With the rapid growth of the Internet of Things (IoT) devices, a lot of IoT malware has been created, and the security against IoT malware, especially the family classification, has become a more important issue. There exist three requirements which classification systems must achieve: detection of new families, precise classification for sequential inputs, and being independent of computer architectures. However, existing methods do not satisfy them simultaneously. In this paper, we propose a realtime IoT malware classification system based on pending samples. In order to detect new families and to classify sequential inputs precisely, we introduce the concept of “pending samples”. This concept is useful when heterogeneous inputs which are difficult to classify instantly come into the system. This is because the system can postpone classifying them until similar samples come. Once similar samples are gathered, we regard these samples as a new cluster, meaning that detecting new families is achieved. Moreover, we use printable strings to satisfy the requirement of being independent of architectures because strings are common among different architectures. Our results show the ability to detect new families demonstrated by finding new clusters after applying our algorithm to the initial clusters. Furthermore, our new clustering algorithms achieves a 0.130 higher V-measure compared to the k-means algorithm, which is the representative clustering algorithm.

Website Fingerprinting Attack (WFA) which identifies websites browsed on Android devices is extremely dangerous because it creates an opportunity for stealing private information. As the most feasible WFA method, we focus on a method that can identify a website by using the power consumption model restored from CPU data. However, that is not effective in a real situation where multiple background tasks run because CPU data which are unrelated to browsing are confused. Furthermore, the previous method cannot accurately identify simple websites that are subject to background tasks. Thus, a more feasible method is required to indicate the dangers. In this paper, we propose a website fingerprinting attack based on virtual memory of process on Android device. We focus on the fact that a specific process about browsing websites works when a website is browsed. Because each process has its virtual memory which is independent of each other, the useful feature of a task can be extracted from the virtual memory without noise. Therefore, the proposed method can precisely identify a browsed website by using the virtual memory-based features even if background tasks work. Furthermore, the proposed method can obtain effective information even for a simple website. By computer simulation with a real dataset, we demonstrate that the proposed method can improve up to 86%, 89%, and 82% in precision, recall, and F-measure, respectively for websites which the previous scheme cannot identify at all.

The development of deep learning (DL) techniques has enabled to crack traditional text-based CAPTCHA (Com-pletely Automated Public Turing test to tell Computers and Humans Apart), which results in new security issues. As a coun-termeasure against DL based attacks, the adversarial CAPTCHA is well suited since it can increase the difficulty of machine recognition while ensuring human readability. However, spatial smoothing can negate the effectiveness of adversarial CAPTCHAs because adversarial noises in them are subject to averaging pixels. As far as we know, there are no effective counters against spatial smoothing, whereas it is the critical problem which facilitates spreading automated attacks. Therefore, to address the unsolved problem, in this paper, we propose an adversarial text-based CAPTCHA generation method utilizing spatial smoothing. We focus on the fact that when spatial smoothing is applied to an image, the amount of information it carries decreases, making the whole image blurred. Spatial smoothing is only viable as an attack when the mitigation of the adversarial noise has a larger impact than the whole image getting blurred. Thus, when the degree of spatial smoothing exceeds a certain threshold, the impact of the two aspects reverses, and the difficulty of the recognition increase. By utilizing this phenomenon in the generation of CAPTCHAs, the proposed method can indirectly neutralize the intended effect of spatial smoothing by attackers, preventing the recognition rate from increasing. Our evaluation shows the proposed method can reduce the recognition rate by up to 34%, compared to the conventional method. Besides, an experiment on human recognition rates marked 73.67%, showing that human recognition is maintained at an acceptable level.

Detecting a Rogue Access Point (RAP) in Wi-Fi network is imperative. The previous scheme is user side detection focusing on two channels used by a RAP. That scheme can detect a RAP in stable traffic environment by revealing the channel used with a Legitimate Access Point (LAP) with intentional interference. However, the detection performance is degraded in the real environment where traffic is more unstable because it affects the traffic on the channel. Thus, it is necessary to design the scheme which is independent of such factors. In this paper, we propose RAP detection by using Address Resolution Protocol (ARP) failure under the Media Access Control (MAC) address duplication. Our main idea is that the traffic is relayed via a RAP and a LAP on the LAN path between a client and a gateway under the attack. This is because the RAP must be established between a client and a LAP to provide Internet connection. On the basis of this idea, the proposed scheme reveals that the Access Point (AP) with which a client connects is a RAP by discovering the MAC address of a LAP on the path. In order to find the MAC address, we leverage the phenomenon that a client cannot receive ARP reply packets in the situation where its MAC address and that of a AP are duplicated on the path. By doing this, the presence of a LAP is revealed, which can judge that the connected AP is a RAP. In our evaluation, the proposed scheme achieves accuracy of 96.5% even in unstable traffic environment. True positive rate and false positive rate are 31.0% higher and 9.0% lower than the previous scheme. Furthermore, the proposed scheme can detect RAPs accurately in real environment where the previous scheme cannot.

There exists a need of “image steganalysis” which reveals whether steganographic signals are embedded in an image to improve information security. Among various steganalysis, Convolutional Neural Networks (CNN) based steganalysis is promising since it can automatically learn the features of diverse steganographic algorithms. However, we discover the detection performance of CNN is degraded when an image is intentionally reduced by the nearest-neighbor interpolation before steganography. This is because spatial frequency in a reduced image gets high, which disturbs the training. In order to overcome this shortcoming, in this paper, we propose a preprocessing methodology by using additional steganography on CNN-based steganalysis. In the proposed preprocessing, steganographic signals are additionally embedded into both reduced original images and reduced steganographic ones since a difference of spatial frequencies between them gets obvious, which helps CNN learn features. Whenever reduced images are trained in CNN or inspected whether they are steganographic ones or not, steganography is applied to them once by the proposed preprocessing. Thus, an image is regarded as a steganographic one if the trained model judges steganography is applied to it twice; otherwise it is an original one. Since the proposed methodology is very simple, its computational cost is low. Our evaluation shows accuracy in a model with the proposed preprocessing is 10.6% higher than that in the conventional one. Besides, even in the situation where another steganography is additionally embedded, the proposed preprocessing yields 7% higher accuracy compared with the conventional one.

To realize content distribution, NDN (Named Data Networking) is gathering attention. Since NDN is vulnerable to spreading fake contents, router based verification schemes are proposed to solve this problem. However, routers are vulnerable to the attack which puts a burden to them by verification of contents (verification attack). In order to detect it, the scheme leveraging the fact that the number of the request of unverified contents and the verification of them increase under the attack is proposed. While verification attack can be detected by that scheme, the attack has already occurred. In order to detect the attack before it occurs, in this paper, we propose a trust-based verification attack prevention scheme using tendency of contents request on NDN. We focus on the fact that the access interval to unverified contents tends to be short dramatically just before verification attack occurs. By leveraging this fact, the router determines that verification attack has occurred and restricts requests of all users temporarily. However, in this case, it is impossible to identify attackers, and the requests of legitimate users are also restricted. Therefore, we focus on the fact that legitimate users tend not to request contents in a cache in many cases. Meanwhile, in order to conduct verification attack, attackers need to request such contents for a short time. By giving low trust value to users requesting these contents, a router can identify attackers and restrict only attackers' requests. Our evaluation results show our scheme can detect verification attack before the attack. Furthermore, we clearly demonstrate that our scheme can restrict only attackers' requests.

Detecting Android malware is imperative. As a promising Android malware detection scheme, we focus on the scheme leveraging the differences of traffic patterns between benign apps and malware. Those differences can be captured even if the packet is encrypted. However, since such features are just statistic based ones, they cannot identify whether each traffic is malicious. Thus, it is necessary to design the scheme which is applicable to encrypted traffic data and supports identification of malicious traffic. In this paper, we propose an Android malware detection scheme based on the level of SSL server certificate. Attackers tend to use an untrusted certificate to encrypt malicious payloads in many cases because passing rigorous examination is required to get a trusted certificate. Thus, we utilize SSL server certificate based features for detection since their certificates tend to be untrusted. Furthermore, in order to obtain the more exact features, we introduce required permission based weight values because malware inevitably require permissions regarding malicious actions. By computer simulation with real dataset, we show our scheme achieves an accuracy of 92.7 %. True positive rate and false positive rate are 5.6% higher and 3.3% lower than the previous scheme, respectively. Our scheme can cope with encrypted malicious payloads and 89 malware which are not detected by the previous scheme.