KOSEN, which emphasizes the acquisition of practical skills from the age of 15, is a good fit with the Cyber security body of knowledge. A cyber security education proj ect has occurred at KOSEN, and a project to develop cyber security teaching materials for further teacher training is also underway. In the course of examining the learning effectiveness in this project, we obtained the knowledge that a certain amount of motivation is a critical point to improve the learning effectiveness when using our teaching materials, when cyber security education is viewed from the perspective of gamification. In this study, to make this finding even more effective, we attempted to confirm whether or not Game Based Learning (GBL) enhances motivation and improves learning effectiveness, both in our teaching materials and in teaching materials developed by others, and to gain a foothold for examining the details of the effectiveness of GBL. The validation results show that prior learning in our materials, whether developed by us or not, works effectively in subsequent learning with materials, increasing motivation and positively correlating learning effects with motivation. As a next step, we will obtain further directions for future educational development by further examining which elements contributed to motivation and which were influenced by motivation.

As cyber-attacks intensify, cyber security education in engineering education is becoming increasingly important, and KOSEN, which emphasizes the acquisition of practical skills from the age of 15, is a good fit with the cyber security body of knowledge. The cyber security education project has occurred at KOSEN, and a project to develop cyber security educational materials that also serve as teacher training has been carried out for the past several years, and the educational effects of the developed educational materials have been examined. Educational methods using educational materials can be expected to improve some skills. However, when cyber security education is viewed from the perspective of gamification, motivation for the concepts of attack and defense may contribute to educational effectiveness. In this study, we discussed the motivation that contributes to the effectiveness of skill improvement in practical exercises using educational materials developed through the project we have been working on. We also discussed whether it is possible to enhance life-work balance by considering the project itself as a Role Playing Game, and obtained suggestions on the effectiveness of motivation and how the project can enhance life-work balance.

In recent years, the use of encryption in Internet communications, such as HTTPS, has become more widespread. While encrypted communication technology has been popular and improved the security of communications, there is a concern that the information available from the communications will be reduced, making it difficult to distinguish between normal and malicious communications. As for SSL/TLS, there is an existing measurement called TLS fingerprinting which tries to identify a server or client based on surface-level information such as headers and handshake parameters. However, by randomizing parameters or modifying handshakes, some attacks have already bypassed the detection. Our goal is to identify encrypted communications in a way that is more robust against such circumvention. Therefore, we propose a method that can identify encryption algorithms and cryptographic libraries used in a communication. We focus on the randomness of encrypted communications and use the statistical characteristics of randomness. Our experiment on HTTPS shows that by using only the encrypted application data from TLS communications, we can identify encryption algorithms (without considering the key length), used in the communication, with 89.6% accuracy.

In recent years, cyberattack techniques have become more and more sophisticated each day. Even if defense measures are taken against cyberattacks, it is difficult to prevent them completely. It can also be said that people can only fight defensively against cyber criminals. To address this situation, it is necessary to predict cyberattacks and take appropriate measures in advance, and the use of intelligence is important to make this possible. In general, many malicious hackers share information and tools that can be used for attacks on the dark web or in the specific communities. Therefore, we assume that a lot of intelligence, including this illegal content exists in cyber space. By using the threat intelligence, detecting attacks in advance and developing active defense is expected these days. However, such intelligence is currently extracted manually. In order to do this more efficiently, we apply machine learning to various forum posts that exist on the dark web, with the aim of extracting forum posts containing threat information. By doing this, we expect that detecting threat information in cyber space in a timely manner will be possible so that the optimal preventive measures will be taken in advance.

In this research, we examine and develop an expert system with a mechanism to automate crime category classification and threat level assessment, using the information collected by crawling the dark web. We have constructed a bag of words from 250 posts on the dark web and developed an expert system which takes the frequency of terms as an input and classifies sample posts into 6 criminal category dealing with drugs, stolen credit card, passwords, counterfeit products, child porn and others, and 3 threat levels (high, middle, low). Contrary to prior expectations, our simple and explainable expert system can perform competitively with other existing systems. For short, our experimental result with 1500 posts on the dark web shows 76.4% of recall rate for 6 criminal category classification and 83% of recall rate for 3 threat level discrimination for 100 random-sampled posts.

In recent years, cyber attack techniques are increasingly sophisticated, and blocking the attack is more and more difficult, even if a kind of counter measure or another is taken. In order for a successful handling of this situation, it is crucial to have a prediction of cyber attacks, appropriate precautions, and effective utilization of cyber intelligence that enables these actions. Malicious hackers share various kinds of information through particular communities such as the dark web, indicating that a great deal of intelligence exists in cyberspace. This paper focuses on forums on the dark web and proposes an approach to extract forums which include important information or intelligence from huge amounts of forums and identify traits of each forum using methodologies such as machine learning, natural language processing and so on. This approach will allow us to grasp the emerging threats in cyberspace and take appropriate measures against malicious activities.

Presents the introductory welcome message from the conference proceedings. May include the conference officers' congratulations to all involved with the conference event and publication of the proceedings record.

Recently, dynamic access control models are proposed to restrict access domain appropriately in multi-layered defense. However, policy description languages proposed so far can not express the models effectively in proper granularity. In this paper, we propose a policy description language which can designate precise condition for access control by using dynamic status of application process. Using the proposed language, we compose the policy of SELinux which is major implementation achieving multi-layered defense and confirm the advantages of the proposed language by evaluating the response and the expressiveness.