Published papers

Copyright © 2019 The Institute of Electronics, Information and Communication Engineers. Multiuser massive multi-input multi-output (MU massive MIMO) is considered as a promising technology for the fifth generation (5G) of the wireless communication system. In this paper, we propose a low-complexity joint antenna and user selection scheme with block diagonalization (BD) precoding for MU massive MIMO downlink channel in the time division duplex (TDD) system. The base station (BS) is equipped with a large-scale transmit antenna array while each user is using the single receive antenna in the system. To reduce the hardware cost, BS will be implemented by limited number of radio frequency (RF) chains and BS must activate some selected transmit antennas in the BS side for data transmitting and some users’ receive antennas in user side for data receiving. To achieve the reduction in the computation complexity in the antenna and user selection while maintaining the same or higher sum-rate in the system, the proposed scheme relies on three complexity reduction key factors. The first key factor is that finding the average channel gains for the transmit antenna in the BS side and the receive antenna in the user side to select the best channel gain antennas and users. The second key factor called the complexity control factor ξ(Xi) for the antenna set and the user set limitation is used to control the complexity of the brute force search. The third one is that using the assumption of the point-to-point deterministic MIMO channel model to avoid the singular value decomposition (SVD) computation in the brute force search. We show that the proposed scheme offers enormous reduction in the computation complexity while ensuring the acceptable performance in terms of total system sum-rate compared with optimal and other conventional schemes.

As smartphones have become widespread in the past decade, Wi-Fi signal-based crowd estimation schemes are receiving increased attention. These estimation schemes count the number of unique MAC addresses in Wi-Fi signals, hereafter called probe requests (PRs), instead of counting the number of people. However, these estimation schemes have low accuracy of crowd estimation under MAC address randomization that replaces a unique MAC address with various dummy MAC addresses. To solve this problem, in this paper, we propose an indoor crowd estimation scheme using the number of PRs under MAC address randomization. The main idea of the proposed scheme is to leverage the fact that the number of PRs per a unit of time changes in proportion to the number of smartphones. Since a smartphone tends to send a constant number of PRs per a unit of time, the proposed scheme can estimate the accurate number of smartphones. Various experiment results show that the proposed scheme reduces estimation error by at most 75% compared to the conventional Wi-Fi signal-based crowd estimation scheme in an indoor environment.

Detecting a Rogue Access Point (RAP) in Wi-Fi network is imperative. The previous scheme is user side detection focusing on two channels used by a RAP. That scheme can detect a RAP in stable traffic environment by revealing the channel used with a Legitimate Access Point (LAP) with intentional interference. However, the detection performance is degraded in the real environment where traffic is more unstable because it affects the traffic on the channel. Thus, it is necessary to design the scheme which is independent of such factors. In this paper, we propose RAP detection by using Address Resolution Protocol (ARP) failure under the Media Access Control (MAC) address duplication. Our main idea is that the traffic is relayed via a RAP and a LAP on the LAN path between a client and a gateway under the attack. This is because the RAP must be established between a client and a LAP to provide Internet connection. On the basis of this idea, the proposed scheme reveals that the Access Point (AP) with which a client connects is a RAP by discovering the MAC address of a LAP on the path. In order to find the MAC address, we leverage the phenomenon that a client cannot receive ARP reply packets in the situation where its MAC address and that of a AP are duplicated on the path. By doing this, the presence of a LAP is revealed, which can judge that the connected AP is a RAP. In our evaluation, the proposed scheme achieves accuracy of 96.5% even in unstable traffic environment. True positive rate and false positive rate are 31.0% higher and 9.0% lower than the previous scheme. Furthermore, the proposed scheme can detect RAPs accurately in real environment where the previous scheme cannot.

There exists a need of ‘‘image steganalysis’’ which reveals whether steganographic signals are embedded in an image to improve information security. Among various steganalysis, Convolutional Neural Networks (CNN) based steganalysis is promising since it can automatically learn the features of diverse steganographic algorithms. However, the detection performance of CNN is degraded when an image is intentionally resized by the nearest-neighbor interpolation before steganography. This is because spatial frequency in a resized image gets high, which disturbs the training. In order to overcome this shortcoming, in this article, we propose a preprocessing by using multiple steganography for intentional image downsampling on CNN-based steganalysis. In the proposed preprocessing, steganographic signals are additionally embedded into both resized original images and resized steganographic ones with the same embedding key since difference of spatial frequencies between them gets obvious, which helps CNN learn features. The reason why the difference gets obvious is that steganographic signals tend to be continuously embedded into same pixels in resized images when they are additionally embedded. Thus, by training resized images after the proposed preprocessing, the detection performance can be improved. Since the proposed preprocessing is very simple, it does not greatly increase the training time of CNN. Our evaluation shows accuracy in a model with the proposed preprocessing is up to 34.8% higher than that in the conventional model when the same steganography is additionally embedded. Besides, we also show that the proposed preprocessing yields up to 23.1% higher accuracy compared with the conventional one even when another steganography is additionally embedded.

Recently, vehicle-to-infrastructure (V2I) communication-based scheduling schemes for connected and automated vehicles (CAVs) on highway on-ramps have received attention because the schemes assign optimal merging times to CAVs based on their criteria, such as first-in first-out order or minimizing CAV total travel time. However, these schemes cause traffic congestion due to the criteria when the vehicle inflow traffic becomes high. To mitigate traffic congestion, a scheduling scheme should assign merging times to CAVs to decrease road vehicle density. In this paper, we propose a scheduling scheme for autonomous vehicle highway merging with an outflow traffic and fairness analysis. We formulate a multiobjective function that achieves both outflow traffic maximization and fairness in assigned merging times. Since more vehicles pass a highway on-ramp as highway on-ramp outflow traffic increases, the proposed scheme decreases vehicle density on roads by maximizing the outflow traffic. Furthermore, the proposed scheme distributes the vehicle density on both the main and ramp roads by fairly assigning their merging times. Simulation results show that the proposed scheme mitigates the potential traffic congestion of previous scheduling schemes. Furthermore, the proposed scheme improves outflow traffic from highway on-ramps by more than 200 veh/h compared with the previous scheduling schemes.

Detecting Android malware is imperative. Among various detection schemes, permission pair based ones are promising for practical detection. However, conventional schemes cannot simultaneously meet requirements for practical use in terms of efficiency, intelligibility, and stability of detection performance. Although the latest scheme relies on differences of frequent pairs between benign apps and malware, it cannot meet the stability. This is because recent malware tends to require unnecessary permissions to imitate benign apps, which makes using the frequencies ineffective. To meet all the requirements, in this paper, we propose Android malware detection based on a Composition Ratio (CR) of permission pairs. We define the CR as a ratio of a permission pair to all pairs in an app. We focus on the fact that the CR tends to be small in malware because of unnecessary permissions. To obtain features without using the frequencies, we construct databases about the CR. For each app, we calculate similarity scores based on the databases. Finally, eight scores are fed into machine learning (ML) based classifiers as features. By doing this, stable performance can be achieved. Since our features are just eight-dimensional, the proposed scheme takes less training time and is compatible with other ML based schemes. Furthermore, our features can quantitatively offer clear information that helps human to understand detection results. Our scheme is suitable for practical use because all the requirements can be met. By using real datasets, our results show that our scheme can detect malware with up to 97.3% accuracy. Besides, compared with an existing scheme, our scheme can reduce the feature dimensions by about 99% with maintaining comparable accuracy on recent datasets.

© 2018 IEEE. In order to fix a bug or install a new application, disseminating a code to specific target sensors is an important management task in wireless sensor networks. In order to disseminate a code to specific target sensors in an energy efficient manner, it is required to select the minimum required number of forwarders with a small number of control messages. In this paper, we propose an energy efficient target specific code dissemination scheme with a forwarder selection algorithm. The proposed scheme consists of two steps, (i) a forwarder selection algorithm with a control message suppression, (ii) unnecessary forwarders reduction with a sleep mechanism. In order to select the minimum required forwarders with a small number of control messages, we propose an algorithm to select a forwarder where more target sensors are reachable, through a single control message by leveraging overhearing of control messages. In addition, in order to reduce the number of forwarders, we propose a sleep mechanism to put unnecessary forwarders to sleep where any target sensor is not reachable. A performance analysis has shown that the number of control messages of the proposed scheme is always theoretically smaller than that of a previously published forwarder selection scheme under the same condition. In addition, we have shown that the proposed scheme reduces the energy consumption compared with the previous scheme.

© 2017 IEEE. On web application services, detecting obfuscated malicious JavaScript utilized for the attacks such as Drive-by-Download is an urgent demand. Obfuscation is a technique that modifies some elements of program codes and is used to evade the pattern matching of traditional anti-virus softwares. In particular, encode obfuscation is adopted in almost all malicious JavaScript codes as the most effective technique to hide their malicious intents. Therefore, many approaches focus on encode obfuscation to detect malicious JavaScript. However, we point out that malicious JavaScript obfuscated by the techniques except for encode obfuscation can easily evade those approaches. Motivated by the above, in this paper, we first investigated the malicious files that previous schemes cannot detect, and found that some files contain divided URL in their codes. In order to detect such JavaScript codes as malicious, we propose obfuscated malicious JavaScript detection scheme using the feature based on divided URL. We focus on the fact that the segments of URL are declared as variables and connected later. Our scheme stores variables and their contents in the dictionary type object and in the connection parts, verifies that malicious URL can be reconstructed. By the computer simulation with real dataset, we show that our scheme improves the detection effectiveness of the conventional scheme.

© 2017 University of Western Australia. Recently, the detection of target link flooding attack which is a new type of DDoS (Distributed Denial of Service) is required. Target link flooding attack is used for disconnecting a specific area from the Internet. It is more difficult to detect and mitigate this attack than legacy DDoS since attacking flows do not reach the target region. Among several schemes for target link flooding attack, the scheme focusing on traceroute is gathering attention. The idea behind that is the attacker needs to send traceroute to investigate the topology around targeted region before attack starts. That scheme detects the attack by finding rapid increase of traceroute. However, it cannot work when attacker's traceroute ratio is low. In this paper, we propose traceroute-based target link flooding attack detection scheme by analyzing hop count to the destination. Since the attacker must choose the link flooded to disconnect the target area, the destinations of attacker's traceroutes are concentrated within several hops from the target link while legitimate user's ones are distributed uniformly. By analyzing the number of traceroutes as per hop counts, the change can be emphasized and the attack symptom might be more easily captured. By computer simulations, we first prove the above hypotheses and show that our scheme has more robustness compared with the conventional scheme.

© 2020, Springer Nature Switzerland AG. The botnet detection is imperative. Among several detection schemes, the promising one uses the communication sequences. The main idea of that scheme is that the communication sequences represent special feature since they are controlled by programs. That sequence is tokenized to truncated sequences by n-gram and the numbers of each pattern’s occurrence are used as a feature vector. However, although the features are normalized by the total number of all patterns’ occurrences, the number of occurrences in larger n are less than those of smaller n. That is, regardless of the value of n, the previous scheme normalizes it by the total number of all patterns’ occurrences. As a result, normalized long patterns’ features become very small value and are hidden by others. In order to overcome this shortcoming, in this paper, we propose a traffic feature-based botnet detection scheme emphasizing the importance of long patterns. We realize the emphasizing by two ideas. The first idea is normalizing occurrences by the total number of occurrences in each n instead of the total number of all patterns’ occurrences. By doing this, smaller occurrences in larger n are normalized by smaller values and the feature becomes more balanced with larger value. The second idea is giving weights to the normalized features by calculating ranks of the normalized feature. By weighting features according to the ranks, we can get more outstanding features of longer patterns. By the computer simulation with real dataset, we show the effectiveness of our scheme.

Copyright c 2019 The Institute of Electronics, Information and Communication Engineers Detecting phishing websites is imperative. Among several detection schemes, the promising ones are the visual similarity-based approaches. In those, targeted legitimate website’s visual features referred to as signatures are stored in SDB (Signature Database) by the system administrator. They can only detect phishing websites whose signatures are highly similar to SDB’s one. Thus, the system administrator has to register multiple signatures to detect various phishing websites and that cost is very high. This incurs the vulnerability of zero-day phishing attack. In order to address this issue, an auto signature update mechanism is needed. The naive way of auto updating SDB is expanding the scope of detection by adding detected phishing website’s signature to SDB. However, the previous approaches are not suitable for auto updating since their similarity can be highly different among targeted legitimate website and subspecies of phishing website targeting that legitimate website. Furthermore, the previous signatures can be easily manipulated by attackers. In order to overcome the problems mentioned above, in this paper, we propose a hue signature auto update system for visual similarity-based phishing detection with tolerance to zero-day attack. The phishing websites targeting certain legitimate website tend to use the targeted website’s theme color to deceive users. In other words, the users can easily distinguish phishing website if it has highly different hue information from targeted legitimate one (e.g. red colored Facebook is suspicious). Thus, the hue signature has a common feature among the targeted legitimate website and subspecies of phishing websites, and it is difficult for attackers to change it. Based on this notion, we argue that the hue signature fulfills the requirements about auto updating SDB and robustness for attackers’ manipulating. This commonness can effectively expand the scope of detection when auto updating is applied to the hue signature. By the computer simulation with a real dataset, we demonstrate that our system achieves high detection performance compared with the previous scheme.

© 2020 The Institute of Electronics. Distributing codes to specific target sensors in order to fix bugs and/or install a new application is an important management task in WSNs (Wireless Sensor Networks). For the energy efficient dissemination of such codes to specific target sensors, it is required to select the minimum required number of forwarders with the fewest control messages. In this paper, we propose a novel RPL (Routing Protocol for Low-power and lossy networks)-based tree construction scheme for target-specific code dissemination, which is called R-TCS. The main idea of R-TCS is that by leveraging the data collection tree created by a standard routing protocol RPL, it is possible to construct the code dissemination tree with the minimum numbers of non-target sensors and control messages. Since by creating a data collection tree each sensor exchanges RPL messages with the root of the tree, every sensor knows which sensors compose its upwards route, i.e. the route towards the root, and downwards route, i.e. the route towards the leaves. Because of these properties, a target sensor can select the upward route that contains the minimum number of non-target sensors. In addition, a sensor whose downward routes do not contain a target sensor is not required to transmit redundant control messages which are related to the code dissemination operation. In this way, R-TCS can reduce the energy consumption which typically happens in other target-specific code dissemination schemes by the transmission of control messages. In fact, various performance evaluation results obtained by means of computer simulations show that R-TCS reduces by at least 50% energy consumption as compared to the other previous known target-specific code dissemination scheme under the condition where ratio of target sensors is 10% of all sensors.

© 2019 IEEE. To realize content distribution, NDN (Named Data Networking) is gathering attention. Since NDN is vulnerable to spreading fake contents, router based verification schemes are proposed to solve this problem. However, routers are vulnerable to the attack which puts a burden to them by verification of contents (verification attack). In order to detect it, the scheme leveraging the fact that the number of the request of unverified contents and the verification of them increase under the attack is proposed. While verification attack can be detected by that scheme, the attack has already occurred. In order to detect the attack before it occurs, in this paper, we propose a trust-based verification attack prevention scheme using tendency of contents request on NDN. We focus on the fact that the access interval to unverified contents tends to be short dramatically just before verification attack occurs. By leveraging this fact, the router determines that verification attack has occurred and restricts requests of all users temporarily. However, in this case, it is impossible to identify attackers, and the requests of legitimate users are also restricted. Therefore, we focus on the fact that legitimate users tend not to request contents in a cache in many cases. Meanwhile, in order to conduct verification attack, attackers need to request such contents for a short time. By giving low trust value to users requesting these contents, a router can identify attackers and restrict only attackers' requests. Our evaluation results show our scheme can detect verification attack before the attack. Furthermore, we clearly demonstrate that our scheme can restrict only attackers' requests.

© 2018 IEEE. Delay Tolerant Network (DTN) is characterized by a lack of end-to-end connectivity. Due to this, detecting flooding attack in DTN is a challenging and important task. Among several schemes against flooding attack in DTN, the scheme using Encounter Record (ER) that consists of past transmission history of each node is gathering attention. Since ER entries are exchanged between nodes, a node can detect an attacker whose transmission rate is too much. Although an attacker may falsify entry to pretend that his/her transmission rate is less than the actual value, it can also be detected through the contradiction between a falsified entry and another entry. However, since a node sends all ER entries in its own buffer regardless of whether an entry is helpful to detect an attacker or not, the energy consumption increases as the number of entries increases. In this paper, we propose an ER reduction scheme based on theoretical contact probability for flooding attack mitigation. We focus on the fact that if the falsified entry does not exist, corresponding entries are not helpful to detect an attacker. Since the falsified entries are propagated over the network with the lapse of time, the probability that there is no contradicting entries over the network gets higher if a node has not received any contradicting entries for a sufficient time. By removing such entries, the energy consumption can be reduced while the effectiveness of ER is kept. By computer simulation, we demonstrate our scheme successfully reduce the energy consumption while the same level of performance is achieved.

© 1997-2012 IEEE. This letter presents novel results for the high-order capacity statistics of equal gain combining diversity receivers. The proposed methodology to obtain these results includes in the analysis the study of generalized fading channels and an arbitrary number of receiving antennas. Analytical expressions for the n-Th order capacity statistics as well as for the amount of dispersion, the reliability of the signal throughput, the kurtosis, and the skewness of the channel capacity distribution have been derived. The validity of the proposed methodology has been verified by means of Monte Carlo computer simulations. Furthermore, it has been shown that previously published results for the first-order capacity statistics are included in the analysis as special cases.

© 2018 IEEE. The main ideas of our scheme are that the storage nodes are selected according to the updating frequency of data for reducing the transmission and the delay, and the relay nodes can be acted as the owners of data instead of the real owner of data for protecting the user's privacy. Furthermore, by using the DIFF method, the user can effectively modify the stored data with the lower transmission cost and delay.

Copyright © 2019 The Institute of Electronics, Information and Communication Engineers. Android malwares are rapidly becoming a potential threat to users. Among several Android malware detection schemes, the scheme using Inter-Component Communication (ICC) is gathering attention. That scheme extracts numerous ICC-related features to detect malwares by machine learning. In order to mitigate the degradation of detection performance caused by redundant features, Correlation-based Feature Selection (CFS) is applied to feature before machine learning. CFS selects useful features for detection in accordance with the theory that a good feature subset has little correlation with mutual features. However, CFS may remove useful ICC-related features because of strong correlation between them. In this paper, we propose an effective feature selection scheme for Android ICC-based malware detection using the gap of the appearance ratio. We argue that the features frequently appearing in either benign apps or malwares are useful for malware detection, even if they are strongly correlated with each other. To select useful features based on our argument, we introduce the proportion of the appearance ratio of a feature between benign apps and malwares. Since the proportion can represent whether a feature frequently appears in either benign apps or malwares, this metric is useful for feature selection based on our argument. Unfortunately, the proportion is ineffective when a feature appears only once in all apps. Thus, we also introduce the difference of the appearance ratio of a feature between benign apps and malwares. Since the difference simply represents the gap of the appearance ratio, we can select useful features by using this metric when such a situation occurs. By computer simulation with real dataset, we demonstrate our scheme improves detection accuracy by selecting the useful features discarded in the previous scheme.

© 2019 IEEE. In this paper, we propose a novel visual similarity-based phishing detection scheme using hue information with auto updating database. Since a PWS (Phishing Website) is created based on targeted legitimate website or other subspecies whose hue information is similar each other, many PWSs can be exhaustively detected by tracing similar colored subspecies. Based on this notion, the proposed scheme detects a new PWS which has similar hue information to already detected PWSs. By repeating this procedure, the detection scope can be effectively expanded. In order to avoid the misdetection of legitimate websites which have similar hue information to database's ones, the proposed scheme utilizes the fact that the combination of used colors is hard to be similar among legitimate websites and PWSs. By the computer simulation with real dataset, we demonstrate that the proposed scheme improves the detection performance as the number of detected PWSs increases.

Copyright © 2020 The Institute of Electronics, Information and Communication Engineers. Since the owner's data might be leaked from the centralized server storage, the distributed storage schemes with the server storage have been investigated. To ensure the owner's data in those schemes, they use Reed Solomon code. However, those schemes occur the burden of data capacity since the parity data are increased by how much the disconnected data can be restored. Moreover, the calculation time for the restoration will be higher since many parity data are needed to restore the disconnected data. In order to reduce the burden of data capacity and the calculation time, we proposed the server-based distributed storage using Secret Sharing with AES-256 for lightweight safety restoration. Although we use Secret Sharing, the owner's data will be safely kept in the distributed storage since all of the divided data are divided into two pieces with the AES-256 and stored in the peer storage and the server storage. Even though the server storage keeps the divided data, the server and the peer storages might know the pair of divided data via Secret Sharing, the owner's data are secure in the proposed scheme from the inner attack of Secret Sharing. Furthermore, the owner's data can be restored by a few parity data. The evaluations show that our proposed scheme is improved for lightweight, stability, and safety.

The flooding DDoS attack is a serious problem these days. In order to detect the flooding DDoS attack, the survival approaches and the mitigation approaches have been investigated. Since the survival approach occurs the burden on the victims, the mitigation approach is mainly studied. As for the mitigation approaches, to detect the flooding DDoS attack, the conventional schemes using the bloom filter, machine learning, and pattern analyzation have been investigated. However, those schemes are not effective to ensure the high accuracy (ACC), the high true positive rate (TPR), and the low false positive rate (FPR). In addition, the data size and calculation time are high. Moreover, the performance is not effective from the fluctuant attack packet per second (pps). In order to effectively detect the flooding DDoS attack, we propose the lightweight detection using bloom filter against flooding DDoS attack. To detect the flooding DDoS attack and ensure the high accuracy, the high true positive rate, and the low false positive rate, the dec-all (decrement-all) operation and the checkpoint are flexibly changed from the fluctuant pps in the bloom filter. Since we only consider the IP address, all kinds of flooding attacks can be detected without the blacklist and whitelist. Moreover, there is no complexity to recognize the attack. By the computer simulation with the datasets, we show our scheme achieves an accuracy of 97.5%. True positive rate and false positive rate show 97.8% and 6.3%, respectively. The data size for processing is much small as 280bytes. Furthermore, our scheme can detect the flooding DDoS attack at once in 11.1sec calculation time.