Search

In recent years, many organizations, companies and government agencies have been suffering from brutality of targeted attacks. Especially, destructive targeted attacks such as Shamoon and Samas have been causing significant damages on the targets' cyber assets, disputing their critical business operations. Since such attacks tend to access many hosts simultaneously, a rapid incident response is essential to prevent serious damages. To realize a rapid response, the responders need to locate all the victim hosts immediately after the first victim host raises a detection alarm. In this paper, we propose a novel method, called Suspicious Activity Spike Train (SAST) that locates potential attack victims by computing similarity between activity patterns of the detected first victim and the other hosts. SAST is based on the observation that the destructive targeted attack causes multiple hosts to perform similar types of suspicious activities synchronically. SAST employs spike trains that records when and which types of activities have been recently observed at each host, and then computes the trains' similarity at an abstract level. Thus, SAST is more robust than traditional indicators such as file hash values. Through the evaluation experiments with a real-world attack example, we demonstrate that immediately after the first victim is detected, SAST can locate all the victims in a testbed with a false positive rate of 0.4% before many victims' assets are tampered. Also, we show SAST is more effective than naive approaches which do not fully utilize features of the attack.

In recent years, the damage from cyber attacks caused by sophisticated malware has continuously increased. It is therefore becoming more difficult to take countermeasures using traditional approaches such as antivirus and firewall products. Against the intrusion of malware, we propose an automated countermeasure technology system named Autonomous Evolution of Defense, which mitigates the risk of actual damage by controlling the internet connection for malware, and in addition optimizes the system's operating conditions. The system takes countermeasures immediately to mitigate risk without causing disruptive effects on business. However, a graylist of malicious addresses generated by malware analysis systems contains many false-positive addresses and is very "noisy" for use in blocking access based on the list. We therefore propose a new technique for improving the accuracy of the unreliable graylist of addresses using image authentication. We report here on the implementation of our system and results of evaluation.

Real-time streaming services are attracting attention. However, an adversary can compromise the safety of these services in ways such as data tampering, spoofing, and repudiation. In this paper we propose a real-time Stream Authentication scheme for Video streams called SAVe. Each packet in the stream is authenticated to correspond to the packet loss seen in UDP-based streaming. The amount of redundancy distributed to each frame is also adjusted according to the importance of each frame, to take account of the special characteristics of video such as differences in importance of and dependencies between frames. Since temporal and spatial compression techniques are adopted for video stream encoding, SAVe is efficient in terms of making important frames robust to packet loss. The simulation results show that the authentication rate is on average approximately equivalent to that of previously proposed schemes. An improvement of 50% in the playing rate over previously proposed schemes can be seen when the packet loss rate is 20%.

With the increasing number of new malware programs, traditional malware detection approaches depending on signature files have been less effective, as it is quite difficult for anti-virus vendors to keep up with the frequent appearance of new malware programs. To address this problem, a system called Anti-malware User Support System, which detects malware files using dynamic analysis and remove them from user PCs, is developed. In this paper, we model this system as a queuing network model. Then, using this model, we evaluate the performance of Anti-malware User Support System against the large scale malware epidemics.

As P2P (Peer-to-Peer) file sharing software is widely deployed, it causes some serious problems, such as network traffic congestion, unwanted file sharing by computer viruses that abuse P2P software, and so on. Detecting and controlling traffic of P2P software is an important issue to solve these problems. In this paper, we propose a basic architecture to observe large-scale network traffic, identify the P2P traffic and control them. This architecture consists of four units, the observation unit, the analysis unit, the control unit and the managing unit. We evaluate the architecture using lOGbps full duplex traffic, and demonstrate that this system can control the P2P traffic properly.

Most of existing network worms have used address scanning to find vulnerable hosts. Recently, however, worms with more effective propagation strategies have emerged. Among the worms, we focus on the worms that exploit address lists obtained from infected hosts to find other vulnerable hosts effectively. In this paper, we propose a method to detect and contain such worms that try to infect all hosts in an enterprise network. In our method, a detection system inserts some dummy addresses into the address lists of hosts in the network. Then, the system detects the existence of worms when a host tries to open a connection to a dummy address, and then traces back the connection logs to find potentially infected hosts and removes them from the network. Computer simulation results showed our method detected and contained worms with less than 1% infected hosts and less than 5% removed hosts.

One of problems with mobile networks is that malicious users can enter networks and launch attacks from the networks. To tackle the issues, in this paper, we propose the MSP-system: Mobile Secure Passport System. The objective of the MSP-system is to detect malicious mobile users and to prevent them from participating in mobile networks. The MSP-system is consisted of the MSP (Mobile Secure Passport) and the MSP-gateway. The MSP, which is a secure mobile device, preserves users' history information. The MSP-gateway detects malicious users by checking the history information about network activities when users try to log into networks. Thus, the MSP-system can prevent malicious users from attacking in mobile networks. Through simulation experiments, we have confirmed the effectiveness of the MSP-system.

In this paper we propose a worm detection method that detects silent worms effectively in intranet and LANs. Most existing detection methods use aggressive activities of worms as a clue for detection and are ineffective against worms that propagate silently using a list of vulnerable hosts. To detect such worms, we propose anomaly connection tree method (ACTM). ACTM uses two features present to most worms. First is that the worms's propagation behaviour is expressed as tree-like structures composed of infection connections as edges. Second is that when selecting infection targets, the worm does not consider which hosts its infected host communicates to frequently. Then, by detecting composed of anomaly connections, ACTM detects the existence of worms. Through the simulation results, it has been shown that ACTM can detect the worms in an early stage of the propagation activities.

This paper proposes a distributed network based worm detection method, d-ACTM, to detect a kind of hit-list worm named Silent worm. The worm propagation behavior in the network is expressed as a tree-like structure composed of the infected hosts and the infection connections. d-ACTM detects the existence of worms by detecting the tree structures composed of anomaly connections in a distributed manner. The simulation result shows that d-ACTM can detect Silent worms before 7% of all vulnerable hosts are infected under the condition where the infection interval is equals to the normal connection interval.

In this paper, we propose SAVe, a real-time stream authentication scheme for video streams. Each packet in the stream is authenticated to correspond to packet loss seen in UDP-based streaming. Since temporal and spatial compression techniques are adopted for video stream encoding, there are differences in the importance and dependencies between frames. Therefore, to take the characteristics special to video into consideration, in SAVe the amount of redundancy distributed to each frame is adjusted according to the importance of each frame. Simulation results show that SAVe improves the playing rate 50% compared to previously proposed schemes

In this paper, an efficient log authentication scheme for forensic computing is proposed. To conduct reliable forensic computing, it is required that the logs as digital evidences be verified. To verify them, digital signatures issued by authorities are needed. However, if many logging hosts connect to the server that issues the signatures, the traffic of the server will increase. Therefore, the authors proposed an efficient log authentication scheme for forensic computing. The scheme reduces the traffic of the sign server, which signs the logs of the logging hosts, by using distributed Merkle tree algorithm among the logging hosts. The scheme's effectiveness was shown through evaluation experiments.

In this paper, we propose a secure logging scheme for Forensic Computing. Forensic Computing is the process conducted to identify the method of an attack and intruders in the case of system compromise. In Forensic Computing, trustworthy logs admissible for court are needed. Moreover, since the log contains various confidential information, the confidentiality of the log must be preserved. Our scheme achieves the integrity of logs and fine-grained access control for logs with small overhead size using the signature tree and Forward Integrity.

In this paper, we propose an authentication scheme considering privacy aimed for JPEG images. A picture from a surveillance camera must be authenticated when submitted to a third party, such as a legal organization, courts and so on. On one hand, privacy of objects in the picture must be considered. Therefore, mosaic and masking must be performed to the picture if needed. Our scheme authenticate JPEG picture, where parts are processed by mosaic and masking. Our scheme uses Merkle tree and Sandhu tree and achieves small overhead size needed to authenticate the processed picture.