Currently, LoRa suffers from scalability issues, making it still far from a feasible option for LPWAN in large deployment scenarios. During Signal Transmission, no other signal employing the same Spreading Factor should be transmitted simultaneously, as this condition would render both signals unrecoverable. We proposed introducing orthogonal codes to the LoRa Physical layer. We demonstrated that the introduction of orthogonal codes significantly enhanced the signal recovery rate, achieving a Detection Error Rate (DER) of $\mathbf{9 9. 5 \%}$ for singledevice scenarios and maintaining robust performance with an $\mathbf{8 5. 3 3 \%}$ DER for two devices per SF.

Biometric verification is essential for secure identity verification and authentication during banking transactions using fingerprints, facial features, irises, and voices. Among these methods, voice biometrics is a promising alternative owing to its potential for robust and convenient user authentication. However, their effectiveness is significantly challenged by variations in the voice caused by different device configurations and environmental conditions. These variations can reduce the effectiveness of speaker identification and undermine the reliability of voice-based systems for securing online transactions. For an effective comparative solution, this study addresses these challenges by focusing on the difficulties posed by voice variations due to differences in device hardware, microphone quality, and environmental noise. Our approach employs machine-learning techniques using advanced speech enhancement methods to improve the consistency and accuracy of voice biometric verification across diverse devices. Specifically, we employ an adaptive filter model that enhances signal extraction, noise suppression, and predictive precision. Furthermore, our empirical demonstration showed that the adaptive filter significantly improved the accuracy of voice biometric systems by mitigating the impact of device-induced voice variations. In addition, we evaluate the performance of this model using a range of metrics.

The introduction of Network Function Virtualization (NFV) has shifted network processing from specialized hardware to more flexible commodity servers, and this transition is still evolving. New industrial applications, the Internet of Things (IoT), and technologies like augmented, virtual, and mixed reality (AR/VR/MR) require networks that can handle event-based operations and middleware with very low and predictable latency. These requirements pose performance optimization challenges for packet processing in a layered infrastructure. In this study, we look deep into the challenges of implementing such network infrastructures using general-purpose hardware, a strategy motivated by its flexibility to realize telco-cloud and the potential to reduce electronic waste. Focusing on NFV with an emphasis on containerized network functions (CNFs), we investigate the performance limitations, particularly the high jitter and throughput variation observed in packet forwarding. We used a network function (NF) implemented using defacto industry standard user-space I/O architecture DPDK in bare-metal and containerized environments for performance evaluation. We conducted ten experiments in a 40 GbE environment to measure throughput, latency, and jitter across various packet sizes, traffic rates, and system configurations. The results indicate that adjusting CPU settings can significantly enhance throughput for CNFs despite a potential increase in jitter. We found that CNFs are feasible for latency-sensitive tasks, particularly under conditions of low traffic and specific packet sizes. With careful system-level configuration, CNFs can be used in beyond 5G cloud-native networking, offering promising potential for latency-sensitive applications.

International audience

Mobile phones were originally designed for commu-nication, wherein they have evolved into multifunctional devices used for financial transactions, social media, and more, making them an integral mode of communication for the dweller's world. However, the mostly used OS in mobile devices, Android consist of various vulnerabilities and lack sufficient security measures, leaving them susceptible to malware injection. Moreover, the attackers develop sophisticated malware, which is challenging to detect by traditional detection approaches. Henceforth, an effective malware detection method is imperative to ensure the safety and security of Android systems. In this study, we address the dynamic analysis of Android malware using supervised and semi-supervised deep neural network techniques to tackle existing challenges. Our investigation is conducted on the CCCS-CIC-AndMal-2020 dataset and the results reveal that our proposed supervised models (1D CNN, MLP, RNN and LSTM) outperform state-of-the-art supervised models significantly with an accuracy of 99.76%. Additionally, we explore semi-supervised approach using limited label data, where our label spreading approach showcases a highly effective detection accuracy of 97.26%, approaching that of a fully supervised approach.

Nowadays, edge computing has become part of the Internet of Things (IoT) that plays a vital role in developing smart applications. As the usage of IoT devices significantly increases, at the same time, network edge infrastructure faces several security challenges. Distributed Denial-of-Service (DDoS) attack is one of the most severe threats to edge-cloud services. Therefore, designing a robust mitigating system is unavoidable for the network edge, and it must be able to recognize emerging attacks. This work proposes an anomaly-based DDoS detection approach that combines information-theoretic metrics and multivariate correlation analysis. The information-theoretic metric captures the randomness and complex nature of traffic behaviour. Similarly, multivariate correlation analysis identifies the relationship among traffic features. Combining information metrics and correlation analysis, we generate normal and attack traffic profiles for the training base to estimate density. The generated profiles build on the metrics including Triangle Area Mapping (TAM) with correlation analysis, Renyi’s divergence, covariance, mean, and standard deviation, which enhances the detection performance of the proposed approach. The effectiveness of the proposed approach is evaluated using testbed and benchmark datasets. The results show that the proposed approach achieves 0.17% and 2.32%, and 0.50% higher accuracy compared to the baseline approaches on the testbed, UNSW and CIC-DDoS datasets, respectively.

Electricity thefts are conventionally manually detected by inspections, accusations, and the failure of meters. However, the recent evolution of machine learning may allow the automatic detection of electricity theft only from the patterns of meter readings. Electric consumption heavily relies on many factors, e.g., the lifestyle of the day and the weather, and thus the accuracy of detection is questioned. We propose an electricity theft detection framework for smart homes with knowledge-based synthetic attack data. This allows training of the attack classifier only from the legitimate power consumption data, i.e, without attack actions and associated labels. We identified five attack patterns as the knowledge which consisted of smart attacks and legacy attacks. We have conducted comprehensive evaluations with nine machine learning models using the Almanac of Minutely Power dataset version 2 (AMPds2) dataset fine-grained time-series data of a smart home. We found that Gradient Boosting-based algorithms achieved the best, and Random Forest performed alternatively with almost 100% accuracy for detecting and classifying legacy attacks. Some smart attacks were not detected, but those algorithms achieved good performance in detection and classification.

Cyber-attacks on industrial control systems (ICSs) may cause huge damage to our society and our lives. RS-485 is a backbone network for many ICSs deployed worldwide as a standard. Attack detection in the RS-485 network has been studied in the past. However, the operator still needs to identify and eliminate the attacker in the network after detected, which may require a huge downtime of the system. We propose an attacker localization framework for RS-485 networks. This framework uses (1) a current transformer for monitoring the analog signals of the communication line and (2) machine learning for detecting and localizing the attacker. We have carried out a performance evaluation on a 200-meter scale testbed and found that regression-based localization model performed the best with an averaging aggregator. It could estimate the location of the attacker with about 100% accuracy if we could obtain 6 or 10 attacker points in the training dataset. It could also estimate the location with 93%-96% accuracy with only 4 attacker training points, which would be still practically useful for finding the attacker in RS-485 network.

Purpose Smart-home security involves multilayered security challenges related to smart-home devices, networks, mobile applications, cloud servers and users. However, very few studies focus on smart-home users. This paper aims to fill this gap by investigating the potential interests of adult smart-home users in cybersecurity awareness training and nonfinancial rewards that may encourage them to adopt sound cybersecurity practices. Design/methodology/approach A total of 423 smart-home users between the ages of 25 and 64 completed a survey questionnaire for this study, with 224 participants from Japan and 199 from the UK. Findings Cultural factors considerably influence adult smart-home users’ attitudes toward cybersecurity. Specifically, cultural differences impact their willingness to participate in cybersecurity awareness training, their views on the importance of cybersecurity training for children and senior citizens and their preference for nonfinancial rewards as an incentive for good cybersecurity behavior. These results highlight the need to consider cultural differences and their potential impact when developing and implementing cybersecurity programs that target smart-home users. Practical implications This research has two main implications. First, it provides insights for information security professionals on the importance of designing cost-effective and time-efficient cybersecurity awareness training programs for smart-home users. Second, the findings may assist governments in establishing nonfinancial incentives to encourage greater uptake of cybersecurity practices among smart-home users. Originality/value The paper investigates whether adult smart-home users are willing to spend time and money to engage in cybersecurity awareness training and to encourage their children and elderly parents to participate in training, as well. In addition, the paper examines incentives, especially nonfinancial rewards, that may motivate adult smart-home users to adopt cybersecurity behaviors at home. Furthermore, the paper analyses demographic differences among smart-home users in Japan and the UK.

Cloud computing dominates the information communication and technology landscape despite the presence of lingering security issues such as the interdependency problem. The latter is a co-residence conundrum where the attacker successfully compromises his target virtual machine by first exploiting the weakest (in terms of security) virtual machine that is hosted in the same server. To tackle this issue, we propose a novel virtual machine allocation policy that is based on the attacker's efficiency and coverage. By default, our allocation policy considers all legitimate users as attackers and then proceeds to host the users' virtual machines to the server where their efficiency and/or coverage are the smallest. Our simulation results show that our proposal performs better than the existing allocation policies that were proposed to tackle the same issue, by reducing the attacker's possibilities to zero and by using between 30 - 48% less hosts.

The Controller Area Network (CAN) bus system works inside connected cars as a central system for communication between electronic control units (ECUs). Despite its central importance, the CAN does not support an authentication mechanism, i.e., CAN messages are broadcast without basic security features. As a result, it is easy for attackers to launch attacks at the CAN bus network system. Attackers can compromise the CAN bus system in several ways: denial of service, fuzzing, spoofing, etc. It is imperative to devise methodologies to protect modern cars against the aforementioned attacks. In this paper, we propose a Long Short-Term Memory (LSTM)-based Intrusion Detection System (IDS) to detect and mitigate the CAN bus network attacks. We first inject attacks at the CAN bus system in a car that we have at our disposal to generate the attack dataset, which we use to test and train our model. Our results demonstrate that our classifier is efficient in detecting the CAN attacks. We achieved a detection accuracy of 99.9949%.

The modern car is increasingly connected. That connection is magnified by the presence of a large number of electronic control units (ECUs). The communication between the ECUs of a modern car is assured by the Controller Area Network (CAN) bus system. Despite its importance, the CAN bus system is bereft of security mechanisms making it vulnerable to numerous security attacks. When an attacker succeeds in compromising the ECUs, they can take control and stop the engine, disable the brakes, turn the lights on/off, etc. An intrusion detection system (IDS) can be deployed as an appropriate security measure to detect the malicious network traffic in the CAN bus system. In this paper, we propose a Convolutional Neural Network (CNN)-based network attacks IDS for protecting the CAN bus system. For efficiency reasons, we generated our own datasets from three car models. Our experiment results demonstrate that our classifier is efficient for detecting the CAN bus system attacks, and it performs with a high accuracy of 99.99% and a detection rate of 0.99.

There is a growing need to anonymize data as new businesses are increasingly utilizing vast amount of unstructured text. Also, unstructured text have a risk of personal location estimation by considering location information. Nevertheless, existing generalizations do not take into location information and therefore cannot robustly handle this attack. In this study, we proposed anonymizing location information in unstructured text using knowledge graph newly constructed from an actual geographic information system. Our method has the advantages of anonymization, taking into account actual geographic information, handling abbreviations and spelling inconsistencies, and allowing for dynamic graph updates. The results of the evaluation experiments show that anonymization is more robust than existing methods against location estimation attacks without compromising its usefulness as a dataset. Also, we found that the names of organizations and places with a high probability of occurrence in unstructured text are more likely to lead to personal identification.

Meltdown & Spectre came as natural disasters to the IT world with several doomsday scenarios being professed. Yet, when we turn to the de facto standard body for assessing the severity of a security vulnerability, the Common Vulnerability Scoring System (CVSS), we surprisingly notice that Meltdown & Spectre do not command the highest scores. We witness a similar situation for other rock star vulnerabilities (vulnerabilities that have received a lot of media attention) such as Heartbleed and KRACKs. In this manuscript, we investigate why the CVSS ‘fails’ at capturing the intrinsic characteristics of rock star vulnerabilities. We dissect the different elements of the CVSS (v2 and v3) to prove that there is nothing within it that can indicate why a particular vulnerability is a rock star. Further, we uncover a pattern that shows that, despite all the beautifully elaborated formulas, magic numbers and catch phrases of the CVSS, there is still a heavy presence human emotion into the scoring as rock star vulnerabilities that were exploited in the wild before being discovered tend to have a higher score than those that were discovered and responsibly disclosed by security researchers. We believe that this is the principal reason of the discrepancy between the scoring and the level of media attention as the majority of 'modern' high level vulnerabilities are introduced by security researchers.

DDoS (Distributed Denial of Service) attacks pose a serious threat to the Internet as they use large numbers of zombie hosts to forward massive numbers of packets to the target host. Here, we present an adaptive boosting-based ensemble learning model for detecting low-and high-rate DDoS attacks by combining information divergence measures. Our model is trained against a baseline model that does not use labeled traffic data and draws on multiple baseline models developed in parallel to improve its accuracy. Incoming traffic is sampled time-periodically to characterize the normal behavior of input traffic. The model's performance is evaluated using the UmU testbed, MIT legitimate, and CAIDA DDoS datasets. We demonstrate that our model offers superior accuracy to established alternatives, reducing the incidence of false alarms and achieving an F1-score that is around 3% better than those of current state-of-the-art DDoS detection models.

Cloud datacenters are engineered to meet the requirements of generalised and specialised workloads including mission-critical applications that not only generate tremendous amounts of data traces but also opens opportunities for attackers. The increasing volume and rapid changing behaviour of metric streams (e.g., CPU, network, latency, memory) in the cloud datacenters create difficulties to ensure high availability, security, and performance to cloud service providers. Several anomaly detection techniques have been developed to combat system anomalies in cloud datacenters. By injecting a fraction of well-crafted malicious samples in cloud datacenter traces, attackers can subvert the learning process and results in unacceptable false alarms. These security issues cause threats to all categories of anomaly detection. Hence, it is crucial to assess these techniques against adversaries to improve scalability and robustness. We propose a linear regression-based optimisation framework with the ability to poison data in the training phase and demonstrate its effectiveness on cloud datacenter traces. Finally, we investigate the worst-case analysis of poisoning attacks on robust statistics-based anomaly detection techniques to quantify and assess the detection accuracy. We validate this framework using benchmark resource traces obtained from Yahoo's service cluster as well as traces collected from an experimental testbed with realistic service composition.

Purpose The purpose of this paper is to investigate security decision-making during risk and uncertain conditions and to propose a normative model capable of tracing the decision rationale. Design/methodology/approach The proposed risk rationalisation model is grounded in literature and studies on security analysts’ activities. The model design was inspired by established awareness models including the situation awareness and observe–orient–decide–act (OODA). Model validation was conducted using cognitive walkthroughs with security analysts. Findings The results indicate that the model may adequately be used to elicit the rationale or provide traceability for security decision-making. The results also illustrate how the model may be applied to facilitate design for security decision makers. Research limitations/implications The proof of concept is based on a hypothetical risk scenario. Further studies could investigate the model’s application in actual scenarios. Originality/value The paper proposes a novel approach to tracing the rationale behind security decision-making during risk and uncertain conditions. The research also illustrates techniques for adapting decision-making models to inform system design.

Many people today use public Wi-Fi networks but they harbor security and privacy risks. We investigated the extent of these risk today, and what factors influenced users to use the networks, adapting the design of a previous UK study, this time in Japan. We first set up an experimental open public Wi-Fi network at ll locations in downtown Nara and captured Internet traffic. From approximately 7.7 million packets captured from 196 unique mobile devices during a 150-hour experiment, we found private photos, emails, documents, and login credentials being transmitted without encryption - showing that many people use unsecured public Wi-Fi networks, and many applications do not encrypt data they send. We then examined why people use public Wi-Fi in a range of scenarios through a survey with 103 participants. We found that the desire to conserve mobile data allowance was linked to a risk-taking attitude, and use of unsecured public Wi-Fi, especially among participants with a low monthly data allowance. Gender and education also played a role; female participants and those with high school education were more likely to use public Wi-Fi.

Cache-based side channel attack (CSCa) techniques in virtualization systems are becoming more advanced, while defense methods against them are still perceived as nonpractical. The most recent CSCa variant called Flush + Flush has showed that the current detection methods can be easily bypassed. Within this work, we introduce a novel monitoring approach to detect CSCa operations inside a virtualization environment. We utilize the Kernel Virtual Machine (KVM) event data in the kernel and process this data using a machine learning technique to identify any CSCa operation in the guest Virtual Machine (VM). We evaluate our approach using Receiver Operating Characteristic (ROC) diagram of multiple attack and benign operation scenarios. Our method successfully separate the CSCa datasets from the non-CSCa datasets, on both trained and nontrained data scenarios. The successful classification also include the Flush + Flush attack scenario. We are also able to explain the classification results by extracting the set of most important features that separate both classes using their Fisher scores and show that our monitoring approach can work to detect CSCa in general. Finally, we evaluate the overhead impact of our CSCa monitoring method and show that it has a negligible computation overhead on the host and the guest VM.

Today, websites are exposed to various threats that exploit their vulnerabilities. A compromised website will be used as a stepping-stone and will serve attackers' evil purposes. For instance, URL redirection mechanisms have been widely used as a means to perform web-based attacks covertly; i.e., an attacker injects a redirect code into a compromised website so that a victim who visits the site will be automatically navigated to a malware distribution site. Although many defense operations against malicious websites have been developed, we still encounter many active malicious websites today. As we will show in the paper, we infer that the reason is associated with the evolution of the ecosystem of malicious redirection . Given this background, we aim to understand the evolution of the ecosystem through long-term measurement. To this end, we developed a honeypot-based monitoring system, which specializes in monitoring the behavior of URL redirections. We deployed the monitoring system across four years and collected more than 100K malicious redirect URLs, which were extracted from 776 distinct websites. Our chief findings can be summarized as follows: (1) Click-fraud has become another motivation for attackers to employ URL redirection, (2) The use of web-based domain generation algorithms (DGAs) has become popular as a means to increase the entropy of redirect URLs to thwart URL blacklisting, and (3) Both domain-flux and IP-flux are concurrently used for deploying the intermediate sites of redirect chains to ensure robustness of redirection. Based on the results, we also present practical countermeasures against malicious URL redirections. Security/network operators can leverage useful information obtained from the honeypot-based monitoring system. For instance, they can disrupt infrastructures of web-based attack by taking down domain names extracted from the monitoring system. They can also collect web advertising/tracking IDs, which can be used to identify the criminals behind attacks.

In this work, we propose a framework for a Virtual Machine Monitor (VMM)-based Anomaly Detection System (ADS). This framework uses a sequence-based analysis Hidden Markov Model (HMM) on static probe instrumentation data collected within the VMM. Long observations are split into multiple, uniformed-length, small sequences. The list of likelihood score of sequences in the new observation is compared to a reference list of likelihood scores created from a normal scenario dataset. Statistical distance values from both lists are used to predict the new observation anomaly status. We evaluated the effectiveness of the approach over multiple statistical distance measures and multiple sequence lengths. We also compared our sequence-based analysis results with a frequency-based analysis results that used the One-Class Support Vector Machine (OC-SVM). The results show that the HMM sequence-based analysis can distinguish normal datasets from anomalous datasets better than the OC-SVM frequency-based analysis.

The transition period which should have brought the end of the IPv4 era has no clear end in sight. With about 3% worldwide deployment rate, IPv6 still looks like a promise and the IPv6 transition like an ongoing struggle. Among the many challenges introduced by this transition process to the Internet community, one of the most difficult is to ensure a scalable network design when using IPv6 transition mechanisms. To that end, this article proposes a black-box approach for benchmarking the load scalability of IPv6 transition technologies. The tentative scalability metric quantifies the performance degradation of well-established metrics such as round-trip delay, jitter, throughput and packet loss. As a study case, empirical data for two open-source IPv6 transition implementations is presented.

To evade detection by network-based anomaly detectors, sophisticated attackers are trying to make their malicious traffic resemble legitimate traffic by running attacks through ports used on a daily basis (e.g., port 80 for HTTP). This mimicry traffic is potentially neglected by detectors. In this paper, we propose a Kullback-Leibler (KL) divergence-based method for detecting anomalous traffic mimicking legitimate traffic. Our method firstly observes the port pair distribution of traffic flows, which is a novel statistical traffic feature proposed in this work. Secondly, our method computes the KL divergence between the port pair distributions of the current and previous time intervals. Our method starts to find anomalous flows when the KL divergence deviates from a specified threshold. We tested the performance of our method with traffic which was mixed by four synthetic mimicry anomalies and real-world backbone traffic. The results indicated that our method could precisely detect all synthetic anomalies. Furthermore, our method additionally revealed six real-world anomalies that were hidden in the testing backbone traffic.

As our cyber society develops and expands, the importance of cybersecurity operations is growing in response to cybersecurity threats coming from beyond national borders. Efficient cybersecurity operations require information exchanges that go beyond organizational borders. Various industry specifications defining information schemata for such exchanges are thus emerging. These specifications, however, define their own schemata since their objectives and the types of information they deal with differ, and desirable schemata differ depending on the purposes. They need to be organized and orchestrated so that individual organizations can fully exchange information and collaborate with one another. To establish the foundations of such orchestration and facilitate information exchanges, this paper proposes a reference ontology for cybersecurity operational information. The ontology structures cybersecurity information and orchestrates industry specifications. We built it from the standpoint of cybersecurity operations in close collaboration with cybersecurity organizations including security operation centers handling actual cybersecurity operations in the USA, Japan and South Korea. This paper demonstrates its usability by discussing the coverage of industry specifications. It then defines an extensible information structure that collaborates with such specifications by using the ontology and describes a prototype cybersecurity knowledge base we constructed that facilitates cybersecurity information exchanges among various parties. Finally, it discusses the usage scenarios of the ontology and knowledge base in cybersecurity operations. Through this work, we wish to contribute to the advancement of cybersecurity information exchanges.

Spam over Internet Telephony (SPIT) refers to a prerecorded advertising call using the Voice over Internet Protocol (VoIP) as a medium. It is expected to be a serious problem in the near future because of the rapidly growing number of VoIP users and the cost-effectiveness for spammers. The real-time nature of a call makes it difficult to detect SPIT. This paper describes a trust-based SPIT detection model that is effective and should be acceptable to call participants because it does not require any interaction from the users. To discriminate legitimate callers from spammers, a trust value is computed from the duration of a call and its direction between users. We propose a trust inference mechanism to calculate a trust value for an unknown caller by using the Dempster-Shafer theory. The social reliability based on past behaviors of a caller is also considered before forwarding a call to a callee. We evaluate the proposed system on different types of network datasets. The experimental results show that our approach is effective in identifying SPIT with a low rate of false positives. The difference of network distribution and the number of spammers do not affect the detection accuracy.

To adapt linear discriminant analysis (LDA) to real-world applications, there is a pressing need to equip it with an incremental learning ability to integrate knowledge presented by one-pass data streams, a functionality to join multiple LDA models to make the knowledge sharing between independent learning agents more efficient, and a forgetting functionality to avoid reconstruction of the overall discriminant eigenspace caused by some irregular changes. To this end, we introduce two adaptive LDA learning methods: LDA merging and LDA splitting. These provide the benefits of ability of online learning with one-pass data streams, retained class separability identical to the batch learning method, high efficiency for knowledge sharing due to condensed knowledge representation by the eigenspace model, and more preferable time and storage costs than traditional approaches under common application conditions. These properties are validated by experiments on a benchmark face image data set. By a case study on the application of the proposed method to multiagent cooperative learning and system alternation of a face recognition system, we further clarified the adaptability of the proposed methods to complex dynamic learning tasks.

Recent statistical studies on telecommunication networks outline that peer-to-peer (P2P) file-sharing is keeping increasing and it now contributes about 50-80% of the overall Internet traffic. Moreover, more and more network applications such as streaming media, internet telephony, and instant messaging are taking a form of P2P telecommunication. The bandwidth intensive nature of P2P applications suggests that P2P traffic can have significant impact on the underlying network. Therefore, analyzing and characterizing this kind of traffic is an essential step to develop workload models towards efficient amelioration in network traffic engineering and capacity planning. In this paper, we first introduce an adaptive system for handy P2P trace capturing and analysis. By using virtualization technology, the system can efficiently organize limited resources to build a reliable and tractable network that supports adjustable experimental study and practical performance tuning. Then the proposed system is applied to traffic characterization of File Sharing P2P (FSP2P) applications. To avoid excessive computing cost of payload information inspection, we proposed a more light-weighted analytical scheme which makes use of meta features extracted from packet headers. With carefully selected system parameters, we show that satisfactory prediction accuracy on differentiating FSP2P applications from ordinary network applications could be achieved with acceptable computing costs. The proposed scheme supports performance tuning between monitoring cost and the system response time, which enables its adaption to network environments with different specifications.

To adapt linear discriminant analysis (LDA) to real world applications, there is a pressing necessity to provide it with an incremental learning ability to integrate knowledge presented by one-pass data streams, a functionality to join multiple LDA models to make the knowledge-sharing between independent learning agents more efficient, and a forgetting functionality to avoid reconstruction of the overall discriminant eigenspace caused by some irregular changes. To this end, we introduce two adaptive LDA learning methods: LDA merging and LDA splitting, which show the following merits: ability of online learning with one-pass data streams, retained class separability identical to the batch learning method, high efficiency for knowledge-sharing due to condensed knowledge representation by the eigenspace model, and more preferable time and storage cost than traditional approaches under common application conditions. These properties are validated by the experiments on a benchmark face image dataset. By the case study on application of the proposed method to multi-agent cooperative learning and system alternation of a face recognition system, we further clarified the adaptability of the proposed methods to complex dynamic learning tasks.

Widespread deployment of the Internet enabled building of an emerging IT delivery model, i.e., cloud computing. Albeit cloud computing-based services have rapidly developed, their security aspects are still at the initial stage of development. In order to preserve cybersecurity in cloud computing, cybersecurity information that will be exchanged within it needs to be identified and discussed. For this purpose, we propose an ontological approach to cybersecurity in cloud computing. We build an ontology for cybersecurity operational information based on actual cybersecurity operations mainly focused on non-cloud computing. In order to discuss necessary cybersecurity information in cloud computing, we apply the ontology to cloud computing. Through the discussion, we identify essential changes in cloud computing such as data-asset decoupling and clarify the cybersecurity information required by the changes such as data provenance and resource dependency information.

Virtual machine monitor provides the drastic improvement of isolation, consolidation and flexibility in running virtual machine. Also, virtual cluster becomes one of the hot topics for the combination of capacity planning, HPC (high performance computing) and virtualization technologies. In this paper we propose a dynamic protection system of Web server in virtual cluster using live migration. VMM (virtual machine monitor) makes it possible to save, suspend and move VM running mission critical service without sustaining sessions. Our system runs in virtual cluster as protection module for making Web server reliable and available against DoS attacks. Proposed system can respond the rapid increase of utilization caused by DoS attacks without stopping sessions and services using live migration. For dynamic protection, an interruptive-notification mechanism is inserted into Web daemon, kernel space and VMM layer to activate the real-time mitigation of DoS by migrating and re-distributing VM on different physical machines. Experiment shows that our system is successful for mitigating DoS attacks without suspending sessions by reducing and distributing utilizations of the resources of VM providing mission critical Web services. We can conclude that our dynamic protection system using inter-VM notification and live migration can make virtualized Web server more reliable and available for DoS attacks.

In this paper, we propose a novel learning framework to reformulate a kernel-based classifier in terms of three modular components: kernel-function determination to incorporate domain knowledge, sparse data representation using FastMap and its variants, and supervised classification performed by using primal form analyzers such as linear SVM. The first important property of this approach is the reusability of the modules: Each module can be easily replaced by its counterparts for a specific learning purpose, e.g., the sparse representation of the data can not only support classification tasks but also be applied in function regression or unsupervised data analysis. Another contribution of the proposed approach is that it enables easy adaption of available primal-form algorithms for nonlinear kernel-based learning. Finally, numerical experiments show that FastMap and SupFM can yield efficient sparse representations with nonlinear kernels. The representation realized better sparsity while maintaining a generalization ability that is comparable to that of the regular SVM classifier.

In this paper, we propose an FDB based intra-domain traceback system (FDB-DTS), which is a hybrid traceback system composed of packet digesting boxes and an iterative query engine to the forwarding data base (FDB) on local subnet switches. A Hash based IP Traceback system (HB-IPTBS) can track the detailed attack paths inside the intra-domain by packet digests, which are encoded packets by an one-way hash function. However, it forces to the operator to settle packet digesting boxes in each router, each switch, or each interface of each router/switch. Thus, HB-IPTBS requires a large investment budget and operation tasks. Our FDB-DTS is a light weight intra-domain hash based packet traceback system. Our FDB-DTS employs a MAC address trace tool for the tracking engine on an layer 2 network by using MAC addresses as keys. In the deployment of the traceback system, our FDB-DTS needs only one packet digesting agent in each layer 2 network, therefore, our FDB-DTS can reduce the investment costs and operation tasks. Here, we present the basic idea of the FDB-DTS and show the design of a sample implementation with a MAC address trace tool by SNMP iterative query.

Web timing have attacks become a new threat on the Internet because they enable attackers to reveal users' private information. In this paper, we evaluate the threat of a web timing attack and its countermeasure. Our contribution is to investigate the occurrence conditions of a web timing attack. We also verify the effectiveness of our countermeasure, whose significant feature is fixing the authentication time whereas previous work fixes the response time. For our evaluation, we measure response times of several web applications, and analyze the result with statistical testing. We find that it is difficult to reveal the of username in some types of applications, and we confirm that our countermeasure can thwart web timing attacks.

In the near future, wireless local area networks (WLANs) will overlap to provide continuous coverage over a wide area. In such ubiquitous WLANs, a mobile node (MN) freely moves between WLANs with different IP subnets during VoIP communication. In such situations, since an MN experiences several handovers, the communication quality is degraded. In previous studies, in order to solve this problem, we proposed a seamless handover scheme based on frame retransmissions and demonstrated its effectiveness through simulation experiments. However, no existing scheme has demonstrated the effectiveness of cross-layer architecture exploiting the number of frame retransmissions on a real system. In the present paper, therefore, we design and implement a handover scheme based on the number of frame retransmissions. In our implementation, we propose a cross-layer architecture using a shared memory to pass the information, i.e., the number of frame retransmissions, from MAC layer to Transport layer. Finally, we show preliminary results in a real wireless environment and evaluate the performance of the proposed prototype system in a simple topology.

The difficulties of achieving an inter-domain traceback architecture come from the issues of overcoming network operation boundaries, especially the leakage of sensitive information, the violation of the administrative permission and the cooperation among Autonomous Systems (ASes). We have proposed InterTrack in [11] as an interconnection architecture for different traceback systems and other Denial of Service (DoS) attack countermeasures. In this paper, we argue that only disclosing AS status to others can reconstruct the reverse AS path of an attack without the leakage of sensitive information or the violation of the administrative permission. Comparing our architecture with other traceback architectures, we also discuss the feasibility of our autonomous traceback architecture.

Cross-site scripting (XSS) attacks target Web sites with cookie-based session management, resulting in the leakage of privacy information. Although several server-side countermeasures for XSS attacks do exist, such techniques have not been applied in a universal manner, because of their deployment overhead and the poor understanding of XSS problems. This paper proposes a client-side system that automatically detects XSS vulnerability by manipulating either request or server response. The system also shares the indication of vulnerability via a central repository. The purpose of the proposed system is twofold: to protect users from XSS attacks, and to warn the Web servers with XSS vulnerabilities.

This study revisits the scalability issue of polling I/O, i.e., select () and poll (). Although polling I/O was an efficient and hence popular I/O multiplexing mechanism, it is believed inadequate today to handle tens of thousands of concurrent TCP connections because the scanning cost of such a large connection list is overwhelmingly high. However, the real problem of polling I/O is not in the semantics itself but in various implementation factors such as memory allocations and copies to process a system call, pointer operations and function calls through VFS, and wait channel management to handle events. To mitigate these overheads and reinstate polling I/O as an efficient I/O multiplexing mechanism, we have developed a fast polling I/O library based on POSIX real-time signals. This library implements the full functionality of polling I/O by managing the state transition of each connection notified with realtime signals. Traditional polling I/O has a weakness especially when it polls a small number of active connections together with a huge number of idle ones. Our polling I/O library is proved to achieve high performance in that situation.

For the effective and early diagnosis of brain diseases, we have developed an evaluation system for brain function using an Independent Component Analysis (ICA) method. This evaluation system benefits greatly from the newly emerged Grid. To embody a Grid environment, a Globus grid toolkit has been utilized as a building block. In this research we have distributed the computational workload for the ICA on a Globus based Grid environment composed of two Alpha cluster systems and a personal computer. In addition, in order to allow scientists and application developers to easily build the Grid-enabled system, we also have adopted a Grid-enabled-Message Passing Interface, called MPICH-G. An introduction of MPICH-G to the medical analysis system on a Grid environment makes it possible for a naïve user to realize rapid analysis without special knowledge of the Grid. Magnetoencephalography (MEG), a highly sophisticated medical technology, is used for the measurement of brain function. The proposed method has the ability to integrate various geographically distributed resources and to analyze functional brain data from MEG

Traditionally, Wide-Wide-Web caching systems store WWW contents in filesystem. However, general purpose filesystems have a lot of unnecessary features for caching systems accompanied with data I/O. For example, typical filesystems maintain directories, inodes and free block maps (they are know as metadata). Those operations cause notable overhead. Modem WWW caching systems employ specialized filesystems for WWW caching. Furthermore, such implementations are often optimized to particular OSs and/or hardwares. Although this approach reduces overheads of filesystem, it is not portable and is expensive. This article describes an alternative approach, user level techniques for improvement of disk I/O.

A method of evaluating brain function using the metacomputer concept of the Globus system combined with a message-passing interface is described. The proposed method has the ability to exploit various geographically distributed resources and parallel computing linked to a high-technology medical instrumentation system, magnetoencephalography, to analyze the functional state of the brain. It is envisaged that the method will lead to the realization of an efficient telemedicine system for health care.