lafarge, who were a major paving company, decided let's have a look at this. They took it to a point whereby they presented the capital and Lafarge decided not to progress it and the two of the founders that were involved in our company thought this is a really good idea. So they took the technology from Lafarge under agreement with Lafarge and we'll talk a little bit about what that actually means with respect to sales contracts later. But yeah, so they took that technology out and started to develop it and so that was about 10 years ago. About five years ago they formed the Empower company and started to develop the site that we have at Delta. And so there's a single site at Delta and people are like, well is this just like a small technology play? Is this just focused? No. The market size for this essentially is the whole of North America. So when you look at what's happening with asphalt shingles today, and you look at the figures in the US, for last year 13 million tons of asphalt shingle tiles came off roofs to be reprocessed. One million of that got is kind of grind up and put in the road. So no matter where you live, if you google you know, recycled asphalt shingles, there's companies all across North America that do this and what they do is they take the tile, they grind it up and then they put it back in roads. So that represents one million tons. So 12 million tons actually goes into landfill. And let me tell you what 12 million tons kind of means in real money. So 12 million tons of asphalt shingles is about 3 million tons of asphalt oil. And 3 million tons of asphalt oil is more than 18 million barrels of oil. Wow. And that is equivalent to one year, one day's worth of US oil production. So the problem that we're trying to solve essentially is that in theory in the first of January, all of US production pouring into landfill. That's what we're trying to address. So what exactly you may have touched on this is the zero waste trend and what impact does it have on North Star's business? Well, if you think about what we're trying to do with respect to diversion, recycling, the circular economy, there's three major trends that are going on. Number one, if you look at, for example, if you look at the clean cities objective, clean cities are trying to reduce what can go into landfill as much as they possibly can. Some have set targets of 50% reduction by 2030. So what that means for us is we literally can go to every municipality and say, give us all your asphalt shingle tiles and you can stop those going into landfill. And we don't produce it. We don't repurpose it and give them a really nasty by-product back. We take it all. So in one single shot, we can literally take all the asphalt shingles as part of that zero waste. The second thing is ESG. So if you think about the asphalt that comes at the back end of our process, it is literally the only green asphalt in North America. So if you think about a green product that is part of a circular economy and ESG, that's fantastic and that's what we do. And the third thing is the circular economy. So if you think about a lot of the trends, so let's take plastics, for example, you know, plastics get recycled, ground up, repurposed and back into plastic pallets that go back into making plastic bottles, for example. And that's exactly what we do. So if you think about something that is literally straight down the fairway of waste repurposing, circular economy and ESG support, those three big things, this company is right down the fairway. That's fantastic. You guys are doing some great work. What do you believe is the market opportunity for North Star? Well, look, I think the market opportunity is if you look at the size of our facility, and we'll talk a little bit about our expansion facility in a minute, but if you look at the size of our expansion facility, it can probably process about 150 to 200 tons a day of asphalt shingles. The market size that is good for that is any city that has over a million people. And so that generates enough asphalt shingles coming off roofs, new roofs being purposed at demolition waste, et cetera, that we can build one plant. And if you think about a city like, let's take Toronto, so our first expansion plant, we'll chat about it later, but our first expansion plant will be based in Calgary. So you think the size of Calgary over a million people. Well, if you go to somewhere like Toronto, that can have four of our facilities. If you go to LA, it could have 10 of our facilities. As long as it's over a million people, that number of tons generates enough for one of our plants. So every CEO will say the market size is unparalleled. The market size for this plant, in my opinion, across North America is absolutely huge. That's incredible. Now, what sets North Star apart from the other companies in the space? Well, look, there's a number of different companies that we would call peers in the space because they're taking a waste product. And then they're as part of kind of a circular economy thing, they're generating stuff that comes like the back end. We're the only people that can do it for asphalt shingles. We're really, really focused. So I actually get the question quite often, well, look, this technology looks great. Can you do? Could you put this into it? Could you put that into it? I'm like, ah, no, we absolutely have to be ruthlessly focused on the execution plan. We have 12 million tons in the US and one and a half million tons in Canada to just to secure. So the first thing we are is very focused. And the second thing we are is this isn't a 2030 ESG plan. This is ready, not our Delta facility, the Empire facility in Delta is targeted to move to steady state production in one queue revenue production, you know, around about the same time as well. So this isn't the difference between us. I think a number of our peers is they have developing technologies. We literally have a technology that is ready to go. That's incredible. Now, I know that North Star expects to reach commercial production and begin generating revenue early next year. Can you tell us about the company's multiple revenue streams and your term revenue projections? Sure. So the first step in this is we, so I talked a little bit earlier about the technology being improved. So we this month ran commissioning runs at the facility in Delta. And commissioning runs are really important because they do two things. The number one proves that the technology works. So, you know, at the back end of the plant, we get we got aggregate and fiber and oil. So we know that the technology works. And now, also during that process, we identified the steps that we need to take to get to steady state production. So we're very confident that will happen in that in Q1 next year. And if you look at the revenue for that for the plant, there's really five buckets of revenue that comes in from the plant perspective. So the first thing is, if you're if you take some Asheville Jingle tiles in off a roof in Vancouver, and you drive it to the landfill, you have to pay a tipping fee of about 130 bucks a ton for every ton of Asheville Jingle that you put in the landfill. So our Delta facility is five kilometers away from the Vancouver Metro landfill. So the first part of the business model is we get the roofers to turn right to our facility instead of left to the Metro facility. And when they come to us, now we'll give them an advantage rate. So we will have a landfill tax that is lower, a tipping fee that is lower than the Vancouver Metro landfill. And so that's the first revenue stream. And when we bring the trucks in, we've got kind of three things to do. Number one, we offer the guy who runs the company an incentive of 20 bucks a ton of advantage to come to us. Number two, it's not like a landfill queue. We can literally unload the trucks within 15 minutes. And the third thing is we might even give the truck driver a cup of coffee and make sure that whenever he turns up, he gets a cup of coffee and a bacon road or whatever when he drops the stuff off. So that's the first kind of part of the revenue model and part of the marketing stream to bring that in. And then you think, so then we process and then at the back end drops fiber and aggregate, so sand. And that's fine because that can go into local markets. Now, are any sand buyers going to give us a huge premium because it's green? Probably not. But we know that there's a local market. There's no supply issues or no demand issues. So we can take those products into the local market. But the third thing at the back end, it's really important is asphalt. So if you think about asphalt, think about the guys who use asphalt for the roads, whether it's Lafarge or Colus or Dow Corning all across North America.  Suddenly, as we build our plants, we start to introduce a green recycled line. Now, I'm not going to tell you that that's necessarily going to be three times the price of asphalt, like, like jet fuel, green jet fuel is versus jet fuel. But we believe that there's upside for that because we believe there will be a green premium, a green premium above market for asphalt coming out the back end. And then the fifth, the fifth part of the model is what we're studying now. And that's what is the CO2 footprint of our facility. We believe because of the way that we're processing it, we have a CO2 footprint that is significantly lower than the virgin production of asphalt, you know, at the back end of refineries and from aggregate, etc. So we believe there'll be a carbon credit element. And we know, we certainly know. And the carbon credit element depends, it often depends on the jurisdiction. It depends on the state law or the provincial law, you know, what the federal regulations are for measuring the carbon credit. But I can tell you for sure that our view is that we will use less carbon to generate a ton of asphalt versus virgin production. So as we run every hour, we will have carbon benefit with our production model. So we still have to do a lot of work about how to monetize that. But that's the fifth revenue model that sits over the whole top of the process. So you have the tipping fee in the front end, three products in the back end, and then the carbon benefit that sits on top. Aiden, one of the things that we really look for here at Rich TV Live is companies that are well funded, well capitalized, with little to no debt. Can you talk a little bit about your financial structure? Sure. So look, this is the thing that I think is really exciting about the company. As I said earlier, so we IPOed on the 13th of July. That generated about, you know, 12.2 million of a raise and all equity raise, so all retail equity, no institutional investors in as yet. So all people like the community you serve. So let's talk about where we are now. So at the end of the last quarter, the last quarterly results, we had 10 million dollars worth of cash on the balance sheet. All of that, about 0.9 of that was debt, but that's a credit revolver to a local friendly Vancouver finance institution, so not term debt. But if you step back and you think about our capital spend, so, you know, it's probably going to cost us a round about a million dollars to get the Empower facility up and running. We have, as we talked about, we have the engineering and the RFP to be done for the expansion plant, and we obviously have the development of the business to get ready for that. But Rich, there's nothing in our capital structure at all at the minute from government subsidies. So we have Wellington DePont, who are our government and public affairs advisor, based in Ottawa, engaging, along with us, engaging the federal government, provincial governments, and municipal governments about the level of support that they could be able to provide to something that is literally right down the fairway of the green infrastructure play. So none of that 10 million worth of cash is any government funding as yet. So that's one of the big things to look forward to that we're driving forward. The second thing is, there is no term debt in the structure. So we literally have no debt in that 10 million dollars worth of cash that is term debt that we will need to build these facilities out. So the expansion plant capacity, as I said, 150 to 200 tons a day, but also probably costs about 10 million bucks to build. So this isn't a renewable ESG plant that's going to cost 100 million or 150 million. Every single facility can be put in these cities and they cost 10 million dollars. So the plan that we have after the Calgary facility in Q3 is to think about potentially between then and the end of 2023, six plants. So a plant per quarter. And so that's a $60 million kind of build program. And we think that the equity that needs to go into that, it might only need to be like 25% that we may have 25% government subsidies and 50% green term debt, which of course is advantaged because every hour we run, we generate a carbon credit. Wow, you guys got it all figured out. Now the company already has a number of supply and offtake agreements in place. Can you tell us a little bit more about those? Sure. So the team that developed this five years ago, the first agreement with Lafarge, of course, was like, take the technology, you're good guys are good to run with it. But for the first three plants in Western Canada, Lafarge have an offtake agreement that we sell all the production to them. That's currently priced at what I would describe as a commissioning contract level. So five years ago, when Lafarge were talking to the empire, the finders, they were like, okay, so you're not sure when you're going to produce, you're not quite sure what the quality is going to be, et cetera, et cetera. Now we've got and so priced, you know, priced at 300 bucks a ton. So now we're in a position whereby we have quality, we know the quality is good, we have, you know, we're clear about when we're going to be producing, we have a good idea about how much we're producing, so it can fit perfectly into their offtake plans. So our discussions with Lafarge are now, well, this should reflect more of a market price. And so if you took the market price, for example, in Vancouver today, it's probably in the kind of $600 to $700 a ton. So, you know, asphalt pricing, it depends on its seasonal, it also depends on oil price. But again, we have the only green asphalt in North America. So we believe that there's a strong market capability and market pricing dynamic for our asphalt too. So that's the discussion ongoing with Lafarge. So we have three plants in Western Canada planned. For the rest of North America, we've now started discussions with both Lafarge and some of the other providers who take asphalt to talk to, including not only paving guys, but if this is a perfect circular economy play, it will go back into roofing. So, you know, we're talking to a number of roofers as well about what those offtake agreements could look like. From a debt perspective, we'll talk a little bit about the capital structure in a minute, but from a debt perspective, we believe if we have supply in the front end and we have an offtake agreement for the majority coming out the back end from a asphalt perspective, that you could fund that with ordinary debt today and green debt on top of it will be even better because we know that there's the CO2 benefit. Now here at Rich TV Live, we love to understand the fundamentals of the company. We also like to understand the management team behind the company. North Star's leadership team has an impressive 280 years of combined operational and capital markets experience. Can you tell us how this contributes to the success of the company? Well, look, I mean, I like the 280 years, but to me actually that could be 280 years of not good experience. So let me tell you why I think our team really works. Sure. So if you think about the team, it's really made up of three, the leadership team has made up of three constituent parts. The first thing, and it's absolutely crucial is, you know, we have the finders of the company and we have the finders of the technology. So the people who literally can walk up to a pump, put their hand on it and go, hmm, I think this should be running better. You know, so they know exactly how to produce the products at the back end. It was their idea and they're hugely vested. The two of the finders own 5% of the company each and so absolutely locked into the success going forward. Also part of the management team is some of the guys that did the capital raise. So Empower was a standalone company. North Star then acquired Empower and it was North Star and the leadership team in North Star that did the capital raise. So IPO in the 13th of July, $12.2 million worth of equity cash came into the company to drive the next steps forward. And so that team is still in place as well. And I joined on the 12th of July.  And then the last 10 years, both at Husky and at Goldman and at Meg, you know, working on the strategic development of businesses. And so me joining enables the kind of third level to be added to the leadership team about how do we drive this business forward and commercialize it. So if you step back, ignoring the 280 years, the three really important component parts of the operation and engineering and the understanding, the financing and how we're helping with the capital markets and driving the strategic business forward, that's what the leadership team has today. I love it. And what should investors watch out for from North Star Clean Technologies in the coming months, years? Well, look, the first thing we talked about earlier was the Empower Plant in Delta. So it should move to steady state production and Q1. So that steady state production to me is probably about, you know, 50 to 100 tons a day. The other thing, and we're going to be announcing this quite shortly, the other thing we've done is we've done an RFP process for a category engineering company. We had three companies that bid for it. We're just about to finalize the agreement with one of those companies, and that's to build the expansion plan. So the plant in Delta is an excellent plant, but it's an entrepreneur plant. It's not a fully engineered plant. And that's what the tech, that's what the engineering provider will do. And that detailed design for the expansion plants will be ready probably about the end of Q1. That's our target. So once that's ready, then essentially we can start the rollout program. So the rollout program will start with Calgary. So we will likely start, we'll likely start construction in Q3. We think from kind of first saw being turned to commissioning, it's probably about six months. So in theory, investors can expect the first expansion plant online by the end of next year. And that expansion plant, that's 150 to 200 tons a day. So that's actually an important point as well with respect to ESG, et cetera, and repurposing plants for this new technology. Like this is ready to go, but the scale-up risk from the current plant to the expansion plant is like times two. So I'm not saying to people, hey listen, invest in us. I have something on a bench in a laboratory and the risk you're taking is a times 50 or a times 100 scale. This isn't ready in 2020. We literally have a scale-up that is two to three times ready by the end of next year. The other thing that we chatted about earlier quickly was the CO2 benefit. The CO2 study should be ready again within this quarter to be able to talk about what we think the benefit is of both the empower plant and Delta, but also the expansion plant. Now, to be fair, we'll know more about the expansion plant carbon footprint whenever the detailed engineering is done by the end of Q1. But indicatively, we should know both of those figures this quarter this year. And so that's something for people to look forward to, because we'll be able to actually say, not only do we believe we're green, but here are the indicative figures that demonstrate that from a carbon perspective. Finally, how can investors get in touch with North Star? So let me just have a quick look at our IR deck. So one of the best ways to get in contact with this from an IR perspective is to talk to kin communications. They are investor relations supporting. So that is roof at kincommunications.com. Our director of capital markets at North Star is Carson Sadon. He's Carson at northstarcleantech.com. And as the CEO, I'll give my contact as well, which is aiden at northstarcleantech.com as well. Fantastic. Now, I must remind everyone who's watching these videos that Rich TV Live is strictly for information and education purposes in saying that, I do believe this is a company that's undervalued, underappreciated, underexposed. Thank you so much for joining us today. The CEO of North Star Clean Technologies, Aiden Mills. Rich, thanks very much. Thanks for your time. Always a pleasure. Love to invite you back on the show. If you ever have any big breaking news or anything you want to talk about with our community, we'd love to invite you back. Thank you for your time today, Aiden Mills. And thank you guys for watching. If you're not winning, you're not watching. You're bringing the winners and we're bringing them to you first. Thank you for watching, everybody, and have a nice day.


So, we want to be able to detect when someone's trying to intrude into our computer system, into our network, for example. So when someone's trying to attack us and log in remotely or do something malicious. We talked about the types of intruders and the general concepts of intrusion detection, but we'll come back to that with some examples today. And really, we'll classify into three types of intrusion detection. Host-based, think of there's some software that runs on a host on a computer and monitors what happens on that computer. And from that monitoring, it tries to determine is there an intruder or not. So a host-based on a computer. Distributed host-based extends that, so say in SIT, we have some software on each of the computers, on each of the hosts, and they collect information and send it back to some central server to help trying to determine if there's an intruder. So distributed host-based collect information not just from one computer, but from multiple computers in the network to see if there's an intruder A into a computer and B into the network. So both of them are looking at what the activities on the computers. And network-based intrusion detection we'll get to is looking at the activities on the network. What packets are being sent between computers into the network and out of the network? So monitoring the packets, the communications, as opposed to monitoring what's happening on the computer, like the file reads, the programs that are executed. So let's go through them. So host-based intrusion detection system, some software that you install on your computer that tries to detect if there's an intruder and log events that may be suspicious so that we can study it later. If you can detect an intruder early, you may be able to stop further intrusion, stop a malicious attack. So if you can detect someone logging in that should not be, then you may be able to automatically log them out so that they cannot do anything else that's malicious. The idea is to look at what the normal users do. So the normal users of the computer system and understand their behavior and then under the assumption that an intruder will do something different and therefore use that information to try and detect, okay, based on the behavior, based on what's happening, is this an intruder doing it or a normal user? Early detection is to look at strange things, look for anomalies. So if we know the behavior of the normal user, let's say that we study the behavior of the normal user over a period of one month and we can understand what they normally do, what files they access, what programs they execute, when do they execute them, when do they log in, how often do they log in per day, per week, for how long are they logged in? So if we can understand the characteristics of the normal behavior, then what we do, given that information, is that when something's happening we compare it to that normal behavior and see if it's outside the normal behavior, that is, it's an anomaly. Two approaches have some thresholds and, for example, we say that based on our study of the normal behavior we expect that no user accesses or starts this program more than five times per day, or no user accesses this file or tries to read this file more than once per week, or no user logs in for more than one hour at a time, or less than two minutes at a time. So based upon some known behavior, set some thresholds, so set some values based on the known behavior, and then when something happens, some events happen that exceed those thresholds, that's a trigger, this may be some strange event, this may be an intruder. It doesn't guarantee that it's intruder, but the idea is that if we, if multiple thresholds are crossed, then that's an indication that this is likely to be an intruder. This is independent of the user, so the thresholds think are for the entire system for any user. So think of the ICT server, there are many users, many students can log in and staff can log in and do things on the server. So what we'd need to do is set to observe some profile of a normal user, students and staff, and then set some thresholds about the activities that may be undertaken, and then monitor if those activities exceed the threshold, then that's a trigger that this may be an intruder. Profile based is a bit more complex in that we look at individual users, normal users, and create profiles of what they do. And again, when for example someone's logged in as that user, compare the activities of that user against their profile. If it doesn't match the profile, that's an indication that it's an intruder. Let's have a look at an example for this concept of a profile. Before we go to the example, let's look at audit records or logs. So where do we get information about what's happening? What do we monitor? Well, computer systems, the applications running, the operating system always or can maintain some log of the events that take place. So say we have a log of who logs in, when, for how long, what files they read and try to write to, what programs they execute, what those programs try to do. So if we could log all the activities of what's happening on the computer, then we use that to observe the behavior. So these are generally called audit records, so some record of what's happening. So most operating systems have logs of what the software and the user does. So native audit records is using those logs of the operating system or the software, the applications. So you run a web server on your operating system, it produces a log normally. So read that log to observe what's happening. So most operating systems and applications have their own logs. So one approach is that the intrusion detection system uses those logs, it reads those data logs and makes some observations based upon that, use the existing ones. The other approach is that the intrusion detection software itself maintains its own logs, it creates its own separate logs. So think again, an intrusion detection system is just a piece of software running on your computer, the host based. So it could generate its own records of what's happening. So when you install the intrusion detection software on your computer, some privileged process, it hooks into the operating system and creates a log of everything that happens on the computer, its own log. So different approaches use the existing logs which the normal applications already create or the intrusion detection system itself creates its own logs or own records. What's the difference? Well, in the first case, we don't need any special software to create the logs, the logs already exist, are there anyway, so it makes sense to reuse them. But as we'll see in an example, the logs produced by different software, by different applications may be in many different formats, maybe text, maybe some binary file, maybe in a database, so we need to handle all those different formats and we need to process it. Because if the intrusion detection system does its own log keeping, then it's independent of the software and it's independent of the operating system, however, it requires some extra processing and record taking. So either way, we need to have some log of what's happening. We need to know what's happening on the system. Does Windows have any log of what's happening? Anyone seen a log? I haven't used Windows for a while, but what's the name of the software or the feature in Windows that shows a log of what's happening? Anyone know? I'm sure you can find in the control panel or somewhere that there's an event, I think it was called a Windows event viewer. You can see many events that happen with respect to the operating system. You can try and find that. It shows at different levels of detail the events, the things that are happening on the system, especially errors and warnings. But you could configure it to log normal things, things that are not errors and warnings and therefore keep a record of everything that's happening. The programs which are started, the users which log in, the files which are read, written to, deleted. Let's look at an example. We'll come back to Moodle log in a moment. Let's look on the ICT server as an example. I'm logged in to the ICT server. Most Linux computers keep very basic logs of some things that happen. For example, the people that log in, the ICT server, many students have accounts that they can log in, so there's a record of who logs in. Let's have a quick look just to see some of the information we can see. In Unix systems, they usually store logs, I'll show you again. In the directories, slash bar, slash log, that's where most applications and the operating system stores their logs, and the logs are usually just text files, just one line for every event that happens. There are many different types of logs. We're not going to look at many, we'll just look at one example. There are logs about what happens when the computer boots. The operating system kernel about the email, because this is also an email server, so when someone sends and receives an email on this server, there's a log of what happens. The system so includes applications, there's logs there, and MySQL, when the database server starts and does things, there's a log of what happens. So up the top, many of them are not relevant. Apache, the web server, so there's a web server running here in that directory. There are many more logs of whenever anyone accesses the website, there's a log of a summary of what happened there. There are many logs, usually just kept in files and you see that they rotate over time, so as the log gets to some size, copy it to a new file and start writing in a new file. But that's not the point here. There's this authentication log, which is a log of essentially the log-ins by people to the server. The details of the log, it's very hard to see, and we'll look at some a little bit closer, but every line it prints, the date, the time, and some message about what happened. Now these, though, are not so important, we'll filter out. There are thousands of logs over the last few days. Let's just go straight to some of them. For example, when I logged in, let's try and see the logs. There are many different logs, so I need to search through them. I think the message is this, we'll try and then explain, no it's not. One word. So this just searches through all this log file, looking for this string, accepted public key for S Gordon. I know that because that's the message that's printed whenever I log in. I don't log in with a password, I use a public and private key to log in. So the software, when I log in, prints a message saying that the system has accepted the key that I've provided, allowing me to log in. In fact, there are many log files. I'll zoom out a bit, and it just lists all of those log-in attempts, or successful log-ins by me. Looking at a little bit closer, just looking at one of them, for example, it shows us the date, the time of the log-in, and when we log in, we use the secure shell to log into the secure shell server, or demon, and it says, accept a public key for this user, so my username, from this address, so this is the IP address that I logged in from, and the port number that I used. So a very simple log, but from this, the server knows when each user logs in, and you can do more analysis to see when they log out as well. So from that, the duration they're logged in for, so for each day, how often they log in, for how long they log in, and at what times do they log in? So let's say we do analysis of all this data from the normal user, and we come up with some profile with respect to the log-ins. And to keep it simple, let's say we analyze and we look at all the times when I log in over the last month, and use that as my profile. So from that log, of course, we wouldn't do it manually. The intrusion detection system should do it for us. You should monitor this to develop a profile. And we come up with some profile, and I'll try and draw a profile that, and you'll see it makes, it compares to one of our earlier slides, a rough plot of the log-ins, or an example of log-ins over time. Let's say we looked at over the past month when I logged in, what times during the day. So from our zero up to 24. And we count how often I log in, say between 11 and 12, or here, 11 and 12. And between 4 p.m. and 5 p.m. And we count them over some period of time to develop a profile of that user's normal behavior. So we'd get a really a histogram of the log-ins. So I'll just make up some data. Let's say I log in these times the most frequent. That is, we record how many occurrences I've logged in at particular times. Whereas this is the frequency, okay? So I'll log in most times around 12 o'clock, sometimes in the afternoon, sometimes at 8 p.m. Okay? So we develop a profile of the user. We can think of that as some distribution. So we could fit a curve to that, it's something like that, okay? So this is the profile of the user. So we've given that, now when the system is running, when someone logs in as S Gordon, the intrusion detection system compares. Okay, someone's logged in. If they've logged in at 1 p.m. as S Gordon, so at this time. And this intrusion detection system compares that to the profile and sees, okay, that matches the profile quite well. Because there's a high probability that the normal user logs in at 1 p.m. But if there's someone logs in as S Gordon at 1 a.m. Okay, at this time. Then again, the intrusion detection system compares, okay? S Gordon logged in at 1 a.m. But given the profile, it's very unlikely that the normal user logs in at 1 a.m. It's possible, but very unlikely. So that's an initial trigger that this is possibly an intrusion. Now, this is quite simple, just considering the login times may not be enough. But then if we add further information, not just the times, but then even the days, days of the week. So you may have different profiles based upon the day of the week as when you log in, sad days and Sundays may be different from Mondays through to Friday. In fact, on Monday when I'm teaching a lab, it will be different from Tuesday when I'm in the office. So the profile will be more detailed than just this. And again, the system compares the current activity to the profile. So with more information about the profile, you can get a more accurate guess or accurate estimate if this is an intruder or not. And this diagram is, if we go back a few slides, is the concept here. So we said this was the profile of the normal user, some parameter that we can measure, some behavior, login times, files accessed. So some profile of the normal user. And we work under the assumption that the intruder would have a different profile. And therefore, we monitor what happens, compare it to the user's profile. If they match, then we assume it's not an intruder. If they don't match, then we assume it's an intruder. And of course, the problems arise with intrusion detection systems in that, okay, sometimes the behavior of the intruder matches that of the normal user. There's an overlap here. So, someone logs in, go back to our case. Someone logs in as S Gordon at, what's, say at 6 a.m. Our profile says that that's unlikely. Okay, it's very unlikely, it's possible. Now, what's the decision, intruder or not? Well, if we make the decision that it's not an intruder, because there is a chance that I logged in at 6 a.m. If we make the decision, or if the intrusion detection system makes the decision, it's not an intruder, but it is, then that's a failure of the detection system. Or the other way, if it assumes it is an intruder, because it was logged in at 6 a.m., which was very unlikely, but if it wasn't an intruder, if it was actually me, I just woke up early, then again, that's a failure of the intrusion detection system. False positives and false negatives. So, a real intrusion detection system doesn't just use one parameter, it uses a combination of many parameters, not just logins, but then also the activities. When I log in, what commands do I execute? What files do I access? The more information, the more accurate it can be. Just coming back to our, well, with that example, our log, so that was a log of my logins. I just searched through for everything that had accepted public key for S Gordon. When you try to log into the server and you have the wrong password, it prints a message, failed password. So, let's search for all the lines that contain failed password. Of course, hard to see how many over the last few days, 2100 failed password attempts. I think the logs are over the last, I don't know, week or so. So, in the last week, there are about 300 attempts per day of someone trying to log into the ICT server and they don't have the correct password. Now, this is just a basic feature of the operating system and the server, but it's a basic intrusion detection system because we can see, if we look at some details, we can see some of the details, okay, failed password for root. So, someone tried to log into the server as the root user from this IP address and at 9.30 a.m., 12 seconds, and then three seconds later tried to log in from the same IP address as root user, and then three seconds later again, okay, then at this time, same IP address trying to log in. What's happening? What's happening there? One computer with IP address 124219196.188 is trying to log in to the ICT server, username root, supply a password, and the password is wrong. So, someone's trying to guess the password for the root user in this case. So, this is an attack on the password of the root user. So, essentially the start of a brute force attack or an attack on password guessing. It may not be brute force, it may be trying some expected passwords. This system is set up such that after several attempts of this, I think five or six, so six attempts, it starts to block that IP address. So, this is the case of one of those ways to stop password guessing. If someone tries to guess the password and they get it wrong six times in some period of time, then don't let them try again. And that's what's happened here that they've tried over a period of just 10 seconds or 15 seconds, six attempts at the root user password. After that, the system blocks that IP address. So, a way to stop password guessing. And then you see some others. Not just for the root user, here's failed password for invalid user. Someone has again tried to log in. All Linux systems have a root user. But in this case, someone's tried to log in as some other user. In this case, it's an invalid user. There's no such user with this name on the ICT server. Again, what they're trying to do is try and log in with common user names. They're passing the user names and then also with those user names trying to guess passwords. So, one thing that may be happening is that they just choose some random or some common user name. And maybe they try the password or one, two, three, four, five. That is, they try common passwords. And then they try a different user with that same common password. And there's not many others shown here. But if we look through later, you'll see some many different attempts at different users. So, that's an attack on the passwords of trying to use common passwords for many different users. We can see that, I think, again for the non-root users. So, here someone has tried many different almost random passwords. Random user names. And they've tried some passwords for them. So, an obvious feature of an intrusion detection system is to monitor the login logs. To see who's trying to log in and to block those that should not be. I think we skipped over this slide. Requirements of any intrusion detection system. Okay, let's go through them quickly. They should run automatically. So, you install the intrusion detection system on your computer. And once it's set up, it just runs and it runs forever. That's the idea. That you don't have to intervene to operate it. Your computer crashes for some reason. Then, of course, the intrusion detection system should automatically start and recover. If someone tries to attack the intrusion detection system itself, it should try to have strong ways to defend against such attacks. Because if someone can attack the intrusion detection system and turn it off, then they can try and log in and, of course, they will not be detected. Or do other things. Of course, when the intrusion detection system is running, it's monitoring logs. It's monitoring events that are happening on the computer. That takes some processing and some discrete time. So it needs to create minimal overhead so that it doesn't disrupt the normal user. It should be configurable. That is, sometimes we have different requirements of what we want the intrusion detection system to do. Maybe we want to focus on monitoring these set of files, which are the files for our accounts, our financial accounts for our organization. So they are the most important things. So configure it to monitor those only or to give high priority to those. So be able to configure it. If we develop a profile of a user and then use that fixed profile, well, unfortunately over time the profile of users changes. So if you develop a profile of S Gordon, of the logins, of the files he accesses and so on, over time his normal activities may mean that that profile changes. So the system should be able to adapt to such changes. On a single host that should work, but in a network where it's more useful, when we have many computers that should be able to adapt, especially distributed host-based intrusion detection and network-based, it needs to be able to work when there are thousands of computers in the network. Maybe the intrusion detection system has components on different computers. We'll see in the last two distributed and network-based, there are many different components. So if some of them fail, for whatever reason, the rest still should keep working. That's the last requirement. So the last two are really about distributed host-based and network-based intrusion detection, not so relevant for host-based. So we said one way is to develop a profile of the user and compare the activities against that profile. If it's inside the profile, okay. If it's outside the profile, let's assume it's an intruder. Looking for anomalies in the behavior. Another approach is signature detection. Define the behavior as a set of rules. So try and write some rules that define what a user normally does, rule-based anomaly detection, or what an attack normally does, penetration identification. So if we can write some rules that the attacks that we know of are trying to penetrate into our network to intrude, if we can define a set of rules as to what that normally involves, then when something happens and matches those rules, then we identify that as an intrusion, a penetration. Whereas rule-based anomaly detection is having rules based on what the normal user does. And again, if something happens that matches those rules, then that's okay. But if something happens that doesn't match those rules, then that's a likely intrusion. But this relies on having some rules, so some statements or some conditions. If this happens and this happens and this happens, then that's normal behavior. And in terms of penetration identification, it relies on knowing about the attacks. An anomaly detection is understanding what the normal user does. Anything that's not normal is an attack. Whereas penetration identification is knowing about what the attack does, and that's the way to identify the attack. A simple example may be, okay, we know there's some attack software that tries to automatically log in to SSH servers, like ICT. And the way that they attack is they first try and find the port number that the secure shell server is using. So they scan through the ports and then they try and submit passwords of these types to try and log in. So we may know what the attack normally does, define some rules to capture that attack, and then when we monitor what happens, if what happens matches those rules, we assume it's an intrusion or an attack. So on Tuesday we mentioned these just to gain, so there are many different measures for what's normal behavior and what's not. So log in activities, activities on files, activities on using programs, using applications. So that was about host-based intrusion detection. So running on an individual computer, some software to detect intrusions. Distributed host-based, we have a network inside SIT. What we do is that we run host-based intrusion detection software on multiple computers on hosts throughout the network. And so we run some special intrusion detection software on each computer inside SIT, the office computers, the servers, for example. They collect information. So we have some agent that collects the information, the records, the logs on the individual computer and eventually send that back to some central manager that will incorporate all of that data, not just from one computer but for all the computers to make decisions of intrusion or not. Of course, the more data you have, potentially the better you can detect intrusions. This also mentions, okay, we may also monitor the traffic on the LAN. So this is leading to network-based intrusion detection. Monitor the packets as well. And the host agents and the LAN monitor send alerts. So when something happens locally, they send some notification to some central manager and that central manager component combines all that data to detect intrusion or not. And the picture, I think, captures that. So a simple network. We have on hosts, we have some, let's think of this, some intrusion detection software. It's called an agent module, but you install some software on each host as part of the intrusion detection system. That monitors what happens on that host, looks at the logs and the events. And that's done on multiple hosts. We may also have some device that monitors the packets going through the network. We'll see the details of that in the next part, but the packets sent from the router to the host, it can monitor them as well. So they all collect information and then they send either all of that information or usually just a condensed form of that information. So they do some processing and send to some central manager who then makes the decision intrusion or not. And the idea is that with the more information, the better you will be at making that detection of an intruder. Because an intruder may, the packets that they send through the network may give an indication if they're an intruder. The hosts that they access, if they access particular hosts, particular computers, if they access someone's laptop or someone's desktop computer, may be different than if they access the database for the finance department. So the computers that they access may be an indicator of what the behavior is. So by collecting all the information we can improve the chance of successful detection. Let's say we have SIT, we have many different computers. We want to run such a system so that all computers, we install some intrusion detection software, this agent module on each computer. So there's one that runs under Windows, there's one that runs under the servers in Linux, and there's some that run in the Mac OS in the labs. They're all running on the individual hosts, and they all report back to a central manager. Some of the issues with that, each of those computers have different formats of their logs. So the intrusion detection system has to deal with all those different formats. So a Linux computer keeps a different log than a Windows computer. So how do we combine that information? The information that comes from those agent modules must be sent back to the central manager, but that needs to be secured. So these agents look at the logs, look at the events that are happening locally, possibly do some processing of that and send back some information, some summary information to the central manager. This information should be secured in the transmission so that no one can intercept it in the network. If we have just one central manager and that fails, then effectively our whole intrusion detection system fails. So this single point of failure is a problem here. If we have multiple managers, so to avoid that problem we duplicate the manager across five or ten different computers, have a distributed system, it should be better, but it's more complex. They must coordinate and make sure that they have up-to-date information. So as with any centralized system, there's a single point of failure. That's a problem. Distributed systems don't have that, but they are more complex to have all those different managers keep up-to-date. So just some of the issues with distributed host-based intrusion detection. And the last approach, network-based intrusion detection. So I think with host-based, we're monitoring what happens on computers. Logins, session activities, file access, program access. Network-based intrusion detection, we monitor the packets through the network. What's being sent and received? Monitor the traffic. So at different points across the network, we monitor what's coming in and out with respect to packets. And we do that using some sensors, some device that will basically keep track of the packets coming in and out. We call them sensors. And then some analysis of that traffic has taken place to do, again, to work out intruder or not. So look at the patterns of behavior based upon the traffic to see if there's an intruder or not. Now the analysis may be done at the sensors, or that they may send information back to some management server that does the analysis for all of them. This is a typo here. Examine packets at close to real-time, not example, examine PLE. That means for this to work efficiently, as packets are being sent through the network, these sensors are capturing the packets. You know how to capture packets. It's the same concept of TCP dump. You capture packets and then do some analysis. So look at the contents of those packets, who's sending them, who they're sending to, what protocol, what's the contents, and try and make a decision. Are these packets an indicator of an intruder or not? And that needs to be done quickly. So examine the packets very quickly at close to real-time.  This is an example, a simple example where we have an internal network, the outside internet. We have some switches and some, okay, here are some internal servers. So here are some PCs, some of the workstations here, but say that the user's computers, some internal servers, some external servers. So these are the servers that the public access, web server, mail server, whereas these internal ones may be just for the internal use only, like database servers for finance, for registration, and different internal uses. So just an example of a network structure connected via some switches. The next topic is about firewalls, but firewalls are really there to control what packets can come in to the network and what can go out in some cases. So we'll look at them in detail next. These magnifying glasses are indicating that these are where we have some sensors. Somehow we need to monitor the packets at these points in this example. So we have some sensors that record the packets coming in and out and then do some analysis of those packets to help determine if there's an intrusion. They could do the analysis themselves, or maybe the sensors could all send some data to some other server that does the analysis, some management server, which is not shown in this example. Normally the analysis of packets can take place at devices which normally have packets passed through them. Switches, routers, and firewalls. So switch, packets come in and it sends packets out. So what does a switch packets come in and come out? Then you can add some software to that switch such that it, as the packets come in, that's intrusion detection software monitors and keeps a record of the packets for analysis. So it's logical in most cases to put the sensors on devices which are already existing in the network for packet delivery. Switches and routers and firewalls even. That is inline sensors. So they insert it into the network and as packets pass through those sensors, they record a copy or do the analysis. Usually runs as software on existing switches, routers and firewalls. So the switches in our lab, in those cabinets, we could set them up that we have some extra software on those switches. Now I'm not sure if they support them but I'm sure we could buy one that does that extra software captures all the packets going through the switch, essentially runs TCP dump, capturing all the packets and also doing analysis of those packets looking at who sent them, who they sent to, what protocol, ICMP packets, HTTP packets and the profile of those packets. Like how many are coming in per second? How many ICMP ping packets are coming in to the switch or the firewall? And the intrusion detection software does some analysis to detect is this an intrusion or not? Are these secure shell requests to log in packets? And then analyze that based on the expected behavior. So an inline sensor is something that usually runs on an existing network device. You don't need extra hardware. Passive sensors usually require some extra device that takes a copy of the traffic and does analysis. And monitors a copy of the traffic. Here is that, let's say this switch here. An inline sensor would be some intrusion detection software running on that switch as packets come in. It analyzes those real packets and then they send out. Passive detection or a passive sensor, there'll be another computer say here and this switch is configured that everything that comes in, let's send a copy to the destination but also send a copy to this extra device. Then that extra device does the analysis. So it's just a difference is do we do the analysis on the switch? Or if so, we need a switch that supports that intrusion detection software. Or quite simply, we use our switch to make a copy of every packet that comes through it. Send it to some special computer that then does the analysis. In that case, we need that extra special computer but it reduces the load on the switch. It just sends a copy. It's very easy to do that with switches. So there's some differences there. Into where do you put your sensors? Inline sensors don't require extra hardware because it's happening as those packets are going in then it can detect quite quickly but it requires a lot of performance of the switch. Packet comes in, analyzed, send it out. When you've got thousands, hundreds of thousands of packets per second coming in you need a high-capability switch in terms of hardware to do that. Whereas a passive sensor, the switch just copies everything and sends it to another computer. That requires another computer but has little impact on the performance. The switch doesn't slow down. And that's the three types of... general types of intrusion detection. So host-based and network-based. Network, look at the packets through the network. It's not looking at what happens on the computer so it's not looking at which files were accessed. What's the CPU utilization? It's just looking at packets. And again, looking at the expected profile. What packets do we expect to be sent through the network? And when there's something that's unexpected, that's an indicator of an intrusion. And that's... We're not going to go through any more detailed examples. There is different software that you can buy or you can get that performs intrusion detection. So an example of a host-based intrusion detection software I think, and I've never used it, is called Tripwire. It's a common one that you install on your computers and it records things like disk activity, file access, and the operating system activity and tries to detect intruders. And then there's software that you can install on network devices to do network-based intrusion detection. And a common one, or popular one, it's called Snort, S-N-O-R-T, that you install on devices, you set it up, and it tries to detect intruders. They're not easy to set up, because we need to get some profile of what we expect. So they're hard to configure and to get right in terms of reducing the false positives and false negatives. It's complex. The last thing in this topic, sort of related, honeypots. What's a honeypot? It catches bees, doesn't it? Something to attract people to some location and keep them there and not let them go to do malicious things elsewhere. That's the idea. The honeypot, the bees go to the honeypot and therefore they don't come to you and sting you. They all hang around the honeypot.  So let's just briefly mention the honeypots but one or two slides, I think. So decoys, they are. They're designed to attract some malicious user, some potential attacker away from your real important systems. So you have some important servers, web servers, database servers, but you set up this honeypot server and make it such that when a malicious user tries to break into your network, it's highly likely that they'll go to the honeypot server because they think that's your important server and so therefore they don't go to your real important servers. Well, how can that help? Well, if they go to that honeypot server and maybe they think they've accessed important information but they really haven't, then maybe they stop attacking from now on and you can learn about the attacker's activity. So if they access this honeypot server, what do they do on it? What commands do they run? What files do they access once they're on this honeypot server and that helps you build up your profile of what an intruder does. And of course if you can encourage the attacker to be logged into that honeypot server for as long as possible, then maybe someone can respond. Again, make it easier to track that intruder. So a honeypot system may be filled with fake information. So normal users don't access it. So imagine SIT has a, we have a web server, an email server, a database server for finance and a database server for registration. They're our real servers. Then we set up a honeypot server that we put on some information that looks like it's information about registration information but it's fake information for fake students, fake grades and so on. And the idea is that when someone tries to intrude into SIT's network and access the grading information for students, they go to this fake honeypot server. They think they've got information so they go away but they haven't obtained anything confidential. So it has no value for the organization, the honeypot. And again, what are we saying here? Okay, so for this honeypot server, if there's packets going to this honeypot server, that is highly likely it's coming from an intruder because this honeypot server is set up that the normal users don't know about it and can't access it. So we have this special honeypot server for SIT. No one else in SIT uses it. There's no need to, they don't even know about it. Therefore, if someone accesses it, someone sends packets into the honeypot server, that's an indicator of an intruder because who else would be sending packets to this server that has no value? So incoming communications is most likely an indicator of someone scanning what's on your network as the prelude to an attack. So again, it's a trigger of a potential intruder. If this honeypot server starts sending packets out, that is packets have come in and then some reason they start sending out, then that means it's being compromised because it should not send out. It should be set up that this server doesn't send out, only if someone accesses it. And the only reason for someone to access it is if they're an intruder because normal users don't access it. So again, if we monitor the honeypot server, if we see packets coming into it, that's a trigger, someone's likely doing an attack on SIT. If we see packets going out of it, that's a trigger, someone's probably done an attack, they've compromised that honeypot server and again, that triggers, we've got an intruder. And if an intruder's within the network and on that honeypot server, then the people running the network can observe what they do to work out what are the flaws in our system. So let's say we run a honeypot server, so there's a set of servers here, there's a web server, DNS server, mail server and a honeypot server that looks like a server for registration, but it's not, it's a fake server. If packets get to this fake server and packets start going out, that suggests that it's been compromised and intruder has got in. And that tells us maybe there's a problem with our firewall because our firewall should have blocked that. So this is an indicator, well, we need to improve our firewall so that we block that. So maybe it indicates a flaw in the setup or the software on the firewall. So honeypots are used to keep people away from the real services and to learn about what intruders do. Oh, this is a better picture. Okay, our real servers, our internal network, several honeypots. One which is outside the firewall so that it's easy to access. So if someone accesses this one and then so they can compromise this, that suggests that for example the access control and the software on this server has flaws that someone can access unauthorized. But if someone can access this honeypot then it suggests there's a problem on this one and there's a problem with our firewall. Because the firewall, and again we haven't covered it yet, but a firewall should be set up to limit who can send packets into the network. They should only be able to send to the correct destinations. So if someone can access Honeypot 2, that's an indicator we've got a problem with our firewall here. Even worse if they access Honeypot 3, again a problem with a firewall because they can not only access publicly available computers, but internal computers as well. So it tells us about how good our network security is if someone accesses a honeypot. But that's all we want to say because I think you may hear about the terminology that's just a brief introduction. Intruders may be insiders or outsiders. It's harder to deal with insiders in many cases. But the intrusion detection systems can in some cases. The aim is to gain access to a computer system. Get access when you're not allowed access or to increase your privileges. That is to be able to do things that you're not authorized to do. How do you do that? Exploit flaws in software and flaws in people's behaviour. So some social engineering to get protected information. So we need intrusion detection. Some way to detect an intruder so that we can respond. And the concept is we need to be able to distinguish normal behaviour from the behaviour of an intruder and using profiles of the patterns and then look for something that's strange in what's happening, anomalies. We can do it on an individual host. So collect data on one host or even better, collect from multiple hosts. And we can collect data from network devices, packets going in. So intrusion detection software can in fact combine all of that. That is not just host-based or network-based, but a combination. Collect packets and collect activity on hosts. What are some issues? It's hard to achieve this trade-off of we want to make sure that we want a low number of false positives and low number of false negatives. So if there is a high false positive we effectively have a denial of service. If there's high false negatives that is if there's many intrusions that we don't detect then again our system is compromised. So dealing with that trade-off is difficult. And attackers once they know of how you're detecting them can change their behaviour to avoid that detection. We've talked about intrusion detection systems but how do we prevent intruders? So there's intrusion prevention systems which we're not covered. There's whole industries or companies that test networks. So penetration of networks. So people have a business of we will test the security of your network. We'll try and penetrate your network to see how good it is. Penetration testers. And if you do that without someone's permission it's usually illegal. Similar honeypots. The legality of honeypots is an issue. And of course in terms of algorithms how do you define normal and abnormal behaviour is an area to explore. But that's something for you to look at it if you're interested. Questions? To finish this topic. Any questions on intrusion detection? The concepts. Everything okay? You know how to detect intruders? No. But be aware of the different types. Those three different types. Be aware of what do we mean by anomaly and signatures and the way that we use profiles to detect. Another main concept here.


what's up everybody welcome back to sequence i'm your host trevor ploof and today we have another very special guest on the program he co-hosts of the starting nine podcast sideline reporter baseball analyst for mbc sports up in oakland and one of only 23 pitchers in the history of the damn game to go 27 up and 27 down my man dallas lee brayden what's up dude clovie how you doing brother i'm doing great i appreciate you coming on we've been talking for a little bit trying to get you on here and today uh ended up working out i want to ask you to like give us your pitch mix so pitch mix is four seamer two seamer cutter slider and a couple different change-ups you know and a screwball and i think it's important to to note this though the two seamer is something i would tell myself or i would call a sinker and that was because i mentally needed to trick myself into throwing a pitch that was going to get the result i was after and i i don't know that i could get that with a two seam fastball but you could get that with a sinker right so it's kind of how i would trick my i was lying to myself and and the slider the slider was so that i would continue to utilize fastball arm speed and fastball hand speed because if i would tell myself curveball i would slow everything down because i had a i had a i had a nice banger in high school and i i mean that's why i got drafted out of high school was because my curveball but that went away when i discovered the screwball in junior college i picked up a i picked up a ball and threw it into the net in juko and had a funky grip on it and was like whoa how did that happen what's the screwball grip is it a circle change is it a um no it's a uh i'm looking just hold tight let me get a fastball let me get a baseball screwball is not something you see too often uh but you gotta love that dallas is scrounging around looking for a ball he's got one there he's back all right so uh the the change up you know is more here yeah fourth team change up and then you can go with a two team change up as well start moving that guy around but then the screwball is getting getting on the inside of the baseball so with the middle finger are you prone any like that so not not until release so with the middle finger i'm pulling down and then with the index finger i'm pulling this seam as well and so at at release it's just a a flick of the wrist and then a manipulation of the fingers and that's what gets you that you know it's almost like a right-handed slider spin you get a dot and there's certain things that that you know i can do with the ball to bounce it on the ground or throw it up in the air to tell me that i'm getting the spin that i'm looking for all right let's let's get to the about i love that we're talking shop here i could talk baseball all damn all day dude all day and lately it's been we haven't had a lot of baseball talk about so this is nice um this is a game in 2009 and i believe i read that you're the a's opening day starter in 2009 is that correct true story yes i mean that's that's pretty awesome ask that first question ask the first question you want to ask how in the yeah i wasn't asked i wouldn't know like how did it come about justin duksher uh got hit by a bus and and that's how i know he he had uh he had hip surgery and for those who don't know who justin duksher is put some respect on that man's name look him up we're talking about an all-star starter all-star reliever the man did work okay and he did work from the right side you know below hitting speed which is not an easy task but he had some hip issues and that put me in a position barring my health to take the ball on opening day so that that's how that happened i mean nobody can ever take that away from me you know it's such an honor to start opening day even as a position player just getting in the lineup is awesome but to be a pitcher starting is really cool it's it's it's one of those feathers in the cat man no doubt so you uh here we're in texas which is a tough place to pitch already it's a launching pad this is the old texas we're going to see how the new uh stadium out there plays this year but this one was a launching pad and i was going through a bunch of the abes you're like locked in this april i don't know what the numbers were but you aren't missing many spots here in all the abets that i've seen yeah i'm uh early on you know texas being a division opponent as well and knowing what kind of lineup that i was facing early on especially earlier in my career those guys were it was a salty vet lineup knowing what the ballpark was going to play yes like and knowing what kind of stuff i did not have pluffy this lineup is stacked yeah that'd be our point man all right so here we go it's two outs we had the bottom of the third again we're facing michael young here let's start this video up check it out we're going to see a young baby a young baby dalis on the hill right there we got no hair no beard i don't know what you what do you got going is that a little a little goat yeah a little goat little goat piece a little goatee just a little this little bad baby goat and there's that bad man at the plate michael young and you can already see i mean it's the camera angle maybe but he's fucking angled right center yeah he's like hey look everything you're gonna throw right now i'm gonna i'm gonna take your second basement for a fucking ride out to out to that right gap that's gonna happen all right so first pitch here you're the kind of guy that can go anywhere um let's see what we got setting up then boom bang it down and then you like that call early in because now i've given myself the opportunity to expand away if i want to get him out away or i've allowed him to know hey i can come in here not only for a strike but i can come in here off if i need to as well just know that i've already told you that i'm present on the inside you know my game plan you know i'm gonna work away at some point in time but when do we get there how do we get there well let's find out what's what's cool about that you that mindset and i'm thinking now as a hater in the box it's like you think to yourself i don't really need to worry about in when i'm facing a guy uh like you because you're like i can react to the fastball but the truth of the matter is when you're expanding the zone like that now you're gonna you know open up the away side you're throwing the changeups you're maybe changing speeds on fastball that 86 to 89 plays up well and and against a guy like michael young his approach maybe my third bet or which is undoubtedly my third best pitch uh the slider i'm not going to lay that in there and try to throw a first pitch quality strike with that to him because that's soft coming to him lefty on righty and he that's going to be up and fat for him to you know maybe he wants to let it travel and really spin on it or maybe he wants to maybe he wants to shoot it the other way which he's really good at doing i don't want to give him that opportunity all right let's go second pitch here coming back inside right here huh yeah second pitch we're gonna double up oh that's a little slide piece huh yes yes trying to go now it's it's that's at 82 so that's a little i'm trying to cut the baseball just trying to work it in off see if i can get some kind of swing so now i see his feet move i like that as far as that ball kind of ended up off i think it was a good take by him because he kind of tunneled that last pitch the heater in with that slider in and unfortunately he saw it but a good pitch yeah well and that's why i say i like to see his feet move for me because now he's you know he's not necessarily buying into one of the other okay all right here we go so one one you can go anywhere here and looks like we are back and i love this right here with the slide step slide step heater we got guy on first base i think it's marlin bird um not too worried about him going anywhere but the idea there again staying hard because i know he knows i'm gonna throw a change at some point in time he's gonna get the change up so with a guy like michael young it's almost like i know he's already that one pitch ahead of me how do i utilize my next move to to almost make two moves in one where i catch up to him but then pass him as well in this chess game and i'm not going to give in to him and go soft no to hell with that i'm gonna stay hard i'm gonna make him a job because right now it looks like he's fighting off fighting off fighting off he's not ready or anticipating that fastball he's looking to adjust to something soft i agree you can totally see that um and i like that you said that like you could tell that he's late on the heat because he's he's he's looking for that change up word on speed pitch it's a defensive hack on a fastball against a guy who's throwing 86 87 i've been there buddy all right one two now now you you can open your bag of tricks at wherever you want to go but it looks like you're continuing to go inside here yeah this plays back into the yeah you're back oh you're getting booed got to control the running game some people like to say that they control the running game that's cute i eliminated the running mark burley is your guy mark burley that's a great example of that mark burley andy pettit oh yeah yeah so again want to want to keep it in the oh you gotta go back there hold i wasn't ready for that all right you got away with it so leading you saw that people leading up to this yeah one two we've stayed what hard three times right yes he hasn't seen that change up so in this count one two i'm going to go wrinkle here or do we not tell him go ahead yeah go ahead man they already saw it screws up one up so we're trying so we're trying to back foot it i i get away with a mistake here and in my change it no this is not a change okay roar let the people see i'm going to show you right now so you're going to see this you're going to see this slide piece this wow that was gross right that was below average at best look at this thing just a spinner up and and look at where he's he's almost like tied up with it he is you you jammed him tied him up with this slide piece right with an elevated just gross slide piece gross isn't not good it was not not good and it's because he sees it soft out of the hand and he's expecting that pitch right there to continue to fade armside he's not thinking that he's getting my third best pitch with two strikes there's no way he's getting my third best pitch with two strikes right so that's part of that that's part of me trying to stay one step ahead or having to make two moves to every one that he's making because he's so damn good so it's like all right i roll the dice here and try to back foot him with my third best pitch because worst case scenario if i execute he swings and misses or best case scenario for him if i've done my job still he fell he pulls us into felt right and we're still at one two and now i can try to heat him up inside still not giving in and giving him the soft stuff or now i make the decision to go my best versus your best right here right now and and that's what being able to execute with my third best pitch would have done for me but i mean there i get away with one so i don't have to continue in that sequence yes but those are the moves that ensue if i'm not able to get him out this is what you're talking about so right about here mike's picking up this ball and you're saying you guys have faced each other a ton before this yeah so he's expecting change up yes at some point yes right about here he's like okay this ball is gonna come it's gonna come down it's gonna fade away arm side and i'm gonna drive it to you know right field right center whatever it is but as we get here and you're gonna notice how he is tied up on this pitch right there yeah look at how far back look where the barrel's at he's not ready for that pitch it's tying him up like you said it's because i i think at that moment that you pause it where he processes that that is now starting to come to him it's you know he processes that it's soft and it's up and it's a and it's a way at the moment so his brain and his body tells him everything that's correct most of the time which is hammer this soft shit the other way but it just continued to spin just enough towards him where it tied him up and that i mean i got away with one i gotta love it you could you could tell he was just like uh-oh he's like what happened not to this guy well he recognized it way too late right there i mean which is a testament to the kind of how you set him up right there how you were hiding the ball and you tunneled some pitches he had no chance no so dallas you demand this this is a bat number one yes we're bringing it back on for a bat number two which is from a very special day in your career thank you for all the helpful tidbits the insight all the kids love this shit so you put on a masterclass there and how to pitch so we thank you yes yes i'll see you guys back for a bat number two


In this video I will define active and passive immunity and describe how vaccines work. Immunity refers to protection from a disease, specifically protection from a disease that is a disease caused by a specific pathogen. Immunity could be passive immunity or active immunity. Active immunity is acquired from another person or another animal. Passive immunity means that while that person is protected, it's usually just a temporary protection because the adaptive immune response of that individual has not become activated and they did not develop the memory to antigens associated with that pathogen. Whereas an active immunity involves activation of the adaptive immune system by exposure to the antigen. You could either have a naturally acquired or an artificially acquired form of immunity whether it's passive or active. In the top left here we see the example of naturally acquired passive immunity where antibodies from the mother are transferred to a newborn through breastfeeding. Antibodies are secreted into the milk and then those antibodies provide some passive immunity to the child. Antibodies also are transferred from the mother to the fetus during development across the placenta. And so while the child is immune to the diseases that the mother was immune to as a result of the antibodies that were passed from the mother to the child, that's only temporary and the child's immune system has not formed a memory of the antigens associated with those pathogens. And later that child will be susceptible to those pathogens. They'll only be protected as long as they have their mother's antibodies in their body. So similarly there's the artificially acquired passive immunity where you can receive an injection of antibodies or an injection of blood. This injection will come from another person or an animal that has been exposed to the pathogen and already developed immunity. And so the naturally acquired active immunity is what occurs when you're exposed to the pathogen and then you develop the illness that results from that pathogen and then over time you recover from the illness but your adaptive immunity has formed a memory by exposure to the antigens that are associated with that pathogen then when a second exposure occurs the adaptive immunity is prepared to protect you from that pathogen. And so an artificially acquired active immunity will also stimulate the adaptive immune response in order to protect an individual for a long time. Vaccination is the main form of artificially acquired active immunity and a vaccine is in a weakened or attenuated form of a pathogen or a vaccine could just be an inactivated form of the pathogen or just a part of the pathogen it could just be a subunit of the pathogen maybe a protein or RNA from that pathogen can then function as a vaccine and the benefit of vaccination is that it stimulates immunity without the person having to suffer the illness that results from infection thousands of years ago long before we had developed vaccination people realized that some of the individuals that survived smallpox would become immune to smallpox and this led to the practice of deliberately inoculating individuals in order to protect them this practice is known as variolation so variolation involved deliberately exposing individuals with the infectious material that comes from these scabs or pustules of smallpox victims and usually people who are exposed to smallpox through variolation would survive and only develop a mild infection and then end up developing immunity to smallpox as a result and this is why variolation was a practice that was used for thousands of years however this was a somewhat risky practice because some percentage of patients that were exposed to smallpox would have developed a severe smallpox infection and some of those patients would have died from smallpox and so variolation was a early form of artificially acquired immunity the physician Edward Jenner depicted in the painting here was the first person to develop a modern vaccine Jenner observed that milk maids the women who milked cows were protected from smallpox and there was another disease known as cowpox that the milk maids were commonly infected with that transferred from cows to the milk maids so Jenner hypothesized that it was exposure to the cowpox that was protecting milk maids from smallpox in order to test this hypothesis Jenner acquired some of the material from a cowpox infected milkmaid so then he injected the pus into a child this caused the child to develop cowpox or to develop a mild infection from the cowpox virus and then later Jenner came back and exposed this child to smallpox deliberately to test and see if he would develop smallpox fortunately this exposure to cowpox protected the child from smallpox the child did not develop smallpox and this then led to the development of the smallpox vaccine which was widely used throughout the world and has led to the eradication of the smallpox virus later Louis Pasteur worked to develop several more vaccines for rabies cholera and anthrax and following that several others have worked on developing vaccines for a wide variety of infectious diseases including chickenpox hepatitis measles mumps polio yellow fever diphtheria pneumonia certain form of pneumonia bacterial pneumonia tetanus whooping cough and HPV the human papillomavirus that causes cervical cancer and other forms of cancer and so vaccination has become one of the most affected one of the most effective techniques in order to reduce the spread of infectious disease and the great benefit of vaccination is that it stimulates the adaptive immunity without requiring a person to go through the illness that would result from a primary exposure to the pathogen so vaccination works similar to the exposure to the pathogen that would occur naturally however with vaccination you don't risk developing the illness from exposure to the vaccine the immune system will still respond to the antigen that is contained within the vaccine and this will stimulate the adaptive immune response producing memory B cells through the process of clonal selection as well as plasma cells that will secrete antibodies of course these antibodies are not really needed to protect against the vaccine during the primary response to the vaccine but the individual is then protected so that if they're exposed to the pathogen in the future they will have a secondary response that involves the memory B cells recognizing the antigen of that pathogen and then rapidly producing plasma cells that can secrete antibodies similarly vaccination can stimulate the cell mediated immunity activating T lymphocytes so exposure to the antigen in the form of a vaccine can activate the production of memory T cells and then upon subsequent exposure to the pathogen in a secondary immune response the memory T cells will be able to rapidly produce cytotoxic T cells that can defend against that infection by destroying infected cells throughout the body


Hey Marines! Today on Gunner's Underground, I'm going to demonstrate a field fix for an issue I know most of you have been having. Recently the Marine Corps went to the PMAG as the primary magazine. The new magazines did not fit properly into the magazine pouch, causing issues when trying to remove the magazine. All you need is two magazines, your magazine pouch, some type of a container for water, and some type of a spacer. What I found works best is two pens just because of the size of the pens and the space that you can get in between the magazines.   Then you will take whatever you're using as a spacer, whether it's a piece of wood or two pens, and slide it in between the two magazines. What that does is it stretches the fibers of the magazine pouch. Go ahead and close it up and then you're going to let your magazine pouch sit out in the sun to dry. What we talked about today is just a quick fix that can help make you more combat effective.