Published papers

This paper proposes a general-purpose anomaly detection mechanism for Internet backbone traffic named GAMPAL (General-purpose Anomaly detection Mechanism using Prefix Aggregate without Labeled data). GAMPAL does not require labeled data to achieve general-purpose anomaly detection. For scalability to the number of entries in the BGP RIB (Border Gateway Protocol Routing Information Base), GAMPAL introduces prefix aggregate. The BGP RIB entries are classified into prefix aggregates, each of which is identified with the first three AS (Autonomous System) numbers in the AS_PATH attribute. GAMPAL establishes a prediction model for traffic sizes based on past traffic sizes. It adopts a LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) model that focuses on the periodicity of the Internet traffic patterns at a weekly scale. The validity of GAMPAL is evaluated using real traffic information, BGP RIBs exported from the WIDE backbone network (AS2500), a nationwide backbone network for research and educational organizations in Japan, and the dataset of an ISP (Internet Service Provider) in Spain. As a result, GAMPAL successfully detects anomalies such as increased traffic due to an event, DDoS (Distributed Denial of Service) attacks targeted at a stub organization, a connection failure, an SSH (Secure Shell) scan attack, and anomaly spam.

A service in cloud computing is executed in a data center, which may result in large communication delay. To host applications requiring low latency, edge/fog computing has attracted great attention. This paper proposes a mechanism called AFC (Application Function Chaining) for realizing distributed edge/fog computing. In AFC, an application is defined as a Chained-AF, which is composed of one or more AFs (Application Functions) with control structures such as conditional branches. An AF basically fulfills a single task similar to a UNIX command. Thus, a Chained-AF looks like a distributed shell script and the networks look like a single computer from users' viewpoint. A MANO (Management and Network Orchestration) mechanism in AFC places AFs on optimal edge/fog servers which satisfy Chained-AF's requirements when it is launched. Evaluation results of a prototype implementation show that it takes 0.5 seconds and 3 seconds to launch a Chained-AF composed of two and six AFs, respectively, and that the throughput of a Chained-AF is more than 90 % of the line speed, which is independent of the number of AFs. The throughput of an AFC depends on processing performance of AFs, not on the AFC mechanism.

Public key cryptography-based authentication methods such as FIDO/WebAuthn can provide a number of security improvements over passwords. However, the need to register every device the user wishes to use reduces its usability for consumer applications. In 2022, the FIDO Alliance introduced a multi-device credential model, which claims to offer numerous convenience and usability enhancements for end users; however, the fact that the WebAuthn credential can leave the protection of a hardware security module undermines the security guarantees previously provided by the FIDO/WebAuthn framework. This limits FIDO's usefulness for applications which require more rigorous protection. Furthermore, FIDO does not specify key management aspects, instead, end users and relying parties are left responsible for credential management. These trade-offs force a difficult compromise between overall security and convenience. In this paper, we propose a protocol for a split-key FIDO mechanism, in which each user device maintains a portion of the user's credential instead of a fully-usable private key. By proving access to multiple devices, the user can use a cloud provider to reassemble their private key in an HSM-protected environment, then use the cloud provider to authenticate on their behalf. Service providers can preserve many of the benefits of multi-device credentials, while still providing relatively strong private key protections. In addition, our proposal adds a key management overlay to the existing FIDO/WebAuthn framework. Our approach uses a user's existing cloud provider to reduce access to a user's private key, thus reducing the potential for credential theft, even if one of the user's devices is fully compromised.

Generally, a network administrator designs, constructs, and operates an enterprise network. Since inconsistency between the network design understood by the administrator and the actual network configuration might arise due to mistakes or errors, a method for automatically detecting such inconsistency is needed. The following four techniques are necessary for this purpose. (i) A machine-readable notation to represent the network configuration. (ii) A tool to write down the network design using the machine-readable notation. (iii) A tool to automatically detect the current network configuration and write it down in the machine-readable notation. (iv) A tool to compare the two outputs generated in (ii) and (iii). This paper employs the network ontology called Bonsai for (i). Bonsai can represent not only physical configurations but also virtualization technologies such as VLAN and overlay. This paper proposes three tools, nc-design, nc-detect, and nc-diff for (ii)-(iv), and confirms that they work as expected in the test network. This paper also measures their fundamental performance.

To detect anomalies in the Internet backbone traffic, Wakui et al. (2025) proposed GAMPALv2 (General-purpose Anomaly detection Mechanism using Prefix Aggregate without Labeled data, version 2). It detects anomalies by comparing the predicted flow sizes with the real observation on aggregated flow traffic, using random forest regression models. It has detected YouTube service disruption, some event traffic and DDoS attacks. However, it does not have enough potential to detect a sort of initial attack activities like scanning and spam. In this paper, we extend it as GAMPALv2.5 to detect them, employing three traffic indicators, specifically flow size, packet count, and session count. We also evaluate and compare the performance with GAMPALv2 through a benchmark dataset.

To detect anomalies on an Internet backbone network, we proposed GAMPAL (General-purpose Anomaly detection Mechanism using Prefix Aggregate without Labeled data). For scalability to the number of entries in the BGP RIB (Border Gateway Protocol Routing Information Base), GAMPAL introduces PA (Prefix Aggregate). It adopts an LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) as a model that focuses on the periodicity of Internet traffic patterns at a weekly scale. However, GAMPAL has three issues: (i) computational complexity, (ii) difficulty in defining detection threshold, and (iii) difficulty in detecting when and in which PA anomaly occurred. Therefore, this paper proposes GAMPALv2, which solves these problems for the practical use of GAMPAL. To solve (i), GAMPALv2 reduces the dimension of the input variables from 288 (five-minute slots in a day) to 7 by defining time features. It also adopts the RFR (Random Forest Regressor) as a prediction model. To solve (ii) and (iii), GAMPALv2 defines the predicted range based on the predicted values of the RFR and detects anomalies for each PA by comparing the predicted range with the observed value. As a result, the training and prediction time is reduced from four days using a GPU to 23 minutes using an 8-core CPU. Utilizing semantics such as date, time, and day of the week defined in the time features improves prediction accuracy. The evaluation results show that GAMPALv2 can detect anomalies in the real world, such as connection failure on YouTube, DDoS (Distributed Denial of Service) attacks, and increasing traffic due to an event. In addition, the accuracy evaluation shows that the recall is improved. Although not precisely comparable due to the different calculation methods, the average recall in the previous work is 81.8%, whereas recall improves to 93.1% in GAMPALv2.

As of 2022, 66% of Internet traffic is generated by video services, among which Netflix and YouTube are the dominant players. By monitoring the traffic volume of individual video services, ISPs (Internet Service Providers) can make appropriate capital investments and determine appropriate peering policies with CDN (Content Delivery Network) providers. Although DPI (Deep Packet Inspection) is widely used to identify network services, packet-level analysis does not scale to the traffic passing through backbone ISPs and is inapplicable to encrypted packets. This paper proposes OLIViS (OSINT-based Lightweight method for Identifying Video Services), a flow-level, label-free method designed for backbone ISPs. OLIViS employs a CNN-VAE (Convolutional Neural Network - Variational AutoEncoder) model to initially identify elephant flows which likely include video service flows and then utilizes OSINT (Open Source INTelligence) data for further services identification. Two datasets are used for evaluation: UTMobileNet2021 and WIDE backbone real trace. The evaluation results show that OLIViS identifies the Netflix and YouTube flows with an accuracy of over 96% in terms of traffic volume. Moreover, OLIViS infers the flow statistics (e.g., mean and peak throughput) of Netflix and YouTube, which closely resemble those inferred with DPI on non-encrypted traffic in a campus network.

In a Multi-access Edge Computing (MEC) environment, an application will be composed of multiple containers running on edge servers, and a container orchestration method determines which containers should be deployed on which edge servers. This paper proposes a container orchestration method considering shared containers. These containers will be introduced in an MEC environment to reduce application resource usage, similar to a shared library in an operating system. The proposed method adopts a multi-stage grouping of edge servers to aggregate computation resource information and network information of the edge servers for efficient orchestration calculation. The formulation of the proposed orchestration method has been successfully completed, marking a significant milestone in this research. Evaluation will be conducted assuming an environment that contains 2,048 edge servers and 200 user terminals.

Network Function Virtualization Infrastructure (NFVI) enables the operation of Network Function Chaining (NFC) in a low-cost and flexible manner by realizing network functions as software on general-purpose servers. One of NFVI's security requirements is access control to packet buffers, which can be achieved using Intra-process Isolation techniques. This paper proposes a secure NFVI using Software Fault Isolation (SFI) for access control to packet buffers by inserting bounds check instructions before indirect memory access instructions. The measurement results show that the proposed method is faster than ERIM, another Intra-process isolation method based on domain switching.

In an MEC (Multi-access Edge Computing) environment, it is suitable to compose an application as a set of containers for flexibility in resource allocation. This paper proposes stateless shared containers (SS-Containers) that can be shared by multiple applications simultaneously in an MEC environment, similar to a shared library in an operating system. It is expected that SS-Containers reduce resource consumption, shorten application startup time, and efficiently manage special hardware such as GPU. When 16 applications share an SS-Container with an encryption function, and each application contains the container with the same encryption function, the memory consumption is reduced by approximately 190 MiB. Comparing the case in which nine applications share an SS-Container that accesses a GPU to solve large-scale simultaneous linear equations with the case in which nine applications randomly access a GPU via a container inside them, the response time is reduced approximately by 57 % (39 seconds).

Software supply chain security has relied upon layered protective measures, such as fuzzing, code signing, and secure coding, to protect against unintentional vulnerabilities and intentional tampering. Regrettably, attacks, such as Solar Winds and Log4Shell zero-day, demonstrated that current protections are insufficient. As a result, several projects have emerged, aimed at providing rigorous protections, focusing largely on dependency management, code signing, and binary file tracking. A common approach adds developer identity within the code signing ecosystem, establishing a chain of trust between developers and code-signing keys. However, these solutions depend upon external identity providers performing authentication correctly, leaving potential for account hijacking and other identity-based attacks. Mitigation is offered via monitoring and auditing, but relies on other parties to actively monitor for anomalies. In this paper, we propose and evaluate a FIDO-based extension to the Sigstore system, which would embed authentication data into the signing process, providing end-users with added identity assurance, complementing Sigstore’s key-to-identity mapping. By providing attestation information to increase authentication strength, we can potentially issue longer lifetime developer certificates, reducing the overall number, for a more scalable system. We also perform a basic evaluation to demonstrate that our improvements can be implemented feasibly with minimal changes to Sigstore.

An academic organization network, e.g., a campus network, is running with limited financial support and manpower while it faces the same operational issues and cybersecurity threats as other organizations. Including the existing network facilities and computers for service providing, the increase of mobile devices such as BYOD becomes an issue in terms of misconfiguration and vulnerabilities. The current security systems focus on the backbone network so that the detailed traffic monitoring and data analysis cannot cover the abnormal behavior of all individual endpoints. In general, a misconfigured or intruded computer conducts some abnormal behavior, e.g., sending stray packets, compared to a normal device. Based on this point, we propose a lightweight abnormality detection mechanism by monitoring the stray packets in order to mitigate the above issues. As a result, not only the abnormal behavior can be detected but also maintain the performance of the existing security systems. In this paper, we describe the design and architecture of our proposed Traffic Analyzer', including the implementation and evaluation of our prototype system.

Generally, a network administrator designs, constructs, and operates an enterprise network. To manage a network correctly, the network administrator needs to understand its configuration. Since inconsistencies between the network design understood by the administrator and the actual network configuration might arise due to mistakes or errors, a method for automatically detecting such inconsistencies is needed. The following five techniques are necessary for this purpose: (i) a machine-readable notation to represent the network configuration, (ii) a tool to write down the network design in the machine-readable notation defined in (i), (iii) a tool to automatically detect the current network configuration and write it down in the machine-readable notation defined in (i), (iv) a tool to compare the two outputs generated in (ii) and (iii), and (v) a network management framework using machine-readable notation to simplify the network administrator’s tasks. This paper employs the network ontology called Bonsai for (i). Bonsai can represent not only a physical network configuration but also a network configuration with various network virtualization technologies such as VLAN (Virtual Local Area Network) and overlay. This paper proposes three tools, nc-design, nc-detect, and nc-diff, for (ii)–(iv) and confirms that they work as expected in a test network. In addition, this paper proposes a network information sharing framework called KANVAS (Knowledge base system in wide Area Networks with general Versatility, Availability, and Scalability) for (v). Evaluation results in a test network with virtualization technologies show that the proposed network management method can localize a network failure in a practical time.

This paper proposes an autonomous network management system based on closed-loop control to deal with network failures and congestion. The proposed system is realized by collaboration of Weaver, an automated system configuration designer based on Intent-based Networking, and KANVAS (Knowledge base system in wide Area Networks with Versatility, Availability, and Scalability), a framework for collecting and utilizing network information. In the proposed system, the KANVAS system collects and analyzes network conditions, and the Weaver system plans and executes countermeasures against a failure event based on the analysis results. This paper shows two case studies. In the first case study, the proposed system can automatically recover from a service failure caused by a node failure in approximately 8.5 minutes. In the second case study, the proposed system can reroute VPN due to congestion in the underlay network in approximately 35 seconds. These results show that the proposed system can automatically recover service networks from a failure and congestion that occur on the underlay network in shorter time than that required for manual recovery.

With the proliferation of digital transactions, trust is becoming increasingly important, as exemplified by the World Economic Forum’s Data Free Flow with Trust. Digital signatures are utilized to establish trust to prevent spoofing and unauthorized modification of transmitted digital data. However, the extent of trust is limited by jurisdictions, trusted lists and bridge certificate authorities, and does not have international coverage. For this reason, mutual recognition is needed, i.e. trust relationships established across countries. Establishing mutual recognition is complex and time-demanding due to the legislations, systems, and technologies involved. In parallel, electronic signatures consist of complex systems and structures and, thus, focusing on the technical requirements and solutions can enhance mutual recognition processes. The purpose of our approach is to develop a testbed that can verify technical aspects of mutual recognition. This paper describes the concept of the testbed “Hakoniwa” which includes analyzing the requirements, simulating and testing mutual recognition trust services across US, UK, EU and JP.

Demands for acquiring Internet behavior are increasing for Internet-scale network understanding such as inter-AS path management and traffic engineering. Although there are several efforts to make Internet behavior public, most of the public information is not structured and it is hard for applications to use such information. This paper proposes a network information sharing framework called KANVAS. It defines a network ontology called Bonsai which models network structure from viewpoints of physical, logical, service, and operation network structures. Bonsai can express network virtualization technologies such as link aggregation (LAG), VLAN, L2 over L3 tunneling, and virtual routing and forwarding (VRF). Applications can access network information via useful API. As a first step of development of KANVAS and Bonsai, this paper describes network information sharing within a single domain focusing on failure localization and throughput monitoring as examples. Evaluation results on a PoC system show that the time for failure localization is short enough and a throughput monitoring tool can choose appropriate monitoring points.

Current IoT systems are closed and specialized for specific purposes. In the near future, IoT Service Providers (IoTSPs) will emerge to allow providing sensing data observed by IoTSPs to subscribers. This paper proposes a mechanism called FedIoT, in which IoTSPs federate or namely unite in an autonomous and decentralized manner. Subscribers to an IoTSP in an FedIoT system can obtain sensing data observed by any IoTSPs in the FedIoT system. The design principle of FedIoT is analogous to that of the Internet. A FedIoT system is composed of multiple IoTSPs as the Internet is composed of multiple ASs (Autonomous Systems). FedIoT basically provides only sensing data to IoT applications and it depends on IoT applications how the sensing data is utilized as the Internet basically provides data exchange between applications. IoTSPs are interconnected with a unified interface called Primitive API considering operation policy as ASs exchange routing information considering operation policy. FedIoT defines a domain ontology called OntoFedIoT as the unified representation of locations and types of sensor nodes. A proof of concept system is implemented in Go language. The basic performance evaluation in this paper shows that the time required for obtaining sensing data is short enough for practical use.

This paper proposes an architecture called Cont-MEC for enabling UEs (User Equipments) to offload a part of applications to MEC (Multi-access Edge Computing) servers. It is expected that a MEC infrastructure is composed of a small number of centralized data centers and geographically distributed edge stations, in each of which multiple edge servers are installed. It is also expected that applications on UEs are implemented as container clusters similar to cloud-native applications and they are deployed on computing clusters. ContMEC has the following three features: (i) constructing a computing cluster per edge station for scalability to the number of UEs, (ii) hierarchical resource management for scalability and efficient resource sharing among computing clusters, and (iii) overlapped computing clusters for efficient resource sharing. A PoC (Proof-of Concept) implementation of ContMEC employs Kubernetes as a container orchestration system without modifications although Kubernetes does not take account of the MEC infrastructure. The PoC implementation shows that advantage of offloading is larger than disadvantage of implementing applications as container clusters, control traffic is moderate against the number of UEs, and efficient resource sharing among computing clusters is achieved.

Researchers and network operators regularly monitor unused Internet address space called the darknet to understand malicious activities on the Internet such as malware infections, DDoS, and scanning to find vulnerable systems. The purpose of this study is to demonstrate the effectiveness of darknet monitoring across multiple organizations by conducting a detailed similarity analysis. In this paper, we analyze darknet data observed in two organizations in different industries and the first octet subnet range. We compared the results of the similarity analysis between intra-organization and inter-organization calculations by dividing the address space into multiple blocks so that one organization conducts similarity analysis in an intra-organization manner. The results show that the similarity of the source hosts is lower in the inter-organization calculation than in the intra-organization calculation. In addition, we monitor more source hosts in inter-organization. Moreover, this work also reports that the results differ depending on the destination ports/protocols. From the results obtained, we clarified the effectiveness of distributing the monitoring points of the darknet across multiple organizations.

In the age of edge/fog computing, it is important to consider not only computing resources but also network resources when hosting services. Since service is composed of multiple small functions in the microservice architecture, we treat a service as a set of BFs (basic functions) that fulfill a single task. It is required to place BFs at edge/fog nodes considering the computing resources and network requirements within a practical time. This paper proposes a MANO (Management and Network Orchestration) for deploying services composed of multiple BFs with requirements to computing and network resources of distributed nodes. The proposed MANO considers the computing resources of edge/fog/cloud as well as the network delay and the bandwidth between them. This paper proposes an optimal method and a heuristic method for calculating the placement of BFs. The evaluation results show that the placement calculation time for a service composed of four BFs is about 10 seconds with the optimal method and about 20 seconds with the heuristic method. The calculation time is within the practical range.