• Search Research Projects
  • Search Researchers
  • How to Use
  1. Back to previous page

Malware Informatics as a Power Base of Cyber Security Analysis

Research Project

Project/Area Number 16H02832
Research Category

Grant-in-Aid for Scientific Research (B)

Allocation TypeSingle-year Grants
Section一般
Research Field Information security
Research InstitutionWaseda University

Principal Investigator

Goto Shigeki  早稲田大学, 理工学術院, 教授 (30287966)

Co-Investigator(Kenkyū-buntansha) 森 達哉  早稲田大学, 理工学術院, 教授 (60708551)
Research Collaborator MORI Tatsuya  
Project Period (FY) 2016-04-01 – 2019-03-31
Project Status Completed (Fiscal Year 2018)
Budget Amount *help
¥17,030,000 (Direct Cost: ¥13,100,000、Indirect Cost: ¥3,930,000)
Fiscal Year 2018: ¥3,900,000 (Direct Cost: ¥3,000,000、Indirect Cost: ¥900,000)
Fiscal Year 2017: ¥5,460,000 (Direct Cost: ¥4,200,000、Indirect Cost: ¥1,260,000)
Fiscal Year 2016: ¥7,670,000 (Direct Cost: ¥5,900,000、Indirect Cost: ¥1,770,000)
Keywordsセキュリティ / マルウェア / 大規模データ解析 / モバイル / セキュア・ネットワーク / マルウェア対策 / サイバー攻撃 / 悪性通信 / 機械学習 / モバイルマルウェア / 高信頼性ネットワーク / 人工知能 / インターネット高度化 / 情報通信工学
Outline of Final Research Achievements

In modern networked society, the most severe threat is Cyber Attack. There is a significant demand for establishing defense technology for cyber attacks. There have been many research projects on cyber attacks. However, they deal with a specific kind of attacks individually, and they include some manual operations in their methods. This project proposes the Malware Informatics which covers the large scale database of malware (malicious software). It also shows the feature engineering, which is useful and powerful in data analysis. It proposes a new method for evaluating machine learning algorithms which play central roles in our data science approach to cyber defense technology. We have published many papers and described detailed results on the Web page of our research project.

Academic Significance and Societal Importance of the Research Achievements

ネットワークの利用が拡大するにつれてサイバー攻撃の脅威が高まっている.攻撃対策技術の確立が望まれるが,攻撃の手法・対象が多岐にわたるために対症療法的な対策になっている.このような現状を認識して,本研究では成果が蓄積されて後に活用されることを重視している.
本研究で提案したのはマルウェア・インフォマティックスという総合的な枠組である.この中には大量のデータを整理して蓄積して多くの研究者に活用されたものがある.またデータの特徴を解析して攻撃対策の技術を確立する際に重要となる素性(feature)エンジニアリングがある.さらに機械学習のアルゴリズムの比較評価がある.この枠組が活用されることを望む.

Report

(4 results)
  • 2018 Annual Research Report   Final Research Report ( PDF )
  • 2017 Annual Research Report
  • 2016 Annual Research Report
  • Research Products

    (41 results)

All 2019 2018 2017 2016 Other

All Journal Article (7 results) (of which Peer Reviewed: 7 results,  Acknowledgement Compliant: 2 results) Presentation (32 results) (of which Int'l Joint Research: 18 results,  Invited: 7 results) Remarks (2 results)

  • [Journal Article] Detection Method of Homograph Internationalized Domain Names with OCR2019

    • Author(s)
      SAWABE Yuta、CJIBA Daiki、AKIYAMA Mitsuaki, GOTO Shigeki
    • Journal Title

      Journal of Information Processing

      Volume: 27

    • NAID

      130007706943

    • Related Report
      2018 Annual Research Report
    • Peer Reviewed
  • [Journal Article] Automatically Generating Malware Analysis Reports Using Sandbox Logs2018

    • Author(s)
      SUN Bo、FUJINO Akinori、MORI Tatsuya、BAN Tao、TAKAHASHI Takeshi、INOUE Daisuke
    • Journal Title

      IEICE Transactions on Information and Systems

      Volume: E101.D Issue: 11 Pages: 2622-2632

    • DOI

      10.1587/transinf.2017ICP0011

    • ISSN
      0916-8532, 1745-1361
    • Year and Date
      2018-11-01
    • Related Report
      2018 Annual Research Report
    • Peer Reviewed
  • [Journal Article] Understanding the Inconsistency between Behaviors and Descriptions of Mobile Apps2018

    • Author(s)
      WATANABE Takuya、AKIYAMA Mitsuaki、SAKAI Tetsuya、WASHIZAKI Hironori、MORI Tatsuya
    • Journal Title

      IEICE Transactions on Information and Systems

      Volume: E101.D Issue: 11 Pages: 2584-2599

    • DOI

      10.1587/transinf.2017ICP0006

    • ISSN
      0916-8532, 1745-1361
    • Year and Date
      2018-11-01
    • Related Report
      2018 Annual Research Report
    • Peer Reviewed
  • [Journal Article] Detecting Malware-Infected Devices Using the HTTP Header Patterns2018

    • Author(s)
      S. Mizuno, M. Hatada, T. Mori, and S. Goto
    • Journal Title

      IEICE Transactions on Information and Systems

      Volume: E101.D Issue: 5 Pages: 1370-1379

    • DOI

      10.1587/transinf.2017EDP7294

    • NAID

      130006729785

    • ISSN
      0916-8532, 1745-1361
    • Year and Date
      2018-05-01
    • Related Report
      2017 Annual Research Report
    • Peer Reviewed
  • [Journal Article] PADetective: A Systematic Approach to Automate Detection of Promotional Attackers in Mobile App Store2018

    • Author(s)
      B. Sun, X. Luo, M. Akiyama, T. Watanabe and T. Mori
    • Journal Title

      Journal of Information Processing

      Volume: 26 Issue: 0 Pages: 212-223

    • DOI

      10.2197/ipsjjip.26.212

    • NAID

      130006351608

    • ISSN
      1882-6652
    • Related Report
      2017 Annual Research Report
    • Peer Reviewed
  • [Journal Article] Finding New Varieties of Malware with the Classification of Network Behavior2017

    • Author(s)
      M. Hatada and T. Mori
    • Journal Title

      IEICE Transactions on Information and Systems

      Volume: 印刷中

    • NAID

      130005876003

    • Related Report
      2016 Annual Research Report
    • Peer Reviewed / Acknowledgement Compliant
  • [Journal Article] APPraiser: A large scale analysis of Android clone apps2017

    • Author(s)
      Y. Ishii, T. Watanabe, M. Akiyama, and T. Mori
    • Journal Title

      IEICE Transactions on Information and Systems

      Volume: 印刷中

    • NAID

      130005876000

    • Related Report
      2016 Annual Research Report
    • Peer Reviewed / Acknowledgement Compliant
  • [Presentation] Understanding the Responsiveness of Mobile App Developers to Software Library Updates2019

    • Author(s)
      T. Yasumatsu, T. Watanabe, F. Kanei, E. Shioji, M. Akiyama, and T. Mori
    • Organizer
      the 9th ACM Conference on Data and Application Security and Privacy (CODASPY 2019)
    • Related Report
      2018 Annual Research Report
    • Int'l Joint Research
  • [Presentation] A measurement study of the Internationalized domain name (IDN) homograph attacks: present and future2019

    • Author(s)
      Tatsuya Mori
    • Organizer
      Asia Pacific Advanced Network 47
    • Related Report
      2018 Annual Research Report
    • Int'l Joint Research / Invited
  • [Presentation] Understanding the Origins of Weak Cryptographic Algorithms Used for Signing Android Apps2018

    • Author(s)
      K. Yoshida, H. Imai, N. Serizawa, T. Mori, and A. Kanaoka
    • Organizer
      the 10th IEEE International Workshop on Security Aspects in Processes and Services Engineering (SAPSE 2018)
    • Related Report
      2018 Annual Research Report
    • Int'l Joint Research
  • [Presentation] OCRを利用したホモグラフIDNの検知法2018

    • Author(s)
      澤部 祐太, 千葉 大紀, 秋山 満昭, 後藤 滋樹
    • Organizer
      コンピュータ・セキュリティ・シンポジウム 2018
    • Related Report
      2018 Annual Research Report
  • [Presentation] PTRレコードの連続的設定を加味した動的IPアドレスブロックおよびクラウド領域検出2018

    • Author(s)
      中森 朋郁, 千葉 大紀, 秋山 満昭, 後藤 滋樹
    • Organizer
      コンピュータ・セキュリティ・シンポジウム 2018
    • Related Report
      2018 Annual Research Report
  • [Presentation] インターネットの大域的な成功と局所的な反省2018

    • Author(s)
      後藤 滋樹
    • Organizer
      コンピュータ・セキュリティ・シンポジウム 2018
    • Related Report
      2018 Annual Research Report
    • Invited
  • [Presentation] Detecting Dynamic IP Addresses Using the Sequential Characteristics of PTR Records2018

    • Author(s)
      Tomofumi Nakamori, Daiki Chiba, Mitsuaki Akiyama, and Shigeki Goto
    • Organizer
      Asia Pacific Advanced Network 46, Research Workshop
    • Related Report
      2018 Annual Research Report
    • Int'l Joint Research
  • [Presentation] Detecting Homograph IDNS using OCR2018

    • Author(s)
      Yuta Sawabe, Daiki Chiba, Mitsuaki Akiyama, and Shigeki Goto
    • Organizer
      Asia Pacific Advanced Network 46, Research Workshop
    • Related Report
      2018 Annual Research Report
    • Int'l Joint Research
  • [Presentation] APAN from Simple to Complex2018

    • Author(s)
      Shigeki Goto
    • Organizer
      Asia Pacific Advanced Network 46
    • Related Report
      2018 Annual Research Report
    • Int'l Joint Research / Invited
  • [Presentation] Don’t throw me away: Threats Caused by the Abandoned Internet Resources Used by Android Apps2018

    • Author(s)
      E. Pariwono, D. Chiba, M. Akiyama, and T. Mori
    • Organizer
      the 13th ACM ASIA Conference on Information, Computer and Communications Security (ASIACCS 2018)
    • Related Report
      2017 Annual Research Report
    • Int'l Joint Research
  • [Presentation] Measurement Study of the Hijackable Internet Resources inside Mobile Apps2018

    • Author(s)
      Elkana Pariwono, Daiki Chiba, Mitsuaki Akiyama, and Tatsuya Mori
    • Organizer
      暗号と情報セキュリティシンポジウム (SCIS 2018)
    • Related Report
      2017 Annual Research Report
  • [Presentation] BotDetector: A robust and scalable approach toward detecting malware-infected devices2017

    • Author(s)
      S. Mizuno, M. Hatada, T. Mori, and S. Goto
    • Organizer
      Proceedings of the IEEE International Conference on Communications (ICC 2017)
    • Place of Presentation
      Paris, France
    • Year and Date
      2017-05-21
    • Related Report
      2016 Annual Research Report
    • Int'l Joint Research
  • [Presentation] How the Internet survey tools could affect network security monitoring?2017

    • Author(s)
      Tatsuya Mori
    • Organizer
      The 43rd APAN Meeting, Network Security Workshop
    • Place of Presentation
      New Delhi, India
    • Year and Date
      2017-02-12
    • Related Report
      2016 Annual Research Report
    • Int'l Joint Research / Invited
  • [Presentation] PUPが生成するDNSクエリパターンの大規模調査2017

    • Author(s)
      畑田充弘,森達哉
    • Organizer
      暗号と情報セキュリティシンポジウム (SCIS 2017)
    • Place of Presentation
      沖縄県沖縄市
    • Year and Date
      2017-01-24
    • Related Report
      2016 Annual Research Report
  • [Presentation] Androidサードパーティマーケットの大規模調査2017

    • Author(s)
      石井悠太,渡邉卓弥,金井文宏,高田雄太,塩治榮太朗,秋山満昭,八木毅,森達哉
    • Organizer
      暗号と情報セキュリティシンポジウム (SCIS2017)
    • Place of Presentation
      沖縄県沖縄市
    • Year and Date
      2017-01-24
    • Related Report
      2016 Annual Research Report
  • [Presentation] Understanding the Security Management of Global Third-Party Android Marketplaces2017

    • Author(s)
      Y. Ishii, T. Watanabe, F. Kanei, Y. Takata, E. Shioji, M. Akiyama, T. Yagi, B. Sun and T. Mori
    • Organizer
      the 2nd International Workshop on App Market Analytics (WAMA 2017)
    • Related Report
      2017 Annual Research Report
    • Int'l Joint Research
  • [Presentation] Detecting and Classifying Android PUAs by similarity of DNS queries2017

    • Author(s)
      M. Hatada and T. Mori
    • Organizer
      the 7th IEEE International COMPSAC Workshop on Network Technologies for Security, Administration and Protection (NETSAP 2017)
    • Related Report
      2017 Annual Research Report
    • Int'l Joint Research
  • [Presentation] Characterizing Promotional Attacks in Mobile App Store2017

    • Author(s)
      B. Sun, X. Luo, M. Akiyama, T. Watanabe and T. Mori
    • Organizer
      the 8th International Conference on Applications and Techniques in Information Security (ATIS 2017)
    • Related Report
      2017 Annual Research Report
    • Int'l Joint Research
  • [Presentation] Discriminating DRDoS Packets using Time Interval Analysis2017

    • Author(s)
      Daiki Noguchi, Tatsuya Mori, Yota Egusa, Kazuya Suzuki, Shigeki Goto
    • Organizer
      the 44th Meeting of the Asia-Pacific Advanced Network
    • Related Report
      2017 Annual Research Report
    • Int'l Joint Research
  • [Presentation] Large-scale network security measurement through the lens of darknet2017

    • Author(s)
      Tatsuya Mori
    • Organizer
      The 44th APAN Meeting, Network Security Workshop
    • Related Report
      2017 Annual Research Report
    • Int'l Joint Research / Invited
  • [Presentation] モバイルアプリ開発者による脆弱性対応の実態調査2017

    • Author(s)
      安松達彦,金井文宏,渡邉卓弥,塩治榮太朗,秋山満昭,森達哉
    • Organizer
      コンピュータセキュリティシンポジウム2017
    • Related Report
      2017 Annual Research Report
  • [Presentation] DNSクエリ分析に基づくAndroid PUAの識別と亜種分類2017

    • Author(s)
      畑田充弘,森達哉
    • Organizer
      コンピュータセキュリティシンポジウム2017
    • Related Report
      2017 Annual Research Report
  • [Presentation] HTTPヘッダフィールドの可変性に基づくマルウェア感染端末の特定2016

    • Author(s)
      水野翔,畑田充弘,森達哉,後藤滋樹
    • Organizer
      コンピュータセキュリティシンポジウム2016論文集
    • Place of Presentation
      秋田県秋田市
    • Year and Date
      2016-10-11
    • Related Report
      2016 Annual Research Report
  • [Presentation] 実行時の通信挙動を用いたマルウェアの分類と未知検体検出への応用2016

    • Author(s)
      畑田充弘,森達哉
    • Organizer
      コンピュータセキュリティシンポジウム2016論文集
    • Place of Presentation
      秋田県秋田市
    • Year and Date
      2016-10-11
    • Related Report
      2016 Annual Research Report
  • [Presentation] モバイルアプリストアにおけるプロモーショナル攻撃の自動検知システム2016

    • Author(s)
      孫博,秋山満昭,森達哉
    • Organizer
      コンピュータセキュリティシンポジウム2016論文集
    • Place of Presentation
      秋田県秋田市
    • Year and Date
      2016-10-11
    • Related Report
      2016 Annual Research Report
  • [Presentation] Paragraph Vectorを用いたマルウェアの亜種推定法2016

    • Author(s)
      佐藤拓未, 後藤滋樹, 武部嵩礼
    • Organizer
      情報処理学会 MWS 2016
    • Place of Presentation
      秋田県秋田市
    • Year and Date
      2016-10-11
    • Related Report
      2016 Annual Research Report
  • [Presentation] DoSリフレクション攻撃の分析と防御法2016

    • Author(s)
      野口大貴, 後藤滋樹
    • Organizer
      情報処理学会 MWS 2016
    • Place of Presentation
      秋田県秋田市
    • Year and Date
      2016-10-11
    • Related Report
      2016 Annual Research Report
  • [Presentation] Analytics of Malware Traffic: Clustering and its Evaluation2016

    • Author(s)
      Mitsuhiro Hatada and Tatsuya Mori
    • Organizer
      The 42nd APAN Meeting, Network Security Workshop
    • Place of Presentation
      香港
    • Year and Date
      2016-08-01
    • Related Report
      2016 Annual Research Report
    • Int'l Joint Research / Invited
  • [Presentation] Detecting malware-infected hosts using HTTP fingerprints2016

    • Author(s)
      Sho Mizuno, Mitsuhiro Hatada, Tatsuya Mori, and Shigeki Goto
    • Organizer
      The 42nd APAN Meeting, Network Security Workshop
    • Place of Presentation
      香港
    • Year and Date
      2016-08-01
    • Related Report
      2016 Annual Research Report
    • Int'l Joint Research / Invited
  • [Presentation] Detecting Drive-by-Download Attacks based on HTTP Context-Types2016

    • Author(s)
      Ryo Kiire and Shigeki Goto
    • Organizer
      APAN Research Workshop 2016
    • Place of Presentation
      香港
    • Year and Date
      2016-08-01
    • Related Report
      2016 Annual Research Report
    • Int'l Joint Research
  • [Presentation] Fingerprinting Attack on Tor Anonymity using Deep Learning2016

    • Author(s)
      Kota Abe and Shigeki Goto
    • Organizer
      APAN Research Workshop 2016
    • Place of Presentation
      香港
    • Year and Date
      2016-08-01
    • Related Report
      2016 Annual Research Report
    • Int'l Joint Research
  • [Presentation] マルウェアの通信モデルによるクラスタリング精度の評価2016

    • Author(s)
      畑田充弘,森達哉
    • Organizer
      信学技報, vol. 116, no. 131, ICSS2016-24
    • Place of Presentation
      山口県山口市
    • Year and Date
      2016-07-14
    • Related Report
      2016 Annual Research Report
  • [Remarks] 森達哉研究室ホームページ

    • URL

      https://nsl.cs.waseda.ac.jp/projects/appraiser/

    • Related Report
      2017 Annual Research Report
  • [Remarks] 森達哉研究室ホームページ

    • URL

      http://nsl.cs.waseda.ac.jp/projects/appraiser/

    • Related Report
      2016 Annual Research Report

URL: 

Published: 2016-04-21   Modified: 2020-03-30  

Information User Guide FAQ News Terms of Use Attribution of KAKENHI

Powered by NII kakenhi