Many security risk assessment models have been proposed to describe and analyze security risks and their dependencies in network systems by means of graphs. However, these models suffer from two significant problems. First, they require a lot of human intervention and expertise in the graph generation process because they assume that experts are responsible for collecting and organizing large amounts of input data necessary for the assessment. Second, they are difficult to apply to large-scale networks since the graph size and the computational cost grow explosively with the network size. To tackle these problems, we propose a novel methodology named malicious communication dependency analysis (Malcoda) for assessing security risks of enterprise networks. Malcoda identifies risks in a network on the basis of input data automatically obtained from existing security products and describes probabilistic dependencies among information assets, threats, and vulnerabilities through a Bayesian network (BN)-based model dubbed the Malco directed acyclic graph (DAG). It then analyzes the Malco DAG to calculate the probability that each asset and vulnerability is exposed to threats (risk probability). Malcoda minimizes human intervention and enables administrators with limited expertise to easily assess security risks by automatically collecting and organizing the input data required for constructing the graphs. The Malco DAG, which is lighter than existing models, significantly reduces the computational cost and improves the scalability. The evaluation of Malcoda implemented in a virtual enterprise network demonstrates that Malcoda can automatically and quickly complete the assessment process and output reasonable risk probabilities reflecting threats, i.e., intrusion detection system (IDS) alerts. The computational complexity of Malcoda is also found to be less than or equal to that of existing models.

As the importance of intrusion detection and prevention systems (IDPSs) increases, great costs are being incurred to manually manage signatures, which are malicious communication pattern files. Network security experts need to classify signatures by importance for an IDPS to work optimally. In this study, we propose and evaluate a machine learning signature classification model with a reject option (RO) to reduce the cost of setting up an IDPS. Experts classify some signatures with predefined if-then rules. We first design two types of features, symbolic features (SFs) and keyword features (KFs), which are used in keyword matching for the if-then rules. Next, we design web information and message features (WMFs) to capture the properties of signatures that do not match the if-then rules. The WMFs are extracted as the term frequency-inverse document frequency (TF-IDF) features of the message text in each signature and the text expanded by web scraping, respectively. Because failures need to be minimized when classifying IDPS signatures, we consider introducing an RO in our proposed model. The effectiveness of the proposed classification model is evaluated in experiments conducted on two real datasets composed of signatures labeled by experts. In the experiment, the SF and WMF combination outperforms the SF and KF combination. We also show that using a deep ensemble improves the performance of the RO. An analysis shows that experts refer to the text contained in the signatures and information from the web.

Consistent hashing has played an indispensable role in cloud infrastructure, although its load balancing performance is not necessarily perfect. Consistent hashing has long remained the most widely used method despite many methods being proposed to improve load balancing because these methods trade off load balancing against consistency, memory usage, lookup performance, and/or fault-tolerance. This article presents Structured Allocation-based Consistent Hashing (SACH), a cloud-optimized consistent hashing algorithm that overcomes the trade-offs by taking advantage of the characteristics of cloud environments: scaling management and auto-healing. Since scaling can be distinguished from failures, SACH applies two different algorithms to update hashing functions: a fast-update algorithm for unmanaged backend failures to satisfy fault-tolerance with quick response and a slow-update algorithm for managed scaling. Hashing functions are initialized or slow-updated considering the characteristics of the fast-update algorithm to satisfy load balancing and the other properties as far as the number of failed backends is kept small by auto-healing. The experimental results show that SACH outperforms existing algorithms in each aspect. SACH will improve the load balancing of cloud infrastructure components, where the trade-offs have prevented the renewal of hashing functions.

Cyber threat intelligence (CTI) sharing is growing in popularity and has become one of the key functions to protect end-users and network services from sophisticated cyber attacks. However, since CTI is not always guaranteed to be correct and trustworthy, security operators spend much time in analyzing CTI and estimating the maliciousness of the indicators of compromise (IoCs) in CTI, such as domain names, URLs, and IP addresses. Previous studies did not estimate such maliciousness sufficiently. They did not approach maliciousness estimation by using both types of IoC characteristics; individual IoC features and relations among IoCs. In this paper, we propose a novel method of estimating the maliciousness of IoCs more accurately through a graph convolutional network (GCN)-based approach, which can use both IoC characteristics. We evaluated the performance of the proposed method by comparing it to conventional methods. The proposed method exhibited an 86.3% accuracy rate and 0.883 recall rate, which are better than those from the conventional methods.

An online recognition method for handwritten Hiragana characters is developed based upon a complex AR model. The time delay of the AR model is enlarged so that global attributes of handwritten characters are well incorporated into the model, and a character segmentation technique is developed for performance improvement. A good recognition score has been obtained for two different writers.