Faculty Profiles - YAMAUCHI Toshihiro

Papers - YAMAUCHI Toshihiro

Division display 61 - 80 of about 219 ／ All the affair displays >>

Privilege Escalation Attack Prevention Method by Focusing on Privilege Changes on 64-bit ARM Reviewed

61 ( 9 ) 1531 - 1541 2020.9

Authorship：Last author,　Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

Privilege escalation attacks that exploit operating system vulnerabilities can cause significant damage to the associated systems. We previously proposed an additional kernel observer (AKO), a prevention method that focuses on modifying process privileges by system calls. AKO verifies the modification in process privilege data and monitors the modification in privilege data by storing them in the kernel stack before processing the system call. However, if an attacker identifies the storage location of privilege data in the kernel stack and alters both process privilege data and privilege data in the kernel stack while the system call is being processed, AKO can be bypassed. Hence, in this paper, we propose a new method for preventing privilege escalation attacks in the 64-bit ARM environment as well as AKO for protecting mobile devices and IoT devices. To address the issues of AKO, the new method protects the stored privilege data employing the ARM TrustZone technology. In this paper, the new method's design, implementation, and evaluation results are described. In the evaluation, we performed a privilege escalation attack detection experiment using an exploit code and measured performance of system calls and applications. The evaluation results showed that protection by attack detection was successful and the performance degradation due to this method was limited.

Privilege Escalation Attack Prevention Method Focusing on Privilege Changes in Guest OS on KVM Reviewed

61 ( 9 ) 1507 - 1518 2020.9

Authorship：Last author,　Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

Privilege escalation attacks can lead to system tampering and information leakage. To address such attacks, we previously proposed a privilege escalation attack prevention method that focus on the modification of privileges by system calls. However, the said method needs to be implemented in the operating system (OS), and its application thus requires alteration of the kernel source code. Additionally, privilege data stored in the kernel space may be forged by attackers. To address these issues, we propose a new method in this paper for preventing privilege escalation attacks by employing KVM, (a virtual machine monitor). The new method hooks the system call invoked in the guest OS and verifies the modification of privileges through system call processing. Application of the new method does not require alteration of the kernel source code. Furthermore, forging of privilege data is deterred by storing privilege data in the memory of the host OS. In this paper, drawbacks of the previously proposed method are discussed, and the new proposed method and its evaluation results are described.

Method to Reduce Redundant Security Policy Using SELinux CIL Reviewed

61 ( 9 ) 1519 - 1530 2020.9

Authorship：Last author,　Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

Application of SELinux involves incorporating a general security policy that permits redundant privileges for individual systems. Hence, we previously proposed a method that eliminates redundant policies from the general policy. However, the said method cannot be applied when there is no policy source file or policies include an attribute that is not supported. During eliminating policies period, the log of access permitted by a particular policy is continually produced as an output, and the associated overhead is large. Furthermore, redundant policies in the base module cannot be eliminated. To address these issues, we propose a new method that extends the previously proposed method. The new method involves the processing of files written in SELinux CIL (an intermediate language) for eliminating redundant policies. Additionally, the new method considers attributes and eliminates policies with fine granularity. The overhead is reduced by eliminating the auditallow statement associated with the policy once converted to the policy format from the policy. Furthermore, by replacing the typeattributeset statement, redundant policies can be eliminated without modifying the base module. In this study, the effectiveness of our method is demonstrated through evaluation of policy elimination and through an attack prevention experiment by incorporating the vulnerabilities in Apache Struts2.

MKM: Multiple Kernel Memory for Protecting Page Table Switching Mechanism Against Memory Corruption. Reviewed

Hiroki Kuzuno, Toshihiro Yamauchi

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 12231 LNCS 97 - 116 2020.9

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：Springer

© Springer Nature Switzerland AG 2020. Countermeasures against kernel vulnerability attacks on an operating system (OS) are highly important kernel features. Some kernels adopt several kernel protection methods such as mandatory access control, kernel address space layout randomization, control flow integrity, and kernel page table isolation; however, kernel vulnerabilities can still be exploited to execute attack codes and corrupt kernel memory. To accomplish this, adversaries subvert kernel protection methods and invoke these kernel codes to avoid administrator privileges restrictions and gain complete control of the target host. To prevent such subversion, we present Multiple Kernel Memory (MKM), which offers a novel security mechanism using an alternative design for kernel memory separation that was developed to reduce the kernel attack surface and mitigate the effects of illegal data manipulation in the kernel memory. The proposed MKM is capable of isolating kernel memory and dedicates the trampoline page table for a gateway of page table switching and the security page table for kernel protection methods. The MKM encloses the vulnerable kernel code in the kernel page table. The MKM mechanism achieves complete separation of the kernel code execution range of the virtual address space on each page table. It ensures that vulnerable kernel code does not interact with different page tables. Thus, the page table switching of the trampoline and the kernel protection methods of the security page tables are protected from vulnerable kernel code in other page tables. An evaluation of MKM indicates that it protects the kernel code and data on the trampoline and security page tables from an actual kernel vulnerabilities that lead to kernel memory corruption. In addition, the performance results show that the overhead is 0.020 $$\mu $$s to 0.5445 $$\mu $$s, in terms of the system call latency and the application overhead average is 196.27 $$\mu $$s to 6,685.73 $$\mu $$s, for each download access of 100,000 Hypertext Transfer Protocol sessions.

DOI： 10.1007/978-3-030-58208-1_6

Other Link： https://dblp.uni-trier.de/db/conf/iwsec/iwsec2020.html#KuzunoY20

Identification of kernel memory corruption using kernel memory secret observation mechanism Reviewed

Kuzuno, H., Yamauchi, T.

IEICE Transactions on Information and Systems E103D ( 7 ) 1462 - 1475 2020.7

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG

Copyright © 2020 The Institute of Electronics, Information and Communication Engineers. Countermeasures against attacks targeting an operating system are highly effective in preventing security compromises caused by kernel vulnerability. An adversary uses such attacks to overwrite credential information, thereby overcoming security features through arbitrary program execution. CPU features such as Supervisor Mode Access Prevention, Supervisor Mode Execution Prevention and the No eXecute bit facilitate access permission control and data execution in virtual memory. Additionally, Linux reduces actual attacks through kernel vulnerability affects via several protection methods including Kernel Address Space Layout Randomization, Control Flow Integrity, and Kernel Page Table Isolation. Although the combination of these methods can mitigate attacks as kernel vulnerability relies on the interaction between the user and the kernel modes, kernel virtual memory corruption can still occur (e.g., the eBPF vulnerability allows malicious memory overwriting only in the kernel mode). We present the Kernel Memory Observer (KMO), which has a secret observation mechanism to monitor kernel virtual memory. KMO is an alternative design for virtual memory can detect illegal data manipulation/writing in the kernel virtual memory. KMO determines kernel virtual memory corruption, inspects system call arguments, and forcibly unmaps the direct mapping area. An evaluation of KMO reveals that it can detect kernel virtual memory corruption that contains the defeating security feature through actual kernel vulnerabilities. In addition, the results indicate that the system call overhead latency ranges from 0.002 μs to 8.246 μs, and the web application benchmark ranges from 39.70 μs to 390.52 μs for each HTTP access, whereas KMO reduces these overheads by using tag-based Translation Lookaside Buffers.

DOI： 10.1587/transinf.2019ICP0011

Other Link： https://dblp.uni-trier.de/db/journals/ieicetd/ieicetd103.html#KuzunoY20

Support System for Assessing Anti-analysis JavaScript Code by Using Proxy Objects Reviewed

61 ( 6 ) 1134 - 1145 2020.6

Authorship：Last author,　Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

JavaScript code used by web-based attacks is usually protected by some anti-analysis techniques such as obfuscation or cloaking in order to hide its intent or avoid detection. Analyzing such code becomes an urgent task to counter cyber attacks. Therefore, we propose an analysis support system for anti-analysis JavaScript code. The proposed system comprehensively monitors browser API operations and outputs API operation logs for helping analyst's understanding the behavior of code. By using Proxy objects to capture API operations, the proposed system successfuly monitors API operations that could not be captured completely by existing methods. In addition, by replacing variable references, it is able to comprementally monitor API operations for non-replaceable APIs. In this paper, we describe the concept of the proposed system and the implementation of analysis method. We also report the result of analyzing anti-analysis JavaScript codes as an evaluation.

第3編―情報技術の発展と展望［CSEC］コンピュータセキュリティ研究会

山内利宏

情報処理学会60年のあゆみ 2020

Method for Delegating I/O Functions to Linux in AnT Operating System Reviewed

60 ( 12 ) 2279 - 2290 2019.12

Authorship：Lead author,　Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

A specialized operating system (OS) can provide some order-made service efficiently. However, development of the specialized OS takes a large amount of cost (e.g., device driver, file management functions). Thus, it is important to reduce the cost. In this paper, we describe a method for introducing the specialized OS and Linux run independently in multicore processors, and the specialized OS uses Linux file I/O functions. This paper describes the design and the implementation of the proposed method for AnT operating system as the specialized OS, and reports the evaluation results of the proposed method.

Threat Analysis of Fake Virus Alerts Using WebView Monitor Reviewed International coauthorship

Yuta Imamura, Rintaro Orito, Kritsana Chaikaew, Celia Manardo, Pattara Leelaprute, Masaya Sato, Toshihiro Yamauchi

Proceedings - 2019 7th International Symposium on Computing and Networking, CANDAR 2019 28 - 36 2019.11

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

© 2019 IEEE. As mobile devices have become more popular, mobile web browsing has surpassed desktop browser use and the number of mobile malware cases has increased. The methods of infiltrating Android devices with malware include malvertising and scams. Android users can access websites via web browsers and Android apps using WebView, which displays web content inside an app without redirecting users to web browsers. However, WebView is vulnerable to cyberattacks and the security mechanisms are not sufficient to prevent all attacks. In this study, to analyze web access threats via WebView, we investigated web access to malicious websites against Android mobile devices. In particular, we focused on fake virus alerts. To monitor web access for threat analysis, we improved the WebView Monitor [1] to capture all web access via Android WebView. In particular, we analyzed the mechanism of displaying a fake virus alert while browsing websites on Android.

DOI： 10.1109/CANDAR.2019.00012

Other Link： https://dblp.uni-trier.de/db/conf/ic-nc/candar2019.html#ImamuraOCMLSY19

KMO: Kernel Memory Observer to Identify Memory Corruption by Secret Inspection Mechanism Reviewed

Hiroki Kuzuno, Toshihiro Yamauchi

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 11879 LNCS 75 - 94 2019.11

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：Springer

© Springer Nature Switzerland AG, 2019. Kernel vulnerability attacks may allow attackers to execute arbitrary program code and achieve privilege escalation through credential overwriting, thereby avoiding security features. Major Linux protection methods include Kernel Address Space Layout Randomization, Control Flow Integrity, and Kernel Page Table Isolation. All of these mitigate kernel vulnerability affects and actual attacks. In addition, the No eXecute bit, Supervisor Mode Access Prevention, and Supervisor Mode Execution Prevention are CPU features for managing access permission and data execution in virtual memory. Although combinations of these methods can reduce the attack availability of kernel vulnerability based on the interaction between the user and kernel modes, kernel virtual memory corruption is still possible (e.g., the eBPF vulnerability executes the attack code only in the kernel mode). To monitor kernel virtual memory, we present the Kernel Memory Observer (KMO), which has a secret inspection mechanism and offers an alternative design for virtual memory. It allows the detection of illegal data manipulation/writing in the kernel virtual memory. KMO identifies the kernel virtual memory corruption, monitors system call arguments, and enables unmapping from the direct mapping area. An evaluation of our method indicates that it can detect the actual kernel vulnerabilities leading to kernel virtual memory corruption. In addition, the results show that the overhead is 0.038 $$\upmu $$ s to 2.505 $$\upmu $$ s in terms of system call latency, and the application benchmark is 371.0 $$\upmu $$ s to 1,990.0 $$\upmu $$ s for 100,000 HTTP accesses.

DOI： 10.1007/978-3-030-34339-2_5

Other Link： https://dblp.uni-trier.de/db/conf/ispec/ispec2019.html#KuzunoY19

仮想計算機を利用した性能プロファイリングシステムの分散化とデータ収集停止時間の短縮 Reviewed

山本昌生,中島耕太,山内利宏,名古屋彰,谷口秀夫

電子情報通信学会論文誌D J102-D ( 10 ) 674 - 684 2019.10

(Short Paper) method for preventing suspicious web access in android WebView Reviewed

Masaya Sato, Yuta Imamura, Rintaro Orito, Toshihiro Yamauchi

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 11689 LNCS 241 - 250 2019.8

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：Springer

© 2019, Springer Nature Switzerland AG. WebView is commonly used by applications on the Android OS. Given that WebView is used as a browsing component on applications, they can be attacked via the web. Existing security mechanisms mainly focus on web browsers; hence, securing WebView is an important challenge. We proposed and implemented a method for preventing suspicious web access in Android WebView. Attackers distribute their malicious content including malicious applications, potentially unwanted programs, and coin miners, by inserting contents into a web page. Because loading malicious content involves HTTP communication, our proposed method monitors HTTP communication by WebView and blocks suspicious web accesses. To apply the proposed method to widely used applications, we implemented our method inside WebView. We also evaluated the proposed method with some popular applications and confirmed that the method can block designated web content without impeding the functionality of applications.

DOI： 10.1007/978-3-030-26834-3_14

Other Link： https://dblp.uni-trier.de/db/conf/iwsec/iwsec2019.html#SatoIOY19

Design and implementation of hiding method for file manipulation of essential services by system call proxy using virtual machine monitor. Reviewed

Masaya Sato, Hideo Taniguchi, Toshihiro Yamauchi

Int. J. Space Based Situated Comput. 9 ( 1 ) 1 - 10 2019.5

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：INDERSCIENCE ENTERPRISES LTD

Security or system management software is essential for keeping systems secure. To deter attacks on essential services, hiding information related to essential services is helpful. This paper describes the design, the implementation, and the evaluation of a method to make files invisible to all services except their corresponding essential services and provides access methods to those files in a virtual machine (VM). In the proposed method, the virtual machine monitor (VMM) monitors the system call, which invoked by an essential process to access essential files, and requests proxy execution to the proxy process on another VM. The VMM returns the result and skips the execution of the original system call on the protection target VM. Thus, access to essential files by the essential service is skipped on the protection target VM, but the essential service can access the file content.

DOI： 10.1504/IJSSC.2019.100007

Hiding File Manipulation of Essential Services by System Call Proxy Reviewed

Masaya Sato, Hideo Taniguchi, Toshihiro Yamauchi

Lecture Notes on Data Engineering and Communications Technologies 22 853 - 863 2019.3

Authorship：Last author,　Corresponding author Language：English Publishing type：Part of collection (book) Publisher：Springer

© 2019, Springer Nature Switzerland AG. Security software or logging programs are frequently attacked because they are an obstruction to attackers. Protecting these essential services from attack is crucial to preventing and mitigating damage. Hiding information related to essential services, such as that of the files and processes, can help to deter attacks on these services. This paper proposes a method of hiding file manipulation for essential services. The method makes the files invisible to all services except their corresponding essential services and provides access methods to those files in a virtual machine (VM) environment. In the proposed method, system calls to those files are executed by a proxy process on the other VM. The original system call is not executed in the operating system of the original VM, however, the result of file access is returned to the original process. Thus, the files of essential services are placed on the other VM and other processes on the original VM cannot access to them. Therefore, the proposed method can prevent or deter identification of essential services based on file information monitoring.

DOI： 10.1007/978-3-319-98530-5_76

Other Link： https://dblp.uni-trier.de/db/conf/nbis/nbis2018.html#SatoTY18

Implementation and Evaluation of Batch Processing Request for Leveraging Distributed Execution of OS Processing Reviewed

60 ( 2 ) 430 - 439 2019.2

Authorship：Last author,　Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

In microkernel operating systems (OSes), some parts of OS functions are implemented as processes, which called OS server. For this reason, OS functions can be distributed by placing OS servers to multiple processors. However, it is difficult to reduce the response time of a processing request from an application program (AP) to an OS server. This is due to invocation of multiple inter server communication for processing requests. In addition, an interface of processing requests from AP to OS servers is blocking in most cases. Hence, a processing request is forced to be done successively even though multiple processing are concurrently executable and related OS servers are independent. In this paper, we propose a batch process request function with blocking interface to request multiple processing to OS servers at one time. We also present evaluation results of basic performance, and distributed processing by the proposed function can reduce the response time for a service consists of multiple processing.

Live Forensic Method Using Process Duplication to Maintain High System Availability Reviewed

60 ( 2 ) 696 - 705 2019.2

Authorship：Lead author,　Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

Most conventional digital forensic methods are designed to target hard disk drives, making them ineffective at detecting in-memory malware. In addition, in order to prevent a target system from changing the evidence on hard disk drives, it is necessary to shut down the system or stop its processing, reducing system availability. In this paper, we propose a live forensic method using process duplication to maintain high system availability. The proposed method duplicates the virtual address space of a target process for investigation, and obtains the relevant evidence from the duplicate. By reducing the occurrence of memory copy in the duplication process, it is possible to detect in-memory malware while retaining system availability. We describe the effectiveness of the proposed method, and furthermore, evaluate and report on the delay time when this method is applied to a periodically executing process.

Additional Kernel Observer to Prevent Privilege Escalation Attacks by Focusing on System Call Privilege Changes Reviewed

Toshihiro Yamauchi, Yohei Akao, Ryota Yoshitani, Yuichi Nakamura, Masaki Hashimoto

DSC 2018 - 2018 IEEE Conference on Dependable and Secure Computing 1 - 8 2019.1

Authorship：Lead author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

© 2018 IEEE. In recent years, there has been an increase in attacks that exploit operating system vulnerabilities. In particular, if an administrator's privilege is acquired by an attacker through a privilege escalation attack, the attacker can operate the entire system and the system can suffer serious damage. In this paper, an additional kernel observer (AKO) method is proposed. It prevents privilege escalation attacks that exploit operating system vulnerabilities. We focus on the fact that a process privilege can be changed only by specific system calls. AKO monitors privilege information changes during system call processing. If AKO detects a privilege change after system call processing, whereby the invoked system call does not originally change the process privilege, AKO regards the change as a privilege escalation attack and applies countermeasures against it. In this paper, we describe the design and implementation of AKO for Linux x86, 64 bit. Moreover, AKO can be expanded to prevent the falsification of various data in the kernel space. We present an expansion example that prevents the invalidation of Security-Enhanced Linux. Evaluation results show that AKO is effective against privilege escalation attacks, while maintaining low overhead.

DOI： 10.1109/DESEC.2018.8625137

Other Link： https://dblp.uni-trier.de/db/conf/desec/desec2018.html#YamauchiAYNH18

Acceleration of analysis processing on decentralized performance profiling system using virtual machines Reviewed

Masao Yamamoto, Kohta Nakashima, Toshihiro Yamauchi, Akira Nagoya, Hideo Taniguchi

Proceedings - 2018 6th International Symposium on Computing and Networking Workshops, CANDARW 2018 152 - 158 2018.12

Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE Computer Society

© 2018 IEEE. To detect the performance anomaly of a computer, as a structure for continuous performance profiling, decentralization of the performance profiling system using virtual machines has been proposed. Moreover, there have already been evaluation results reported regarding overhead, including data storing, and data sampling stall time. On the other hand, for continuous performance profiling, the continuous processing of performance profiling is needed, including not only data sampling and data storing but also analysis processing. Therefore, first, this paper describes a relationship condition among data sampling time, data storing time, and analysis processing time as the necessary condition for continuous performance profiling on a decentralized performance profiling system. Second, in order to satisfy the relationship condition, we propose a concurrent operation technique as the acceleration method of analysis processing for a decentralized performance profiling system. Finally, this paper presents quantitative evaluations of the proposed method, including the case of a multi-VMM environment.

DOI： 10.1109/CANDARW.2018.00035

Other Link： https://dblp.uni-trier.de/db/conf/ic-nc/candar2018w.html#YamamotoNYNT18

Mitigating use-after-free attack using library considering size and number of freed memory Reviewed

Yuya Ban, Toshihiro Yamauchi

Proceedings - 2018 6th International Symposium on Computing and Networking Workshops, CANDARW 2018 398 - 404 2018.12

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE Computer Society

© 2018 IEEE. Use-after-free (UAF) vulnerabilities, are abused by exploiting a dangling pointer that refers to a freed memory, location and then executing arbitrary code. Vulnerabilities are caused by bugs in software programs, particularly large scale programs such as browsers. We had previously proposed HeapRevolver, which prohibits freed memory area from being reused for a certain period. HeapRevolver on Windows uses the number of freed memory areas that are prohibited for reuse as a trigger to release the freed memory area. Alternatively, HeapRevolver uses the number of the freed memory areas as a threshold for releasing freed memory. However, when the size of individual freed memory area is large, HeapRevolver on Windows increases the memory overhead. In this paper, we propose an improved HeapRevolver for Windows considering the size and number of the freed memory areas. The improved HeapRevolver prohibits the reuse of a certain number of freed memory areas at a given time by considering the size and number of freed memory areas as thresholds. Evaluation results demonstrate that the improved HeapRevolver can prevent attacks that exploit UAF vulnerabilities. Particularly, when the size of individual freed memory area is small in a program, HeapRevolver is effective in decreasing the attack success rate.

DOI： 10.1109/CANDARW.2018.00080

Other Link： https://dblp.uni-trier.de/db/conf/ic-nc/candar2018w.html#BanY18

マルチコア環境におけるスケジューラ連携による優先度逆転抑制法 Reviewed

鴨生悠冬, 山内利宏, 谷口秀夫

電子情報通信学会論文誌D J101-D ( 6 ) 998 - 1008 2018.6

　 PREV - NEXT 　

1
2
3
4
5
6
7
8
9
10
11