Matsuura Laboratory Members
Update: Jan, 2024
List
Members
Interest
Publications
-
Kanta Matsuura,
Takurou Hosoi.
Mechanism Design of Data Sharing for Cybersecurity Research,
IPSI Transactions on Advanced Research,
Vol.11,
No.1,
pp.35-40,
2015
[detail]
abstract
If we want to realize a scientific approach to cybersecurity, we need objective
and reproducible evaluation of security.
Although some of cryptographic
technologies have rigorous security proofs, a lot of cybersecurity technologies
rely on experimental evaluation which needs good datasets.
One may expect that
sharing such datasets would help at least the reproducibility of the evaluation.
At the same time, one may be afraid that effective mechanism design is difficult
because there have been a lot of studies on disincentive problems
(e.g.
free-riding) associated with information sharing in cybersecurity.
However, the requirements and typical solutions for data sharing would be
different from those for information sharing.
In this paper, we comprehensively
discuss the features of "data sharing for cybersecurity research" based on a
systematic comparison with "information sharing for cybersecurity practice".
We
also report a Japanese case in the field of malware analysis.
One important finding is that considering human resource development is an
important factor in the activities associated with data sharing.
-
Kanta Matsuura,
Takurou Hosoi.
Data Sharing for Cybersecurity Research and Information Sharing for Cybersecurity Practice,
The 8th International Workshop on Security (IWSEC2013),
2013
[detail]
abstract
When we want to realize a scientific approach to cybersecurity,
we need objective and reproducible evaluation of security properties.
Although some of cryptographic technologies have rigorous security proofs,
a lot of cybersecurity technologies rely on experimental security evaluation
which needs good datasets.
One may expect that sharing such datasets would help
at least the reproducibility of the evaluation.
At the same time, one may be afraid
that effective mechanism design is not trivial because there have been a lot of
studies on disincentive problems (e.g.
free-riding) associated with information
sharing for cybersecurity practice.
However, the requirements and typical solutions
for data sharing would be different from those for information sharing.
In this poster,
we comprehensively discuss the features of data sharing for cybersecurity research
based on a systematic comparison with information sharing for cybersecurity practice.
We also identify some intrinsic limitations of the data sharing approach.
-
Takurou Hosoi,
Kanta Matsuura.
Effectiveness of a Change in TCP Retransmission Timer Management for Low-rate DoS Attack Mitigation and Attack Variants,
The 8th International Workshop on Security (IWSEC2013),
2013
[detail]
abstract
The mechanism of TCP retransmission timeout
is essential to the Internet congestion control.
But existing research pointed out
that this mechanism allows DoS attack
with low-rate mean traffic.
We proposed a change in TCP retransmission timeout management,
in which
length of TCP retransmission timer is increased
not to precisely twice of the prior timer length
in successive timeout waiting.
We investigate its effectiveness
in DoS attack mitigation analytically,
and some attack variants under this countermeasure.
-
Kanta Matsuura,
Takurou Hosoi.
Data Sharing for Cybersecurity Research: A Comparison with Information Sharing for Cybersecurity Practice,
Ninth Annual Forum on Financial Information Systems and Cybersecurity: A Public Policy Perspective,
2013
-
Takurou HOSOI,
Kanta Matsuura.
Evaluation of the Common Dataset Used in Anti-Malware Engineering Workshop 2009,
Lecture Notes in Computer Science (Recent Advances in Intrusion Detection,
13th International Symposium on Recent Advances in Intrusion Detection: RAID 2010),
Vol.6307,
pp.496-497,
2010
-
Takuro Hosoi,
Kanta Matsuura,
Hideki Imai.
IP Trace Back by Packet Marking Method with Bloom Filters,
Proceedings of the 2007 IEEE International Carnahan Conference on Security Technology (2007 ICCST) 41st Annual Conference,
pp.255-263,
2007
Interest
- Digital forensics, Control system security
Publications
-
Kensuke Tamura,
Kanta Matsuura.
Improvement of Anomaly Detection Performance using Packet Flow Regularity in Industrial Control Networks,
IEICE Transactions on Fundamentals of Electronics,
Communications and Computer Sciences,
Vol.E102-A,
No.1,
pp.65-73,
2019
[detail]
abstract
Since cyber attacks such as cyberterrorism against Industrial
Control Systems (ICSs) and cyber espionage against companies managing
them have increased, the techniques to detect anomalies in early
stages are required.
To achieve the purpose, several studies have developed
anomaly detection methods for ICSs.
In particular, some techniques
using packet flow regularity in industrial control networks have achieved
high-accuracy detection of attacks disrupting the regularity, i.e.
normal
behavior, of ICSs.
However, these methods cannot identify scanning attacks
employed in cyber espionage because the probing packets assimilate
into a number of normal ones.
For example, the malware called Havex is
customized to clandestinely acquire information from targeting ICSs using
general request packets.
The techniques to detect such scanning attacks
using widespread packets await further investigation.
Therefore, the goal of
this study was to examine high performance methods to identify anomalies
even if elaborate packets to avoid alert systems were employed for attacks
against industrial control networks.
In this paper, a novel detection model
for anomalous packets concealing behind normal traffic in industrial control
networks was proposed.
For the proposal of the sophisticated detection
method, we took particular note of packet flow regularity and employed the
Markov-chain model to detect anomalies.
Moreover, we regarded not only
original packets but similar ones to them as normal packets to reduce false
alerts because it was indicated that an anomaly detection model using the
Markov-chain suffers from the ample false positives affected by a number
of normal, irregular packets, namely noise.
To calculate the similarity between
packets based on the packet flow regularity, a vector representation
tool called word2vec was employed.
Whilst word2vec is utilized for the
calculation of word similarity in natural language processing tasks, we applied
the technique to packets in ICSs to calculate packet similarity.
As a
result, the Markov-chain with word2vec model identified scanning packets
assimilating into normal packets in higher performance than the conventional
Markov-chain model.
In conclusion, employing both packet flow
regularity and packet similarity in industrial control networks contributes
to improving the performance of anomaly detection in ICSs.
- Associate Research Fellow
Interest
- Anonymous communication system
Interest
Publications
-
Ryu Ishii,
Kyosuke Yamashita,
Yusuke Sakai,
Tadanori Teruya,
Takahiro Matsuda,
Goichiro Hanaoka,
Kanta Matsuura,
Tsutomu Matsumoto.
Aggregate Signature Schemes with Traceability of Devices Dynamically Generating Invalid Signatures,
IEICE Transactons on Information and Systems,
Vol.E105-D,
No.11,
pp.1845-1856,
2022
[detail]
abstract
Aggregate signature schemes enable us to aggregate multiple signatures
into a single short signature.
One of its typical applications is sensor networks,
where a large number of users and devices measure their environments,
create signatures to ensure the integrity of the measurements,
and transmit their signed data.
However, if an invalid signature is
mixed into aggregation, the aggregate signature becomes invalid,
thus if an aggregate signature is invalid, it is necessary to identify
the invalid signature.
Furthermore, we need to deal with a situation
where an invalid sensor generates invalid signatures probabilistically.
In this paper, we introduce a model of aggregate signature schemes with
interactive tracing functionality that captures such a situation, and
define its functional and security requirements and propose aggregate
signature schemes that can identify all rogue sensors.
More concretely,
based on the idea of Dynamic Traitor Tracing, we can trace rogue sensors
dynamically and incrementally, and eventually identify all rogue sensors
of generating invalid signatures even if the rogue sensors adaptively collude.
In addition, the efficiency of our proposed method is also sufficiently practical.
-
Ryu Ishii,
Kyosuke Yamashita,
Zihao Song,
Yusuke Sakai,
Tadanori Teruya,
Goichiro Hanaoka,
Kanta Matsuura,
and Tsutomu Matsumoto.
Constraints and Evaluations on Signature Transmission Interval for Aggregate Signatures with Interactive Tracing Functionality,
Lecture Notes in Computer Science (Attacks and Defenses for the Internet-of-Things 5th International Workshop,
ADIoT 2022),
Vol.13745,
pp.51-71,
2022
[detail]
abstract
Fault-tolerant aggregate signature (FT-AS) is a special type of
aggregate signature that is equipped with the functionality for
tracing signers who generated invalid signatures in the case an
aggregate signature is detected as invalid.
In existing FT-AS
schemes (whose tracing functionality requires multi-rounds), a
verifier needs to send a feedback to an aggregator for efficiently
tracing the invalid signer(s).
However, in practice, if this feedback
is not responded to the aggregator in a sufficiently fast and timely
manner, the tracing process will fail.
Therefore, it is important to
estimate whether this feedback can be responded and received in time on a real system.
In this work, we measure the total processing time required for the
feedback by implementing an existing FT-AS scheme, and evaluate
whether the scheme works without problems in real systems.
Our experimental results show that the time required for the feedback
is 605.3 ms for a typical parameter setting, which indicates that
if the acceptable feedback time is significantly larger than a few hundred ms,
the existing FT-AS scheme would effectively work in such systems.
However,
there are situations where such feedback time is not acceptable,
in which case the existing FT-AS scheme cannot be used.
Therefore,
we further propose a novel FT-AS scheme that does not require any feedback.
We also implement our new scheme and show that a feedback in this scheme
is completely eliminated but the size of its aggregate signature
(affecting the communication cost from the aggregator to the verifier)
is 144.9 times larger than that of the existing FT-AS scheme (with feedbacks)
for a typical parameter setting, and thus has a trade-off between the feedback
waiting time and the communication cost from the verifier to the aggregator
with the existing FT-AS scheme.
-
Daisuke Sumita,
Kanta Matsuura.
Identifying Crypto API Usages in Android Apps using a Static Analysis Framework,
First DFRWS APAC Conference (poster presentation),
2021
[detail]
abstract
Forensic analysis of mobile devices is essential work for digital forensic investigators.
While there are various data stored in smartphones, some of the data is encrypted by applications.
Data encryption is one of the major issues of digital forensics, preventing investigators from analyzing the data quickly.
In this work, we develop a tool to automatically analyze crypto API usages in Android apps.
There are many Android apps which encrypt their data in smartphones using standard crypto APIs.
In such cases, we can identify the cryptographic algorithms and parameters via application analysis,
which helps us to analyze encrypted data.
Most existing studies focus on single app, and rely on manual analysis,
which requires a certain amount of skill and knowledge about reverse engineering.
For this reason,
we develop our tool which can analyze apps automatically, therefore we can easily identify crypto API usages in new apps.
For developing analysis tool, we select and categorize typical 41 Android APIs which is used
for derivation of crypto APIs parameters.
Then we build our tool which can identify what API is used for crypto APIs parameters.
We conduct experimental tests analyzing 139 real-world apps using our tool.
As a result,
we found 378 crypto API calls for the data decryption and identify 212 parameters of the API calls.
Interest
Publications
-
Ryuya Hayashi,
Taiki Asano,
Junichiro Hayata,
Takahiro Matsuda,
Shota Yamada,
Shuichi Katsumata,
Yusuke Sakai,
Tadanori Teruya,
Jacob C.
N.
Schuldt,
Nuttapong Attrapadung,
Goichiro Hanakoka,
Kanta Matsuura,
Tsutomu Matsumoto.
Signature for Objects: Formalizing How to Authenticate Physical Data and More,
Lecture Notes in Computer Science (The 27th International Conference on Financial Cryptography and Data Security: FC2023),
Vol.13950,
pp.182-199,
2023
[detail]
abstract
While the integrity of digital data can be ensured via digital signatures,
ensuring the integrity of physical data,
i.e., objects, is a more challenging task.
For example, constructing a digital signature on data extracted
from an object does not necessarily guarantee that an adversary
has not tampered with the object or replaced this
with a cleverly constructed counterfeit.
This paper proposes a new concept called signatures for objects
to guarantee the integrity of objects cryptographically.
We first need to consider a mechanism that allows us to mathematically
treat objects which exist in the physical world.
Thus, we define a model called an object setting in which
we define physical actions, such as a way to extract data
from objects and test whether two objects are identical.
Modeling these physical actions via oracle access enables
us to naturally enhance probabilistic polynomial-time algorithms
to algorithms having access to objects - we denote
these physically enhanced algorithms (PEAs).
Based on the above formalization, we introduce two security definitions
for adversaries modeled as PEAs.
The first is unforgeability, which is the natural extension
of EUF-CMA security, meaning that any adversary
cannot forge a signature for objects.
The second is confidentiality, which is a privacy notion,
meaning that signatures do not leak any information about signed objects.
With these definitions in hand,
we show two generic constructions: one satisfies unforgeability
by signing extracted data from objects; the other satisfies unforgeability
and confidentiality by combining a digital signature with obfuscation.
Interest
Publications
-
Taichi Igarashi,
Hiroya Kato,
Iwao Sasase,
Kanta Matsuura.
A Realtime IoT Malware Classification System Based on Pending Samples,
2023 IEEE International Conference on Communications (ICC): Communication and Information System Security Symposium (ICC2023),
pp.4380-4385,
2023
[detail]
abstract
With the rapid growth of Internet of Things (IoT) devices,
a lot of IoT malware has been created,
and the security against IoT malware,
especially the family classification, has become a more important issue.
There exist three requirements which classification systems
must achieve: detection of new families,
precise classification for sequential inputs,
and being independent of computer architectures.
However, existing methods do not satisfy them simultaneously.
In this paper, we propose a realtime IoT malware classification system
based on pending samples.
In order to detect new families and to classify sequential inputs precisely,
we introduce the concept of "pending samples".
This concept is useful when heterogeneous inputs which are difficult
to classify instantly come into the system.
This is because the system can postpone classifying them until
similar samples come.
Once similar samples are gathered, we regard these samples
as a new cluster, meaning that detecting new families is achieved.
Moreover, we use printable strings to satisfy the requirement
of being independent of architectures
because strings are common among different architectures.
Our results show the ability to detect new families demonstrated
by finding new clusters after applying our algorithm to
the initial clusters.
Furthermore, our new clustering algorithms achieves a 0.130 higher
V-measure compared to the k-means algorithm,
which is the representative clustering algorithm.
-
Taichi Igarashi,
Kanta Matsuura.
A Refined Classification of Malicious Smart Contract,
Lecture Notes in Computer Science (The 27th International Conference on Financial Cryptography and Data Security: FC2023,
Posters presentation),
2023
[detail]
abstract
With the rapid growth of blockchain, smart contract,
which is the computer program executed on blockchain systems,
has played an important role especially in the trade of cryptcurrency.
However, smart contracts are utilized to commit some crimes or attacks
because they often hold a large amount of cryptcurrency.
Thus, to enhance the security of smart contract is an urgent need.
There exists three types of crimes regarding smart contract, namely,
attack using vulnerabilities,
trade between criminals, and fraud.
Some researchers reported that many smart contracts have vulnerabilities,
and attackers exploit them to steal cryptcurrency or attack system itself
like DoS attack.
Another type of crime is to trade criminal information for rewards
between criminals using smart contracts.
Especially in recent years, fraud acts including phishing have become
a big problem on blockchain, and smart contracts are utilized to support them.
These crimes have occured due to the presense of Malicious Smart Contract
(MSC).
Thus, the systems which detect MSC are needed to prevent these crimes.
Though MSC is a smart contract which shows malicious activities,
there does not exist a clear definition.
As a result, the word "malicious" is used in different ways among researchers.
In this situation, it is difficult to detect whole MSCs.
This is because different types of MSC have different malicious activities,
meaning that detection systems corresponded to each type of MSC are needed.
Therefore, the classification of MSC is required.
Some researchers classify MSC into
two types: Vulnerable Smart Contract (VSC) related to vulnerability
and Criminal Smart Contract (CSC) related to trade between criminals.
In this classification model, however,
there does not exist a type of MSC corresponded to fraud activities.
To overcome this problem,
we propose a new standpoint that MSC should be classified into VSC,
CSC and Fraudulent Smart Contract (FSC),
which supports frauds.
By introducing this standpoint,
to detect whole MSCs will be realized by constructing detection systems
of each MSC simultaneously.
While there exists a lot of works of detecting VSC and a few CSC works
have also proposed, a field of FSC detection has not developed.
Some researchers proposed detection systems of malicious accounts.
In this field, "malicious" means fraud activities.
Thus, we consider that these kinds of works are similar to detection
of FSC and can be applied.
These studies mainly use machine learning to detect malicious accounts.
However, their models only consider graph-based features constructed
from external transaction and address data,
and not focus on other features.
Therefore, as a future work,
considering internal transaction and smart contract code-based feature
like opcode is worth working.
|