Published papers

Logging data is a valuable and an important information to reveal the attacker's activities and to recover broken system. Unfortunately, once the attacker successfully penetrates a protected system, he never fails to either modify the logging data, or even worse, delete them to cover his traces. To avoid such a disaster, it is best to keep logging data in another machine by forwarding them to a central logging server. However, this approach has a flaw: while transmitting on network, the data could be illegally sniffed or the traffic might be secretly redirected to a malicious machine. This paper proposes a novel method named Xenlog to secure logging data for systems run on Xen virtual machine: the solution does not use network stack to send data. Experimental and resulted tool proves that this approach is more secure than the traditional solution, while logging process is far more effective (nearly 21 times faster) and more reliable.

In this letter, a new self-organizing map (SOM) algorithm with computational cost O(log2M) is proposed where M2 is the size of a feature map. The first SOM algorithm with O(M2) was originally proposed by Kohonen. The proposed algorithm is composed of the subdividing method and the binary search method. The proposed algorithm does not need the neighborhood functions so that it eliminates the computational cost in learning of neighborhood vectors and the labor of adjusting the parameters of neighborhood functions. The effectiveness of the proposed algorithm was examined by an analysis of codon frequencies of Escherichia coli (E. coli) K12 genes. These drastic computational reduction and accessible application that requires no adjusting of the neighborhood function will be able to contribute to many scientific areas.

In this paper, we discuss the effectiveness of applying the ATP (automated theorem proving) strategy called hot list strategy for N-coloring graph problem The process of graph coloring is formulated by equality substitution of paramodulation. It is showed that hot list strategy is useful to control the reasoning process driven by paramodulation. This ATP strategy are designed to deal with a substantial delay in going to a retained conclusion, which makes it possible to reduce the CPU time occurred by redundant generated clauses. Hot list strategy enables reasoning program to look ahead for faster resolution. In proposal graph coloring method, hot list strategy prevents paramodulation to generate much retained information thus reduce CPU time to reach the conclusion. Experiment shows that paramodulation could used for formulating graph coloring problem and hot list strategy is suitable for controlling paramoudlation based resolution. We measured CPU time and the number of generated clauses in solving coloring problem of Petersen graphs. Five kinds of Petersen graphs are formulated and processed by proposal theorem proving program.

Honeypot is a common solution to investigate attacker's activities, but the data capture tool, one of the key components of high-interaction honeypot architecture, faces a major difficulty: it is very hard to hide its presence. For example Sebek, the de-factor data capture tool, suffers from this problem: the intruder can easily uncover it even without privileged access right. This paper presents a design and implementation of a light-weight "camera" software in Xen virtual machine environment: the camera can be put into the virtual machine honeypot to gather necessary data about intruder's action. The camera tool is named XenKamera, which aims to collect TTY data from consoles of observed honeypot, then replays the collected data in on-line or off-line manner as the administrator wishes. Simply put, XenKamera allows us to watch the intruder as if we were looking over his shoulder while he is typing. In order to prevent the intruder from discovering XenKamera, a special architecture is proposed, so the data recording process becomes stealth, hard to detect and circumvent. To protect the gathered data, the TTY logging is secretly transferred to a separate virtual machine and safely kept there. Experiments demonstrate that XenKamera is effective and reliable. Besides to serve for honeypot purpose, XenKamera is designed to be so light-weight that it is practical and can also be used in the production systems to record the working sessions, and the administrator can rely on the logging data to investigate and trouble-shoot administration.

In this paper we propose a resolution based detection method for detecting metamorphic computer virus. Our method is the application of formal verification using theorem proving, which deduce parts of viral code from the large number of obfuscated operations and re-assemble those in order to reveal the signature of virus. While previously many kinds of the symbolic emulation based methods have been applied for metamorphic virus, no resolution strategy based method is proposed. It is showed that the complexity of metamorphic virus can be solved if the obfuscated viral code is canonicalized and simplified using resolution based state pruning and generation. To make our detection method more feasible and effective, redundancy-control strategies are applied for the resolution process. In this paper the strategies of demodulation and subsumption are applied for eliminating the redundant path of resolution. Experiment shows that without these strategies, resolving metamorphic code into several simplified operations is almost impossible, at least is not feasible in reasonable computing time. The statistics of reasoning process in detecting obfuscated API call is also presented. We divide obfuscated API call into four modules according to the types of metamorphic techniques and compare the conventional resolution with our method applying redundancy-control strategy.

Data capture tool is one of the core components of a honeypot system. The most vital requirement of this component is: it must function as stealthily as possible, so the intruder is not aware of its presence. Currently Sebek is the most sophisticated tool for this purpose. Unfortunately Sebek is rather easy to detect, even with unprivileged right access. This paper presents a novel approach to improve Sebek on this aspect. We proposes a design and implementation of a tool named Xebek, which is based on Xen technology, to fix the most outstanding problems of Sebek. Our experimental results prove that Xebek is much more covert, while the reliability and efficient are improved significantly.

Logging data is valuable and important information to reveal the attacker's activities and recover broken system. Unfortunately, once the attacker successfully penetrates a protected system, he never fails to either modify the logging data, or even worse, delete them to cover his traces. To avoid such a disaster, it is best to keep logging data in another machine by forwarding them to a central logging server. However, this approach has a flaw: while transmitting on network, data could be illegally sniffed or the traffic might be secretly redirected to a malicious machine. This paper proposes a novel method named Xenlog to secure logging data for systems run on Xen virtual machine: the solution does not use network stack to send data. Experimental and resulted tool proves that this approach is more secure than the traditional solution, while logging process is far more effective (nearly 24 times faster) and more reliable.

In this paper, we propose Micro Secure Socket Layer (MSSL) for 8-bit flash micro controller that is about 1.3 Kbytes in code size. We have analyzed and compared various cryptographic protocols in TCP/IP stack for Micro Server to propose a simple secure layer based on simple handshake processing and encryption. Security implementation for Micro Server, which has very limited size of memory with a small processor, is very difficult and challenging task. However, security on the applications of ubiquitous sensors has become very important issues recently. Crackers can easily access to the sensor nodes or Micro Servers without security. Because the proposed MSSL is very small in code size, it can be implemented and is suitable for small sensors and Micro Server systems.

Digital watermarking became a key technology for protecting copyrights. In this paper, we propose a method of key generation scheme for static visual digital watermarking by using machine learning technology, neural network as its exemplary approach for machine learning method. The proposed method is to provide intelligent mobile collaboration with secure data transactions using machine learning approaches, herein neural network approach as an exemplary technology. First, the proposed method of key generation is to extract certain type of bit patterns as training data set for machine learning of digital watermark Second, the proposed method of watermark extraction is processed by presenting visual features by the training approach of machine learning technology. Third, the training approach is to converge the extraction key as the classifier, which is generated by the machine learning process is used as watermark extraction key. The proposed method is to contribute to secure visual information hiding without losing any detailed data of visual objects or any additional resources of hiding visual objects as molds to embed hidden visual objects.

Soft computing in the area of information security is a promising field for the creation of intelligent solutions. This paper discusses a method for digital watermarking using artificial neural networks to realize secure copyright protection of visual information without any damage. The discussed watermark extraction keys and feature extraction keys identify the secure and unique hidden patterns for proper digital watermarks. In the experiments, we have shown that the proposed method is robust to high pass filtering and JPEG compression of visual information, only for those watermark extraction keys which were able to identify the proper hidden bit patterns from original visual information using corresponding feature extraction keys. The proposed method is to contribute to secure visual digital watermarking without damaging or losing any detailed data of visual information.

In this paper, we propose a new information hiding technique without embedding any information into the target content by using neural network trained on frequency domain. Proposed method can detect a hidden bit codes from the content by processing the selected feature subblocks into the trained neural network. Hidden codes are retrieved from the neural network only with the proper extraction key provided. The extraction key, in proposed method, are the coordinates of the selected feature subblocks and the network weights generated by supervised learning of neural network. The supervised learning uses the coefficients of the selected feature subblocks as set of input values and the hidden bit patterns are used as teacher signal values of neural network. With our proposed method, we are able to introduce a information hiding scheme with no damage to the target content.

In this paper we propose a novel biological reasoning technique to find genetic palindrome using the resolution- based ATP (automated theorem proving) computing strategy. To retrieve the palindromic sequence, we apply automated deduction software with some resolution strategies to increase program performance. While the conventional reasoning or logic programming oriented method is basically top-down process, our method is bottom-up, resolution-based and also enhanced by direction and restriction reasoning strategies. Proposal method is divided into two steps. First, each element of sequence is represented as one state clause. Second, biological reasoning program resolve these states to retrieve palindrome motif from genetic sequence. Besides, to make this resolution process faster, we apply a reasoning strategy called resonance restriction. This resolution strategy blocks the biological reasoning by avoiding expression that do not mach the patterns set by researchers. This pattern is called “resonator” which is expressed by symbol patterns in automated reasoning. In our model, researcher assigns resonators to the gap between repeated regions which prevent his program from redundant search related non-symmetric parts of genetic sequence. Resonators restrict discovery process by discarding clauses generated around the gap between palindromic motifs, which enhance sharply the performance of reasoning program. In experiment, we translate whole genome sequence of Escherichia coli into clausal representation. Numerical results are presented about the retrieval of palindrome in Escherichia coli to valid the effectiveness of proposal technique. We validate that resonance restriction makes reasoning process faster with experimental output of generated clauses, CPU time.

A variety of tools and architectures have been developed to detect security violations to Operating System kernels. However, they all have fundamental flaw in the design so that they fail to discover kernel-level attack. Few hardware solutions have been proposed to address the outstanding problem, but unfortunately they are not widely accepted. This paper presents a software-based method to detect intrusion to kernel. The proposed tool named XenKIMONO, which is based on Xen Virtual Machine, is able to detect many kernel rootkits in virtual machines with small penalty to the system's performance. In contrast with the traditional approaches, XenKIMONO is isolated with the kernel being monitored, thus it can still function correctly even if the observed kernel is compromised. Moreover, XenKIMONO is flexible and easy to deploy as it absolutely does not require any modification to the monitored systems.