Design and Implementation of a Game with Network Traffic Visualization to Enhance Security Awareness

Size: px

Start display at page:

Download "Design and Implementation of a Game with Network Traffic Visualization to Enhance Security Awareness"

きよあつみうら
7 years ago
Views:

1 Rodney D. Van Meter III

2 ( 22 ) : 1, 2., 3., 4,

3 Abstract of Bachelor s Thesis - Academic Year 2010 Network Traffic Visualization to Enhance Security Awareness For typical computer users these days, information security practice is considered as passive as users take necessary actions only when malicious software or attack attempts were detected. However, recent security breach due to continuous appearing of new malwares raised needs for users to recognize threats and to consider countermeasures against it. In this thesis, design and implementation of a computer game software that observes network traffic and uses it as game components to enhance end-users security awareness has been conducted. In addition to existing anti-virus software by using this software, a user would be able to monitor network traffic while improving awareness of information security autonomously. End-users can see the state of network traffic without technical knowledge, and recognize malwares and security incidents on his or her network simultaneously. Because this software replaces every technical term by a familiar object, it accelerates the user s understanding without requiring the user to know any technical languages. This thesis aims to bring enlightenment to end-users with a software, and to establish a beachhead to change their security consciousness. Keywords : 1. Packet Capturing, 2. Entertainment, 3. Internet Security, 4. Network Monitoring Keio University, Faculty of Policy Management Hideaki Fukuoka

However, recent security breach due to continuous appearing of new malwares raised needs for users to recognize threats and to consider countermeasures against it.

4 iii

1....................... 7 3.2......................... 8 3.3................. 8 3.4...................................... 9 4 10 4.1.............................. 10 4.1.1.......................... 10 4.1.2......................... 11 4.

5 SYN iv

4................................. 22 5.4.1............................ 22 5.4.2....................... 22 5.4.3.......................... 23 5.4.4................................. 23 5.5...................................... 23 6 24 6.

6 Web A 52 A B 55 B B C 60 C C

1................................. 46 8.2................................... 47 48 A 52 A.1.............................. 52 B 55 B.1................................ 55 B.2....................... 56 C 60 C.

7 3.1 Packet Garden GIGAZINE[18] PacketCapture SYN C C C vi

4................................... 29 6.5.................................. 30 6.6.................................. 32 6.7................................ 34 6.8.................................. 34 6.9................................. 35 6.

8 C C C

9 A A

10 1 1.1 JNSA [1] Winny[2] Antinny[3] XSS Scareware[4] 87.4% [5] 2009 IPA [5]

11 IP 2

13 [6] [5] [7] 4

14 2 Security Tools[8] Scareware[4] Antinny[3] 1 Antinny [9] [10] [11] Twitter[12] XSS [13] javascript Twitter 1 [5] IPA [5] 4 [14] 8 [5]

16 3 3.1 [15] HTTP DNS ( )[16] 80 Packet Garden[17] 3.1 7

17 3 3.1: Packet Garden GIGAZINE[18] 3.2 [19] 3.3 [20] 1998 [21] [22] 1 8

18 [23] 2007 Wii[24] Wii Fit[25] 2006 Nintendo DS[26] DS[27] 2005 DS [28] 3.4 9

20 4 4.1: HTTP DNS IP 4.2 Web 11

21 4 4.2: Web

22 4 4.3:

25 5 5.1: PacketCapture

26 5 5.2:

28 5 5.3: IP IP IP DDOS 1 IP 32bit 128bit IP IP 19

29 SYN SYN TCP SYN SYN

30 5 5.4: HTTP 1024 Registered Port Number 5.4 SYN 6 IP 21

31 5 5.5:

32 HTTP Web

33 C++ Visual Studio 2008 DirectX9 C++ Windows Windows C++ Windows XP Windows OS Windows Windows OS [29] 6.2 SYN FTP DNS HTTP WELL KNOWN PORT NUMBERS 1023 TCP UDP TCP UDP 24

34 6 6.1: 6.1: TCP UDP A A.1 A HTTP SSL SMTP POP3 MSN AOL IRC P2P SSH DHCP NETBIOS 25

35 WELL KNOWN PORT NUMBERS REGISTERED PORT NUMBERS DYNAMIC AND/OR PRIVATE PORTS UDP TCP IP 26

36 6 6.2: M L T otal L th C T otal C th L th C th ( min 0.35 L ) ( T otal, min 0.35 C ) T otal, 0.35 L th C th (6.1) 27

37 6 6.3: SYN SYN SYN SYN SYN 6.3 SYN 1 SYN TCP SYN SYN 28

38 6 6.4:

6 6.5: 10 30 10 1 6.2 P 60 Hp Hp limit Ht Ht max Eq Eq max 0.

39 6 6.5: P 60 Hp Hp limit Ht Ht max Eq Eq max 0.2 ( ) Hplimit Hp 2 P = random(60) random 120 ( random(50) 0.5 Ht ) Ht ( max random(20) 0.5 Eq ) Eq max P = P 0.2 (6.2)

40 I Ec Ec limit P opulation T x (0.7) 0 0 I = Ec P opulation T x 0.7; (6.3) Ec limit Ec Ec amp 10 MerchantP ower P opulation Ec middle 800 P opulation (100 )P opulation th Ec middle Ec limit 2 Ec (10000) 6.5 Hp Hp rnd 10 Hp rnd 0 MerchantP ower Ec = Ec amp + Ec amp + Ec middle P opulation ( Ec amp = min P opulation ) 69200, P opulation th Ec middle = Ec limit 2 Ec (6.4) 31

41 6 Hp = 10 + random(hp rnd ) Hp rnd = 0 > % + 5 (6.5) :

42 6 Amount T ech T ech max Demand 3 Supply Ec = Amount 100 T ech ( ) Demand 3 min 0.98, (6.6) T ech max Supply Duty 100G IX amount Amount 1/2 0G G 0 3 IX amount = Amount 1 2 Duty 100 (6.7)

43 6 6.7: 6.8: / 34

44 6 6.9:

45 6 6.10:

46 6 6.11: :

47 6 B 38

48 WindowsXP SP C.1 39

50 Web Google Docs[30] C.2 Google Docs[30] C C

51 7 7.1: 7.2: Web C % % C

52 7 7.3: C : C C

53 7 7.5: 7.6: % 44

55 % 88% 46

57 Rodney D.Van Meter III Doan Viet Tung

58 [1] NPO. ver incident_survey_v1.1.pdf, [2] 47. Winny [3] Antinny - / / / it. jp/w/antinny.html, [4] - wikipedia. BD%E8%A3%85%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3%E3% 83%84%E3%83%BC%E3%83%AB, [5] IPA ishiki.pdf, [6] japan/about/prelease/pr_10b.asp?pr=10/11/17-1, [7] Symantec. bloodhound. http: // [8] GIGAZINE. security tool - gigazine. security_tool/, [9] Internet Watch. 1 winny pc [10] Internet Security Knowledge. Winny

59 8 [11] IPA outline.html, [12] Twitter. twitter [13] IT media. Twitter xss - itmedia [14] [15],,,, and.. 57, pages 47 52, [16] and. ( ).. OIS, 104(714), pages 7 12, [17] Packet Garden. Packet garden : Main - home page title. net/~julian/pg/pmwiki.php?n=main.homepage, [18] GIGAZINE. packet garden - gigazine [19] and. :., Vol.41, No.12, pages , [20] [21].. html, [22] BANDAI [23] JATY ( ). wiki - (jaty 1998 ) [24]. Wii [25] [26]. Nintendo ds

60 [27] and. ds [28]. ds [29] Net Applications. Os market share. os-market-share.aspx?qprid=11#, [30] Google. Google docs

61 A A.1 52

62 A A.1: 1 HTTP HTTPS SMTPS NNTPS SMTP POP3 IMAP IMAPS POP3S MESSANGER CD FTP P2P IRC SSH Telnet DNS DCHP NNTP NETBIOS UPnP WELL KNOWN PORT (SEND) WELL KNOWN PORT (RECV) RPC File Sharing NON TCP and NON UDP Registered by User DropBox 53

63 A A.2: 2 TCP (SEND) Registered Port Number TCP (RECV) Registered Port Number TCP (SEND) Dynamic Port Number TCP (RECV) Dynamic Port Number UDP (SEND) Registered Port Number with Port UDP (RECV) Registered Port Number with Port UDP (SEND) Registered Port Number with Port = UDP (RECV) Registered Port Number with Port = UDP (SEND) Dynamic Port Number UDP (RECV) Dynamic Port Number 54

64 B B.1 Windows XP SP3 C++ WinPCap DirectX 147,965 UI 55

65 B B.2 56

66 57 B

67 58 B

68 59 B

69 C C

70 C

71 C C TXT C.1:

72 C C.2: Web % % C.3: 63

73 C C.4:

74 C C.5: C.6: 65

29 jjencode JavaScript

29 jjencode JavaScript Kochi University of Technology Aca Title jjencode で難読化された JavaScript の検知 Author(s) 中村, 弘亮 Citation Date of 2018-03 issue URL http://hdl.handle.net/10173/1975 Rights Text version author Kochi, JAPAN http://kutarr.lib.kochi-tech.ac.jp/dspa