Faculty Profiles - YAMAUCHI Toshihiro

Papers - YAMAUCHI Toshihiro

Division display 81 - 100 of about 219 ／ All the affair displays >>

Performance Improvement and Evaluation of Function for Tracing Diffusion of Classified Information on KVM Reviewed

Hideaki Moriyama, Toshihiro Yamauchi, Masaya Sato, Hideo Taniguchi

Proceedings - 2017 5th International Symposium on Computing and Networking, CANDAR 2017 2018-January 463 - 468 2018.4

Authorship：Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE Computer Society

© 2017 IEEE. As a result of the increasing amounts of classified information being managed by personal computers, leakage of this information to external computers has become a serious problem. To prevent such leakage, we previously proposed a function for tracing the diffusion of classified information in a guest operating system (OS) using a virtual machine monitor (VMM). This function allows determination of the classified information location and information leakage detection without modification of the guest OS source code. In addition, it is more difficult for attacks to target this function, because the VMM is isolated from the guest OS. The tracing function hooks a system call in the guest OS from the VMM and judges whether the hooked system call is related to the diffusion of classified information. However, if the tracing function induces processing of large overheads, introduction of this function may degrade performance. In this paper, we analyze the processing performance of the tracing function in detail, identifying processing involving large overheads. Hence, we determine that the recording overheads for files or processes having the potential to diffuse classified information are especially large. To reduce the influence of the tracing function introduction, it is necessary to reduce these overheads. Therefore, we present a policy for efficient management. Further, we propose an improved tracing function and report on its evaluation.

DOI： 10.1109/CANDAR.2017.91

Other Link： https://dblp.uni-trier.de/db/conf/ic-nc/candar2017.html#MoriyamaYST17

Web access monitoring mechanism for Android WebView Reviewed

Yuta Imamura, Hiroyuki Uekawa, Yasuhiro Ishihara, Masaya Sato, Toshihiro Yamauchi

ACM International Conference Proceeding Series 1 - 8 2018.1

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：ACM

© 2018 Association for Computing Machinery. In addition to conventional web browsers, WebView is used to display web content on Android. WebView is a component that enables the display of web content in mobile applications, and is extensively used. As WebView displays web content without having to redirect the user to web browsers, there is the possibility that unauthorized web access may be performed secretly via Web-View, and information in Android may be stolen or tampered with. Therefore, it is necessary to monitor and analyze web access via WebView, particularly because attacks exploiting WebView have been reported. However, there is no mechanism for monitoring web access viaWebView. In this work, the goals are to monitor web access via WebView and to analyze mobile applications using Web-View. To achieve these goals, we propose a web access monitoring mechanism for Android WebView. In this paper, the design and implementation of a mechanism that does not require any modifications to the Android Framework and Linux kernel are presented for the Chromium Android System WebView app. In addition, this paper presents evaluation results for the proposed mechanism.

DOI： 10.1145/3167918.3167942

Other Link： https://dblp.uni-trier.de/db/conf/acsw/acsw2018.html#ImamuraUISY18

Access control mechanism to mitigate cordova plugin attacks in hybrid applications Reviewed

Naoki Kudo, Toshihiro Yamauchi, Thomas H. Austin

Journal of Information Processing 26 396 - 405 2018.1

Authorship：Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：Information Processing Society of Japan

© 2018 Information Processing Society of Japan. Hybrid application frameworks such as Cordova are more and more popular to create platform-independent applications (apps) because they provide special APIs to access device resources in a platform-agonistic way. By using these APIs, hybrid apps can access device resources through JavaScript. In this paper, we present a novel apprepackaging attack that repackages hybrid apps with malicious code; this code can exploit Cordova’s plugin interface to steal and tamper with device resources. We address this attack and cross-site scripting attacks against hybrid apps. Since these attacks need to use plugins to access device resources, we refer to both of these attacks as Cordova plugin attacks. We further demonstrate a defense against Cordova plugin attacks through the use of a novel runtime access control mechanism that restricts access based on the mobile user’s judgement. Our mechanism is easy to introduce to existing Cordova apps, and allows developers to produce apps that are resistant to Cordova plugin attacks. Moreover, we evaluate the effectiveness and performance of our mechanism.

DOI： 10.2197/ipsjjip.26.396

ディレクトリ優先方式における未参照バッファ数に着目した入出力バッファ分割法 Reviewed

横山和俊, 土谷彰義, 山本光一, 河辺誠弥, 山内利宏, 乃村能成, 谷口秀夫

電子情報通信学会論文誌D J101-D ( 1 ) 46 - 56 2018

Kernel rootkits detection method by monitoring branches using hardware features Reviewed

Toshihiro Yamauchi, Yohei Akao

IEICE Transactions on Information and Systems E100D ( 10 ) 2377 - 2381 2017.10

Authorship：Lead author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG

Copyright © 2017 The Institute of Electronics, Information and Communication Engineers. An operating system is an essential piece of software that manages hardware and software resources. Thus, attacks on an operating system kernel using kernel rootkits pose a particularly serious threat. Detecting an attack is difficult when the operating system kernel is infected with a kernel rootkit. For this reason, handling an attack will be delayed causing an increase in the amount of damage done to a computer system. In this paper, we propose Kernel Rootkits Guard (KRGuard), which is a new method to detect kernel rootkits that monitors branch records in the kernel space. Since many kernel rootkits make branches that differ from the usual branches in the kernel space, KRGuard can detect these differences by using the hardware features of commodity processors. Our evaluation shows that KRGuard can detect kernel rootkits that involve new branches in the system call handler processing with small overhead.

DOI： 10.1587/transinf.2016INL0003

Other Link： https://dblp.uni-trier.de/db/journals/ieicet/ieicet100d.html#YamauchiA17

Access control for plugins in cordova-based hybrid applications Reviewed

Naoki Kudo, Toshihiro Yamauchi, Thomas H. Austin

Proceedings - International Conference on Advanced Information Networking and Applications, AINA 1063 - 1069 2017.5

Authorship：Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

© 2017 IEEE. Hybrid application frameworks such as Cordovaallow mobile application (app) developers to create platformindependent apps. The code is written in JavaScript, with special APIs to access device resources in a platform-agnostic way. In this paper, we present a novel app-repackaging attack that repackages hybrid apps with malicious code, this code can exploit Cordova's plugin interface to tamper with device resources. We further demonstrate a defense against this attack through the use of a novel runtime access control mechanism that restricts access based on the mobile user's judgement. Our mechanism is easy to introduce to existing Cordova apps, and allows developers to produce apps that are resistant to app-repackaging attacks.

DOI： 10.1109/AINA.2017.61

Other Link： https://dblp.uni-trier.de/db/conf/aina/aina2017.html#KudoYA17

KRGuard: Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features Reviewed

Yohei Akao, Toshihiro Yamauchi

ICISS 2016 - 2016 International Conference on Information Science and Security 100-D ( 10 ) 22 - 26 2017.3

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG

© 2016 IEEE. Attacks on an operating system kernel using kernel rootkits pose a particularly serious threat. Detecting an attack is difficult when the operating system kernel is infected with a kernel rootkit. For this reason, handling an attack will be delayed causing an increase in the amount of damage done to a computer system. In this paper, we discuss KRGuard (Kernel Rootkits Guard), which is a new method to detect kernel rootkits that monitors branch records in the kernel space. Since many kernel rootkits make branches that differ from the usual branches in the kernel space, KRGuard can detect these differences by using hardware features of commodity processors. Our evaluation shows that KRGuard can detect kernel rootkits with small overhead.

DOI： 10.1109/ICISSEC.2016.7885860

Other Link： https://dblp.uni-trier.de/db/journals/ieicet/ieicet100d.html#YamauchiA17

Memory access monitoring and disguising of process information to Avoid Attacks to essential services Reviewed

Masaya Sato, Toshihiro Yamauchi, Hideo Taniguchi

Proceedings - 2016 4th International Symposium on Computing and Networking, CANDAR 2016 635 - 641 2017.1

Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

© 2016 IEEE. To prevent attacks on essential software and to mitigate damage, an attack avoiding method that complicates process identification from attackers is proposed. This method complicates the identification of essential services by replacing process information with dummy information. However, this method allows attackers to identify essential processes by detecting changes in process information. To address this problems and provide more complexity to process identification, this paper proposes a memory access monitoring by using a virtual machine monitor. By manipulating the page access permission, a virtual machine monitor detects page access, which includes process information, and replaces it with dummy information. This paper presents the design, implementation, and evaluation of the proposed method.

DOI： 10.1109/CANDAR.2016.89

Other Link： https://dblp.uni-trier.de/db/conf/ic-nc/candar2016.html#SatoYT16

Rule-based sensor data aggregation system for M2M gateways Reviewed

Yuichi Nakamura, Akira Moriguchi, Masanori Irie, Taizo Kinoshita, Toshihiro Yamauchi

IEICE Transactions on Information and Systems E99D ( 12 ) 2943 - 2955 2016.12

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG

© Copyright 2016 The Institute of Electronics, Information and Communication Engineers. To reduce the server load and communication costs of machine-to-machine (M2M) systems, sensor data are aggregated in M2M gateways. Aggregation logic is typically programmed in the C language and embedded into the firmware. However, developing aggregation programs is difficult for M2M service providers because it requires gatewayspecific knowledge and consideration of resource issues, especially RAM usage. In addition, modification of aggregation logic requires the application of firmware updates, which are risky. We propose a rule-based sensor data aggregation system, called the complex sensor data aggregator (CSDA), for M2M gateways. The functions comprising the data aggregation process are subdivided into the categories of filtering, statistical calculation, and concatenation. The proposed CSDA supports this aggregation process in three steps: the input, periodic data processing, and output steps. The behaviors of these steps are configured by an XML-based rule. The rule is stored in the data area of flash ROM and is updatable through the Internet without the need for a firmware update. In addition, in order to keep within the memory limit specified by the M2M gateway's manufacturer, the number of threads and the size of the working memory are static after startup, and the size of the working memory can be adjusted by configuring the sampling setting of a buffer for sensor data input. The proposed system is evaluated in an M2M gateway experimental environment. Results show that developing CSDA configurations is much easier than using C because the configuration decreases by 10%. In addition, the performance evaluation demonstrates the proposed system's ability to operate on M2M gateways.

DOI： 10.1587/transinf.2016PAP0020

Other Link： https://dblp.uni-trier.de/db/journals/ieicet/ieicet99d.html#NakamuraMIKY16

プロセス間通信を抑制しデータ共有するマイクロカーネル構造OS向けファイル操作機能の実現と評価 Reviewed

江原寛人, 枡田圭祐, 山内利宏, 谷口秀夫

電子情報通信学会論文誌D J99-D ( 10 ) 1069 - 1079 2016.10

Heaprevolver: Delaying and randomizing timing of release of freed memory area to prevent use-after-free attacks Reviewed

Toshihiro Yamauchi, Yuta Ikegami

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 9955 LNCS 219 - 234 2016.9

Authorship：Lead author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：SPRINGER INT PUBLISHING AG

© Springer International Publishing AG 2016. Recently, there has been an increase in use-after-free (UAF) vulnerabilities, which are exploited using a dangling pointer that refers to a freed memory. Various methods to prevent UAF attacks have been proposed. However, only a few methods can effectively prevent UAF attacks during runtime with low overhead. In this paper, we propose HeapRevolver, which is a novel UAF attack-prevention method that delays and randomizes the timing of release of freed memory area by using a memory-reuse-prohibited library, which prohibits a freed memory area from being reused for a certain period. In this paper, we describe the design and implementation of HeapRevolver in Linux and Windows, and report its evaluation results. The results show that HeapRevolver can prevent attacks that exploit existing UAF vulnerabilities. In addition, the overhead is small.

DOI： 10.1007/978-3-319-46298-1_15

Other Link： https://dblp.uni-trier.de/db/conf/nss/nss2016.html#YamauchiI16

Implementation and Evaluation of Partitioning Method of I/O Buffer Based on Cache Hit Ratio Reviewed

57 ( 6 ) 1539 - 1553 2016.6

Authorship：Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

In order to improve file access performance of the processing that users would like to execute at high priority, it is effective to improve cache hit ratio of I/O buffer. Thus, a directory oriented buffer cache mechanism was proposed. This mechanism divides I/O buffer into two areas, and gives higher caching priority to files in specified directories. However, this mechanism monotonically expands the area used for caching files given higher priority. Therefore, this mechanism declines the performance of the whole computer due to deterioration of cache hit ratio of files not given higher priority. Thus, this paper proposes the dynamic partitioning method based on cache hit ratio. The proposed method divides I/O buffer to maintain high cache hit ratio of files given higher priority and prevent cache hit ratio of the other files from degradation. Additionally, this paper describes the evaluation of effectivity of the proposed method.

Evaluation and design of function for tracing diffusion of classified information for file operations with KVM Reviewed

Shota Fujii, Masaya Sato, Toshihiro Yamauchi, Hideo Taniguchi

Journal of Supercomputing 72 ( 5 ) 1841 - 1861 2016.5

Authorship：Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：SPRINGER

© 2016, Springer Science+Business Media New York. Cases of classified information leakage have become increasingly common. To address this problem, we have proposed a function for tracing the diffusion of classified information within an operating system. However, this function suffers from the following two problems: first, in order to introduce the function, the operating system’s source code must be modified. Second, there is a risk that the function will be disabled when the operating system is attacked. Thus, we have designed a function for tracing the diffusion of classified information in a guest operating system by using a virtual machine monitor. By using a virtual machine monitor, we can introduce the proposed function in various environments without modifying the operating system’s source code. In addition, attacks aimed at the proposed function are made more difficult, because the virtual machine monitor is isolated from the operating system. In this paper, we describe the implementation of the proposed function for file operations and child process creation in the guest operating system with a kernel-based virtual machine. Further, we demonstrate the traceability of diffusing classified information by file operations and child process creation. We also report the logical lines of code required to introduce the proposed function and performance overheads.

DOI： 10.1007/s11227-016-1671-5

Plate: Persistent memory management for nonvolatile main memory Reviewed

Toshihiro Yamauchi, Yuta Yamamoto, Kengo Nagai, Tsukasa Matono, Shinji Inamoto, Masaya Ichikawa, Masataka Goto, Hideo Taniguchi

Proceedings of the ACM Symposium on Applied Computing 04-08-April-2016 1885 - 1892 2016.4

Authorship：Lead author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：ACM

© 2016 ACM. Over the past few years, nonvolatile memory has actively been researched and developed. Therefore, studying operating system (OS) designs predicated on the main memory in the form of a nonvolatile memory and studying methods to manage persistent data in a virtual memory are crucial to encourage the widespread use of nonvolatile memory in the future. However, the main memory in most computers today is volatile, and replacing highcapacity main memory with nonvolatile memory is extremely cost-prohibitive. This paper proposes an OS structure for nonvolatile main memory. The proposed OS structure consists of three functions to study and develop OSs for nonvolatile main memory computers. First, a structure, which is called plate, is proposed whereby persistent data are managed assuming that nonvolatile main memory is present in a computer. Second, we propose a persistent-data mechanism to make a volatile memory function as nonvolatile main memory, which serves as a basis for the development of OSs for computers with nonvolatile main memory. Third, we propose a continuous operation control using the persistent-data mechanism and plates. This paper describes the design and implementation of the OS structure based on the three functions on The ENduring operating system for Distributed EnviRonment and describes the evaluation results of the proposed functions.

DOI： 10.1145/2851613.2851744

Other Link： https://dblp.uni-trier.de/db/conf/sac/sac2016.html#YamauchiYNMIIGT16

Attacker Investigation System Triggered by Information Leakage Reviewed

Yuta Ikegami, Toshihiro Yamauchi

Proceedings - 2015 IIAI 4th International Congress on Advanced Applied Informatics, IIAI-AAI 2015 24 - 27 2016.1

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

© 2015 IEEE. While a considerable amount of research has been devoted to preventing leakage of classified information, little attention has been paid to identifying attackers who steal information. If attackers can be identified, more precise countermeasures can be taken. In this paper, we propose an attacker investigation system that focuses on information leakage. The system traces classified information in a computer and substitutes it with dummy data, which is then sent to the outside. Moreover, a program embedded in the dummy data transmits information back from the attacker's computer to a pre-specified system for investigation. Information about the attacker can be obtained by an attacker executing the program.

DOI： 10.1109/IIAI-AAI.2015.247

Other Link： https://dblp.uni-trier.de/db/conf/iiaiaai/iiaiaai2015.html#IkegamiY15

Proposal of Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features Reviewed

Yohei Akao, Toshihiro Yamauchi

Proceedings - 2015 IIAI 4th International Congress on Advanced Applied Informatics, IIAI-AAI 2015 721 - 722 2016.1

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

© 2015 IEEE. Attacks on computer systems have become more frequent in recent years. Attacks using kernel root kits pose a particularly serious threat. When a computer system is infected with a kernel root kit, attack detection is difficult. Because of this, handling the attack will be delayed causing an increase in the amount of damage done to the computer system. This paper proposes a new method to detect kernel root kits by monitoring the branch records in kernel space using hardware features of commodity processors. Our method utilizes the fact that many kernel root kits make branches that differ from the usual branches. By introducing our method, it is possible to detect kernel root kits immediately and, thereby, reduce damages to a minimum.

DOI： 10.1109/IIAI-AAI.2015.243

Other Link： https://dblp.uni-trier.de/db/conf/iiaiaai/iiaiaai2015.html#AkaoY15

Design of function for tracing diffusion of classified information for IPC on KVM Reviewed

Shota Fujii, Masaya Sato, Toshihiro Yamauchi, Hideo Taniguchi

Journal of Information Processing 24 ( 5 ) 781 - 792 2016

Authorship：Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：Information Processing Society of Japan

© 2016 Information Processing Society of Japan. The leaking of information has increased in recent years. To address this problem, we previously proposed a function for tracing the diffusion of classified information in a guest OS using a virtual machine monitor (VMM). This function makes it possible to grasp the location of classified information and detect information leakage without modifying the source codes of the guest OS. The diffusion of classified information is caused by a file operation, child process creation, and inter-process communication (IPC). In a previous study, we implemented the proposed function for a file operation and child process creation excluding IPC using a kernel-based virtual machine (KVM). In this paper, we describe the design of the proposed function for IPC on a KVM without modifying the guest OS. The proposed function traces the local and remote IPCs inside the guest OS from the outside so as to trace the information diffusion. Because IPC with an outside computer might cause information leakage, tracing the IPCs enables the detection of such a leakage. We also report the evaluation results including the traceability and performance of the proposed function.

DOI： 10.2197/ipsjjip.24.781

Toshihiro Yamauchi

IEICE Trans. Inf. Syst. 99-D ( 4 ) 785 - 786 2016

Fast control method of software-managed TLB for reducing zero-copy communication overhead Reviewed

Toshihiro Yamauchi, Masahiro Tsuruya, Hideo Taniguchi

IEICE Transactions on Information and Systems E98D ( 12 ) 2187 - 2191 2015.12

Authorship：Lead author,　Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG

© Copyright 2015 The Institute of Electronics, Information and Communication Engineers. Microkernel operating systems (OSes) use zero-copy communication to reduce the overhead of copying transfer data, because the communication between OS servers occurs frequently in the case of microkernel OSes. However, when a memory management unit manages the translation lookaside buffer (TLB) using software, TLB misses tend to increase the overhead of interprocess communication (IPC) between OS servers running on a microkernel OS. Thus, improving the control method of a software-managed TLB is important for microkernel OSes. This paper proposes a fast control method of software-managed TLB that manages page attachment in the area used for IPC by using TLB entries, instead of page tables. Consequently, TLB misses can be avoided in the area, and the performance of IPC improves. Thus, taking the SH-4 processor as an example of a processor having a software-managed TLB, this paper describes the design and the implementation of the proposed method for AnT operating system, and reports the evaluation results of the proposed method.

DOI： 10.1587/transinf.2015PAL0003

Other Link： https://dblp.uni-trier.de/db/journals/ieicet/ieicet98d.html#YamauchiTT15

マルチコア向けAnTオペレーティングシステムのファイル操作における分散効果の評価 Reviewed

河上裕太, 山内利宏, 谷口秀夫

マルチマディア通信と分散処理ワークショップ2015論文集 2015 ( 5 ) 100 - 106 2015.10

　 PREV - NEXT 　

1
2
3
4
5
6
7
8
9
10
11