Yoshiaki Kasahara

Bot Detection Based on Traffic Analysis

Recently, botnet becomes a social problem due to the expansion of bot infection. Ideally, all the vulnerable computers should be fortified to counteract laying malware. Accordingly, it is important to implement an information system which detects bot-infected computers and alerts them. In this paper, we focused on bots using IRC to communicate, and examined the behavior of such bots when they connected to an IRC server. We observed the actual traffic of some ports which were often used by IRC protocol. As a result, we confirmed that bots tried to reconnect to an IRC server at certain intervals when the server refused the connection from the bot. Moreover, we examined the distribution of the intervals and confirmed that the communication from other IP addresses showed similar behavior.

Implementation and operation of the Kyushu university authentication system

Nowadays, a university needs to build and maintain a central ID database and authentication system for better ICT (information and communication technology) services. In 2008, the headquarters of Kyushu University had defined medium-range policy of ICT infrastructure preparation, and the policy had indicated construction of a central authentication system. According to the policy, the authors elaborated an installation plan of the Kyu(Q)shu University authentication system (QUAS, for short). Since 2009, Information Infrastructure Initiative of Kyushu University, to which the authors belong, has been issuing ID cards to all employees, and also operating LDAP servers. This paper introduces the action plan and outline of QUAS. This paper also describes two recent topics of QUAS. One is high load of LDAP servers because of rapid increase of mobile devices, and the other one is development of a multifactor authentication Shibboleth Identity Provider (IdP).

Compiling programs to their dependence-based representations

A dependence-based program representation has many applications in various software development activities, and therefore, it can be used as a unified internal representation of various target programs in an integrated software development environment. This paper presents an overview of a general-purpose system to compile target programs written in various programming languages including C, Pascal, Ada, and Occam 2 into their dependence-based representations.<<ETX>>

A tasking deadlock detector for Ada programs

A tasking deadlock detector for Ada programs is presented. The software tool works by monitoring the tasking behavior of a target program and operating a task-wait-for graph for the program. It can detect all types of tasking deadlocks in a class of Ada programs. The authors describe the principle of detecting tasking deadlocks dynamically, present their implementation of the tool, and give a real example of using the tool to detect a complex taking deadlock.<<ETX>>

Introduction of New Kyushu University Primary Mail Service for Staff Members and Students

In the end of fiscal year 2013 (March 2014), Kyushu University Information Infrastructure Initiative introduced new Primary Mail Service for Staff Members and Students. The previous service for staff members had been built using proprietary mail and LDAP appliance, but tight user license and the nature of proprietary system caused several troubles. The previous service for students had been built using open source software (Postfix and Dovecot), but there were some issues with the old implementation of LDAP authentication. With these experiences, we decided to design a new system by merging both system using open source software including Postfix, Dovecot, OpenLDAP, and Squirrelmail. We also extended alias address setting service (previously available for students only) to all the members including staff members. In this paper, we explain the design and implementation, user migration, current status and future works of our new mail service.

Implementation and evaluation of bot detection scheme based on data transmission intervals

Botnet is one of the most considerable issues in the world. A host infected with a bot is used for collecting personal information, launching DoS attacks, sending spam e-mail and so on. If such a machine exists in an organizational network, that organization will lose its reputation. We have to detect these bots existing in organizational networks immediately. Several network-based bot detection methods have been proposed; however, some traditional methods using payload analysis or signature-based detection scheme are undesirable in large amount of traffic. Also there is a privacy issue with looking into payloads, so we have to develop another scheme that is independent of payload analysis. In this paper, we propose a bot detection method which focuses on data transmission intervals. We distinguish human-operated clients and bots by their network behaviors. We assumed that a bot communicates with C&C server periodically and each interval of data transmission will be the same. We found that we can detect such behaviors by using clustering analysis to these intervals. We implemented our proposed algorithm and evaluated by testing normal IRC traffic and bot traffic captured in our campus network. We found that our method could detect IRC-based bots with low false positives.

Gulliver's toss: Google's chronic big load to university mail server and its sudden resolution

Traditionally, Kyushu University has been providing email service internally using its own domain name for staff members and students of the university. Around January 2012, we noticed that the high load of the university authentication server, and we realized that one of causes was the access from the mail server for students (called Student Primary Mail Service). Detailed analysis showed that there was chronic big load produced by Gmails Mail Fetcher, especially toward nonexistent accounts removed due to graduation. In this paper, we explain the situation and reasons of the big load induced by Google, its possible countermeasures, and its sudden resolution by Googles silent change.

An integrated support environment for distributed software development based on unified program representations

Almost all, if not all, software development and maintenance activities require some abstract representations for target programs in order to grasp necessary information about the programs and ignore unnecessary information. This paper presents the role of unified program representations in distributed software development, basic considerations on constructing an integrated environment for supporting distributed software development based on unified program representation, and the design and implementation of an integrated environment we are developing.

Darknet Monitoring on Real-Operated Networks

Dark net monitoring is an effective method to analyze malicious activities on networks including the Internet. Since there is no legitimate host on darknets, traffic sent to such a space is considered to be malicious. There are two major issues for dark net monitoring: how to prepare unused address space and how to configure network sensors deployed on the network. Preparation of monitoring addresses is difficult, and it have not been obvious yet what an appropriate configuration is. To solve the first issue, we proposed a method for network monitoring by exploiting unused IP addresses on segments managed by DHCP server, where is a real-operated network. By assigning these addresses, we can easily obtain IP addresses for monitoring and enable network monitoring on production network. Furthermore, we conducted real dark net monitoring experiments and clarified what kind of information could be obtained. We deployed several types of sensors on real-operated network and captured dark net traffic. After analyzing the traffic, we compared the data between each sensor. We found that there were dramatic differences between the data collected by each sensor and our proposed method was useful for real network monitoring.

DDoS Attack Defense Architecture Using Active Network Technology

To solve the congestion problem, network nodes at near the zombies need to filter the attack traffic. But the amounts of attack packets are small at upstream node and it is hard to detect an occurrence of an attack. In this case, the network node near the protected site should perform attack detection. Our proposed system uses active network technology and allowing detecting attack at active router near protected server. This detecting process uses dynamic, adaptive detecting algorithm. Elementary classification will reduce network congestion and adaptive classification will reduce error detecting rate. Signatures which are created by these two classifications are transferred to other active routers. And then they perform filtering process based on signatures.