Studies on An Active Darknet Monitoring System

• Project/Area Number: 26730066
• Research Category: Grant-in-Aid for Young Scientists (B)
• Allocation Type: Multi-year Fund
• Research Field: Information security
• Research Institution: Kyushu Institute of Technology
• Principal Investigator: Satoh Akihiro 九州工業大学, 情報科学センター, 助教 (30609376)
• Project Period (FY): 2014-04-01 – 2016-03-31
• Project Status: Completed (Fiscal Year 2015)
• Budget Amount: ¥3,380,000 (Direct Cost: ¥2,600,000、Indirect Cost: ¥780,000); Fiscal Year 2015: ¥1,170,000 (Direct Cost: ¥900,000、Indirect Cost: ¥270,000); Fiscal Year 2014: ¥2,210,000 (Direct Cost: ¥1,700,000、Indirect Cost: ¥510,000)
• Keywords: ネットワークセキュリティ / トラヒックモニタリング / 機械学習

Outline of Final Research Achievements

We develop an active darknet monitoring system to reveal various types of malware behaviors in detail. The proposed system has two functions: (1) response packet generation and (2) malware classification. The former automatically generates response packets to inspect malware behaviors, and the latter classifies malwares according to their exploit.

Research Products

• [Journal Article] マルウェア感染ステップのファイルタイプ遷移に基づいたDrive-by Download攻撃検知手法 (2014)
  • Author(s): 進藤 康孝，佐藤 彰洋，中村 豊，飯田 勝吉
  • Journal Title: コンピュータセキュリティシンポジウム論文集 Volume: 2 Pages: 575582-575582
  • NAID: 170000087317
  • Acknowledgement Compliant
• [Journal Article] Lightweight Approach to Detect Drive-by Download Attacks Based on File Type Transition (2014)
  • Author(s): Yasutaka Shindo, Akihiro Satoh, Yutaka Nakamura, Katsuyoshi Iida
  • Journal Title: Proceedings of the CoNEXT on Student Workshop Volume: 1 Pages: 2830-2830
  • Peer Reviewed
• [Presentation] Lightweight Approach to Detect Drive-by Download Attacks Based on File Type Transition (2014)
  • Author(s): Yasutaka Shindo, Akihiro Satoh, Yutaka Nakamura, Katsuyoshi Iida
  • Organizer: CoNEXT Student Workshop
  • Place of Presentation: Sydney, Australia
  • Year and Date: 2014-12-02 – 2014-12-05
• [Presentation] マルウェア感染ステップのファイルタイプ遷移に基づいたDrive-by Download攻撃検知手法 (2014)
  • Author(s): 進藤 康孝，佐藤 彰洋，中村 豊，飯田 勝吉
  • Organizer: コンピュータセキュリティシンポジウム
  • Place of Presentation: 北海道
  • Year and Date: 2014-10-22 – 2014-10-24