研究者詳細 - 武藤　佳恭

論文 - 武藤　佳恭

分割表示 211 件中 61 - 80 件目／全件表示 >>

Damageless information hiding technique using neural network

Naoe Kensuke, Takefuji Yoshiyasu

253 - 256 2008年

In this paper, we propose a new information hiding technique without embedding any information into the target content by using neural network trained on frequency domain. Proposed method can detect a hidden bit codes from the content by processing the selected feature subblocks into the trained neural network. Hidden codes are retrieved from the neural network only with the proper extraction key provided. The extraction key, in proposed method, are the coordinates of the selected feature subblocks and the network weights generated by supervised learning of neural network. The supervised learning uses the coefficients of the selected feature subblocks as set of input values and the hidden bit patterns are used as teacher signal values of neural network. With our proposed method, we are able to introduce a information hiding scheme with no damage to the target content.

Access to Document (DOI)

Can we survive an Internet blackout?

Takefuji Yoshiyasu

IEEE Technology and Society Magazine 26 （ 3 ） 8 2007年09月

ISSN 0278-0097

Access to Document (DOI)

Can we survive an internet blackout?

武藤佳恭

IEEE TECHNOLOGY AND SOCIETY MAGAZINE 26 （ 3 ） 8 - 8 2007年01月

研究論文（学術雑誌）, ISSN 0278-0097

Access to Document (DOI)

Resonance restriction technique for the resolution-based retrieval of palindrome in escherichia coli genome sequence

Ando Ruo, Takefuji Yashiyasu

205 - 208 2007年

In this paper we propose a novel biological reasoning technique to find genetic palindrome using the resolution- based ATP (automated theorem proving) computing strategy. To retrieve the palindromic sequence, we apply automated deduction software with some resolution strategies to increase program performance. While the conventional reasoning or logic programming oriented method is basically top-down process, our method is bottom-up, resolution-based and also enhanced by direction and restriction reasoning strategies. Proposal method is divided into two steps. First, each element of sequence is represented as one state clause. Second, biological reasoning program resolve these states to retrieve palindrome motif from genetic sequence. Besides, to make this resolution process faster, we apply a reasoning strategy called resonance restriction. This resolution strategy blocks the biological reasoning by avoiding expression that do not mach the patterns set by researchers. This pattern is called “resonator” which is expressed by symbol patterns in automated reasoning. In our model, researcher assigns resonators to the gap between repeated regions which prevent his program from redundant search related non-symmetric parts of genetic sequence. Resonators restrict discovery process by discarding clauses generated around the gap between palindromic motifs, which enhance sharply the performance of reasoning program. In experiment, we translate whole genome sequence of Escherichia coli into clausal representation. Numerical results are presented about the retrieval of palindrome in Escherichia coli to valid the effectiveness of proposal technique. We validate that resonance restriction makes reasoning process faster with experimental output of generated clauses, CPU time.

A novel approach for a file-system integrity monitor tool of Xen virtual machine

Quynh Nguyen Anh, Takefuji Yoshiyasu

194 - 202 2007年

File-system integrity tools (FIT) are commonly deployed host-based intrusion detections (HIDS) tool to detect unauthorized file-system changes. While FIT are widely used, this kind of HIDS has many drawbacks: the intrusion detection is not done in real-time manner, which might render the whole scheme useless if the attacker can somehow take over the system with privileged access in the time between. The administrator also has a lot of problems to keep the base-line database updating. Besides, the database and the FIT itself are vulnerable if the attacker gains local privileged access.This paper presents a novel approach to address the outstanding problems of the current FIT. We propose a design and implementation of a tool named XenFIT for Xen virtual machines. XenFIT can monitor and fires alarms on intrusion in real-time manner, and our approach does not require to create and update the database like in the legacy methods. XenFIT works by dynamically patching memory of the protected machine, so it is not necessary to install any kernel code or user-space application into the protected machines. As a result, XenFIT is almost effortless to deploy and maintain. In addition, thanks to the advantage introduced by Xen, the security polices as well as the detection process are put in a secure machine, so XenFIT is tamper-resistant with attack, even in case the attacker takes over the whole VM he is penetrating in. Finally, if deploying strictly, XenFIT is able to function very stealthily to avoid the suspect of the intruder.

Access to Document (DOI)

Damageless watermark extraction using nonlinear feature extraction scheme trained on frequency domain

Naoe Kensuke, Takefuji Yoshiyasu

117 - 142 2007年

In this chapter, we propose a new information hiding and extracting method without embedding any information into the target content by using a nonlinear feature extraction scheme trained on frequency domain. The proposed method can detect hidden bit patterns from the content by processing the coefficients of the selected feature subblocks to the trained neural network. The coefficients are taken from the frequency domain of the decomposed target content by frequency transform. The bit patterns are retrieved from the network only with the proper extraction keys provided. The extraction keys, in the proposed method, are the coordinates of the selected feature subblocks and the neural network weights generated by the supervised learning of the neural network. The supervised learning uses the coefficients of the selected feature subblocks as the set of input values, and the hidden bit patterns are used as the teacher signal values of the neural network, which is the watermark signal in the proposed method. With our proposed method, we are able to introduce a watermark scheme with no damage to the target content.

Access to Document (DOI)

Symbolic computation for DS-CDMA code acquisition using first order logic

Ando Ruo, Takefuji Yoshiyasu

241 - 250 2007年

Code division multiple access (CDMA) is widely used because of its effectiveness to send multiple signal and confidentiality of career signal. We present a formulation of state-space problem of which solution is directed by redundant reasoning control method for semiheuristic and lightweight DS-CDMA code acquisition. The reasoning of the state-space problem provides us with the way to find a K bit synchronized sequence among K dephased sequences with less calculation cost, compared with serial search and matched filter. In this process, redundancy-restriction method, called weighting strategy, enhances the searching ability of FOL (first order logic) reasoning for the faster and lightweight code acquisition. The combination of weighting strategy and correlator enables us to achieve the peak-detection within K/3 times of calculating inner products and its measurement. Our system is evaluated by the reduced cost of proving state-space problem using weighting strategy and its robustness of using the proposal code acquisition framework. Experiment shows that the proposal method is robust if K/N sequences are grouped with N ranging from 3 to 5.

Access to Document (DOI)

Parallel analysis for lightweight network incident detection using nonlinear adaptive systems

Ando Ruo, Takefuji Yoshiyasu

319 - 325 2007年

The rapid increasing of security incidents imposes a great burden on Internet users and system administrators. In this paper we discuss a parallel analysis for lightweight network incident detection using nonlinear adaptive systems. We run AID (anomaly intrusion detection) and MID (misuse intrusion detection) systems in parallel. Two detectors generate binary output misuse = {YES/NO} and anomaly = {YES/NO}. Then, we can determine whether we need to perform network or security operation. We apply clustering algorithm for AID and classification algorithm for MID. The nonlinear adaptive system is trained for running MID and AID in parallel. Proposed parallel system is more lightweight and simple to operate even if the number of incident patterns is increased. Experimental results in the case where false positive is frequently caused show that our method is functional with a recognition rate of attacks less than 10%, while finding the anomaly status. Also, performance evaluation show that proposed system can work with reasonable CPU utilization compared with conventional serial search based system.

Access to Document (DOI)

Secure image archiving using novel digital watermarking techniques

Ando Ruo, Takefuji Yoshiyasu

399 - 412 2007年

With the rapid advance in digital network, digital libraries, and particularly WWW (World Wide Web) services, we can retrieve many kinds of images on personal and mobile computer anytime and anywhere. At the same time, secure image archiving is becoming a major research area because the serious concern is raised about copyright protection and authority identification in digital media. A more sophisticated technique is required for future multimedia copyright protection. In this chapter we propose a secure image archiving using novel digital-watermarking techniques. Firstly, a nonlinear adaptive system (neural network) is applied for frequency-based digital watermarking. Secondly, we discuss application-oriented watermarking method for GIS image archiving. This chapter is divided into two parts. First section is about the way to apply nonlinear adaptive system for frequency-based image watermarking. We propose a new asymmetric technique employing nonlinear adaptive system trained on frequency domain. Our system uses two public keys to prevent removal attack and archive more fragile watermarking. In embedding, location information of frequency domain, where adaptive system is trained, is binalized, expressed in hexadecimal number, and encrypted in asymmetric cryptosystem. Encrypted location information is embedded in several parts of digital host contents. In generating key, supervised neural networks learn to assign the array of coefficients to teacher signal corresponding to the message to insert. This is one kind of transform-based method to generate public key from private key. In extracting, we use key matrix created by one-way signal processing of adaptive system. Proposal method is tested in still image, and we have empirically obtained the results that the proposal model is functional in implementing more secure and fragile watermarking compared with previous techniques, such as correlation and transform-based asymmetric watermarking. Several experiments are reported to validate the effectiveness of our watermarking method. Second section is about the application of GIS image archiving using digital watermarking technique. Recently, the utilization of GIS (geographical information system) is becoming rapidly pervasive. Consequently, new methodology of archiving and managing images is a pressing problem for GIS users. It is also expected that as the utilization of GIS becomes widely spread, protecting copyright and confidential images will be more important. In this chapter, we propose a three-layer image data format that makes it possible to synthesize two kinds of related images and analysis information in one image data size. To achieve the confidentiality of one hidden image, we apply the private watermarking scheme, where the algorithm is closed to the public. In the proposal model, encoder netlist embedded in the third layer is generated by FOL prover to achieve more secure and less information to decode it, compared with one operation of another block cipher such as RSA. Proposal system users can process two images without the cost of maintaining key and decoding operation.

Access to Document (DOI)

Device driver based computer in broadband age

Takefuji Yoshiyasu, Shoji Koichiro, Nozaki Takashi

251 - 258 2007年

Access to Document (DOI)

Towards a tamper-resistant kernel rootkit detector

Quynh Nguyen Anh, Takefuji Yoshiyasu

276 - 283 2007年

A variety of tools and architectures have been developed to detect security violations to Operating System kernels. However, they all have fundamental flaw in the design so that they fail to discover kernel-level attack. Few hardware solutions have been proposed to address the outstanding problem, but unfortunately they are not widely accepted. This paper presents a software-based method to detect intrusion to kernel. The proposed tool named XenKIMONO, which is based on Xen Virtual Machine, is able to detect many kernel rootkits in virtual machines with small penalty to the system's performance. In contrast with the traditional approaches, XenKIMONO is isolated with the kernel being monitored, thus it can still function correctly even if the observed kernel is compromised. Moreover, XenKIMONO is flexible and easy to deploy as it absolutely does not require any modification to the monitored systems.

Access to Document (DOI)

O(log₂M) self-organizing map algorithm without learning of neighborhood vectors

Kusumoto Hiroki, Takefuji Yoshiyasu

IEEE Transactions on Neural Networks 17 （ 6 ） 1656 - 1661 2006年11月

ISSN 1045-9227

In this letter, a new self-organizing map (SOM) algorithm with computational cost O(log₂M) is proposed where M² is the size of a feature map. The first SOM algorithm with O(M²) was originally proposed by Kohonen. The proposed algorithm is composed of the subdividing method and the binary search method. The proposed algorithm does not need the neighborhood functions so that it eliminates the computational cost in learning of neighborhood vectors and the labor of adjusting the parameters of neighborhood functions. The effectiveness of the proposed algorithm was examined by an analysis of codon frequencies of Escherichia coli (E. coli) K12 genes. These drastic computational reduction and accessible application that requires no adjusting of the neighborhood function will be able to contribute to many scientific areas.

Access to Document (DOI)

Hot list strategy for faster paramodulation based graph coloring

Ando Ruo, Takefuji Yoshiyasu

WSEAS Transactions on Computers 5 （ 7 ） 1596 - 1599 2006年07月

ISSN 1109-2750

In this paper, we discuss the effectiveness of applying the ATP (automated theorem proving) strategy called hot list strategy for N-coloring graph problem The process of graph coloring is formulated by equality substitution of paramodulation. It is showed that hot list strategy is useful to control the reasoning process driven by paramodulation. This ATP strategy are designed to deal with a substantial delay in going to a retained conclusion, which makes it possible to reduce the CPU time occurred by redundant generated clauses. Hot list strategy enables reasoning program to look ahead for faster resolution. In proposal graph coloring method, hot list strategy prevents paramodulation to generate much retained information thus reduce CPU time to reach the conclusion. Experiment shows that paramodulation could used for formulating graph coloring problem and hot list strategy is suitable for controlling paramoudlation based resolution. We measured CPU time and the number of generated clauses in solving coloring problem of Petersen graphs. Five kinds of Petersen graphs are formulated and processed by proposal theorem proving program.

A practical and light-weight data capture tool for Xen virtual machine

Quynh Nguyen Anh, Takefuji Yoshiyasu

WSEAS Transactions on Computers 5 （ 5 ） 1053 - 1060 2006年05月

ISSN 1109-2750

Honeypot is a common solution to investigate attacker's activities, but the data capture tool, one of the key components of high-interaction honeypot architecture, faces a major difficulty: it is very hard to hide its presence. For example Sebek, the de-factor data capture tool, suffers from this problem: the intruder can easily uncover it even without privileged access right. This paper presents a design and implementation of a light-weight "camera" software in Xen virtual machine environment: the camera can be put into the virtual machine honeypot to gather necessary data about intruder's action. The camera tool is named XenKamera, which aims to collect TTY data from consoles of observed honeypot, then replays the collected data in on-line or off-line manner as the administrator wishes. Simply put, XenKamera allows us to watch the intruder as if we were looking over his shoulder while he is typing. In order to prevent the intruder from discovering XenKamera, a special architecture is proposed, so the data recording process becomes stealth, hard to detect and circumvent. To protect the gathered data, the TTY logging is secretly transferred to a separate virtual machine and safely kept there. Experiments demonstrate that XenKamera is effective and reliable. Besides to serve for honeypot purpose, XenKamera is designed to be so light-weight that it is practical and can also be used in the production systems to record the working sessions, and the administrator can rely on the logging data to investigate and trouble-shoot administration.

Faster resolution based metamorphic virus detection using ATP control strategy

Ando Ruo, Anh Quynh Nguyen, Takefuji Yoshiyasu

WSEAS Transactions on Information Science and Applications 3 （ 2 ） 260 - 266 2006年02月

ISSN 1790-0832

In this paper we propose a resolution based detection method for detecting metamorphic computer virus. Our method is the application of formal verification using theorem proving, which deduce parts of viral code from the large number of obfuscated operations and re-assemble those in order to reveal the signature of virus. While previously many kinds of the symbolic emulation based methods have been applied for metamorphic virus, no resolution strategy based method is proposed. It is showed that the complexity of metamorphic virus can be solved if the obfuscated viral code is canonicalized and simplified using resolution based state pruning and generation. To make our detection method more feasible and effective, redundancy-control strategies are applied for the resolution process. In this paper the strategies of demodulation and subsumption are applied for eliminating the redundant path of resolution. Experiment shows that without these strategies, resolving metamorphic code into several simplified operations is almost impossible, at least is not feasible in reasonable computing time. The statistics of reasoning process in detecting obfuscated API call is also presented. We divide obfuscated API call into four modules according to the types of metamorphic techniques and compare the conventional resolution with our method applying redundancy-control strategy.

A novel stealthy data capture tool for honeypot system

Quynh Nguyen Anh, Takefuji Yoshiyasu

WSEAS Transactions on Computers 5 （ 1 ） 209 - 215 2006年01月

ISSN 1109-2750

Data capture tool is one of the core components of a honeypot system. The most vital requirement of this component is: it must function as stealthily as possible, so the intruder is not aware of its presence. Currently Sebek is the most sophisticated tool for this purpose. Unfortunately Sebek is rather easy to detect, even with unprivileged right access. This paper presents a novel approach to improve Sebek on this aspect. We proposes a design and implementation of a tool named Xebek, which is based on Xen technology, to fix the most outstanding problems of Sebek. Our experimental results prove that Xebek is much more covert, while the reliability and efficient are improved significantly.

A novel approach to secured and central logging data

Quynh Nguyen Anh, Takefuji Yoshiyasu

WSEAS Transactions on Computers 5 （ 1 ） 201 - 208 2006年01月

ISSN 1109-2750

Logging data is valuable and important information to reveal the attacker's activities and recover broken system. Unfortunately, once the attacker successfully penetrates a protected system, he never fails to either modify the logging data, or even worse, delete them to cover his traces. To avoid such a disaster, it is best to keep logging data in another machine by forwarding them to a central logging server. However, this approach has a flaw: while transmitting on network, data could be illegally sniffed or the traffic might be secretly redirected to a malicious machine. This paper proposes a novel method named Xenlog to secure logging data for systems run on Xen virtual machine: the solution does not use network stack to send data. Experimental and resulted tool proves that this approach is more secure than the traditional solution, while logging process is far more effective (nearly 24 times faster) and more reliable.

A real-time integrity monitor for xen virtual machine

Quynh Nguyen Anh, Takefuji Yoshiyasu

2006年

File-system integrity tools (FIT) are commonly deployed to assist forensic investigation after security incidents and as host-based intrusion detections (HIDS) tool to detect unauthorized file-system changes. Basically all the current solutions employ the same tactic: the administrator specifies a list of critical files and directories that needs to be monitored, then uses the FIT to create a base-line database that tracks general parameters about these files. The FIT is then re-run periodically, and if it detects the modifies of the file-system against the information stored in the database, the report on the changed file is generated. However, this strategy is far from perfect: the intrusion detection cannot be done in real-time, which might render the whole scheme useless if the attacker can somehow take over the system with privileged access in the time between. The administrator also has a lot of problems to keep the database updating. Besides, he must do everything he can to protect the database and the FIT itself from compromising by the attacker, which is not an easy task especially if the attacker gains local access. This paper presents a novel approach to address the outstanding problems of the current FIT. We propose a design and implementation of a tool named XenRIM for Xen virtual machines. XenRIM can monitor and fires alarms on intrusion in real-time manner, and our approach does not require to create and update the database like in the legacy methods. As a result, XenRIM is almost effortless to deploy and maintain. Thanks to the advantage introduced by Xen, the detection polices are centralized in a secure virtual machine and resistant to tampering. Even better, if deploying strictly this tool is able to function very stealthily to avoid the suspect of the attacker. Our experimental result demonstrates that XenRIM incurs very low performance overhead (less than 4%), which makes the solution attractive and practical for production systems.

Access to Document (DOI)

A central and secured logging data solution for Xen virtual machine

Quynh Nguyen Anh, Takefuji Yoshiyasu

218 - 224 2006年

Logging data is a valuable and an important information to reveal the attacker's activities and to recover broken system. Unfortunately, once the attacker successfully penetrates a protected system, he never fails to either modify the logging data, or even worse, delete them to cover his traces. To avoid such a disaster, it is best to keep logging data in another machine by forwarding them to a central logging server. However, this approach has a flaw: while transmitting on network, the data could be illegally sniffed or the traffic might be secretly redirected to a malicious machine. This paper proposes a novel method named Xenlog to secure logging data for systems run on Xen virtual machine: the solution does not use network stack to send data. Experimental and resulted tool proves that this approach is more secure than the traditional solution, while logging process is far more effective (nearly 21 times faster) and more reliable.

Towards an invisible honeypot monitoring system

Quynh Nguyen Anh, Takefuji Yoshiyasu

111 - 122 2006年

Honeypot is a decoy system to trap attackers, and data capture tool is one of the components of the honeypot architecture. Being used to collect the intruder's activities inside the honeypot, this key component must be able to function as stealthily as possible, so the intruder does not know that he is under watch. Unfortunately Sebek, a de-facto tool for this purpose in the modern honeypot technology, is rather easy to detect, even with unprivileged right access. This paper proposes to use Xen Virtual Machine to deploy honeypot, and takes the advantage introduced by Xen to fix some of the outstanding problems of Sebek. We present a design and implementation of a Xen-based system named Xebek as a solution. While Xebek provides similar features as Sebek does, our system is more "invisible" and harder to defeat. The experimental results also demonstrate that Xebek is more flexible, while the reliability and efficiency are significantly improved over its counterpart.

Access to Document (DOI)

　前のページ - 次のページ　

武藤 佳恭

論文 - 武藤 佳恭

武藤　佳恭

論文 - 武藤　佳恭