Global darknet monitoring provides an effective way to observe cyber-attacks that are significantly threatening network security and management. In this paper, we present a study on characterization of cyberattacks in the big stream data collected in a large scale distributed darknet using association rule learning. The experiment shows that association rule learning in the darknet stream data can support strategic cyberattack countermeasure in the following ways. First, statistics computed from malware-specific rules can lead to better understanding of the global trend of cyberattacks in the Internet. Second, strong association rules can lead to further insights into the nature of the attacking tools and hence expedite the diagnosis. Then, the discovery of emerging new attacks may lead to early detection and prompt prevention of pandemic incidents, preventing damage to the IT infrastructure and extensive financial loss. Finally, exploring the knowledge in the frequent attacking patterns can enable accurate prediction of future attacks from analyzed hosts, which could improve the performance of honeypot systems to collect more pertinent malware information using limited system and network resources.

Packing is among the most popular obfuscation techniques to impede anti-virus scanners from successfully detecting malware. In this paper we propose a string-kernel-based support vector machine classifier to identify the packer that is used to create a given malware program. Our approach is featured by the following characteristics. First, the adoption of a string-kernel-based method bridges the gap between signature-based and machine-learning-base approaches. Second, the kernel function derived from the Levenshtein distance integrates important domain knowledge in the learning process. Then, application of support vector machine, a state-of-the-art classifier, enables an automated packer identification scheme with high generalization ability and time efficiency. Finally, selection of the code segment with the most essential packer relevant information further boosts the classification performance. Experiments on a dataset of 3228 binary programs composed of packed files created by 25 packers show that the proposed approach outperforms PEiD and previous machine-learning-based approaches in prediction accuracy with a large margin. This method can help to improve the scanning efficiency of anti-virus products and promote efficient back-end malware research.

Characterization of Peer-to-Peer (P2P) traffic is an essential step to develop workload models towards capacity planning and cyber-threat countermeasure over P2P networks. In this paper, we present a new scheme for characterizing P2P file sharing hosts based on transport layer statistical features. The proposed scheme is featured by its tunability over monitoring cost, system response time, and prediction accuracy. We further employ feature selection to identify the most essential discriminators for the analysis. Experimental results show that an equally accurate system could be obtained using only 3 out of the 18 defined discriminators, which further enhances the adaptability and reduces the monitoring cost of the system.

A darknet is a set of unused IP addresses whose monitoring is an effective way of detecting malicious activities on the Internet. We have developed an alert system called DAEDALUS (direct alert environment for darknet and livenet unified security), which is based on large-scale darknet monitoring. This paper presents a novel real-time 3D visualization engine called DAEDALUS-VIZ that enables operators to grasp visually and in real time a complete overview of alert circumstances and provides highly flexible and tangible interactivity. We describe some case studies and evaluate the performance of DAEDALUS-VIZ.

Malware, such as computer viruses, worms, and bots, has been recognized as one of the major security threats in the Internet environment, and a large amount of research and development is taking place to find effective countermeasures. These countermeasures are mainly based on either macroscopic or microscopic analysis. Macroscopic analysis is based on monitoring the network in order to grasp the global trends of malware propagations while microscopic analysis investigates malware executables to identify the details of how they behave. We have been developing the network incident analysis center for tactical emergency response (NICTER), where both kinds of analysis are highly integrated. By integrating and correlating the results from the both two approaches, the nicter binds phenomena, i.e., scans observed by network monitoring with their root causes, i.e., malwares. Previous analysis of malware has mainly focused on their internal behavior in the system. However, in order to achieve such a goal, it is crucial that the microscopic analysis extracts a malware's external behavior towards the network. We propose a novel way to analyze malware behavior: focus closely on the malware's external behavior. A malware sample is executed on a real machine that is connected to a virtual Internet environment called a "miniature network". Since this analysis environment is totally isolated from the real Internet, the execution of the sample, unlike in previously proposed methods, causes no further unwanted propagation. Furthermore, the behavioral analysis is carried out in two passes. In the first pass, in order to extract a wider variety of network behaviors from the sample, the miniature network responds as interactively as possible. In the second pass, to make only suitable response that will enable us to concentrate on specific behavior, namely scan behaviors, the miniature network is configured on the basis of the first pass result. We also present concrete analysis results that are gained by using the proposed method.

High-speed links such as OC-48c and OC-192c links need to be used as backbone links of the Internet in order to accommodate rapidly increasing Internet traffic. Network experiments over a test bed are important to check new services and new applications perform well over high-speed Internet backbones. In order to obtain the correct experiment results, it is important to use suitable background traffic at the network experiments. The existing traffic testers use MMPP (Markov modulated Poisson process) and MAP (Markov arrival process) as traffic models to generate background traffic. However, MMPP and MAP are so simplistic that the network experiments may produce misleading results. In order to solve the problem, we have developed an OC-48c traffic tester for generating and analyzing long-range dependence traffic because the traffic model is considered one of the most realistic traffic models. The traffic tester achieves the OC-48 rate traffic generation using hardware logic, and enables the long-range dependence traffic generation using time series data of packet numbers or byte numbers.

Satellite-based Internet is one of attractive access media because it can be deployed even in inconvenient locations. However, it is a problem that TCP throughput is degraded by the large propagation delay in the satellite link. We previously proposed to introduce an intermediate gateway only in the carrier side premises to accelerate TCP throughput and confirmed its effectiveness in case of no network congestion. In order to accommodate many subscribers, it is also required to avoid network congestion caused by the extremely asymmetry of the access link. We describe the new TCP gateway taking account of multiple subscribers accommodated by a shared satellite access link. We also confirmed that the new gateway can accelerate TCP throughput more than 8 times avoiding network congestion.

Results are presented of a study of the feasibility realizing a real-time information retrieval service operating between different worldwide videotex systems by means of gateway facilities that use conversion of data syntax and processing of the videotex information structure. Two separate evaluations were carried out, both using response time as the performance criterion. One was for communication processes at both of two gateways, and the other was for data syntax conversion at the local host. Both approaches are considered as kernel functions in the gateway system. The results of each evaluation were favorable in the sense that response time for the total system using gateways compared favorably to the response time in direct videotex access over the packet-switched public data network.>

Under the increasing demand for secure communications, the existing security techniques cannot fulfil the requirements for security satisfactorily. A number of study items are identified in this area; however, one of the major targets is to realize security services in the open systems interconnection (OSI) communication environment. In response to this need, the secure communication service element (SCSE) is proposed in the OSI application layer as a new type of common application service element to provide the security services of peer-entity authentication, data confidentiality, and data integrity. As for the peer-entity authentication service, the overall authentication protocol between the peer SCSEs is proposed by using the underlying association control service element authentication procedure. Regarding the data integrity and confidentiality, the SCSE transfer service is introduced to cover all the requirements for these services to the extent of the selective field services and the recovery for integrity errors.>