Faculty Profiles - YAMAUCHI Toshihiro

Papers - YAMAUCHI Toshihiro

Division display 41 - 60 of about 219 ／ All the affair displays >>

Prevention of Kernel Memory Corruption Using Kernel Page Restriction Mechanism. Reviewed

Hiroki Kuzuno, Toshihiro Yamauchi

Journal of Information Processing 30 563 - 576 2022.9

Analysis of Android Applications Shared on Twitter Focusing on Accessibility Services. Reviewed International coauthorship

Shuichi Ichioka, Estelle Pouget, Takao Mimura, Jun Nakajima, Toshihiro Yamauchi

Journal of Information Processing 30 601 - 612 2022.9

KDPM: Kernel Data Protection Mechanism Using a Memory Protection Key. Reviewed

Hiroki Kuzuno, Toshihiro Yamauchi

17th International Workshop on Security (IWSEC 2022) Lecture Notes in Computer Science (LNCS) 13504 66 - 84 2022.8

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings)

The kernel data of an operating system kernel can be modified through memory corruption by exploiting kernel vulnerabilities. Memory corruption allows privilege escalation and defeats security mechanisms. The kernel control flow integrity verifies and guarantees the order of invoking kernel codes. The kernel address space layout randomization randomizes the virtual address layout of the kernel code and data. The additional kernel observer focuses on the unintended privilege modifications to restore the original privileges. However, these existing security mechanisms do not prevent writing to the kernel data. Therefore, kernel data can be overwritten by exploiting kernel vulnerabilities. Additionally, privilege escalation and the defeat of security mechanisms are possible. We propose a kernel data protection mechanism (KDPM), which is a novel security design that restricts the writing of specific kernel data. This mechanism protects privileged information and the security mechanism to overcome the limitations of existing approaches. The KDPM adopts a memory protection key (MPK) to control the write restriction of kernel data. The KDPM with the MPK ensures that the writing of privileged information for user processes is dynamically restricted during the invocation of specific system calls. To prevent the security mechanisms from being defeated, the KDPM dynamically restricts the writing of kernel data related to the mandatory access control during the execution of specific kernel codes. Further, the KDPM is implemented on the latest Linux with an MPK emulator. We also evaluated the possibility of preventing the writing of privileged information. The KDPM showed an acceptable performance cost, measured by the overhead, which was from 2.96% to 9.01% of system call invocations, whereas the performance load on the MPK operations was 22.1 ns to 1347.9 ns.

DOI： 10.1007/978-3-031-15255-9_4

Scopus

researchmap

Other Link： https://dblp.uni-trier.de/db/conf/iwsec/iwsec2022.html#KuzunoY22

CyNER: Information Extraction from Unstructured Text of CTI Sources with Noncontextual IOCs. Reviewed

Shota Fujii, Nobutaka Kawaguchi, Tomohiro Shigemoto, Toshihiro Yamauchi

17th International Workshop on Security (IWSEC 2022) Lecture Notes in Computer Science (LNCS) 13504 85 - 104 2022.8

Design and Implementation of System for URL Signature Construction and Impact Assessment Reviewed

Shota Fujii, Nobutaka Kawaguchi, Shoya Kojima, Tomoya Suzuki, Toshihiro Yamauchi

Proceedings of 2022 11th International Congress on Advanced Applied Informatics (IIAI-AAI 2022) 95 - 100 2022.7

Improving Transparency of Hardware Breakpoints with Virtual Machine Introspection. Reviewed

Masaya Sato, Ryosuke Nakamura, Toshihiro Yamauchi, Hideo Taniguchi

Proceedings of 2022 11th International Congress on Advanced Applied Informatics (IIAI-AAI 2022) 113 - 117 2022.7

Flexible Method for Supporting OAuth 2.0 Based Security Profiles in Keycloak. Reviewed

Takashi Norimatsu, Yuichi Nakamura, Toshihiro Yamauchi

Lecture Notes in Informatics (LNI) P-325 87 - 98 2022.6

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings)

Keycloak is identity and access control open-source software. When used for open banking, where many OAuth 2.0 clients need to be managed and a different OAuth 2.0-based security profile needs to be applied to each type of API, the problem of increasing managerial costs by the Keycloak administrator occurs because Keycloak's security profile logic depends on the client settings, and the logic cannot be changed for each client's request. This paper proposes its solution by separating the security profile logic from the client settings, and by changing the security profile for each client's request based on the content of the request, and actual security profiles Financial-grade API (FAPI) are implemented to Keycloak. The paper calculates managerial costs in both the existing and proposed methods in scenarios managing FAPI, and compares the results. The comparison shows that using the proposed method reduces costs. Our implementations are contributed to Keycloak.

DOI： 10.18420/OID2022_07

Scopus

researchmap

Other Link： https://dblp.uni-trier.de/db/conf/openidentity/openidentity2022.html#NorimatsuNY22

Malware Classification by Deep Learning Using Characteristics of Hash Functions Reviewed

Takahiro Baba, Kensuke Baba, Toshihiro Yamauchi

Proceedings of the 36th International Conference on Advanced Information Networking and Applications (AINA-2022) 2 480 - 481 2022.3

Improvement and Evaluation of a Function for Tracing the Diffusion of Classified Information on KVM. Reviewed

Hideaki Moriyama, Toshihiro Yamauchi, Masaya Sato, Hideo Taniguchi

Journal of Internet Services and Information Security (JISIS) 12 ( 1 ) 26 - 43 2022.2

Authorship：Corresponding author Language：English Publishing type：Research paper (scientific journal)

The leakage of computerized classified information can cause serious losses for companies and individuals. In a prior work, we addressed this by providing a function for tracing the diffusion of classified information in a guest operating system (OS). However, that method was vulnerable to attack and was tightly coupled to the OS. Hence, in another previous work, we applied the tracing function using a virtual machine monitor that hooks into system calls that handle classified information, allowing us to understand the diffusion path in a more robust and OS-agnostic fashion. However, as the overhead of the tracing function increases, so does the performance degradation of each system call. Hence, in the current research, the processing performance of the tracing function is further analyzed in depth by identifying the processes that cause the large overhead. We find that the performance overhead generated by outputting the diffusion path log is too burdensome. Therefore, improvements are implemented, and the effectiveness of the upgraded performance is described. Ultimately, the log-output overhead problem is improved.

DOI： 10.22667/JISIS.2022.02.28.026

Scopus

researchmap

Function for Tracing Diffusion of Classified Information to Support Multiple VMs with KVM Reviewed

Kohei Otani, Toshiki Okazaki, Toshihiro Yamauchi, Hideaki Moriyama, Masaya Sato, Hideo Taniguchi

Proceedings of 2021 nineth International Symposium on Computing and Networking Workshops, 8th International Workshop on Information and Communication Security (WICS 2021) 352 - 358 2021.11

Proposal of Method of Generating a Blacklist for Mobile Devices by Searching Malicious Websites and Analysis Using Demonstration Experiment Data Reviewed

石原聖, 佐藤将也, 佐藤将也, 山内利宏

情報処理学会論文誌ジャーナル(Web) 62 ( 9 ) 1536 - 1548 2021.9

Authorship：Last author,　Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

One of the methods to attack mobile devices is redirecting a user to unwanted websites. To the best of our knowledge, there is no method to generate a blacklist that focuses on such attacks. Therefore, we propose a method to generate a blacklist for mobile devices by searching malicious websites. To detect new malicious websites, this method collects HTML files from the webspace using a crawler and searches for HTML files highly likely to be malicious using keywords extracted from known malicious websites. In the evaluation, we performed detection experiments with the blacklist generated by the proposed method using the demonstration experiment data. The evaluation results showed that the generated blacklist detects malicious websites used in attacks of redirecting a user to unwanted websites with few false positives. In addition, new malicious websites were discovered using the generated blacklist; furthermore, we describe an analysis of attacks of redirecting a user to unwanted websites.

DOI： 10.20729/00212759

KPRM: Kernel Page Restriction Mechanism to Prevent Kernel Memory Corruption Reviewed

Hiroki Kuzuno, Toshihiro Yamauchi

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 12835 LNCS 45 - 63 2021.9

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：Springer International Publishing

An operating system (OS) comprises a mechanism for sharing the kernel address space with each user process. An adversary’s user process compromises the OS kernel through memory corruption, exploiting the kernel vulnerability. It overwrites the kernel code related to security features or the kernel data containing privilege information. Process-local memory and system call isolation divide one kernel address space into multiple kernel address spaces. While user processes create their own kernel address space, these methods leave the kernel code vulnerable. Further, an adversary’s user process can involve malicious code that elevates from user mode to kernel mode. Herein, we propose the kernel page restriction mechanism (KPRM), which is a novel security design that prohibits vulnerable kernel code execution and prevents writing to the kernel data from an adversary’s user process. The KPRM dynamically unmaps the kernel page of vulnerable kernel code and attack target kernel data from the kernel address space. This removes the reference of the unmapped kernel page from the kernel page table at the system call invocation. The KPRM achieves that an adversary’s user process can not employ the reference of unmapped kernel page to exploit the kernel through vulnerable kernel code on the running kernel. We implemented KPRM on the latest Linux kernel and showed that it successfully thwarts actual proof-of-concept kernel vulnerability attacks that may cause kernel memory corruption. In addition, the KPRM performance results indicated limited kernel processing overhead in software benchmarks and a low impact on user applications.

DOI： 10.1007/978-3-030-85987-9_3

Web of Science

Scopus

researchmap

Other Link： https://dblp.uni-trier.de/db/conf/iwsec/iwsec2021.html#KuzunoY21

(Short Paper) Evidence Collection and Preservation System with Virtual Machine Monitoring Reviewed

Toru Nakamura, Hiroshi Ito, Shinsaku Kiyomoto, Toshihiro Yamauchi

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 12835 LNCS 64 - 73 2021.9

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：Springer International Publishing

In a system audit and verification, it is important to securely collect and preserve evidence of execution environments, execution processes, and program execution results. Evidence-based verification of program processes ensures their authenticity; for example, the processes include no altered/infected program library. This paper proposes a solution for collection of evidence on program libraries based on Virtual Machine Monitor (VMM). The solution can solve semantic gap by obtaining library file path names. This paper also shows a way to obtain hash values of library files from a guest OS. Furthermore, this paper provides examples of evidence on program execution and the overhead of the solution.

DOI： 10.1007/978-3-030-85987-9_4

Web of Science

Scopus

researchmap

Other Link： https://dblp.uni-trier.de/db/conf/iwsec/iwsec2021.html#NakamuraIKY21

Physical Memory Management with Two Page Sizes in Tender OS. Reviewed

Koki Kusunoki, Toshihiro Yamauchi, Hideo Taniguchi

Lecture Notes in Networks and Systems 313 238 - 248 2021.9

Authorship：Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：Springer

Physical memory capacity has increased owing to large-scale integration. In addition, memory footprints have increased in size, as multiple programs are executed on a single computer. Many operating systems manage physical memory by paging a 4 KB page. Therefore, the number of entries in the virtual address translation table for virtual to physical increases along with the size of the memory footprints. This cause a decrease in the translation lookaside buffer (TLB) hit ratio, resulting in the performance degradation of the application. To address this problem, we propose the implementation of physical memory management with two page sizes: 4 KB and 4 MB. This allows us to expand range of addresses to be translated by a single TLB entry, thereby improving the TLB hit rate. This paper describes the design and implementation of the physical memory management mechanism that manages physical memory using two page sizes on The ENduring operating system for Distributed EnviRonment (OS). Our results showed that when the page size is 4 MB, the processing time of the memory allocation can be reduced by as much as approximately 99.7%, and the processing time for process creation can be reduced by as much as approximately 51%, and the processing time of the memory operation could be reduced by as much as 91.9%.

DOI： 10.1007/978-3-030-84913-9_22

Scopus

researchmap

Other Link： https://dblp.uni-trier.de/db/conf/nbis/nbis2021.html#KusunokiYT21

Mitigation of Kernel Memory Corruption Using Multiple Kernel Memory Mechanism. Reviewed

Hiroki Kuzuno, Toshihiro Yamauchi

IEEE Access 9 111651 - 111665 2021.8

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：Institute of Electrical and Electronics Engineers ({IEEE})

Operating systems adopt kernel protection methods (e.g., mandatory access control, kernel address space layout randomization, control flow integrity, and kernel page table isolation) as essential countermeasures to reduce the likelihood of kernel vulnerability attacks. However, kernel memory corruption can still occur via the execution of malicious kernel code at the kernel layer. This is because the vulnerable kernel code and the attack target kernel code or kernel data are located in the same kernel address space. To gain complete control of a host, adversaries focus on kernel code invocations, such as function pointers that rely on the starting points of the kernel protection methods. To mitigate such subversion attacks, this paper presents multiple kernel memory (MKM), which employs an alternative design for kernel address space separation. The MKM mechanism focuses on the isolation granularity of the kernel address space during each execution of the kernel code. MKM provides two kernel address spaces, namely, i) the trampoline kernel address space, which acts as the gateway feature between user and kernel modes and ii) the security kernel address space, which utilizes the localization of the kernel protection methods (i.e., kernel observation). Additionally, MKM achieves the encapsulation of the vulnerable kernel code to prevent access to the kernel code invocations of the separated kernel address space. The evaluation results demonstrated that MKM can protect the kernel code and kernel data from a proof-of-concept kernel vulnerability that could lead to kernel memory corruption. In addition, the performance results of MKM indicate that the system call overhead latency ranges from 0.020 μs to 0.5445 μs , while the web application benchmark ranges from 196.27 μs to 6, 685.73 μs for each download access of 100,000 Hypertext Transfer Protocol sessions. MKM attained a 97.65% system benchmark score and a 99.76% kernel compilation time.

DOI： 10.1109/ACCESS.2021.3101452

Web of Science

Scopus

researchmap

Analysis of commands of Telnet logs illegally connected to IoT devices Reviewed

Toshihiro Yamauchi, Ryota Yoshimoto, Takahiro Baba, Katsunari Yoshioka

Proceedings of 2021 10th International Congress on Advanced Applied Informatics (IIAI-AAI 2021) 913 - 915 2021.7

Implementation and Evaluation of Resource Pooling Function for High-speed Process Creation Reviewed

谷口秀夫, 山内利宏, 田村大

情報処理学会論文誌ジャーナル(Web) 62 ( 2 ) 443 - 454 2021.2

Authorship：Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

In the recent cloud computing environment, many short-lived processes are created, a method of realizing a service by mutual cooperation of these processes has been attracting attention. Therefore, speeding up the process creation is very important. Tender OS, thus, proposes a mechanism for fast process creation and deletion. The proposed mechanism involves the recycling of process resources. However, the proposed mechanism cannot recycle process resources during process creation if the stored process resources are not adequate. Stored process resources may increase monotonically if they are not recycled for process creation, which in turn can cause memory starvation. This paper, therefore, proposes a resource pooling function for addressing the these problems. In addition to the function for resource recycling, the resource pooling function incorporates the resource creation function and the resource reduction function. Furthermore, this paper reports the effectiveness of the resource pooling function in terms of processing time efficiency and memory usage.

Improvement and Evaluation of a Function for Tracing the Diffusion of Classified Information on KVM Reviewed

Moriyama, H., Yamauchi, T., Sato, M., Taniguchi, H.

Advances in Intelligent Systems and Computing 1264 AISC 338 - 349 2021.1

Authorship：Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：Advances in Intelligent Systems and Computing

© 2021, Springer Nature Switzerland AG. The increasing amount of classified information currently being managed by personal computers has resulted in the leakage of such information to external computers, which is a major problem. To prevent such leakage, we previously proposed a function for tracing the diffusion of classified information in a guest operating system (OS) using a virtual machine monitor (VMM). The tracing function hooks a system call in the guest OS from the VMM, and acquiring the information. By analyzing the information on the VMM side, the tracing function makes it possible to notify the user of the diffusion of classified information. However, this function has a problem in that the administrator of the computer platform cannot grasp the transition of the diffusion of classified processes or file information. In this paper, we present the solution to this problem and report on its evaluation.

DOI： 10.1007/978-3-030-57811-4_32

Scopus

researchmap

Other Link： https://dblp.uni-trier.de/db/conf/nbis/nbis2020.html#MoriyamaYST20

Accessibility service utilization rates in android applications shared on Twitter Reviewed

Ichioka, S., Pouget, E., Mimura, T., Nakajima, J., Yamauchi, T.

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 12583 LNCS 101 - 111 2020.12

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

© Springer Nature Switzerland AG 2020. The number of malware detected has been increasing annually, and 4.12% of malware reported in 2018 attacked Android phones. Therefore, preventing attacks by Android malware is critically important. Several previous studies have investigated the percentage of apps that utilize accessibility services and are distributed from Google Play, that have been reportedly used by Android malware. However, the Social Networking Services (SNSs) that are used to spread malware have distributed apps not only from Google Play but also from other sources. Therefore, apps distributed from within and outside of Google Play must be investigated to capture malware trends. In this study, we collected apps shared on Twitter in 2018, which is a representative SNS, and created a Twitter shared apps dataset. The dataset consists of 32,068 apps downloaded from the websites of URLs collected on Twitter. We clarified the proportion of apps that contained malware and proportion of apps utilizing accessibility services. We found that both, the percentage of malware and percentage of total apps using accessibility services have been increasing. Notably, the percentages of malware and un-suspicious apps using accessibility services were quite similar. Therefore, this problem cannot be solved by automatically blocking all apps that use accessibility services. Hence, specific countermeasures against malware using accessibility services will be increasingly important for online security in the future.

DOI： 10.1007/978-3-030-65299-9_8

Scopus

researchmap

Other Link： https://dblp.uni-trier.de/db/conf/wisa/wisa2020.html#IchiokaPMNY20

Method of Generating a Blacklist for Mobile Devices by Searching Malicious Websites. Reviewed

Takashi Ishihara, Masaya Sato, Toshihiro Yamauchi

Proceedings - 2020 8th International Symposium on Computing and Networking Workshops, CANDARW 2020 328 - 333 2020.11

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

© 2020 IEEE. As mobile devices have become more popular, mal-ware and attacks directed at them have significantly increased. One of the methods to attack mobile devices is redirecting a user to unwanted websites by unwanted page transition. One of the countermeasures against such attacks is to generate a blacklist of URLs and hostnames, which can prevent access to malicious websites. To generate a blacklist, first, malicious websites are collected in the web space. Then, URLs and hostnames of the malicious websites are added to the blacklist. However, URLs of the malicious websites are typically changed frequently; thus, it is necessary to keep track of the malicious websites and update the blacklist in a timely manner. In this study, we proposed a method to generate blacklists for mobile devices by searching malicious websites. The method collects many HTML files from the web space using a crawler and searches for HTML files that are highly likely to be malicious using keywords extracted from the known malicious websites to discover the new ones. Thus, new malicious websites can be added to the blacklist in a timely manner. Using the proposed method, we discovered malicious websites that were not detected by Google Safe Browsing. Moreover, the blacklist generated using the method had a high detection rate for certain malicious websites. This paper reports the design process and the results of the evaluation of the new method.

DOI： 10.1109/CANDARW51189.2020.00070

Scopus

researchmap

Other Link： https://dblp.uni-trier.de/db/conf/ic-nc/candar2020w.html#IshiharaSY20

　 PREV - NEXT 　

< YAMAUCHI Toshihiro >

Papers - YAMAUCHI Toshihiro