- PDF Free Download

Size: px

Start display at page:

Download ""

ゆみかいせき
7 years ago
Views:

3 Twitter LVS Keepalived Web SSH IPS IRC CAPTCHA P2P

4 / PC PC PC 2 [1] ICAP Proxy Proxy Web PC 3 Web JavaScript 4 D3M D3M(Drive-by Download Data by Marionette) D3M 24 URL pcap pcap 5-1-

13-0001 2015 2/2 1: D3M pcap Wireshark 1 URL URL DNS

5 /2 1: D3M pcap Wireshark 1 URL URL DNS DNS WireShark DNS URL JavaScript 6 D3M [1] ICAP Proxy 25-2-

6 /2 Twitter SNS LINE Twitter Facebook SNS Twitter 140 # # LoveLive LoveLive! LoveLive!LoveLive 2 [1] A A B B A B 3 Twitter Twitter Search API A Yahoo! Web API 1 Twitter Search API Yahoo! Web API API Twitter Search API Fedora 14 Web Apache PHP HTML JavaScript -3-

7 /2 1: 3.1 Twitter Search API Twitter Search API Twitter API Twitter Twitter API Ver1 URL ATOM JSON Ver1.1 JSON 3.2 Yahoo! Yahoo! Web API URL WebAPI 24 50, KB XML JSON PHP Serialize XML 4 XML API JSON [1] Twitter

8 / [1] [2] : -5-

9 / : (10cm) (2 ) (10 ) (30cm) (1 ) (10 ) (1 ) (1 ) (2 ) (1 ) 6 [1] 24 [2] 26-6-

10 / Android 2 3 Android Picture Password Lockscreen[1] 4 [2] 2-7-

11 /2 5 1 Android 6 7 Android Android [1] TwinBlade Picture Password Lockscreen - Android Apps on Google Play PicturePassword&hl=en [2] 27 pp

12 / IAT 2 IAT IAT(Import Address Table) API Windows DLL IAT IAT API IAT API API IAT IAT API 3 IAT IAT API Import Redirection IAT API Import Redirection IAT API API API JMP IAT API IAT -9-

13-195 2015 2/2 4 EXE Windows PE(Portable Executable) PE PE PE Windows.text().idata(API ).data().rsrc( ) 5 UPX Telock shooting.

13 /2 4 EXE Windows PE(Portable Executable) PE PE PE Windows.text().idata(API ).data().rsrc( ) 5 UPX Telock shooting.exe UPX Telock PE PE Tools 2 UPX 1: 3 Telock 1 2 UPX.text.rdata.data.reloc UPX0 UPX1 2: UPX UPX0 0 UPX1 UPX1 UPX0 1 3 Telock.reloc 3: Telock [1].text.text EIP( ) Windows OllyDbg EIP 6 PE [1] 11 pp

14 / [1] 50% Bluetooth 2 [2] [3]

15 /2 1: [1] 1 ICT [2] 26 [3]

16 /2 LVS Keepalived [1] 64.2% % 40.3 SNS 2 SSL SSL 2.1 LVS Linux LVS Linux Virtual Server LVS Linux Linux L4 IPVS IP Virtual Service 2.2 Keepalived LVS Keepalived LVS Linux VRRP Virtual Router Redundancy Protocol -13-

13-209 2015 2/2 1: Apache Bench Requests per second Time per request [ms] 4 DSR 5440.70 0.184 4 NAT 5021.69 0.199 2 DSR 4475.35 0.223 2 NAT 3619.55 0.268 1 3123.75 0.

17 /2 1: Apache Bench Requests per second Time per request [ms] 4 DSR NAT DSR NAT NAT Network Address Translation DSR Direct Server Return NAT DSR Web OS CentOS 6.6 IPVS v1.26 Keepalive v Web Apache : NAT 2: DSR NAT 1 NAT 2 DSR NAT NAT Keepalived IP Keepalived 4 Web 4.9KB html Apache Bench DSR NAT 2 DSR NAT 1 1 NAT DSR DSR KB Apache Bench [1] 27 johotsusintokei/whitepaper/ja/h27/html/nc html

18 /2 Web DoS DoS Denial of Service DoS DoS 2 [1] SYN Flood 2 SYN Flood SYN Flood TCP 3 3 SYN SYN/ACK ACK SYN Flood ACK SYN IP SYN/ACK ACK half-open SYN TCP 3 [2] SYN Flood TBF SYN Flood Web TBF 1 Web 1 1 Web rate burst Web 1 rate burst Web SSH rate burst -15-

19 /2 1: TBF 4 5 TBF TBF Snort IDS SYN IP IP SYN SYN Flood ACK half-open 3 half-open 3 SYN Web 6 SYN Flood DoS SYN Flood DoS 1 2 IP IP spoofingsyn Flood IP [1] DoS -SOHO (Ver1.20) security/fy14/contents/soho/html/chap1/dos.html [2] Web

20 /2 SSH [1] SSH 2 [2] SSH Syslog IP Web IP 3 1 SSH Syslog rsyslog rsyslog syslog TCP syslog MySQL rsyslog SSH IP MySQL Web IP SSH rsyslog SSHのアクセスログを rsyslogに収集 MySQL 必要な情報を抽出 Mail レポート Web レポート 1: IP PHP Web IP GeoIP[3] GeoIP MaxMind IP -17-

21 /2 2: Web 3: Web 4 SSH : :59 Web 2 IP GeoIP SSH SSH 5 Web Unix SSH SSH kippo [1] (2015) 2015 p.10 [2] SSH 2013 [3] GeoIP - MaxMind

22 / [1] GDP 7, Weka Weka Time series forecasting environment Weka 3 [2] TREND IP IP 1 6 TREND IP 1 6 F IP TREND 1: IP IP A B C D E F

23 /2 2: s-1 s-6 s-1 s-2 s-3 s-4 s-5 s s-1 s n1 s-1 s-1 n1 A 2. s-1 B 3. A B n1 s-1 Weka 5 [1] main sosiki/joho tsusin/policyreports/chousa/mail ken/pdf/ pdf [2]

24 /2 IPS IRC [1] C&C IRC IRC IPS 2 C&C DDoS C&C IRC IRC [2] CCC Dataset2013[3] IRC 4 IRC 3 IRC IRC TCP/IP IRC IRC 4 IRC NICK IRC NICK IRC IRC XChat IRC NICK 8 IRC IPS IRC NICK 8 IPS 1: -21-

25 /2 1: IRC IRC OS ngircd CentOS6.5 ircd-hybrid CentOS6.5 InspIRCd Windows7 2: IRC IRC OS kaiten CentOS6.5 perlbot CentOS6.5 sdbot WindowsVista dorkbot WindowsVista Agobot WindowsVista IRCbot WindowsVista Rbot WindowsVista IDS Snort OS CentOS NICK IRC 1 IRC IRC 1 IRC IRC C&C IRC 2 IRC 6 IRC IRC IRC IRC IRC [1] IPA pdf [2] IRC 2013 Vol 2013 No 11 pp [3] Vol 2009 No 11 pp

26 /2 CAPTCHA Web CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) [1] CAPTCHA Web CAPTCHA CAPTCHA CAPTCHA CAPTCHA CAPTCHA Web [2] 2 CAPTCHA CAPTCHA CAPTCHA Google Yahoo! Microsoft Web 3 [3] CAPTCHA 4 s b k b 1 b 2... b k B (1) B = {b 1 b 2... b k } (1) -23-

27 /2 n M (2) M = {s b 1 b 2... b (n 1) } (2) : CAPTCHA [1] Carnegie Mellon University : CAPTCHA: Telling Humans and Computers Apart Automatically, ( ). [2] W3C: Inaccessibility of CAPTCHA Alternatives to Visual Turing Tests on the Web W3C Working Group Note 23 November 2005, ( ) [3] IT Text

28 / ID ID ID ID ID 2 [1] 13 FRR False Reject RateFAR False Accept Rate FAR [2] Yahoo goo Web Web Jaccard Simpson 50 ( ) ( ) 3 4 FRR FAR -25-

29 /2 1: Google goo MeCab Jaccard Simpson 5 8 FRR FAR [1] 21 [2] Web AI 108(119) pp

30 / Microsoft Windows 8 [1] Android

31 /2 key input key input key (1) (1) 4 5 V : (%) 100 V [1] ja/archive/ 2011/12/22/signing-picture-password.aspx

32 / McAfee [1] , [2] Intel Dynamically Binary InstrumentationDBI Pin[3] DBI [4] telock PESpin Pin 3-29-

33 / n n+1 4 OllyDbg v1.10 [5] OllyDbg Plugin Development Kit 1.10 [6] : MOV (BYTE WORD DWORD) PTR DS : [ ( EAX ECX EDX EBX ESP EBP ESI EDI ) ]. 4.2 Map 4.3 GUI 2 5 [1] McAfee threat-center/report/download91.aspx [2] The 30th Symposium on Cryptography and Information Security 2013 [3] Pin - A Dynamic Binary Instrumentation Tool en-us/articles/pintool [4] Piotr Bania Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs p [5] OllyDbg v [6] Plugin Development Kit

34 / [1] [2] 3 iphone

35 / : % % XYZ [1] 24 [2]

36 /2 P2P P2P Chord 2 DHT Distributed Hash Table DHT Chord [1] Chord 3 Chord Chord Successor List n Successor List Successor 4 P2P [2] Chord P2P [3] -33-

37 /2 XOR 1 XOR 5 Chord 1 Successor 分割データ1 分割データ3 先頭から順に分割したファイルを配置する. 分割データ2 1: 入力データファイルサイズの大きいファイルをチャンクごとに分割する. Successor 6 [1] Ion Stoica, Robert Morris, David Liben-Nowell, David R. Karger, M. Frans Kaashoek, Frank Dabek, and Hari Balakrishnan Chord: A Scalable Peer-to-Peer Lookup Protocol for Internet Applications IEEE/ACM TRANSACTIONS ON NETWORKING VOL. 11, NO. 1, FEBRUARY 2003 [2] P2P 23 [3] P2P

1 DHT Fig. 1 Example of DHT 2 Successor Fig. 2 Example of Successor 2.1 Distributed Hash Table key key value O(1) DHT DHT 1 DHT 1 ID key ID IP value D

1 DHT Fig. 1 Example of DHT 2 Successor Fig. 2 Example of Successor 2.1 Distributed Hash Table key key value O(1) DHT DHT 1 DHT 1 ID key ID IP value D P2P 1,a) 1 1 Peer-to-Peer P2P P2P P2P Chord P2P Chord Consideration for Efficient Construction of Distributed Hash Trees on P2P Systems Taihei Higuchi 1,a) Masakazu Soshi 1 Tomoyuki Asaeda 1 Abstract: