Published papers

There exists a need of 'image steganalysis' which reveals whether steganographic signals are embedded in an image to improve information security. Among various steganalysis, Convolutional Neural Networks (CNN) based steganalysis is promising since it can automatically learn the features of diverse steganographic algorithms. However, we discover the detection performance of CNN is degraded when an image is intentionally reduced by the nearest-neighbor interpolation before steganography. This is because spatial frequency in a reduced image gets high, which disturbs the training. In order to overcome this shortcoming, in this paper, we propose a preprocessing methodology by using additional steganography on CNN-based steganalysis. In the proposed preprocessing, steganographic signals are additionally embedded into both reduced original images and reduced steganographic ones since a difference of spatial frequencies between them gets obvious, which helps CNN learn features. Whenever reduced images are trained in CNN or inspected whether they are steganographic ones or not, steganography is applied to them once by the proposed preprocessing. Thus, an image is regarded as a steganographic one if the trained model judges steganography is applied to it twice; otherwise it is an original one. Since the proposed methodology is very simple, its computational cost is low. Our evaluation shows accuracy in a model with the proposed preprocessing is 10.6% higher than that in the conventional one. Besides, even in the situation where another steganography is additionally embedded, the proposed preprocessing yields 7% higher accuracy compared with the conventional one.

Recently, connected and automated vehicles have potential to mitigate traffic congestion and improve traffic efficiency at a highway on-ramp. Especially, vehicle to infrastructure communication based scheduling schemes are paid attention because a central control server can assign merging timing to automated vehicles to improve traffic efficiency on whole roads. Although several schemes calculate merging timing based on their criteria, these schemes cause traffic congestion when inflow traffic becomes high. In order to solve this problem, it is necessary to schedule merging timing of vehicles such that density of vehicles decreases on whole roads. In this paper, we propose a scheduling scheme for cooperative merging at a highway on-ramp with maximizing average speed of automated vehicles. The main idea of the proposed scheme is to utilize the traffic model that density and speed of vehicles have a negative correlation. By utilizing the traffic model, the proposed scheme preferentially assigns merging timing to vehicles which are on a congested road by maximizing average speed of all vehicles on whole roads. Simulation result shows that the proposed scheme decreases density of vehicles on whole roads even if inflow traffic becomes high. Furthermore, the proposed scheme improves outflow traffic from a highway on-ramp by 400 (veh/h) at most in comparison with related schemes.

Delay Tolerant Networks (DTNs) are vulnerable to message flooding attacks in which a very large number of malicious messages are sent so that network resources are depleted. To address this problem, previous studies mainly focused on constraining the number of messages that nodes can generate per time slot by allowing nodes to monitor the other nodes' communication history. Since the adversaries may hide their attacks by claiming a false history, nodes exchange their communication histories and detect an attacker who has presented an inconsistent communication history. However, this approach increases node energy consumption since the number of communication histories increases every time a node communicates with another node. To deal with this problem, in this paper, we propose an energy-efficient defense against such message flooding attacks. The main idea of the proposed scheme is to time limit the communication history exchange so as to reduce the volume while ensuring the effective detection of inconsistencies. The advantage of this approach is that, by removing communication histories after they have revealed such inconsistencies, the energy consumption is reduced. To estimate such expiration time, analytical expressions based upon a Markov chain based message propagation model, are derived for the probability that a communication history reveals such inconsistency in an arbitrary time. Extensive performance evaluation results obtained by means of computer simulations and several performance criteria verify that the proposed scheme successfully improves the overall energy efficiency. For example, these performance results have shown that, as compared to other previously known defenses against message flooding attacks, the proposed scheme extends by at least 22% the battery lifetime of DTN nodes, while maintaining the same levels of protection.

© 2019 IEEE. Detecting Android malware is imperative. As a promising Android malware detection scheme, we focus on the scheme leveraging the differences of traffic patterns between benign apps and malware. Those differences can be captured even if the packet is encrypted. However, since such features are just statistic based ones, they cannot identify whether each traffic is malicious. Thus, it is necessary to design the scheme which is applicable to encrypted traffic data and supports identification of malicious traffic. In this paper, we propose an Android malware detection scheme based on the level of SSL server certificate. Attackers tend to use an untrusted certificate to encrypt malicious payloads in many cases because passing rigorous examination is required to get a trusted certificate. Thus, we utilize SSL server certificate based features for detection since their certificates tend to be untrusted. Furthermore, in order to obtain the more exact features, we introduce required permission based weight values because malware inevitably require permissions regarding malicious actions. By computer simulation with real dataset, we show our scheme achieves an accuracy of 92.7 %. True positive rate and false positive rate are 5.6% higher and 3.3% lower than the previous scheme, respectively. Our scheme can cope with encrypted malicious payloads and 89 malware which are not detected by the previous scheme.

Copyright © 2020 The Institute of Electronics, Information and Communication Engineers. Detecting Android malwares is imperative. As a promising Android malware detection scheme, we focus on the scheme leveraging the differences of traffic patterns between benign apps and malwares. Those differences can be captured even if the packet is encrypted. However, since such features are just statistic based ones, they cannot identify whether each traffic is malicious. Thus, it is necessary to design the scheme which is applicable to encrypted traffic data and supports identification of malicious traffic. In this paper, we propose an Android malware detection scheme based on level of SSL server certificate. Attackers tend to use an untrusted certificate to encrypt malicious payloads in many cases because passing rigorous examination is required to get a trusted certificate. Thus, we utilize SSL server certificate based features for detection since their certificates tend to be untrusted. Furthermore, in order to obtain the more exact features, we introduce required permission based weight values because malwares inevitably require permissions regarding malicious actions. By computer simulation with real dataset, we show our scheme achieves an accuracy of 92.7%. True positive rate and false positive rate are 5.6% higher and 3.2% lower than the previous scheme, respectively. Our scheme can cope with encrypted malicious payloads and 89 malwares which are not detected by the previous scheme.

© 2017 IEEE. The detection of phishing websites and identifying their target are imperative. Among several phishing detection schemes, the scheme using visual similarity is gathering attention. It takes a screenshot of website and stores it to the database. If the inputted website''s screenshot is similar to database''s one, it is judged as phishing. However, if multiple similar websites exist, the first inputted website is regarded as legitimate. As a result, it cannot correctly detect legitimate website and identifying phishing target becomes difficult. As a second shortcoming, if the screenshot of phishing website is locally different from ones in the database, false negative occurs. In this paper, we propose visual similarity-based phishing detection scheme using image and CSS with target website finder. To remedy first shortcoming, we focus on the fact that legitimate websites are often linked by other websites and regard such website as legitimate and store the screenshot and CSS in the database. Since CSS is a file which defines the websites visual contents, attackers often steal legitimate CSS to mimic the legitimate website. Thus, by detecting the website which plagiarizes appearance or CSS of legitimate website, we detect phishing website and its target simultaneously. Moreover, we can alleviate the second shortcoming by using CSS because it is probable that the websites which have locally different appearance use identical CSS. By computer simulation with real dataset, we demonstrate our scheme improves detection accuracy while finding phishing target.

VoIP/SIP is taking place of conventional telephony because of very low call charge but it is also attractive for SPITters who advertise or spread phishing calls toward many callees. Although there exist many feature-based SPIT detection methods, none of them provides the flexibility against multiple features and thus complex threshold settings and training phase cannot be avoided. In this paper, we propose an unsupervised and threshold-free SPITters detection scheme by using clustering algorithm. Our scheme does not use multiple features directly to trap SPITters but uses them to find the dissimilarity among each caller pair and tries to separate the callers into SPITters cluster and legitimate one based on the dissimilarity. By computer simulation, we show that the combination of Random Forests dissimilarity and PAM clustering brings the best classification accuracy and our scheme works well when the SPITters account for more than 20% of the entire caller