Faculty Profiles - YAMAUCHI Toshihiro

Proposal and Evaluation of Method to Set High Priority Directories for a Directory Oriented Buffer Cache Mechanism

TSUCHIYA Akiyoshi, MATSUBARA Takahiro, YAMAUCHI Toshihiro, TANIGUCHI Hideo

The IEICE transactions on information and systems (Japanese edetion) 96 ( 3 ) 506 - 518 2013.3

External Storage Mechanism for Preserving File Access Log with Virtualization Technology

54 ( 2 ) 585 - 595 2013.2

Language：Japanese Publishing type：Research paper (scientific journal)

Recently, it is more important to grasp and control the damage of attacks safely, so much research has been done to increase the security of the general-purpose OS by observing the behavior using virtualization technology. In this paper, we propose a mechanism to observe and logging the file access in guest OS from virtual machine monitor using the inter-domain communication by the filter driver. Our mechanism can be applied independently of the implementation of virtual machine monitor. By hooking file accesses in the guest OS, log messages are transferred and stored to the virtual machine monitor, so our approach is effective from the viewpoint of preservation of the log. We show the design and implementation of our mechanism for both Xen and KVM. Furthermore, we report the results of measuring the performance when accessing files as evaluation.

DroidTrack: Tracking information diffusion and preventing information leakage on android

Other Link： http://id.nii.ac.jp/1001/00090264/

Syunya Sakamoto, Kenji Okuda, Ryo Nakatsuka, Toshihiro Yamauchi

Lecture Notes in Electrical Engineering 240 LNEE 243 - 251 2013

Language：English Publishing type：Research paper (international conference proceedings) Publisher：Springer

An app in Android can collaborate with other apps and control personal information by using the Intent or user's allowing of permission. However, users cannot detect when they communicate. Therefore, users might not be aware information leakage if app is malware. This paper proposes DroidTrack, a method for tracking the diffusion of personal information and preventing its leakage on an Android device. DroidTrack alerts the user of the possibility of information leakage when an app uses APIs to communicate with outside. These alerts are triggered only if the app has already called APIs to collect personal information. Users are given the option to refuse the execution of the API if it is not appropriate. Further, by illustrating how their personal data is diffused, users can have the necessary information to help them decide whether the API use is appropriate. © 2013 Springer Science+Business Media Dordrecht(Outside the USA).

DOI： 10.1007/978-94-007-6738-6_31

Design and evaluation of a diffusion tracing function for classified information among multiple computers

Other Link： https://dblp.uni-trier.de/db/conf/mue/mue2013.html#SakamotoONY13

Nobuto Otsubo, Shinichiro Uemura, Toshihiro Yamauchi, Hideo Taniguchi

Lecture Notes in Electrical Engineering 240 LNEE 235 - 242 2013

Language：English Publishing type：Research paper (international conference proceedings) Publisher：Springer

In recent years, the opportunity to deal with classified information in a computer has increased, so the cases of classified information leakage have also increased. We have developed a function called "diffusion tracing function for classified information" (tracing function), which has the ability to trace the diffusion of classified information in a computer and to manage which resources might contain classified information. The classified information exchanged among the processes in multiple computers should be traced. This paper proposes a method which traces the diffusion for classified information among multiple computers. Evaluation results show the effectiveness of the proposed methods. © 2013 Springer Science+Business Media Dordrecht(Outside the USA).

DOI： 10.1007/978-94-007-6738-6_30

Evaluation of load balancing in multicore processor for AnT

Other Link： https://dblp.uni-trier.de/db/conf/mue/mue2013.html#OtsuboUYT13

Takeshi Sakoda, Toshihiro Yamauchi, Hideo Taniguchi

Proceedings - 16th International Conference on Network-Based Information Systems, NBiS 2013 360 - 365 2013

Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE

Operating systems (OSes) that is based on microkernel architecture have high adaptability and toughness. In addition, multicore processors have been developed along with the progress of LSI technology. By running a microkernel OS on a multicore processor and distributing the OS server to multiple cores, it is possible to realize load balancing of the OS processing. In this method, transaction processing, which requires a large amount of OS processing, can be provided effectively in a multicore environment. This paper presents evaluations of distributed OS processing performances for various scenarios for AnT operating system that is based on the microkernel architecture in a multicore environment. In these evaluations, we describe the differences in performance by distribution forms when referring the data in a block. Moreover, we use the PostMark and Bonnie benchmark tools to evaluate the effects of load balancing for the distribution forms. © 2013 IEEE.

DOI： 10.1109/NBiS.2013.57

Implementation of Mechanism to Support Tracing Diffusion of Classified Information by Visualization and Filtering Function

Other Link： https://dblp.uni-trier.de/db/conf/nbis/nbis2013.html#SakodaYT13

53 ( 9 ) 2171 - 2181 2012.9

Language：Japanese Publishing type：Research paper (scientific journal)

The number of incidents leaking of classified information has increased. To prevent leakage of information, it is important for users to understand the usage of classified information. To understand the usage of classified information, an method has implemented that monitors operations on the classified information and logs those operations. However, because an analysis of logs is necessary for understanding the usage of classified information, it is difficult to prevent leakage of classified information. We proposed the function to trace the classified information diffusion and detect a leakage of classified information. However, to understand the usage of classified information from the function by users, it is necessary to analyze the log in text format. Therefore, it takes long time to investigate the cause of the leakage of information. This paper proposes a function to visualize diffusion path of classified information. The function enables us to visualize the diffusion path of designated files that contain classified information. In addition, the function can visualize the diffusion paths focusing on the designated period of file operations. This paper also describes the implementation of the proposed function by extending the existing tracing function of classified information.

Other Link： http://id.nii.ac.jp/1001/00083925/

VMM-based log-tampering and loss detection scheme Reviewed

Masaya Sato, Toshihiro Yamauchi

Journal of Internet Technology 13 ( 4 ) 655 - 666 2012.7

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (scientific journal) Publisher：NATL ILAN UNIV, JIT

Logging information about the activities that placed in a computer is essential for understanding its behavior. In Homeland Security, the reliability of the computers used in their activities is of paramount importance. However, attackers can delete logs to hide evidence of their activities. Additionally, various problems may result in logs being lost. These problems decrease the dependability of Homeland Security. To address these problems, we previously proposed a secure logging scheme using a virtual machine monitor (VMM). The scheme collects logs and isolates them from the monitored OS. However, the scheme cannot store them automatically. Thus, logs in memory are lost when the computer is shutdown. Further, if the logs are not stored, it is impossible to detect incidents of tampering by comparing the logs of the monitored OS with those of the logging OS. To address these additional problems, this paper proposes a log-storing module and a tamper detection scheme. The log-storing module automatically stores logs collected by the logging module, and tamper detection is realized by comparing these stored log files with those of the monitored OS. We implemented the log-storing module and realized the tamper detection scheme. Evaluations reveal the effectiveness of the tamper detection scheme.

Implementation and Evaluation of a Method for CMP-Oriented Thread Scheduling Based on Continuation Model

MORIYAMA Hideaki, YAMAUCHI Toshihiro, NOMURA Yoshinari, TANIGUCHI Hideo

The IEICE transactions on information and systems (Japanese edetion) 95 ( 3 ) 400 - 411 2012.3

SELinuxの不要なセキュリティポリシ削減の自動化手法の提案 Reviewed

矢儀真也,中村雄一,山内利宏

情報処理学会論文誌コンピューティングシステム(ACS) 5 ( 2 ) 63 - 73 2012.3

Logging System to Prevent Tampering and Loss with Virtual Machine Monitor

53 ( 2 ) 847 - 856 2012.2

Language：Japanese Publishing type：Research paper (scientific journal)

Logging information is necessary in order to understand a computer's behavior. However, there is a possibility that attackers will delete logs to hide the evidence of their attacking and cheating. Moreover, various problems might cause the loss of logging information. To address these issues, we propose a system to prevent tampering and loss of logging information using a virtual machine monitor (VMM). In this system, logging information generated by the operating system (OS) and application program (AP) working on the target virtual machine (VM) is gathered by the VMM without any modification of the kernel source codes. The security of the logging information is ensured by its isolation from the VM. In addition, the isolation and multiple copying of logs can help in the detection of tampering.

Novel control method for preventing missed deadlines in periodic scheduling

Other Link： http://id.nii.ac.jp/1001/00080698/

Yuuki Furukawa, Toshihiro Yamauchi, Hideo Taniguchi

Proceedings of the 2012 15th International Conference on Network-Based Information Systems, NBIS 2012 459 - 464 2012

Language：English Publishing type：Research paper (international conference proceedings) Publisher：IEEE Computer Society

Processing that is executed periodically must be completed before the next release time. If such processing is not completed before the next release time, the processing that had been scheduled is not executed. This is complicated by the fact that the execution time from release to the end of periodically executed processing is not constant, due to changing I/O processing time and the influence of timer interrupts. To solve this, we propose a system that records the execution time of the processing, judges whether the processing will be finished before the specified deadline, and can execute appropriate processing that can be completed within the remaining time. In this paper, we describe the design and evaluation of our system. © 2012 IEEE.

DOI： 10.1109/NBiS.2012.79

Other Link： https://dblp.uni-trier.de/db/conf/nbis/nbis2012.html#FurukawaYT12

LSMPMON: Performance evaluation mechanism of LSM-based secure OS

Toshihiro Yamauchi, Kenji Yamamoto

International Journal of Security and its Applications 6 ( 2 ) 81 - 90 2012

Authorship：Lead author Language：English Publishing type：Research paper (scientific journal)

Security focused OS (Secure OS) is attracting attention as a method for minimizing damage caused by various intrusions. Secure OSs can restrict the damage due to an attack by using Mandatory Access Control (MAC). In some projects, secure OSs for Linux have been developed. In these OSs, different implementation methods have been adopted. However, there is no method for easily evaluating the performance of the secure OS in detail, and the relationship between the implementation method and the performance is not clear. The secure OS in Linux after version 2.6 has often been implemented by Linux Security Modules (LSM). Therefore, we determine the effect of introducing the secure OS on the performance of the OS by using the overhead measurement tool, the LSM Performance Monitor (LSMPMON). This paper reports the evaluation results of three secure OSs on Linux 2.6.36 by LSMPMON. The results show the effect of introducing the secure OS.

Proposal of a Method to Automatically Reduce Redundant Security Policy of SELinux

Design of an OS Architecture that Simplifies Understanding of Operating System Behavior

Toshihiro Yamauchi, Akira Kinoshita, Taisuke Kawahara, Hideo Taniguchi

Proceedings of 2012 International Conference on Information Technology and Computer Science (ITCS 2012) 51 - 58 2012

5 ( 2011 ) 84 - 94 2011.11

Limiting Use of Tokens for Improvement of Bayesian Filter

52 ( 9 ) 2686 - 2696 2011.9

Authorship：Lead author Language：Japanese Publishing type：Research paper (scientific journal)

Using the Bayesian filter is a popular approach to distinguish between spam and legitimate e-mails. Spam senders sometimes modify emails to bypass the Bayesian filter. The tokens included in the e-mail are investigated for improving the accuracy of classification of emails. The results show that tokens found at the first time sometimes degrade the accuracy of the classification. In this paper, we propose an anti-spam method that consider the difference of the property of tokens. The proposed method limits the use of tokens for improvement of Bayesian filter. The evaluations were performed by using some email sets. The results shows that the proposed method can decrease the false negative rate.

Evaluation of Performance of Secure OS Using Performance Evaluation Mechanism of LSMPMON

Other Link： http://id.nii.ac.jp/1001/00077500/

52 ( 9 ) 2596 - 2601 2011.9

Language：Japanese Publishing type：Research paper (scientific journal)

In some projects, secure OSes for Linux have been developed and different implementations have been adopted. However, there is no report on evaluation of performance of secure OS that after Linux 2.6.19 in detail, and the relationship between the kernel version and the performance is not clear. Therefore, we evaluate change of the performance at the version interval and overhead of three secure OSes (SELinux, TOMOYO Linux, LIDS), by using the overhead measurement tool, the LSM Performance Monitor (LSMPMON) developed for Linux 2.6.30. This paper shows the performance of secure OSes on Linux 2.6.30.

Other Link： http://id.nii.ac.jp/1001/00077491/

VMBLS: Virtual machine based logging scheme for prevention of tampering and loss Reviewed

Masaya Sato, Toshihiro Yamauchi

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 6908 LNCS 176 - 190 2011.8

Authorship：Last author,　Corresponding author Language：English Publishing type：Research paper (international conference proceedings) Publisher：SPRINGER-VERLAG BERLIN

Logging information is necessary in order to understand a computer's behavior. However, there is a possibility that attackers will delete logs to hide the evidence of their attacking and cheating. Moreover, various problems might cause the loss of logging information. In homeland security, the plans for counter terrorism are based on data. The reliability of the data is depends on that of data collector. Because the reliability of the data collector is ensured by logs, the protection of it is important problem. To address these issues, we propose a system to prevent tampering and loss of logging information using a virtual machine monitor (VMM). In this system, logging information generated by the operating system (OS) and application program (AP) working on the target virtual machine (VM) is gathered by the VMM without any modification of the OS. The security of the logging information is ensured by its isolation from the VM. In addition, the isolation and multiple copying of logs can help in the detection of tampering. © 2011 IFIP International Federation for Information Processing.

DOI： 10.1007/978-3-642-23300-5_14