Details of a Researcher

Papers - Sasase, Iwao

Division display 1 - 20 of about 588 ／ All the affair displays >>

Rogue Access Point Detection by Using ARP Failure under the MAC Address Duplication

Igarashi K., Kato H., Sasase I.

IEEE International Symposium on Personal, Indoor and Mobile Radio Communications, PIMRC （IEEE International Symposium on Personal, Indoor and Mobile Radio Communications, PIMRC) 2021-September 1469 - 1474 2021.09

ISSN 9781728175867

Detecting a Rogue Access Point (RAP) in Wi-Fi network is imperative. The previous scheme is user side detection focusing on two channels used by a RAP. That scheme can detect a RAP in stable traffic environment by revealing the channel used with a Legitimate Access Point (LAP) with intentional interference. However, the detection performance is degraded in the real environment where traffic is more unstable because it affects the traffic on the channel. Thus, it is necessary to design the scheme which is independent of such factors. In this paper, we propose RAP detection by using Address Resolution Protocol (ARP) failure under the Media Access Control (MAC) address duplication. Our main idea is that the traffic is relayed via a RAP and a LAP on the LAN path between a client and a gateway under the attack. This is because the RAP must be established between a client and a LAP to provide Internet connection. On the basis of this idea, the proposed scheme reveals that the Access Point (AP) with which a client connects is a RAP by discovering the MAC address of a LAP on the path. In order to find the MAC address, we leverage the phenomenon that a client cannot receive ARP reply packets in the situation where its MAC address and that of a AP are duplicated on the path. By doing this, the presence of a LAP is revealed, which can judge that the connected AP is a RAP. In our evaluation, the proposed scheme achieves accuracy of 96.5% even in unstable traffic environment. True positive rate and false positive rate are 31.0% higher and 9.0% lower than the previous scheme. Furthermore, the proposed scheme can detect RAPs accurately in real environment where the previous scheme cannot.

Access to Document (DOI)

An energy-efficient defense against message flooding attacks in delay tolerant networks

ASAHINA H., ARAI K., HARUTA S., MATHIOPOULOS P.T., SASASE I.

IEICE Transactions on Communications （IEICE Transactions on Communications) E104.B （ 4 ） 348 - 359 2021.04

ISSN 09168516

Delay Tolerant Networks (DTNs) are vulnerable to message flooding attacks in which a very large number of malicious messages are sent so that network resources are depleted. To address this problem, previous studies mainly focused on constraining the number of messages that nodes can generate per time slot by allowing nodes to monitor the other nodes' communication history. Since the adversaries may hide their attacks by claiming a false history, nodes exchange their communication histories and detect an attacker who has presented an inconsistent communication history. However, this approach increases node energy consumption since the number of communication histories increases every time a node communicates with another node. To deal with this problem, in this paper, we propose an energy-efficient defense against such message flooding attacks. The main idea of the proposed scheme is to time limit the communication history exchange so as to reduce the volume while ensuring the effective detection of inconsistencies. The advantage of this approach is that, by removing communication histories after they have revealed such inconsistencies, the energy consumption is reduced. To estimate such expiration time, analytical expressions based upon a Markov chain based message propagation model, are derived for the probability that a communication history reveals such inconsistency in an arbitrary time. Extensive performance evaluation results obtained by means of computer simulations and several performance criteria verify that the proposed scheme successfully improves the overall energy efficiency. For example, these performance results have shown that, as compared to other previously known defenses against message flooding attacks, the proposed scheme extends by at least 22% the battery lifetime of DTN nodes, while maintaining the same levels of protection.

Access to Document (DOI)

Indoor crowd estimation scheme using the number of Wi-Fi probe requests under MAC address randomization

Furuya Y., Asahina H., Yoshida M., Sasase I.

IEICE Transactions on Information and Systems （IEICE Transactions on Information and Systems) E104D （ 9 ） 1420 - 1426 2021

ISSN 09168532

As smartphones have become widespread in the past decade, Wi-Fi signal-based crowd estimation schemes are receiving increased attention. These estimation schemes count the number of unique MAC addresses in Wi-Fi signals, hereafter called probe requests (PRs), instead of counting the number of people. However, these estimation schemes have low accuracy of crowd estimation under MAC address randomization that replaces a unique MAC address with various dummy MAC addresses. To solve this problem, in this paper, we propose an indoor crowd estimation scheme using the number of PRs under MAC address randomization. The main idea of the proposed scheme is to leverage the fact that the number of PRs per a unit of time changes in proportion to the number of smartphones. Since a smartphone tends to send a constant number of PRs per a unit of time, the proposed scheme can estimate the accurate number of smartphones. Various experiment results show that the proposed scheme reduces estimation error by at most 75% compared to the conventional Wi-Fi signal-based crowd estimation scheme in an indoor environment.

Access to Document (DOI)

Android Malware Detection Based on Composition Ratio of Permission Pairs

Kato H., Sasaki T., Sasase I.

IEEE Access （IEEE Access) 9 130006 - 130019 2021

Detecting Android malware is imperative. Among various detection schemes, permission pair based ones are promising for practical detection. However, conventional schemes cannot simultaneously meet requirements for practical use in terms of efficiency, intelligibility, and stability of detection performance. Although the latest scheme relies on differences of frequent pairs between benign apps and malware, it cannot meet the stability. This is because recent malware tends to require unnecessary permissions to imitate benign apps, which makes using the frequencies ineffective. To meet all the requirements, in this paper, we propose Android malware detection based on a Composition Ratio (CR) of permission pairs. We define the CR as a ratio of a permission pair to all pairs in an app. We focus on the fact that the CR tends to be small in malware because of unnecessary permissions. To obtain features without using the frequencies, we construct databases about the CR. For each app, we calculate similarity scores based on the databases. Finally, eight scores are fed into machine learning (ML) based classifiers as features. By doing this, stable performance can be achieved. Since our features are just eight-dimensional, the proposed scheme takes less training time and is compatible with other ML based schemes. Furthermore, our features can quantitatively offer clear information that helps human to understand detection results. Our scheme is suitable for practical use because all the requirements can be met. By using real datasets, our results show that our scheme can detect malware with up to 97.3% accuracy. Besides, compared with an existing scheme, our scheme can reduce the feature dimensions by about 99% with maintaining comparable accuracy on recent datasets.

Access to Document (DOI)

A scheduling scheme for autonomous vehicle highway merging with an outflow traffic and fairness analysis

Kunibe M., Asahina H., Shigeno H., Sasase I.

IEEE Access （IEEE Access) 9 49219 - 49232 2021

Recently, vehicle-to-infrastructure (V2I) communication-based scheduling schemes for connected and automated vehicles (CAVs) on highway on-ramps have received attention because the schemes assign optimal merging times to CAVs based on their criteria, such as first-in first-out order or minimizing CAV total travel time. However, these schemes cause traffic congestion due to the criteria when the vehicle inflow traffic becomes high. To mitigate traffic congestion, a scheduling scheme should assign merging times to CAVs to decrease road vehicle density. In this paper, we propose a scheduling scheme for autonomous vehicle highway merging with an outflow traffic and fairness analysis. We formulate a multiobjective function that achieves both outflow traffic maximization and fairness in assigned merging times. Since more vehicles pass a highway on-ramp as highway on-ramp outflow traffic increases, the proposed scheme decreases vehicle density on roads by maximizing the outflow traffic. Furthermore, the proposed scheme distributes the vehicle density on both the main and ramp roads by fairly assigning their merging times. Simulation results show that the proposed scheme mitigates the potential traffic congestion of previous scheduling schemes. Furthermore, the proposed scheme improves outflow traffic from highway on-ramps by more than 200 veh/h compared with the previous scheduling schemes.

Access to Document (DOI)

A lightweight detection using bloom filter against flooding DDOS attack

Choi S., An Y., Sasase I.

IEICE Transactions on Information and Systems （IEICE Transactions on Information and Systems) E103D （ 12 ） 2600 - 2610 2020.12

ISSN 09168532

The flooding DDoS attack is a serious problem these days. In order to detect the flooding DDoS attack, the survival approaches and the mitigation approaches have been investigated. Since the survival approach occurs the burden on the victims, the mitigation approach is mainly studied. As for the mitigation approaches, to detect the flooding DDoS attack, the conventional schemes using the bloom filter, machine learning, and pattern analyzation have been investigated. However, those schemes are not effective to ensure the high accuracy (ACC), the high true positive rate (TPR), and the low false positive rate (FPR). In addition, the data size and calculation time are high. Moreover, the performance is not effective from the fluctuant attack packet per second (pps). In order to effectively detect the flooding DDoS attack, we propose the lightweight detection using bloom filter against flooding DDoS attack. To detect the flooding DDoS attack and ensure the high accuracy, the high true positive rate, and the low false positive rate, the dec-all (decrement-all) operation and the checkpoint are flexibly changed from the fluctuant pps in the bloom filter. Since we only consider the IP address, all kinds of flooding attacks can be detected without the blacklist and whitelist. Moreover, there is no complexity to recognize the attack. By the computer simulation with the datasets, we show our scheme achieves an accuracy of 97.5%. True positive rate and false positive rate show 97.8% and 6.3%, respectively. The data size for processing is much small as 280bytes. Furthermore, our scheme can detect the flooding DDoS attack at once in 11.1sec calculation time.

Access to Document (DOI)

A Preprocessing Methodology by Using Additional Steganography on CNN-based Steganalysis

Kato H., Osuge K., Haruta S., Sasase I.

2020 IEEE Global Communications Conference, GLOBECOM 2020 - Proceedings （2020 IEEE Global Communications Conference, GLOBECOM 2020 - Proceedings) 2020.12

ISSN 9781728182988

There exists a need of 'image steganalysis' which reveals whether steganographic signals are embedded in an image to improve information security. Among various steganalysis, Convolutional Neural Networks (CNN) based steganalysis is promising since it can automatically learn the features of diverse steganographic algorithms. However, we discover the detection performance of CNN is degraded when an image is intentionally reduced by the nearest-neighbor interpolation before steganography. This is because spatial frequency in a reduced image gets high, which disturbs the training. In order to overcome this shortcoming, in this paper, we propose a preprocessing methodology by using additional steganography on CNN-based steganalysis. In the proposed preprocessing, steganographic signals are additionally embedded into both reduced original images and reduced steganographic ones since a difference of spatial frequencies between them gets obvious, which helps CNN learn features. Whenever reduced images are trained in CNN or inspected whether they are steganographic ones or not, steganography is applied to them once by the proposed preprocessing. Thus, an image is regarded as a steganographic one if the trained model judges steganography is applied to it twice; otherwise it is an original one. Since the proposed methodology is very simple, its computational cost is low. Our evaluation shows accuracy in a model with the proposed preprocessing is 10.6% higher than that in the conventional one. Besides, even in the situation where another steganography is additionally embedded, the proposed preprocessing yields 7% higher accuracy compared with the conventional one.

Access to Document (DOI)

A Scheduling Scheme for Cooperative Merging at a Highway On-Ramp with Maximizing Average Speed of Automated Vehicles

Yoshida M., Asahina H., Shigeno H., Sasase I.

IEEE Vehicular Technology Conference （IEEE Vehicular Technology Conference) 2020-November 2020.11

ISSN 9781728194844

Recently, connected and automated vehicles have potential to mitigate traffic congestion and improve traffic efficiency at a highway on-ramp. Especially, vehicle to infrastructure communication based scheduling schemes are paid attention because a central control server can assign merging timing to automated vehicles to improve traffic efficiency on whole roads. Although several schemes calculate merging timing based on their criteria, these schemes cause traffic congestion when inflow traffic becomes high. In order to solve this problem, it is necessary to schedule merging timing of vehicles such that density of vehicles decreases on whole roads. In this paper, we propose a scheduling scheme for cooperative merging at a highway on-ramp with maximizing average speed of automated vehicles. The main idea of the proposed scheme is to utilize the traffic model that density and speed of vehicles have a negative correlation. By utilizing the traffic model, the proposed scheme preferentially assigns merging timing to vehicles which are on a congested road by maximizing average speed of all vehicles on whole roads. Simulation result shows that the proposed scheme decreases density of vehicles on whole roads even if inflow traffic becomes high. Furthermore, the proposed scheme improves outflow traffic from a highway on-ramp by 400 (veh/h) at most in comparison with related schemes.

Access to Document (DOI)

A Server-Based Distributed Storage Using Secret Sharing with AES-256 for Lightweight Safety Restoration

Choi S., Haruta S., An Y., Sasase I.

IEICE Transactions on Information and Systems （IEICE Transactions on Information and Systems) E103D （ 7 ） 1647 - 1659 2020.07

ISSN 09168532

Copyright © 2020 The Institute of Electronics, Information and Communication Engineers. Since the owner's data might be leaked from the centralized server storage, the distributed storage schemes with the server storage have been investigated. To ensure the owner's data in those schemes, they use Reed Solomon code. However, those schemes occur the burden of data capacity since the parity data are increased by how much the disconnected data can be restored. Moreover, the calculation time for the restoration will be higher since many parity data are needed to restore the disconnected data. In order to reduce the burden of data capacity and the calculation time, we proposed the server-based distributed storage using Secret Sharing with AES-256 for lightweight safety restoration. Although we use Secret Sharing, the owner's data will be safely kept in the distributed storage since all of the divided data are divided into two pieces with the AES-256 and stored in the peer storage and the server storage. Even though the server storage keeps the divided data, the server and the peer storages might know the pair of divided data via Secret Sharing, the owner's data are secure in the proposed scheme from the inner attack of Secret Sharing. Furthermore, the owner's data can be restored by a few parity data. The evaluations show that our proposed scheme is improved for lightweight, stability, and safety.

Access to Document (DOI)

RPL-based tree construction scheme for target-specific code dissemination in wireless sensors networks

Asahina H., Toyoda K., Mathiopoulos P.T., Sasase I., Yamamoto H.

IEICE Transactions on Communications （IEICE Transactions on Communications) E103B （ 3 ） 190 - 199 2020

ISSN 09168516

© 2020 The Institute of Electronics. Distributing codes to specific target sensors in order to fix bugs and/or install a new application is an important management task in WSNs (Wireless Sensor Networks). For the energy efficient dissemination of such codes to specific target sensors, it is required to select the minimum required number of forwarders with the fewest control messages. In this paper, we propose a novel RPL (Routing Protocol for Low-power and lossy networks)-based tree construction scheme for target-specific code dissemination, which is called R-TCS. The main idea of R-TCS is that by leveraging the data collection tree created by a standard routing protocol RPL, it is possible to construct the code dissemination tree with the minimum numbers of non-target sensors and control messages. Since by creating a data collection tree each sensor exchanges RPL messages with the root of the tree, every sensor knows which sensors compose its upwards route, i.e. the route towards the root, and downwards route, i.e. the route towards the leaves. Because of these properties, a target sensor can select the upward route that contains the minimum number of non-target sensors. In addition, a sensor whose downward routes do not contain a target sensor is not required to transmit redundant control messages which are related to the code dissemination operation. In this way, R-TCS can reduce the energy consumption which typically happens in other target-specific code dissemination schemes by the transmission of control messages. In fact, various performance evaluation results obtained by means of computer simulations show that R-TCS reduces by at least 50% energy consumption as compared to the other previous known target-specific code dissemination scheme under the condition where ratio of target sensors is 10% of all sensors.

Access to Document (DOI)

Android malware detection scheme based on level of SSL server certificate

Kato H., Haruta S., Sasase I.

IEICE Transactions on Information and Systems （IEICE Transactions on Information and Systems) E103D （ 2 ） 379 - 389 2020

ISSN 09168532

Copyright © 2020 The Institute of Electronics, Information and Communication Engineers. Detecting Android malwares is imperative. As a promising Android malware detection scheme, we focus on the scheme leveraging the differences of traffic patterns between benign apps and malwares. Those differences can be captured even if the packet is encrypted. However, since such features are just statistic based ones, they cannot identify whether each traffic is malicious. Thus, it is necessary to design the scheme which is applicable to encrypted traffic data and supports identification of malicious traffic. In this paper, we propose an Android malware detection scheme based on level of SSL server certificate. Attackers tend to use an untrusted certificate to encrypt malicious payloads in many cases because passing rigorous examination is required to get a trusted certificate. Thus, we utilize SSL server certificate based features for detection since their certificates tend to be untrusted. Furthermore, in order to obtain the more exact features, we introduce required permission based weight values because malwares inevitably require permissions regarding malicious actions. By computer simulation with real dataset, we show our scheme achieves an accuracy of 92.7%. True positive rate and false positive rate are 5.6% higher and 3.2% lower than the previous scheme, respectively. Our scheme can cope with encrypted malicious payloads and 89 malwares which are not detected by the previous scheme.

Access to Document (DOI)

Traffic Feature-Based Botnet Detection Scheme Emphasizing the Importance of Long Patterns

An Y., Haruta S., Choi S., Sasase I.

Advances in Intelligent Systems and Computing （Advances in Intelligent Systems and Computing) 1062 181 - 188 2020

ISSN 9783030312534

© 2020, Springer Nature Switzerland AG. The botnet detection is imperative. Among several detection schemes, the promising one uses the communication sequences. The main idea of that scheme is that the communication sequences represent special feature since they are controlled by programs. That sequence is tokenized to truncated sequences by n-gram and the numbers of each pattern’s occurrence are used as a feature vector. However, although the features are normalized by the total number of all patterns’ occurrences, the number of occurrences in larger n are less than those of smaller n. That is, regardless of the value of n, the previous scheme normalizes it by the total number of all patterns’ occurrences. As a result, normalized long patterns’ features become very small value and are hidden by others. In order to overcome this shortcoming, in this paper, we propose a traffic feature-based botnet detection scheme emphasizing the importance of long patterns. We realize the emphasizing by two ideas. The first idea is normalizing occurrences by the total number of occurrences in each n instead of the total number of all patterns’ occurrences. By doing this, smaller occurrences in larger n are normalized by smaller values and the feature becomes more balanced with larger value. The second idea is giving weights to the normalized features by calculating ranks of the normalized feature. By weighting features according to the ranks, we can get more outstanding features of longer patterns. By the computer simulation with real dataset, we show the effectiveness of our scheme.

Access to Document (DOI)

A preprocessing by using multiple steganography for intentional image downsampling on CNN-based steganalysis

Kato H., Osuge K., Haruta S., Sasase I.

IEEE Access （IEEE Access) 8 195578 - 195593 2020

There exists a need of ‘‘image steganalysis’’ which reveals whether steganographic signals are embedded in an image to improve information security. Among various steganalysis, Convolutional Neural Networks (CNN) based steganalysis is promising since it can automatically learn the features of diverse steganographic algorithms. However, the detection performance of CNN is degraded when an image is intentionally resized by the nearest-neighbor interpolation before steganography. This is because spatial frequency in a resized image gets high, which disturbs the training. In order to overcome this shortcoming, in this article, we propose a preprocessing by using multiple steganography for intentional image downsampling on CNN-based steganalysis. In the proposed preprocessing, steganographic signals are additionally embedded into both resized original images and resized steganographic ones with the same embedding key since difference of spatial frequencies between them gets obvious, which helps CNN learn features. The reason why the difference gets obvious is that steganographic signals tend to be continuously embedded into same pixels in resized images when they are additionally embedded. Thus, by training resized images after the proposed preprocessing, the detection performance can be improved. Since the proposed preprocessing is very simple, it does not greatly increase the training time of CNN. Our evaluation shows accuracy in a model with the proposed preprocessing is up to 34.8% higher than that in the conventional model when the same steganography is additionally embedded. Besides, we also show that the proposed preprocessing yields up to 23.1% higher accuracy compared with the conventional one even when another steganography is additionally embedded.

Access to Document (DOI)

Android malware detection scheme based on level of SSL server certificate

Kato H., Haruta S., Sasase I.

2019 IEEE Global Communications Conference, GLOBECOM 2019 - Proceedings （2019 IEEE Global Communications Conference, GLOBECOM 2019 - Proceedings) 2019.12

ISSN 9781728109626

© 2019 IEEE. Detecting Android malware is imperative. As a promising Android malware detection scheme, we focus on the scheme leveraging the differences of traffic patterns between benign apps and malware. Those differences can be captured even if the packet is encrypted. However, since such features are just statistic based ones, they cannot identify whether each traffic is malicious. Thus, it is necessary to design the scheme which is applicable to encrypted traffic data and supports identification of malicious traffic. In this paper, we propose an Android malware detection scheme based on the level of SSL server certificate. Attackers tend to use an untrusted certificate to encrypt malicious payloads in many cases because passing rigorous examination is required to get a trusted certificate. Thus, we utilize SSL server certificate based features for detection since their certificates tend to be untrusted. Furthermore, in order to obtain the more exact features, we introduce required permission based weight values because malware inevitably require permissions regarding malicious actions. By computer simulation with real dataset, we show our scheme achieves an accuracy of 92.7 %. True positive rate and false positive rate are 5.6% higher and 3.3% lower than the previous scheme, respectively. Our scheme can cope with encrypted malicious payloads and 89 malware which are not detected by the previous scheme.

Access to Document (DOI)

Trust-based verification attack prevention scheme using tendency of contents request on NDN

Nakano H., Kato H., Haruta S., Yoshida M., Sasase I.

Proceedings of 2019 25th Asia-Pacific Conference on Communications, APCC 2019 （Proceedings of 2019 25th Asia-Pacific Conference on Communications, APCC 2019) 159 - 164 2019.11

ISSN 9781728136790

© 2019 IEEE. To realize content distribution, NDN (Named Data Networking) is gathering attention. Since NDN is vulnerable to spreading fake contents, router based verification schemes are proposed to solve this problem. However, routers are vulnerable to the attack which puts a burden to them by verification of contents (verification attack). In order to detect it, the scheme leveraging the fact that the number of the request of unverified contents and the verification of them increase under the attack is proposed. While verification attack can be detected by that scheme, the attack has already occurred. In order to detect the attack before it occurs, in this paper, we propose a trust-based verification attack prevention scheme using tendency of contents request on NDN. We focus on the fact that the access interval to unverified contents tends to be short dramatically just before verification attack occurs. By leveraging this fact, the router determines that verification attack has occurred and restricts requests of all users temporarily. However, in this case, it is impossible to identify attackers, and the requests of legitimate users are also restricted. Therefore, we focus on the fact that legitimate users tend not to request contents in a cache in many cases. Meanwhile, in order to conduct verification attack, attackers need to request such contents for a short time. By giving low trust value to users requesting these contents, a router can identify attackers and restrict only attackers' requests. Our evaluation results show our scheme can detect verification attack before the attack. Furthermore, we clearly demonstrate that our scheme can restrict only attackers' requests.

Access to Document (DOI)

A novel visual similarity-based phishing detection scheme using hue information with auto updating database

Haruta S., Yamazaki F., Asahina H., Sasase I.

Proceedings of 2019 25th Asia-Pacific Conference on Communications, APCC 2019 （Proceedings of 2019 25th Asia-Pacific Conference on Communications, APCC 2019) 280 - 285 2019.11

ISSN 9781728136790

© 2019 IEEE. In this paper, we propose a novel visual similarity-based phishing detection scheme using hue information with auto updating database. Since a PWS (Phishing Website) is created based on targeted legitimate website or other subspecies whose hue information is similar each other, many PWSs can be exhaustively detected by tracing similar colored subspecies. Based on this notion, the proposed scheme detects a new PWS which has similar hue information to already detected PWSs. By repeating this procedure, the detection scope can be effectively expanded. In order to avoid the misdetection of legitimate websites which have similar hue information to database's ones, the proposed scheme utilizes the fact that the combination of used colors is hard to be similar among legitimate websites and PWSs. By the computer simulation with real dataset, we demonstrate that the proposed scheme improves the detection performance as the number of detected PWSs increases.

Access to Document (DOI)

Low-complexity joint antenna and user selection scheme for the downlink multiuser massive MIMO system with complexity reduction factors

Aye Mon Htun, Maung Sann Maw and Iwao Sasase

IEICE Trans. on Communications （IEICE) E102B （ 3 ） 592 - 602 2019.03

Research paper (scientific journal), Joint Work, Accepted, ISSN 09168516

Copyright © 2019 The Institute of Electronics, Information and Communication Engineers. Multiuser massive multi-input multi-output (MU massive MIMO) is considered as a promising technology for the fifth generation (5G) of the wireless communication system. In this paper, we propose a low-complexity joint antenna and user selection scheme with block diagonalization (BD) precoding for MU massive MIMO downlink channel in the time division duplex (TDD) system. The base station (BS) is equipped with a large-scale transmit antenna array while each user is using the single receive antenna in the system. To reduce the hardware cost, BS will be implemented by limited number of radio frequency (RF) chains and BS must activate some selected transmit antennas in the BS side for data transmitting and some users’ receive antennas in user side for data receiving. To achieve the reduction in the computation complexity in the antenna and user selection while maintaining the same or higher sum-rate in the system, the proposed scheme relies on three complexity reduction key factors. The first key factor is that finding the average channel gains for the transmit antenna in the BS side and the receive antenna in the user side to select the best channel gain antennas and users. The second key factor called the complexity control factor ξ(Xi) for the antenna set and the user set limitation is used to control the complexity of the brute force search. The third one is that using the assumption of the point-to-point deterministic MIMO channel model to avoid the singular value decomposition (SVD) computation in the brute force search. We show that the proposed scheme offers enormous reduction in the computation complexity while ensuring the acceptable performance in terms of total system sum-rate compared with optimal and other conventional schemes.

Access to Document (DOI)

Hue signature auto update system for visual similarity-based phishing detection with tolerance to zero-day attack

Haruta S., Asahina H., Yamazaki F., Sasase I.

IEICE Transactions on Information and Systems （IEICE Transactions on Information and Systems) E102D （ 12 ） 2461 - 2471 2019

ISSN 09168532

Copyright c 2019 The Institute of Electronics, Information and Communication Engineers Detecting phishing websites is imperative. Among several detection schemes, the promising ones are the visual similarity-based approaches. In those, targeted legitimate website’s visual features referred to as signatures are stored in SDB (Signature Database) by the system administrator. They can only detect phishing websites whose signatures are highly similar to SDB’s one. Thus, the system administrator has to register multiple signatures to detect various phishing websites and that cost is very high. This incurs the vulnerability of zero-day phishing attack. In order to address this issue, an auto signature update mechanism is needed. The naive way of auto updating SDB is expanding the scope of detection by adding detected phishing website’s signature to SDB. However, the previous approaches are not suitable for auto updating since their similarity can be highly different among targeted legitimate website and subspecies of phishing website targeting that legitimate website. Furthermore, the previous signatures can be easily manipulated by attackers. In order to overcome the problems mentioned above, in this paper, we propose a hue signature auto update system for visual similarity-based phishing detection with tolerance to zero-day attack. The phishing websites targeting certain legitimate website tend to use the targeted website’s theme color to deceive users. In other words, the users can easily distinguish phishing website if it has highly different hue information from targeted legitimate one (e.g. red colored Facebook is suspicious). Thus, the hue signature has a common feature among the targeted legitimate website and subspecies of phishing websites, and it is difficult for attackers to change it. Based on this notion, we argue that the hue signature fulfills the requirements about auto updating SDB and robustness for attackers’ manipulating. This commonness can effectively expand the scope of detection when auto updating is applied to the hue signature. By the computer simulation with a real dataset, we demonstrate that our system achieves high detection performance compared with the previous scheme.

Access to Document (DOI)

An effective feature selection scheme for android ICC-based malware detection using the gap of the appearance ratio

Osuge K., Kato H., Haruta S., Sasase I.

IEICE Transactions on Information and Systems （IEICE Transactions on Information and Systems) E102D （ 6 ） 1136 - 1144 2019

ISSN 09168532

Copyright © 2019 The Institute of Electronics, Information and Communication Engineers. Android malwares are rapidly becoming a potential threat to users. Among several Android malware detection schemes, the scheme using Inter-Component Communication (ICC) is gathering attention. That scheme extracts numerous ICC-related features to detect malwares by machine learning. In order to mitigate the degradation of detection performance caused by redundant features, Correlation-based Feature Selection (CFS) is applied to feature before machine learning. CFS selects useful features for detection in accordance with the theory that a good feature subset has little correlation with mutual features. However, CFS may remove useful ICC-related features because of strong correlation between them. In this paper, we propose an effective feature selection scheme for Android ICC-based malware detection using the gap of the appearance ratio. We argue that the features frequently appearing in either benign apps or malwares are useful for malware detection, even if they are strongly correlated with each other. To select useful features based on our argument, we introduce the proportion of the appearance ratio of a feature between benign apps and malwares. Since the proportion can represent whether a feature frequently appears in either benign apps or malwares, this metric is useful for feature selection based on our argument. Unfortunately, the proportion is ineffective when a feature appears only once in all apps. Thus, we also introduce the difference of the appearance ratio of a feature between benign apps and malwares. Since the difference simply represents the gap of the appearance ratio, we can select useful features by using this metric when such a situation occurs. By computer simulation with real dataset, we demonstrate our scheme improves detection accuracy by selecting the useful features discarded in the previous scheme.

Access to Document (DOI)

An Energy Efficient Target Specific Code Dissemination Scheme with Forwarder Selection Algorithm in WSNs

Asahina H., Toyoda K., Sasase I., Mathiopoulos P., Yamamoto H.

ISSN 9781538660096

© 2018 IEEE. In order to fix a bug or install a new application, disseminating a code to specific target sensors is an important management task in wireless sensor networks. In order to disseminate a code to specific target sensors in an energy efficient manner, it is required to select the minimum required number of forwarders with a small number of control messages. In this paper, we propose an energy efficient target specific code dissemination scheme with a forwarder selection algorithm. The proposed scheme consists of two steps, (i) a forwarder selection algorithm with a control message suppression, (ii) unnecessary forwarders reduction with a sleep mechanism. In order to select the minimum required forwarders with a small number of control messages, we propose an algorithm to select a forwarder where more target sensors are reachable, through a single control message by leveraging overhearing of control messages. In addition, in order to reduce the number of forwarders, we propose a sleep mechanism to put unnecessary forwarders to sleep where any target sensor is not reachable. A performance analysis has shown that the number of control messages of the proposed scheme is always theoretically smaller than that of a previously published forwarder selection scheme under the same condition. In addition, we have shown that the proposed scheme reduces the energy consumption compared with the previous scheme.

Access to Document (DOI)

　 Previous page - Next page 　