Computers connected to the Internet are a target for a myriad of complicated attacks. Companies can use sophisticated security systems to protect their computers; however, average users usually rely on built-in or personal firewalls to protect their computers while avoiding the more complicated and expensive alternatives. In this paper we study the feasibility — from the network performance point of view — of a VM configured as an integrated security appliance for personal computers. After discussing the main causes of network performance degradation, we use netperf on the host computer to find the network performance overhead when using a virtual appliance. We are mainly concerned with the bandwidth and the latency that would limit a network link. We compared the bandwidth and latency of this integrated security virtual appliance with current market products and in both cases, the performance of the virtual appliance was excellent compared with hardware counterparts. This security virtual appliance for example allows more than an 80Mbps data transfer rate for individual users, while security appliances generally allow only 150Mbps for small office users. In brief, our tests show that the network performance of a security virtual appliance is on par with the current security appliances available in the market; therefore, this solution is quite feasible.

抄録全体を表示

Computers connected to the Internet are a target for a myriad of complicated attacks. Companies can use sophisticated security systems to protect their computers; however, average users usually rely on built-in or personal firewalls to protect their computers while avoiding the more complicated and expensive alternatives. In this paper we study the feasibility — from the network performance point of view — of a VM configured as an integrated security appliance for personal computers. After discussing the main causes of network performance degradation, we use netperf on the host computer to find the network performance overhead when using a virtual appliance. We are mainly concerned with the bandwidth and the latency that would limit a network link. We compared the bandwidth and latency of this integrated security virtual appliance with current market products and in both cases, the performance of the virtual appliance was excellent compared with hardware counterparts. This security virtual appliance for example allows more than an 80Mbps data transfer rate for individual users, while security appliances generally allow only 150Mbps for small office users. In brief, our tests show that the network performance of a security virtual appliance is on par with the current security appliances available in the market; therefore, this solution is quite feasible.

抄録全体を表示

Operating system (OS) reboots are an essential part of updating kernels and applications on laptops and desktop PCs. Long downtime during OS reboots severely disrupts users' computational activities. This long disruption discourages the users from conducting OS reboots, failing to enforce them to conduct software updates. Although the dynamic updatable techniques have been widely studied, making the system “reboot-free” is still difficult due to their several limitations. As a result, users cannot benefit from new functionality or better performance, and even worse, unfixed vulnerabilities can be exploited by attackers. This paper presents ShadowReboot, a virtual machine monitor (VMM)-based approach that shortens downtime of OS reboots in software updates. ShadowReboot conceals OS reboot activities from user's applications by spawning a VM dedicated to an OS reboot and systematically producing the rebooted state where the updated kernel and applications are ready for use. ShadowReboot provides an illusion to the users that the guest OS travels forward in time to the rebooted state. ShadowReboot offers the following advantages. It can be used to apply patches to the kernels and even system configuration updates. Next, it does not require any special patch requiring detailed knowledge about the target kernels. Lastly, it does not require any target kernel modification. We implemented a prototype in 4.0.10 OSE. Our experimental results show that ShadowReboot successfully updated software on unmodified commodity OS kernels and shortened the downtime of commodity OS reboots on five Linux distributions (Fedora, Ubuntu, Gentoo, Cent, and SUSE) by 91 to 98%.

抄録全体を表示

MateriApps (https://ma.issp.u-tokyo.ac.jp) は2013 年に公開された物質科学シミュレーションのポータルサイトである．MateriApps では，国内外で開発された250 以上の物質科学アプリケーションやツールについてその概要や特徴を掲載することで，ソフトウェア開発者の広報活動を支援するだけでなく，実験家や企業研究者，学生が計算物質科学ソフトウェアを使い始める上で有益な情報を発信してきた．本稿では，MateriApps を用いたソフトウェアの検索方法について紹介するとともに，物質科学シミュレーションパッケージMateriApps LIVE!上で分子動力学シミュレーションを実際に行ってみた例についても説明する．

抄録全体を表示

Nowadays, virtualization is being deployed in many companies and institutions' systems. However, a noticeable security problem of virtualization is the fact that multiple virtual machines are run on one physical host machine called hypervisor. Hypervisors often implement a virtual switch to manage network connections between the internal virtual network and the external physical network. However, an adversary could exploit virtual switch flaws and use them to sabotage the entire virtual network. As a consequence, the attack could make all applications running on virtual machines unavailable. In this paper, we present SVTester, a fuzzing-based testing tool that can automatically identify possible vulnerabilities of a virtual switch that can be exploited for certain types of Denial-of-Service attack. We used an initial version of SVTester to check several hypervisors that implement the virtual switch. The results show that SVTester was able to rediscover DoS weaknesses on an old version of VMware hypervisor and found a novel possible vulnerability in the Oracle

hypervisor. Our results also prove the effectiveness and potential of SVTester in evaluating virtual network security.

抄録全体を表示

Cloud-based video surveillance systems, as a new cloud computing service model, are an emerging research topic, both at home and abroad. Current research is mainly focused on exploring applications of the system. This paper proposes a design and implementation method for cloud-based video surveillance systems using the characteristics of cloud computing, such as parallel computing, large storage space, and easy expandability. The system architecture and function modules are built, and a prototype cloud-based video surveillance system is established in a campus network using key technologies, including virtual machine task access control, video-data distributed storage, and database-active communication methods. Using the system, the user is able to place a webcam in a location that requires monitoring so that video surveillance can be achieved, and video data can be viewed through a browser. The system has the following advantages: low investment and maintenance cost, high portability, easily extendable, superior data security, and excellent sharing. As a private cloud server in the campus network, the system is able to not only provide convenient video surveillance services, but it can also be an excellent practical experimental platform for cloud computing-related research, which carries outstanding application value.

抄録全体を表示

Researchers collect data and use various methods to organize it. Ensuring the reliability and reproducibility of data is crucial, and collaboration across different research fields is on the rise. However, when there is geographical distance, sharing data becomes a challenging task. Therefore, there is a need for the development of a mechanism for sharing data on the web. We have developed an integrated database to facilitate the sharing and management of research data, particularly focusing on small molecules. The integrated database serves as a platform for centralizing data related to small molecules, including their chemical structures, wet lab experimental data, simulation data, and more. It has been constructed as a web application, offering features such as library management for small molecules, registration and viewing of wet lab experiment results, generation of initial conformations for simulations, and data visualization. This enables researchers to efficiently share their research data and collaborate seamlessly, whether within their research group or via cloud-based access that allows project and team members to connect from anywhere. This integrated database plays a critical role in connecting wet lab experiments and simulations, enabling researchers to cross-reference and analyze experimental data comprehensively. It serves as an essential tool to advance research and foster idea generation.

抄録全体を表示

This paper presents 2 improvements related to network construction exercise with network simulator IMUNES in 2018. Improvement 1 is that a method to copy strings printed in IMUNES's virtual terminals on FreeBSD OS to a window of application software on Windows OS is added to the exercise. The method make it easy for users to copy strings. Since IMUNES is an open source software, users can study network construction with the exercise and IMUNES with low cost. Improvement 2 is that how to edit an IMUNES network configuration file is added to the exercise. This method solves a problem that user can't save router configuration on IMUNES's virtual terminals.

抄録全体を表示

In this paper, we propose a scheme to strengthen network-based moving target defense with disposable identifiers. The main idea is to change disposable identifiers for each packet to maximize unpredictability with large hopping space and substantially high hopping frequency. It allows network-based moving target defense to defeat active scanning, passive scanning, and passive host profiling attacks. Experimental results show that the proposed scheme changes disposable identifiers for each packet while requiring low overhead.

抄録全体を表示

Hadoop, a distributed processing framework for big-data, is now widely used for multimedia processing. However, when processing video data from a Hadoop distributed file system (HDFS), unnecessary network traffic is generated due to an inefficient HDFS block slice policy for picture frames in video files. We propose a new block replication policy to solve this problem and compare the newly proposed HDFS with the original HDFS via extensive experiments. The proposed HDFS reduces network traffic, and increases locality between processing cores and file locations.

抄録全体を表示

Due to the government’s declaration of a state of emergency, it was difficult to manage the exercise courses because the students were unable to come to the campus. The author implemented Docker for the virtual machines used in two exercise courses, “Advanced Topics in Media Informatics” and “Media Informatics Major Lab/Exercises B”. The lecture and exercise were conducted via online. Both courses were completed without any serious problems, and the engagement of the students seemed to be increased, suggesting the high educational effectiveness and usefulness of the system. A questionnaire survey, which was conducted after the courses, showed that the system was generally well received, and the space-time independence of the system was also highly evaluated by the students. Especially during “Media Informatics Major Lab/Exercises B” , the students were spontaneously working far beyond the regular class time.

抄録全体を表示

Recently, with the proliferation of IoT devices, network technologies have also rapidly developed to serve the rising needs of users. IoT devices are often complemented by cloud computing technology to provide better services. Fog computing was introduced as a method to bring cloud applications closer to IoT devices so that end-users could avoid communication latency. An edge device at the fog node could use Network Functions Virtualization to optimize its performance and resource management. However, recent research has shown that certain fundamental virtual switch settings can be misused to carry out cyberattacks. In previous research, we proposed Slow-port-exhaustion DoS Attack, an attack that targets virtual switches using the Port Address Translation mechanism for communication between virtual machines and the physical network. In this attack, an attacker with a low amount of attack bandwidth can sabotage the virtual switch by occupying all of the host machine's ports for a long period of time. In this paper, we introduce some methods for exploiting IoT devices to leverage this attack. We also perform experimental attacks with new methods and compare the results with the old methods. Finally, we suggest some countermeasures against this kind of attack.

抄録全体を表示

Many malware programs emerging from the Internet are compressed and/or encrypted by a wide variety of packers to deter code analysis, thus making it necessary to perform unpacking first. To do this task efficiently, Guo et al. proposed a generic unpacking system named Justin that provides original entry point (OEP) candidates. Justin executes a packed program, and then it extracts written-and-executed points caused by the decryption of the original binary until it determines the OEP has appeared, taking those points as candidates. However, for several types of packers, the system can provide comparatively large sets of candidates or fail to capture the OEP. For more effective generic unpacking, this paper presents a novel OEP detection method featuring two mechanisms. One identifies the decrypting routine by tracking relations between writing instructions and written areas. This is based on the fact that the decrypting routine is the generator for the original binary. In case our method fails to detect the OEP, the other mechanism sorts candidates based on the most likely candidate so that analysts can reach the correct one quickly. With experiments using a dataset of 753 samples packed by 25 packers, we confirm that our method can be more effective than Justin's heuristics, in terms of detecting OEPs and reducing candidates. After that, we also propose a method combining our method with one of Justin's heuristics.

抄録全体を表示

CAPTCHA is a kind of challenge response test, which is used to distinguish human users from malicious computer program such as bots. However, the attack technique called relay attack as a method to avoid the CAPTCHA has been devised. This attack relays the CAPTCHA challenges to remote human-solvers, let them to decode CAPTCHA challenges. We used delay time that is caused by communications needed in relay attack. Our new CAPTCHA uses this delay time between communications to prevent relay attacks. We constructed an experimental environment in which relay attack can be simulated, made a series of experiments in order to evaluate the performance of the proposed method.

抄録全体を表示

Malicious software (malware) poses various significant challenges. One is the need to retrieve plain-text messages transmitted between malware and herders through an encrypted network channel. Those messages (e.g., commands for malware) can be a useful hint to reveal their malicious activities. However, the retrieving is challenging even if the malware is executed on an analysis computer. To assist analysts in retrieving the plain-text from the memory, this paper presents FCReducer(Function Candidate Reducer), which provides a small candidate set of cryptographic functions called by malware. Given this set, an analyst checks candidates to locate cryptographic functions. If the decryption function is found, she then obtains its output as the plain-text. Although existing systems such as CipherXRay have been proposed to locate cryptographic functions, they heavily rely on fine-grained dynamic taint analysis (DTA). This makes them weak against under-tainting, which means failure of tracking data propagation. To overcome under-tainting, FCReducer conducts coarse-grained DTA and generates a typical data dependency graph of functions in which the root function accesses an encrypted message. This does not require fine-grained DTA. FCReducer then applies a community detection method such as InfoMap to the graph for detecting a community of functions that plays a role in decryption or encryption. The functions in this community are provided as candidates. With experiments using 12 samples including four malware specimens, we confirmed that FCReducer reduced, for example, 4830 functions called by Zeus malware to 0.87% as candidates. We also propose a heuristic to reduce candidates more greatly.

抄録全体を表示

The most important point to learn network and system management is to provide a proper and practical training environment to try learning tasks for system administrator to all learners. Although several popular software for virtualization with the emulation technologies are developed and released in nowadays and anyone is able to use the software to learn system management, it is difficult to learn with the Unix type OS for non-specialist learners. The OS (platform) in general does not have ideal functions to advise to the users and also to lead users to the goal. We are constructing a training environment with an advisory function for system administrator on Linux server. In this article, we propose a learning model for server administrator and implementation method as a browser application program, and also we discuss the result of the experiment for system evaluation as example of Web server construction training.

抄録全体を表示