• Search Research Projects
  • Search Researchers
  • How to Use
  1. Back to previous page

Network Worm Detection by Identifying Infection Route and its Application to Digital Forensics

Research Project

Project/Area Number 18500063
Research Category

Grant-in-Aid for Scientific Research (C)

Allocation TypeSingle-year Grants
Section一般
Research Field Computer system/Network
Research InstitutionKeio University

Principal Investigator

SHIGENO Hiroshi  Keio University, 理工学部, 准教授 (30306881)

Co-Investigator(Kenkyū-buntansha) OKADA Kenichi  慶應義塾大学, 理工学部, 教授 (80118926)
Project Period (FY) 2006 – 2008
Project Status Completed (Fiscal Year 2008)
Budget Amount *help
¥4,170,000 (Direct Cost: ¥3,600,000、Indirect Cost: ¥570,000)
Fiscal Year 2008: ¥910,000 (Direct Cost: ¥700,000、Indirect Cost: ¥210,000)
Fiscal Year 2007: ¥1,560,000 (Direct Cost: ¥1,200,000、Indirect Cost: ¥360,000)
Fiscal Year 2006: ¥1,700,000 (Direct Cost: ¥1,700,000)
Keywords情報ネットワーク / ディジタルフォレンジックス / ワーム検知 / ロギング / ネットワーク / セキュアネットワーク / セキュア・ネットワーク / ワーム検
Research Abstract

近年, ネットワークワームの脅威が増してきており, 今後も強力な新型ワームの出現が予想されている. 本研究では, 脆弱ホストのアドレスリストを利用して感染先を発見するフラッシュワームを対象として, アノマリコネクションのツリーの検出を利用したワーム検知手法ACTMと, その分散型のd-ACTM/VTを提案し, シミュレーションによって有効性を示した. さらに, 自動アルゴリズムよる解析と視覚化システムを用いた人手による解析を併用するワーム感染経路の解析手法を提案し, ユーザ評価実験からその有効性を示した.

Report

(4 results)
  • 2008 Annual Research Report   Final Research Report ( PDF )
  • 2007 Annual Research Report
  • 2006 Annual Research Report
  • Research Products

    (27 results)

All 2009 2008 2007 2006 Other

All Journal Article (8 results) (of which Peer Reviewed: 5 results) Presentation (16 results) Remarks (3 results)

  • [Journal Article] デジタルフォレンジックのためのワーム感染経路特定手法2009

    • Author(s)
      稲場太郎, 田原慎也, 川口信隆, 塩澤秀和, 重野寛, 岡田謙一
    • Journal Title

      情報処理学会論文誌 Vol.50, No.3

      Pages: 1002-1011

    • NAID

      110007970392

    • Related Report
      2008 Final Research Report
    • Peer Reviewed
  • [Journal Article] デジタルフォレンジックのためのワーム感染経路特定手法2009

    • Author(s)
      稲場太郎
    • Journal Title

      情報処理学会論文誌 Vol. 50, No3

      Pages: 1002-1011

    • Related Report
      2008 Annual Research Report
    • Peer Reviewed
  • [Journal Article] d-ACTM/VT : A Distributed Virtual AC Tree Detection Method2008

    • Author(s)
      Nobutaka Kawaguchi, Hiroshi Shigeno, Kenichi Okada
    • Journal Title

      IPSJ Journal Vol.49, No.2

      Pages: 1010-1021

    • NAID

      130000058181

    • Related Report
      2008 Final Research Report
    • Peer Reviewed
  • [Journal Article] d-ACTM/VT:A Distributed Virtual AC Tree Detection Method2008

    • Author(s)
      Nobutaka Kawaguchi
    • Journal Title

      IPSJ Journal Vol.49,No.2

      Pages: 1010-1021

    • Related Report
      2007 Annual Research Report
    • Peer Reviewed
  • [Journal Article] サイレントワーム検知のためのアノマリコネクションツリーメソッド2007

    • Author(s)
      川口信隆, 重野寛, 上田真太郎, 塩沢秀和, 岡田謙一
    • Journal Title

      情報処理学会論文誌 Vol.48, No.2

      Pages: 614-624

    • NAID

      110006207783

    • Related Report
      2008 Final Research Report
    • Peer Reviewed
  • [Journal Article] サイレントワーム検知のためのアノマリコネクションツリーメソッド2007

    • Author(s)
      川口信隆
    • Journal Title

      情報処理学会論文誌 Vol. 48, No. 2

      Pages: 614-624

    • Related Report
      2006 Annual Research Report
  • [Journal Article] A Distributed Worm Detection Method based on ACTM2007

    • Author(s)
      Hiroshi Shigeno
    • Journal Title

      情報処理学会研究報告 2007-DPS-130

      Pages: 201-206

    • NAID

      110006249253

    • Related Report
      2006 Annual Research Report
  • [Journal Article] アノマリコネクションツリーを用いたサイレントワームの早期検知手法の提案2006

    • Author(s)
      川口信隆
    • Journal Title

      情報処理学会研究報告 2006-CSEC-33

      Pages: 31-36

    • Related Report
      2006 Annual Research Report
  • [Presentation] ディジタルフォレンジックのための視覚化によるワームの感染経路特定手法2008

    • Author(s)
      稲場太郎, 芝口誠仁, 川口信隆, 重野寛, 岡田謙一
    • Organizer
      情報処理学会DICOMO2008シンポジウム
    • Place of Presentation
      北海道札幌市
    • Year and Date
      2008-07-09
    • Related Report
      2008 Final Research Report
  • [Presentation] ディジタルフォレンジックのための視覚化によるワームの感染経路特定手法2008

    • Author(s)
      稲場太郎
    • Organizer
      情報処理学会マルチメディア, 分散, 協調とモバイル(DTCOMO2008)シンポジウム
    • Place of Presentation
      北海道札幌市
    • Year and Date
      2008-07-09
    • Related Report
      2008 Annual Research Report
  • [Presentation] A Distributed Detection of Hitlist Worms2008

    • Author(s)
      Nobutaka Kawaguchi, Hiroshi Shigeno, Kenichi Okada
    • Organizer
      The IEEE 2008International Conference on Communications
    • Place of Presentation
      Beijing, China
    • Year and Date
      2008-05-21
    • Related Report
      2008 Final Research Report
  • [Presentation] A Distributed Detection of Hitlist Worms2008

    • Author(s)
      Nobutaka Kawaguchi
    • Organizer
      In Proc. of The IEEE 2008 International Conference on Communications
    • Place of Presentation
      Beijing, China
    • Year and Date
      2008-05-21
    • Related Report
      2008 Annual Research Report
  • [Presentation] Early Containment of Worms Using Dummy Addresses and Connection Trace Back2007

    • Author(s)
      Taro Inaba, Nobutaka Kawaguchi, Sinya Tahara, Hiroshi Shigeno, Ken-ichi Okada
    • Organizer
      The 13th International Conference on Parallel and Distributed Systems
    • Place of Presentation
      Hsinchu, Taiwan
    • Year and Date
      2007-12-06
    • Related Report
      2008 Final Research Report
  • [Presentation] Early Containment of Worms Using Dummy Addresses and Connection Trace Back2007

    • Author(s)
      Nobutaka Kawaguchi
    • Organizer
      13th International Conference on Parallel and Distributed Systems(ICPADS)
    • Place of Presentation
      Hsinchu,Taiwan
    • Year and Date
      2007-12-06
    • Related Report
      2007 Annual Research Report
  • [Presentation] Worm Containment with Dummy Addresses and Connection Trace Back2007

    • Author(s)
      Taro Inaba, Nobutaka Kawaguchi, Shinya Tahara, Hiroshi Shigeno, Kenichi Okada
    • Organizer
      The 15th IPSJ Workshop On Multimedia Communication and Distributed Processing(13-18)
    • Place of Presentation
      石川県加賀市
    • Year and Date
      2007-10-31
    • Related Report
      2008 Final Research Report
  • [Presentation] Worm Containment with Dummy Addresses and Connection Trace Back2007

    • Author(s)
      Taro Inaba
    • Organizer
      情報処理学会第15回マルチメディア通信と分散処理ワークショップ
    • Place of Presentation
      石川県加賀市
    • Year and Date
      2007-10-31
    • Related Report
      2007 Annual Research Report
  • [Presentation] Detection of Silent Worms using Anomaly Connection tree2007

    • Author(s)
      Nobutaka Kawaguchi
    • Organizer
      IEEE 21st International Conference on Advanced Information Networking and Applications(AINA)
    • Place of Presentation
      Niagara Falls,Canada
    • Year and Date
      2007-07-07
    • Related Report
      2007 Annual Research Report
  • [Presentation] Cooperative Detection of Malicious Mobile Users using Network Activity History2007

    • Author(s)
      Shinya Tahara, Nobutaka Kawaguchi, Taro Inaba, Hidekazu Shiozawa, Hiroshi Shigeno, Ken-ichi Okada
    • Organizer
      DICOMO symposium
    • Place of Presentation
      三重県鳥羽市
    • Year and Date
      2007-07-05
    • Related Report
      2008 Final Research Report
  • [Presentation] Cooperative Detection of Malicious Mobile Users using Network Activity History2007

    • Author(s)
      Shinya Tahara
    • Organizer
      マルチメディア・分散・協調とモバイル(DICOMO2007)シンポジウム
    • Place of Presentation
      三重県鳥羽市
    • Year and Date
      2007-07-05
    • Related Report
      2007 Annual Research Report
  • [Presentation] Detection of Silent Worms using Anomaly Connection Tree2007

    • Author(s)
      Nobutaka Kawaguchi, Hiroshi Shigeno, Kenichi Okada
    • Organizer
      In Proc. of The IEEE 21st International Conference on Advanced Information Networking and Applications(412-419)
    • Place of Presentation
      Niagara Falls, Ontario, Canada
    • Year and Date
      2007-05-21
    • Related Report
      2008 Final Research Report
  • [Presentation] d-ACTM : Distributed Anomaly Connection Tree Method to detect Silent Worms2007

    • Author(s)
      Nobutaka Kawaguchi, Hiroshi Shigeno, Kenichi Okada
    • Organizer
      In Proc. of 26th IEEE International Performance, Computing and Communications Conference (Malware'07 Track)(510-517)
    • Place of Presentation
      New Orleans, Louisiana USA
    • Year and Date
      2007-04-13
    • Related Report
      2008 Final Research Report
  • [Presentation] d-ACTM:Distributed Anomaly Connection Tree Method to detect Silent Worms2007

    • Author(s)
      Nobutaka Kawaguchi
    • Organizer
      2nd International Swarm Intelligence&Other Forms of Malware Workshop
    • Place of Presentation
      New Orleans,Louisiana,USA
    • Year and Date
      2007-04-13
    • Related Report
      2007 Annual Research Report
  • [Presentation] A Distributed Worm Detection Method based on ACTM2007

    • Author(s)
      重野寛, 川口信隆, 岡田謙一
    • Organizer
      情報処理学会研究報告2007-DPS-130(pp201-206)
    • Place of Presentation
      福岡県福岡市
    • Year and Date
      2007-03-01
    • Related Report
      2008 Final Research Report
  • [Presentation] アノマリコネクションツリーを用いたサイレントワームの早期検知手法の提案2006

    • Author(s)
      川口信隆, 重野寛, 岡田謙一
    • Organizer
      情報処理学会研究報告2006-CSEC-33(pp31-36)
    • Place of Presentation
      茨城県つくば市
    • Year and Date
      2006-05-12
    • Related Report
      2008 Final Research Report
  • [Remarks] 研究室ホームページ

    • URL

      http://www.mos.ics.keio.ac.jp/

    • Related Report
      2008 Final Research Report
  • [Remarks]

    • URL

      http://www.mos.ics.keio.ac.jp/

    • Related Report
      2008 Annual Research Report
  • [Remarks]

    • URL

      http://www.mos.ics.keio.ac.jp/

    • Related Report
      2007 Annual Research Report

URL: 

Published: 2006-04-01   Modified: 2016-04-21  

Information User Guide FAQ News Terms of Use Attribution of KAKENHI

Powered by NII kakenhi