Hiroki Takakura

Hierarchical visualization of network intrusion detection data

A technique for visualizing intrusion-detection system log files using hierarchical data based on IP addresses represents the number of incidents for thousands of computers in one display space. Our technique applies a hierarchical data visualization technique that represents leaf nodes as black square icons and branch nodes as rectangular borders enclosing the icons. This representation style visualizes thousands of hierarchical data leaf nodes equally in one display space. We applied the technique to bioactive chemical visualization and job distribution in parallel-computing environments.

Web-based inference rules for processing conceptual geographical relationships

Dealing with prepositions such as near, between and in front of is very important in geographic information systems (GISs). In most systems, real-world distances are used to handle these prepositions. One of the difficulties in processing these prepositions lies in the fact that their geographical range is distorted in peoples cognitive maps. For example, the size of an area referred to by the preposition near gets narrowed when a more famous landmark exists right next to the base geographical object. This is because users are likely to choose the most famous landmark when referring to a certain position. Also, the area referred to by between is not a straight line; it curves along the most commonly used pathway between the base objects. The difference in the popularity of geographical objects is the main reason for causing such distortions in cognitive maps. Since there is a large amount of data on the World Wide Web, we believe that such conceptual distortion can be calculated by analyzing Web data. Popularity and co-occurrence rates are calculated through their frequency in Web resources. Inference rules are set to restrict the target of conceptual prepositions using GISs and information obtained from the Web.

Optimization of geographic area to a Web page for two-dimensional range query processing

We have been developing a geographic Web search system to retrieve proper Web pages for a user-specified geographic area. One of location specification methods possible in the system is a two-dimensional range query, which is specified by a rectangle region corresponding to a geographic area. In order to handle such a geographic query, we propose: i) a geographic Web index method which is possible to manage each Web pages by optimized geographic scope; and ii) geometric operations such as Contain as a function to retrieve geographic Web pages. However, recall and precision of search results by raw geometric search operations become very low, if we do not optimize a geographic area to a Web page. By considering of geowords characterics, we can improve the result by geometric operations in range query processing.

A comprehensive approach to detect unknown attacks via intrusion detection alerts

Intrusion detection system(IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it still suffers from detecting an unknown attack, i.e., 0-day attack, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack. This paper presents a novel approach that is quite different from the traditional detection models based on raw traffic data. The proposed method can extract unknown activities from IDS alerts by applying data mining technique.We evaluated our method over the log data of IDS that is deployed in Kyoto University, and our experimental results show that it can extract unknown(or under development) attacks from IDS alerts by assigning a score to them that reflects how anomalous they are, and visualizing the scored alerts.

A Clustering Method for Improving Performance of Anomaly-Based Intrusion Detection System

Intrusion detection system (IDS) has played a central role as an appliance to effectively defend our crucial computer systems or networks against attackers on the Internet. The most widely deployed and commercially available methods for intrusion detection employ signature-based detection. However, they cannot detect unknown intrusions intrinsically which are not matched to the signatures, and their methods consume huge amounts of cost and time to acquire the signatures. In order to cope with the problems, many researchers have proposed various kinds of methods that are based on unsupervised learning techniques. Although they enable one to construct intrusion detection model with low cost and effort, and have capability to detect unforeseen attacks, they still have mainly two problems in intrusion detection: a low detection rate and a high false positive rate. In this paper, we present a new clustering method to improve the detection rate while maintaining a low false positive rate. We evaluated our method using KDD Cup 1999 data set. Evaluation results show that superiority of our approach to other existing algorithms reported in the literature.

Classification of web pages with geographic scope and level of details for mobile cache management

Although there is various useful information on the web,it is very hard to identify proper web pages, due to theproblem of heterogonous and large amount of volume. Incase of caching web pages on mobile devices, this is a crucialproblem. Since we have to select web pages satisfy-ingthe requirements in order to prefetch pages which havehigh possibility of usage. This paper focuses on the geographiccharacteristics and description types of web resources.Keyword based search does not take account ofthe positional information of geographic names and thuscollecting web resources related a specific region is verydifficult. Besides, it does not consider the differences betweena web page with detailed information and summaryinformation so that it cannot deal with the users requirementsof detailed information. In this paper, a method todetermine Geographic Scope and Level of Details of webpages is developed. Geographic Scope identifies the regiona web page mentions with the positional information of geographicnames. Level of Details classifies web pages intothree types, Table-of-Contents type, Summary type,and Detailed-Description type, with considering HTMLtags, the number of kinds of geographic names and statisticvalues of parts of speech such as verbs and nouns. Experimentalresults show these two measures classify the webpages with relatively high precision. Finally, we present aMobile Cache algorithm using these two measures. It is definedbased on users interest in a specific location.

Dynamic map synthesis utilizing extended thesauruses and reuse of query generation process

In this paper, we will discuss a map synthesis system which handles static information (geographic objects) as well as dynamic information (traffic conditions, weather, etc.). The system is considered to be general purpose and can generate arbitrary maps according to the user specification, It is very difficult for a user to specify a exact query which corresponds to the required map. Furthermore even selected objects are appropriate, the map may not be proper to be displayed. The system automatically generates missing information or find errors in the user specification. The result is feedback-ed to the user and further refinement is made. For the purpose we use geographic domain thesaurus which contains aggregation and other semantic relationships as well as conventional thesaurus hierarchy. Especially compatibility levels of objects play important roles to generate maps and ilnd errors in the specification, We will also discuss methods to reuse similar map generation processes.

A robust feature normalization scheme and an optimized clustering method for anomaly-based intrusion detection system

Intrusion detection system(IDS) has played a central role as an appliance to effectively defend our crucial computer systems or networks against attackers on the Internet. Traditional IDSs employ signature-based methods or anomaly-based methods which rely on labeled training data. However, they have several problems, for example, it consumes huge amounts of cost and time to acquire the labeled training data, and they often experienced difficulty in detecting new types of attack. In order to cope with the problems, many researchers have proposed various kinds of algorithms for several years. Although they do not require labeled data for training and have the capability to detect unforeseen attacks, they are based on the assumption that the ratio of attack to normal is extremely small. However, the assumption may not be satisfied in a realistic situation because some attacks, most notably the denial-of-service attacks, consist of a large number of simultaneous connections. Consequently if the assumption fails, the performance of the algorithm will deteriorate. In this paper, we present a new normalization and clustering method that can overcome a limitation on the attack ratio of the training data. We evaluated our method using KDD Cup 1999 data set. Evaluation results show that performance of our approach is constant irrespective of an increase in the attack ratio.

Web locality based ranking utilizing location names and link structure

It is very important to identify web pages strongly relatedto some locations. In this paper, we introduce the concept ofthe degree of locality which shows the strength of relationshipsbetween a web page and specific locations. Use of locationnames appearing in one web page is a conventionalway to identify local pages. We cannot use the number ofappearances of location names as the measure of locality,since the same location name usually will not be repeatedoften even if the name is important. We will introduce AreaExpansion technique to identify local pages. In order todetermine the degree of locality we will use link informationas well. For example, the degree of locality of a webpage will be increased, if the page is connected from localpages or connected to local pages. By repeated applicationsof this process, we can calculate the degree of localities forweb pages. The method to handle the cases when the graphwhose vertices corresponding to local pages are not connected,will be also discussed. Two methods are developedand experimental results show usefulness of the algorithm.

Visual Query Processing for GIS with Web Contents

In many geographic objects such as a travel planning, the use of web information is significantly increasing. For an efficient support of such work, it is very important to combine web information with map semantics. Current web systems usually do not support map semantics. Conversely, conventional Geographic Information Systems (GIS) do not utilize the web resources. The purpose of the research is as follows: (1) to get semantics from the web contents to realize advanced GIS functions on geographic web searches, and (2) to develop a user interface which can utilize web contents and map semantics in an effective integrating way. For such a purpose, we construct two map semantics about geographic characteristics and relationships available on the web. Utilizing semantics, we have developed a prototype system, KyotoSEARCH; its main function is to support users’ information navigations among the web, the map and web-based geographic knowledge, in an integrated way.