• Search Research Projects
  • Search Researchers
  • How to Use
  1. Back to previous page

Effective detection of various kinds of cyberattacks using histogram database technology

Research Project

Project/Area Number 25330131
Research Category

Grant-in-Aid for Scientific Research (C)

Allocation TypeMulti-year Fund
Section一般
Research Field Multimedia database
Research InstitutionKyushu University

Principal Investigator

Feng Yaokai  九州大学, システム情報科学研究科(研究院, 助教 (60363389)

Project Period (FY) 2013-04-01 – 2016-03-31
Project Status Completed (Fiscal Year 2015)
Budget Amount *help
¥4,810,000 (Direct Cost: ¥3,700,000、Indirect Cost: ¥1,110,000)
Fiscal Year 2015: ¥1,170,000 (Direct Cost: ¥900,000、Indirect Cost: ¥270,000)
Fiscal Year 2014: ¥1,170,000 (Direct Cost: ¥900,000、Indirect Cost: ¥270,000)
Fiscal Year 2013: ¥2,470,000 (Direct Cost: ¥1,900,000、Indirect Cost: ¥570,000)
Keywords分散型攻撃 / 挙動に基づく異常検知 / サイバーセキュリティ / ポートスキャン攻撃 / DRDoS攻撃 / DNS amp 攻撃 / DDoS攻撃 / C&C 通信 / ポートスキャン / Behavior mode / behavior-based detection / Frequency distribution / Learning algorithm / Cyber attacks / Distributed attacks / Port scan attacks / 挙動に基づいた検知 / 評価関数
Outline of Final Research Achievements

1) For detecting many kinds of cyber attacks, features and machine learning algorithms were tested and their detection performance was verified. Specifically, DRDoS attacks, DNS amp attacks, the sign of DDoS attacks. 2) Histogram construction method was investigated by further detailed analysis of the behavior of the cyber attacks that have been collected. The performance was also demonstrated.  3) In order to dynamically and rapidly construct histogram in real time from large, multidimensional packet datasets was invesitgated.
To accomplish an effective and rapid abnormality detection system, it is necessary to construct dynamically a moving histogram at high speed. We developed a method to incrementally construct histograms.

Report

(4 results)
  • 2015 Annual Research Report   Final Research Report ( PDF )
  • 2014 Research-status Report
  • 2013 Research-status Report
  • Research Products

    (15 results)

All 2016 2015 2014

All Journal Article (1 results) (of which Peer Reviewed: 1 results,  Acknowledgement Compliant: 1 results) Presentation (14 results) (of which Int'l Joint Research: 1 results)

  • [Journal Article] 挙動に基づくポートスキャン検知の自動化に向けた学習アルゴリズムの提案とその性能評価2015

    • Author(s)
      王サン, フォン ヤオカイ, 川本 淳平, 堀 彰良, 櫻井 幸一
    • Journal Title

      情報処理学会論文誌

      Volume: 56(9) Pages: 1770-1781

    • Related Report
      2015 Annual Research Report
    • Peer Reviewed / Acknowledgement Compliant
  • [Presentation] ランダムフォレストを用いたボットネットの検出2016

    • Author(s)
      呂 良, フォン ヤオカイ, 川本 淳平, 櫻井 幸一
    • Organizer
      電子情報通信学会総合大会2016
    • Place of Presentation
      福岡
    • Year and Date
      2016-03-16
    • Related Report
      2015 Annual Research Report
  • [Presentation] 機械学習を利用したDRDoS攻撃検知の提案とその性能実証2016

    • Author(s)
      高 宇軒, フォン ヤオカイ, 川本 淳平, 櫻井 幸一
    • Organizer
      第33回 暗号と情報セキュリティシンポジウム(SCIS2016)
    • Place of Presentation
      熊本
    • Year and Date
      2016-01-22
    • Related Report
      2015 Annual Research Report
  • [Presentation] 挙動に基づくDNSアンプ攻撃の検知2015

    • Author(s)
      蔡龍洙, フォン ヤオカイ, 川本 淳平, 櫻井 幸一
    • Organizer
      コンピュータセキュリティシンポジウム2015 (CSS2015)
    • Place of Presentation
      長崎
    • Year and Date
      2015-10-23
    • Related Report
      2015 Annual Research Report
  • [Presentation] パケットマーキングとロギングを用いたサイバー攻撃に対するトレースバック2015

    • Author(s)
      李 鵬飛, フォン ヤオカイ, 川本 淳平, 櫻井 幸一
    • Organizer
      コンピュータセキュリティシンポジウム2015 (CSS2015)
    • Place of Presentation
      長崎
    • Year and Date
      2015-10-23
    • Related Report
      2015 Annual Research Report
  • [Presentation] 挙動に基づく検知手法に向けてパラメータなしの学習アルゴリズムの提案と検証2015

    • Author(s)
      王サン, フォン ヤオカイ, 川本 淳平, 堀 良彰, 櫻井 幸一
    • Organizer
      第67回電気関係学会九州支部連合大会講演論文
    • Place of Presentation
      鹿児島大学
    • Year and Date
      2015-09-18 – 2015-09-19
    • Related Report
      2014 Research-status Report
  • [Presentation] A Proposal for Detecting Distributed Cyber-Attacks Using Automatic Thresholding2015

    • Author(s)
      Yaokai Feng, Yoshiaki Hori, Kouichi Sakurai
    • Organizer
      the 10th Asia Conference on information security
    • Place of Presentation
      Taiwan
    • Year and Date
      2015-05-26
    • Related Report
      2015 Annual Research Report
    • Int'l Joint Research
  • [Presentation] A Behavior-based Engine for Detecting Distributed Internet Attacks and its Performance Investigation2015

    • Author(s)
      フォン ヤオカイ, 堀良彰, 櫻井 幸一
    • Organizer
      第32回 暗号と情報セキュリティシンポジウム(SCIS2015) ,2015.01.20.
    • Place of Presentation
      小倉市(福岡県)
    • Year and Date
      2015-01-21 – 2015-01-25
    • Related Report
      2014 Research-status Report
  • [Presentation] 挙動に基づくポートスキャン検知手法に向けたパラメータなしの学習アルゴリズムの提案とその性能評価2015

    • Author(s)
      王サン, フォン ヤオカイ, 川本 淳平, 堀良彰, 櫻井 幸一
    • Organizer
      第32回 暗号と情報セキュリティシンポジウム(SCIS2015) ,2015.01.20.
    • Place of Presentation
      小倉市(福岡県)
    • Year and Date
      2015-01-21 – 2015-01-25
    • Related Report
      2014 Research-status Report
  • [Presentation] An Approach for Detecting Distributed Cyber-Attacks2015

    • Author(s)
      Yaokai Feng, Yoshiaki Hori, Kouichi Sakurai
    • Organizer
      The 8th Workshop WAIS2015
    • Place of Presentation
      ソウル
    • Year and Date
      2015-01-08 – 2015-01-09
    • Related Report
      2014 Research-status Report
  • [Presentation] A Learning Algorithm for the Threshold in Behavior-based PortScan Detection and Its Evaluation2015

    • Author(s)
      Can Wang, Yaokai Feng, Junpei Kawamoto, Yoshiaki Hori, Kouichi Sakurai
    • Organizer
      The 8th Workshop WAIS2015
    • Place of Presentation
      ソウル
    • Year and Date
      2015-01-08 – 2015-01-09
    • Related Report
      2014 Research-status Report
  • [Presentation] A Parameterless Learning Algorithm for Behavior-Based Attack Detection2014

    • Author(s)
      Can Wang, Yaokai Feng, Junpei Kawamoto, Yoshiaki Hori, Kouichi Sakurai
    • Organizer
      9th Asia Conference on information security
    • Place of Presentation
      武漢(中国)
    • Year and Date
      2014-09-24 – 2014-09-26
    • Related Report
      2014 Research-status Report
  • [Presentation] 挙動に基づく分散型攻撃の検知案の再考2014

    • Author(s)
      フォン ヤオカイ
    • Organizer
      31回 暗号と情報セキュリティシンポジウム(SCIS2014)
    • Place of Presentation
      鹿児島市
    • Related Report
      2013 Research-status Report
  • [Presentation] ポートのアクセス数分布によるポートスキャン検知2014

    • Author(s)
      Can Wang, フォン ヤオカイ
    • Organizer
      31回 暗号と情報セキュリティシンポジウム(SCIS2014)
    • Place of Presentation
      鹿児島市
    • Related Report
      2013 Research-status Report
  • [Presentation] A Behavior-Based Port Scan Detection by the Distribution Diagram of Accessed Ports2014

    • Author(s)
      Can Wang, Yaokai Feng
    • Organizer
      The Seventh Workshop among Asian Information Security Labs (WAIS2014)
    • Place of Presentation
      上海(中国)
    • Related Report
      2013 Research-status Report

URL: 

Published: 2014-07-25   Modified: 2019-07-29  

Information User Guide FAQ News Terms of Use Attribution of KAKENHI

Powered by NII kakenhi