Development of Sensor Systems to Trace and Detect Unknown Cyber Attacks
| Project/Area Number |
23300025
|
|---|
| Research Category |
Grant-in-Aid for Scientific Research (B)
|
| Allocation Type | Single-year Grants |
|---|
| Section | 一般 |
|---|
| Research Field |
Computer system/Network
|
|---|
| Research Institution | National Institute of Informatics (2015)
Nagoya University |
|---|
Principal Investigator |
Hiroki Takakura 国立情報学研究所, アーキテクチャ科学研究系, 教授 (70281144)
|
|---|
| Research Collaborator |
ARAKI Shohei
FUCHIGAMI Satoshi
FUKUSHIMA Tatsuya
HASEGAWA Hirokazu
HIRONO Soshi
HIRUTA Sohei
Song Jungsuk
KISHIMOTO Kazuya
KITAGAWA Naoya
LIM Hyoyoung
SATO Masaaki
YANASE Shun
ZHONG Yang
|
|---|
| Project Period (FY) |
2011-04-01 – 2016-03-31
|
| Project Status |
Completed (Fiscal Year 2015)
|
| Budget Amount *help |
¥19,240,000 (Direct Cost: ¥14,800,000、Indirect Cost: ¥4,440,000)
Fiscal Year 2015: ¥3,640,000 (Direct Cost: ¥2,800,000、Indirect Cost: ¥840,000)
Fiscal Year 2014: ¥4,290,000 (Direct Cost: ¥3,300,000、Indirect Cost: ¥990,000)
Fiscal Year 2013: ¥3,640,000 (Direct Cost: ¥2,800,000、Indirect Cost: ¥840,000)
Fiscal Year 2012: ¥4,290,000 (Direct Cost: ¥3,300,000、Indirect Cost: ¥990,000)
Fiscal Year 2011: ¥3,380,000 (Direct Cost: ¥2,600,000、Indirect Cost: ¥780,000)
|
|---|
| Keywords | サイバーセキュリティ / 攻撃検知 / 未知攻撃 / 機械学習 / Fuzzy hashing / SVM / ハニーポット / マルウェア検知 / サイバー攻撃対策 / 未知攻撃対策 / 標的型攻撃対策 / 標的型攻撃 / ゼロデイ攻撃 / トラフィック解析 / 情報セキュリティ / サイバー攻撃 / データマイニング / セキュア・ネットワーク / ネットワーク / インターネット高度化 |
|---|
| Outline of Final Research Achievements |
This research has developed IPv6 based honeypots by which the attacks various types of devices including IoT ones were observed. SVM based algorithm has been proposed to identify suspicious traffics. For detecting communication caused by malwares among the suspicious traffic, Fuzzy hashing based algorithm has also been developed. Because it is impossible to prepare clean teacher data for machine learning algorithms in advance, i.e., sets of completely clean sessions and those of completely malicious sessions, these algorithms can be utilized without teacher data.
These techniques were evaluated by real environment or benchmark data obtained from the real networks. As results, their feasibility was confirmed.
|
Report
(6 results)
Research Products
(37 results)
