Faculty Profiles - YAMAUCHI Toshihiro

Dynamic Control Method for Sending User Information Using TaintDroid Reviewed

56 ( 9 ) 1857 - 1867 2015.9

Authorship：Last author,　Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

In recent years, Android malware has been increasing, and countermeasures against them have become an issue. In particular, the leakage of user information by malware has become an important issue. In order to address this problem, we design and implement a method that uses TaintDroid to prevent the leakage of user information from Android device. This method tracks the diffusion of user information in a device and dynamically controls the action of application program (AP) when the leakage of user information is detected. As a result, this method prevents the leakage of user information from the device. In addition, this method obtains the AP name involved in the leakage of user information and understands the diffusion path of user information when APs communicate user information with each other. Therefore, a user can deal with each AP of leakage factors. Furthermore, this method replaces user information that is leaked from a device with a dummy data. As a result, this method prevents the leakage of user information from the device without interfering the process of AP.

CiNii Article

CiNii Books

Reducing resource consumption of SELinux for embedded systems with contributions to open-source ecosystems Reviewed

Yuichi Nakamura, Yoshiki Sameshima, Toshihiro Yamauchi

Journal of Information Processing 23 ( 5 ) 664 - 672 2015.9

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：Information Processing Society of Japan

© 2015 Information Processing Society of Japan. Security-Enhanced Linux (SELinux) is a useful countermeasure for resisting security threats to embedded systems, because of its effectiveness against zero-day attacks. Furthermore, it can generally mitigate attacks without the application of security patches. However, the combined resource requirements of the SELinux kernel, userland, and the security policy reduce the performance of resource-constrained embedded systems. SELinux requires tuning, and modified code should be provided to the open-source software (OSS) community to receive value from its ecosystem. In this paper, we propose an embedded SELinux with reduced resource requirements, using code modifications that are acceptable to the OSS community. Resource usage is reduced by employing three techniques. First, the Linux kernel is tuned to reduce CPU overhead and memory usage. Second, unnecessary code is removed from userland libraries and commands. Third, security policy size is reduced with a policy-writing tool. To facilitate acceptance by the OSS community, build flags can be used to bypass modified code, such that it will not affect existing features; moreover, side effects of the modified code are carefully measured. Embedded SELinux is evaluated using an evaluation board targeted for M2M gateway, and benchmark results show that its read/write overhead is almost negligible. SELinux's file space requirements are approximately 200 Kbytes, and memory usage is approximately 500 Kbytes; these account for approximately 1% of the evaluation board's respective flash ROM and RAM capacity . Moreover, the modifications did not result in any adverse side effects. The modified code was submitted to the OSS community along with the evaluation results, and was successfully merged into the community code.

DOI： 10.2197/ipsjjip.23.664

Setting Method of Opportunity of Updating File Importance on FFU Reviewed

56 ( 6 ) 1451 - 1462 2015.6

Authorship：Lead author,　Corresponding author Language：Japanese Publishing type：Research paper (scientific journal)

Buffer cache is implemented to improve I/O performance with data in disks. As buffer cache management, there are many mechanisms based on access pattern of block. On the other hand, we proposed I/O buffer cache mechanism based on the frequency of file usage (FFU). Our previous proposed mechanism calculates file importance from the information of system-call of the file operation. Then, it controls two level buffer cache based on the file importance. In this paper, we propose a setting method of opportunity of updating file importance on FFU. The proposed method focuses on whether the file state is access intensive or not. This paper also describes a setting method of parameters of the proposed method based on access information of a target system. Finally, this paper reports the evaluation results of the proposed method by using typical access pattern data and real access patterns.

CiNii Article

CiNii Books

Access control to prevent malicious javascript code exploiting vulnerabilities of webview in android OS Reviewed

Jing Yu, Toshihiro Yamauchi

IEICE Transactions on Information and Systems E98D ( 4 ) 807 - 811 2015.4

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG

Copyright © 2015 The Institute of Electronics, Information and Communication Engineers. Android applications that using WebView can load and display web pages. Interaction with web pages allows JavaScript code within the web pages to access resources on the Android device by using the Java object, which is registered into WebView. If this WebView feature were exploited by an attacker, JavaScript code could be used to launch attacks, such as stealing from or tampering personal information in the device. To address these threats, we propose an access control on the security-sensitive APIs at the Java object level. The proposed access control uses static analysis to identify these security-sensitive APIs, detects threats at runtime, and notifies the user if threats are detected, thereby preventing attacks from web pages.

DOI： 10.1587/transinf.2014ICL0001

Other Link： https://dblp.uni-trier.de/db/journals/ieicet/ieicet98d.html#YuY15

CSDA: Rule-based complex sensor data aggregation system for M2M gateway Reviewed

Yuichi Nakamura, Akira Moriguchi, Toshihiro Yamauchi

2015 8th International Conference on Mobile Computing and Ubiquitous Networking, ICMU 2015 108 - 113 2015.3

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：SPRINGER-VERLAG BERLIN

© 2015 IPSJ. To reduce the server load and communication cost of machine-to-machine (M2M) systems, sensor data are aggregated in M2M gateways. The C language is typically used for programming the aggregation logic, and the program is embedded into the firmware. However, developing aggregation programs is difficult for M2M service providers because it requires gateway-specific knowledge, and consideration must be given to CPU and memory resources. In addition, modifying aggregation logic requires firmware updates, which are risky. We propose a rule-based sensor data aggregation system, called the complex sensor data aggregator (CSDA) for M2M gateways. Data aggregation is categorized into filtering, statistical calculation, and concatenation. The proposed CSDA supports this aggregation process in three steps: the input, data processing, and output steps. The behaviors of these steps are configured by an XML based rule. The CSDA also supports update modules, which download and overwrite aggregation rules from the server when the modification of data aggregation logic is required. In this case, firmware updates are not necessary. The proposed system is evaluated in an M2M gateway experimental environment. Results show that developing CSDA configurations is much easier than using C because the configuration amount decreases by 10%. In addition, the performance evaluation demonstrates the proposed system's ability to operate on M2M gateways. CPU usage was less than 10%, even with a heavy load, and memory consumption was 128 Kbytes.

DOI： 10.1109/ICMU.2015.7061051

Other Link： https://dblp.uni-trier.de/db/conf/icmu/icmu2015.html#NakamuraMY15

Malware detection method focusing on anti-debugging functions Reviewed

Kota Yoshizaki, Toshihiro Yamauchi

Proceedings - 2014 2nd International Symposium on Computing and Networking, CANDAR 2014 563 - 566 2015.2

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

© 2014 IEEE. Malware has received much attention in recent years. Antivirus software is widely used as a countermeasure against malware. However, some kinds of malware can evade detection by antivirus software, hence, a new detection method is required. In this paper, we propose a malware detection method that focuses on Anti-Debugging functions. An Anti-Debugging function is a method that prevents malware analysts from analyzing an application program (AP). The function can form part of benign as well as malicious APs. Our method focuses on a behavioral difference between benign and malicious APs and detects malware by comparing the two behavioral patterns. Evaluation results with malware confirmed our method to be capable of successfully detecting malware.

DOI： 10.1109/CANDAR.2014.36

Other Link： https://dblp.uni-trier.de/db/conf/ic-nc/candar2014.html#YoshizakiY14

Design of a Function for Tracing the Diffusion of Classified Information for File Operations with a KVM Reviewed

Shota Fujii, Toshihiro Yamauchi, Hideo Taniguchi

Proceedings of the 2015 International Symposium on Advances in Computing, Communications, Security, and Applications (ACSA 2015) 77 2015

Secure and fast log transfer mechanism for virtual machine Reviewed

Masaya Sato, Toshihiro Yamauchi

Journal of Information Processing 22 ( 4 ) 597 - 608 2014.10

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：Information Processing Society of Japan

© 2014 Information Processing Society of Japan. Ensuring the integrity of logs is essential to reliably detect and counteract attacks because adversaries tamper with logs to hide their activities on a computer. Even though some studies proposed various protections of log files, adversaries can tamper with logs in kernel space with kernel-level malicious software (malware) because file access and inter-process communication are provided by an OS kernel. Virtual machine introspection (VMI) can collect logs from virtual machines (VMs) without interposition of a kernel. It is difficult for malware to hinder that log collection, because a VM and VM monitor (VMM) are strongly separated. However, complexity and unnecessary performance overhead arise because VMI is not specialized for log collection. This paper proposes a secure and fast log transfer method using library replacement for VMs. In the proposed method, a process on a VM requests a log transfer to a VMM using the modified library, which contains a trigger for a log transfer. The VMM collects logs from the VM and isolate them to another VM. The proposed method provides VM-level log isolation and security for the mechanism itself with low performance overhead.

DOI： 10.2197/ipsjjip.22.597

Implementation of Multi-core Tender with Mutual Exclusion Localization Based on Mechanism of Resource Independence Reviewed

Proposal of Kernel Rootkits Detection Method by Comparing Kernel Stack Reviewed

55 ( 9 ) 2047 - 2060 2014.9

7 ( 3 ) 25 - 36 2014.8

Complicating process identification by replacing process information for attack avoidance Reviewed

Masaya Sato, Toshihiro Yamauchi

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 8639 LNCS 33 - 47 2014.8

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：Springer Verlag

Security-critical software is open to attacks by adversaries that disable its functionality. To decrease the risk, we propose an attack avoidance method for complicating process identification. The proposed method complicates identification based on process information by dynamically replacing the information held by a kernel with dummy information. Replacing process information makes identifying the attack target difficult because adversaries cannot find the attack target by seeking the process information. Implementation of the proposed method with a virtual machine monitor enhances the security of the mechanism itself. Further, by implementing the proposed method with a virtual machine monitor, modification to operating systems and application programs are unnecessary. © 2014 Springer International Publishing.

DOI： 10.1007/978-3-319-09843-2_3

Other Link： https://dblp.uni-trier.de/db/conf/iwsec/iwsec2014.html#SatoY14

A new OS structure for simplifying understanding of operating system behavior Reviewed

Toshihiro Yamauchi, Akira Kinoshita, Taisuke Kawahara, Hideo Taniguchi

Information (Japan) 17 ( 5 ) 1945 - 1950 2014.5

Authorship：Lead author,　Corresponding author Language：English Publishing type：Research paper (scientific journal)

It is difficult to understand the processing flow of complicated software such as operating systems (OSs). Thus, a mechanism that can collect and analyze behavioral information in order to comprehend the behavior of OS is necessary. Although several collection mechanisms have been developed, their OS structures were not designed to collect OS behavior. In this paper, we describe an OS structure that simplifies comprehension of OS behavior and the implementation of it on Tender OS. We also describe a mechanism for the visualization of OS behavior. Finally, we investigate the cost of introducing our proposed comprehension mechanism and the overhead and efficiency of the proposed mechanism. © 2014 International Information Institute.

Implementation and Evaluation of Software Control Method for TLB on Microkernel OS

TSURUYA Masahiro, YAMAUCHI Toshihiro, TANIGUCHI Hideo

The IEICE transactions on information and systems (Japanese edition) 97 ( 1 ) 216 - 225 2014.1

DroidTrack: Tracking and Visualizing Information Diffusion for Preventing Information Leakage on Android.

Shunya Sakamoto, Kenji Okuda, Ryo Nakatsuka, Toshihiro Yamauchi

Journal of Internet Services and Information Security 4 ( 2 ) 55 - 69 2014

KRGuard: Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features Reviewed

Yohei Akao, Toshihiro Yamauchi

2016 INTERNATIONAL CONFERENCE ON INFORMATION SCIENCE AND SECURITY (ICISS) 22 - 26 2014

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

Attacks on an operating system kernel using kernel rootkits pose a particularly serious threat. Detecting an attack is difficult when the operating system kernel is infected with a kernel rootkit. For this reason, handling an attack will be delayed causing an increase in the amount of damage done to a computer system. In this paper, we discuss KRGuard (Kernel Rootkits Guard), which is a new method to detect kernel rootkits that monitors branch records in the kernel space. Since many kernel rootkits make branches that differ from the usual branches in the kernel space, KRGuard can detect these differences by using hardware features of commodity processors. Our evaluation shows that KRGuard can detect kernel rootkits with small overhead.

Implementation of the Localized Exclusive Control for Multi-core Tender

Takahiro Yamamoto, Toshihiro Yamauchi, Hideo Taniguchi

2013 ( 2013 ) 14 - 23 2013.11

Secure log transfer by replacing a library in a virtual machine Reviewed

Masaya Sato, Toshihiro Yamauchi

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 8231 LNCS 1 - 18 2013.11

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：Springer

Ensuring the integrity of logs is essential to reliably detect and counteract attacks, because adversaries tamper with logs to hide their activities on a computer. Even though some research studies proposed different ways to protect log files, adversaries can tamper with logs in kernel space with kernel-level malicious software (malware). In an environment where Virtual Machines (VM) are utilized, VM Introspection (VMI) is capable of collecting logs from VMs. However, VMI is not optimized for log protection and unnecessary overhead is incurred, because VMI does not specialize in log collection. To transfer logs out of a VM securely, we propose a secure log transfer method of replacing a library. In our proposed method, a process on a VM requests a log transfer by using the modified library, which contains a trigger for a log transfer. When a VM Monitor (VMM) detects the trigger, it collects logs from the VM and sends them to another VM. The proposed method provides VM-level log isolation and security for the mechanism itself. This paper describes design, implementation, and evaluation of the proposed method. © 2013 Springer-Verlag.

DOI： 10.1007/978-3-642-41383-4_1

Access control to prevent attacks exploiting vulnerabilities of WebView in android OS Reviewed

Other Link： https://dblp.uni-trier.de/db/conf/iwsec/iwsec2013.html#SatoY13

Jing Yu, Toshihiro Yamauchi

Proceedings - 2013 IEEE International Conference on High Performance Computing and Communications, HPCC 2013 and 2013 IEEE International Conference on Embedded and Ubiquitous Computing, EUC 2013 1628 - 1633 2013.11

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

Android applications that using WebView can load and display web pages. Furthermore, by using the APIs provided in WebView, Android applications can interact with web pages. The interaction allows JavaScript code within the web pages to access resources on the Android device by using the Java object, which is registered into WebView. If this WebView feature were exploited by an attacker, JavaScript code could be used to launch attacks, such as stealing from or tampering personal information in the device. To address these threats, we propose a method that performs access control on the security-sensitive APIs at the Java object level. The proposed method uses static analysis to identify these security-sensitive APIs, detects threats at runtime, and notifies the user if threats are detected, thereby preventing attacks from web pages. © 2013 IEEE.

DOI： 10.1109/HPCC.and.EUC.2013.229