The search functionality is under construction.
The search functionality is under construction.

Keyword Search Result

[Keyword] CTI(8214hit)

1201-1220hit(8214hit)

  • Deblocking Artifact of Satellite Image Based on Adaptive Soft-Threshold Anisotropic Filter Using Wavelet

    RISNANDAR  Masayoshi ARITSUGI  

     
    PAPER-Image Processing and Video Processing

      Pubricized:
    2018/02/26
      Vol:
    E101-D No:6
      Page(s):
    1605-1620

    New deblocking artifact, or blocking artifact reduction, algorithms based on nonlinear adaptive soft-threshold anisotropic filter in wavelet are proposed. Our deblocking algorithm uses soft-threshold, adaptive wavelet direction, adaptive anisotropic filter, and estimation. The novelties of this paper are an adaptive soft-threshold for deblocking artifact and an optimal intersection of confidence intervals (OICI) method in deblocking artifact estimation. The soft-threshold values are adaptable to different thresholds of flat area, texture area, and blocking artifact. The OICI is a reconstruction technique of estimated deblocking artifact which improves acceptable quality level of estimated deblocking artifact and reduces execution time of deblocking artifact estimation compared to the other methods. Our adaptive OICI method outperforms other adaptive deblocking artifact methods. Our estimated deblocking artifact algorithms have up to 98% of MSE improvement, up to 89% of RMSE improvement, and up to 99% of MAE improvement. We also got up to 77.98% reduction of computational time of deblocking artifact estimations, compared to other methods. We have estimated shift and add algorithms by using Euler++(E++) and Runge-Kutta of order 4++ (RK4++) algorithms which iterate one step an ordinary differential equation integration method. Experimental results showed that our E++ and RK4++ algorithms could reduce computational time in terms of shift and add, and RK4++ algorithm is superior to E++ algorithm.

  • Submodular Based Unsupervised Data Selection

    Aiying ZHANG  Chongjia NI  

     
    PAPER-Speech and Hearing

      Pubricized:
    2018/03/14
      Vol:
    E101-D No:6
      Page(s):
    1591-1604

    Automatic speech recognition (ASR) and keyword search (KWS) have more and more found their way into our everyday lives, and their successes could boil down lots of factors. In these factors, large scale of speech data used for acoustic modeling is the key factor. However, it is difficult and time-consuming to acquire large scale of transcribed speech data for some languages, especially for low-resource languages. Thus, at low-resource condition, it becomes important with which transcribed data for acoustic modeling for improving the performance of ASR and KWS. In view of using acoustic data for acoustic modeling, there are two different ways. One is using the target language data, and another is using large scale of other source languages data for cross-lingual transfer. In this paper, we propose some approaches for efficient selecting acoustic data for acoustic modeling. For target language data, a submodular based unsupervised data selection approach is proposed. The submodular based unsupervised data selection could select more informative and representative utterances for manual transcription for acoustic modeling. For other source languages data, the high misclassified as target language based submodular multilingual data selection approach and knowledge based group multilingual data selection approach are proposed. When using selected multilingual data for multilingual deep neural network training for cross-lingual transfer, it could improve the performance of ASR and KWS of target language. When comparing our proposed multilingual data selection approach with language identification based multilingual data selection approach, our proposed approach also obtains better effect. In this paper, we also analyze and compare the language factor and the acoustic factor influence on the performance of ASR and KWS. The influence of different scale of target language data on the performance of ASR and KWS at mono-lingual condition and cross-lingual condition are also compared and analyzed, and some significant conclusions can be concluded.

  • Source-Side Detection of DRDoS Attack Request with Traffic-Aware Adaptive Threshold

    Sinh-Ngoc NGUYEN  Van-Quyet NGUYEN  Giang-Truong NGUYEN  JeongNyeo KIM  Kyungbaek KIM  

     
    LETTER-Information Network

      Pubricized:
    2018/03/12
      Vol:
    E101-D No:6
      Page(s):
    1686-1690

    Distributed Reflective Denial of Services (DRDoS) attacks have gained huge popularity and become a major factor in a number of massive cyber-attacks. Usually, the attackers launch this kind of attack with small volume of requests to generate a large volume of attack traffic aiming at the victim by using IP spoofing from legitimate hosts. There have been several approaches, such as static threshold based approach and confirmation-based approach, focusing on DRDoS attack detection at victim's side. However, these approaches have significant disadvantages: (1) they are only passive defences after the attack and (2) it is hard to trace back the attackers. To address this problem, considerable attention has been paid to the study of detecting DRDoS attack at source side. Because the existing proposals following this direction are supposed to be ineffective to deal with small volume of attack traffic, there is still a room for improvement. In this paper, we propose a novel method to detect DRDoS attack request traffic on SDN(Software Defined Network)-enabled gateways in the source side of attack traffic. Our method adjusts the sampling rate and provides a traffic-aware adaptive threshold along with the margin based on analysing observed traffic behind gateways. Experimental results show that the proposed method is a promising solution to detect DRDoS attack request in the source side.

  • Optimization of Body Biasing for Variable Pipelined Coarse-Grained Reconfigurable Architectures

    Takuya KOJIMA  Naoki ANDO  Hayate OKUHARA  Ng. Anh Vu DOAN  Hideharu AMANO  

     
    PAPER-Computer System

      Pubricized:
    2018/03/09
      Vol:
    E101-D No:6
      Page(s):
    1532-1540

    Variable Pipeline Cool Mega Array (VPCMA) is a low power Coarse Grained Reconfigurable Architecture (CGRA) based on the concept of CMA (Cool Mega Array). It provides a pipeline structure in the PE array that can be configured so as to fit target algorithms and required performance. Also, VPCMA uses the Silicon On Thin Buried oxide (SOTB) technology, a type of Fully Depleted Silicon On Insulator (FDSOI), so it is possible to control its body bias voltage to provide a balance between performance and leakage power. In this paper, we study the optimization of the VPCMA body bias while considering simultaneously its variable pipeline structure. Through evaluations, we can observe that it is possible to achieve an average reduction of energy consumption, for the studied applications, of 17.75% and 10.49% when compared to respectively the zero bias (without body bias control) and the uniform (control of the whole PE array) cases, while respecting performance constraints. Besides, it is observed that, with appropriate body bias control, it is possible to extend the possible performance, hence enabling broader trade-off analyzes between consumption and performance. Considering the dynamic power as well as the static power, more appropriate pipeline structure and body bias voltage can be obtained. In addition, when the control of VDD is integrated, higher performance can be achieved with a steady increase of the power. These promising results show that applying an adequate optimization technique for the body bias control while simultaneously considering pipeline structures can not only enable further power reduction than previous methods, but also allow more trade-off analysis possibilities.

  • Evaluation of Register Number Abstraction for Enhanced Instruction Register Files

    Naoki FUJIEDA  Kiyohiro SATO  Ryodai IWAMOTO  Shuichi ICHIKAWA  

     
    PAPER-Computer System

      Pubricized:
    2018/03/14
      Vol:
    E101-D No:6
      Page(s):
    1521-1531

    Instruction set randomization (ISR) is a cost-effective obfuscation technique that modifies or enhances the relationship between instructions and machine languages. An Instruction Register File (IRF), a list of frequently used instructions, can be used for ISR by providing the way of indirect access to them. This study examines the IRF that integrates a positional register, which was proposed as a supplementary unit of the IRF, for the sake of tamper resistance. According to our evaluation, with a new design for the contents of the positional register, the measure of tamper resistance was increased by 8.2% at a maximum, which corresponds to a 32.2% increase in the size of the IRF. The number of logic elements increased by the addition of the positional register was 3.5% of its baseline processor.

  • Online Linear Optimization with the Log-Determinant Regularizer

    Ken-ichiro MORIDOMI  Kohei HATANO  Eiji TAKIMOTO  

     
    PAPER-Fundamentals of Information Systems

      Pubricized:
    2018/03/01
      Vol:
    E101-D No:6
      Page(s):
    1511-1520

    We consider online linear optimization over symmetric positive semi-definite matrices, which has various applications including the online collaborative filtering. The problem is formulated as a repeated game between the algorithm and the adversary, where in each round t the algorithm and the adversary choose matrices Xt and Lt, respectively, and then the algorithm suffers a loss given by the Frobenius inner product of Xt and Lt. The goal of the algorithm is to minimize the cumulative loss. We can employ a standard framework called Follow the Regularized Leader (FTRL) for designing algorithms, where we need to choose an appropriate regularization function to obtain a good performance guarantee. We show that the log-determinant regularization works better than other popular regularization functions in the case where the loss matrices Lt are all sparse. Using this property, we show that our algorithm achieves an optimal performance guarantee for the online collaborative filtering. The technical contribution of the paper is to develop a new technique of deriving performance bounds by exploiting the property of strong convexity of the log-determinant with respect to the loss matrices, while in the previous analysis the strong convexity is defined with respect to a norm. Intuitively, skipping the norm analysis results in the improved bound. Moreover, we apply our method to online linear optimization over vectors and show that the FTRL with the Burg entropy regularizer, which is the analogue of the log-determinant regularizer in the vector case, works well.

  • Static Dependency Pair Method in Functional Programs

    Keiichirou KUSAKARI  

     
    PAPER-Formal Approaches

      Pubricized:
    2018/03/16
      Vol:
    E101-D No:6
      Page(s):
    1491-1502

    We have previously introduced the static dependency pair method that proves termination by analyzing the static recursive structure of various extensions of term rewriting systems for handling higher-order functions. The key is to succeed with the formalization of recursive structures based on the notion of strong computability, which is introduced for the termination of typed λ-calculi. To bring the static dependency pair method close to existing functional programs, we also extend the method to term rewriting models in which functional abstractions with patterns are permitted. Since the static dependency pair method is not sound in general, we formulate a class; namely, accessibility, in which the method works well. The static dependency pair method is a very natural reasoning; therefore, our extension differs only slightly from previous results. On the other hand, a soundness proof is dramatically difficult.

  • An Approach for Virtual Network Function Deployment Based on Pooling in vEPC

    Quan YUAN  Hongbo TANG  Yu ZHAO  Xiaolei WANG  

     
    PAPER-Network

      Pubricized:
    2017/12/08
      Vol:
    E101-B No:6
      Page(s):
    1398-1410

    Network function virtualization improves the flexibility of infrastructure resource allocation but the application of commodity facilities arouses new challenges for systematic reliability. To meet the carrier-class reliability demanded from the 5G mobile core, several studies have tackled backup schemes for the virtual network function deployment. However, the existing backup schemes usually sacrifice the efficiency of resource allocation and prevent the sharing of infrastructure resources. To solve the dilemma of balancing the high level demands of reliability and resource allocation in mobile networks, this paper proposes an approach for the problem of pooling deployment of virtualized network functions in virtual EPC network. First, taking pooling of VNFs into account, we design a virtual network topology for virtual EPC. Second, a node-splitting algorithm is proposed to make best use of substrate network resources. Finally, we realize the dynamic adjustment of pooling across different domains. Compared to the conventional virtual topology design and mapping method (JTDM), this approach can achieve fine-grained management and overall scheduling of node resources; guarantee systematic reliability and optimize global view of network. It is proven by a network topology instance provided by SNDlib that the approach can reduce total resource cost of the virtual network and increase the ratio of request acceptance while satisfy the high-demand reliability of the system.

  • MIMO Radar Waveforms Using Orthogonal Complementary Codes with Doppler-Offset

    Takaaki KISHIGAMI  Hidekuni YOMO  Naoya YOSOKU  Akihiko MATSUOKA  Junji SATO  

     
    PAPER-Sensing

      Pubricized:
    2017/12/20
      Vol:
    E101-B No:6
      Page(s):
    1503-1512

    This paper proposes multiple-input multiple-output (MIMO) radar waveforms consisting of Doppler-offset orthogonal complementary codes (DO-OCC) for raising the Doppler resilience of MIMO radar systems. The DO-OCC waveforms have low cross-correlation among multiplexed waves and a low autocorrelation peak sidelobe level (PSL) even in the Doppler shift condition. They are verified by computer simulations and measurements. Computer simulations show that the peak sidelobe ratio (PSR) of the DO-OCC exceeds over 60dB and the desired to undesired signal power ratio (DUR) is over 60dB in the case that the Doppler shift is 0.048 rad per pulse repetition interval (PRI). And through the experimental measurements, it has been verified that the PSR of the DO-OCC is over 40dB and the DUR is over 50dB in the case that Doppler shift is 0.05 rad per PRI and that The DO-OCC waveforms enable to maintain the direction of arrival (DOA) estimation accuracy for moving targets as almost same as the one for static targets. The results prove the effectiveness of the proposed MIMO waveforms in achieving Doppler tolerance while maintaining orthogonality and autocorrelation properties.

  • Scattering Characteristics of the Human Body in 67-GHz Band

    Ngochao TRAN  Tetsuro IMAI  Koshiro KITAO  Yukihiko OKUMURA  Takehiro NAKAMURA  Hiroshi TOKUDA  Takao MIYAKE  Robin WANG  Zhu WEN  Hajime KITANO  Roger NICHOLS  

     
    PAPER-Antennas and Propagation

      Pubricized:
    2017/12/15
      Vol:
    E101-B No:6
      Page(s):
    1434-1442

    The fifth generation (5G) system using millimeter waves is considered for application to high traffic areas with a dense population of pedestrians. In such an environment, the effects of shadowing and scattering of radio waves by human bodies (HBs) on propagation channels cannot be ignored. In this paper, we clarify based on measurement the characteristics of waves scattered by the HB for typical non-line-of-sight scenarios in street canyon environments. In these scenarios, there are street intersections with pedestrians, and the angles that are formed by the transmission point, HB, and reception point are nearly equal to 90 degrees. We use a wide-band channel sounder for the 67-GHz band with a 1-GHz bandwidth and horn antennas in the measurements. The distance parameter between antennas and the HB is changed in the measurements. Moreover, the direction of the HB is changed from 0 to 360 degrees. The evaluation results show that the radar cross section (RCS) of the HB fluctuates randomly over the range of approximately 20dB. Moreover, the distribution of the RCS of the HB is a Gaussian distribution with a mean value of -9.4dBsm and the standard deviation of 4.2dBsm.

  • Correlation Performance Measures for Phase-Only Correlation Functions Based on Directional Statistics

    Shunsuke YAMAKI  Masahide ABE  Masayuki KAWAMATA  

     
    LETTER-Digital Signal Processing

      Vol:
    E101-A No:6
      Page(s):
    967-970

    This letter proposes performance evaluation of phase-only correlation (POC) functions using signal-to-noise ratio (SNR) and peak-to-correlation energy (PCE). We derive the general expressions of SNR and PCE of the POC functions as correlation performance measures. SNR is expressed by simple fractional function of circular variance. PCE is simply given by squared peak value of the POC functions, and its expectation can be expressed in terms of circular variance.

  • Hybrid Mechanism to Detect Paroxysmal Stage of Atrial Fibrillation Using Adaptive Threshold-Based Algorithm with Artificial Neural Network

    Mohamad Sabri bin SINAL  Eiji KAMIOKA  

     
    PAPER-Biological Engineering

      Pubricized:
    2018/03/14
      Vol:
    E101-D No:6
      Page(s):
    1666-1676

    Automatic detection of heart cycle abnormalities in a long duration of ECG data is a crucial technique for diagnosing an early stage of heart diseases. Concretely, Paroxysmal stage of Atrial Fibrillation rhythms (ParAF) must be discriminated from Normal Sinus rhythms (NS). The both of waveforms in ECG data are very similar, and thus it is difficult to completely detect the Paroxysmal stage of Atrial Fibrillation rhythms. Previous studies have tried to solve this issue and some of them achieved the discrimination with a high degree of accuracy. However, the accuracies of them do not reach 100%. In addition, no research has achieved it in a long duration, e.g. 12 hours, of ECG data. In this study, a new mechanism to tackle with these issues is proposed: “Door-to-Door” algorithm is introduced to accurately and quickly detect significant peaks of heart cycle in 12 hours of ECG data and to discriminate obvious ParAF rhythms from NS rhythms. In addition, a quantitative method using Artificial Neural Network (ANN), which discriminates unobvious ParAF rhythms from NS rhythms, is investigated. As the result of Door-to-Door algorithm performance evaluation, it was revealed that Door-to-Door algorithm achieves the accuracy of 100% in detecting the significant peaks of heart cycle in 17 NS ECG data. In addition, it was verified that ANN-based method achieves the accuracy of 100% in discriminating the Paroxysmal stage of 15 Atrial Fibrillation data from 17 NS data. Furthermore, it was confirmed that the computational time to perform the proposed mechanism is less than the half of the previous study. From these achievements, it is concluded that the proposed mechanism can practically be used to diagnose early stage of heart diseases.

  • BackAssist: Augmenting Mobile Touch Manipulation with Back-of-Device Assistance

    Liang CHEN  Dongyi CHEN  Xiao CHEN  

     
    LETTER-Computer System

      Pubricized:
    2018/03/16
      Vol:
    E101-D No:6
      Page(s):
    1682-1685

    Operations, such as text entry and zooming, are simple and frequently used on mobile touch devices. However, these operations are far from being perfectly supported. In this paper, we present our prototype, BackAssist, which takes advantage of back-of-device input to augment front-of-device touch interaction. Furthermore, we present the results of a user study to evaluate whether users can master the back-of-device control of BackAssist or not. The results show that the back-of-device control can be easily grasped and used by ordinary smart phone users. Finally, we present two BackAssist supported applications - a virtual keyboard application and a map application. Users who tried out the two applications give positive feedback to the BackAssist supported augmentation.

  • Co-Propagation with Distributed Seeds for Salient Object Detection

    Yo UMEKI  Taichi YOSHIDA  Masahiro IWAHASHI  

     
    PAPER-Image Processing and Video Processing

      Pubricized:
    2018/03/09
      Vol:
    E101-D No:6
      Page(s):
    1640-1647

    In this paper, we propose a method of salient object detection based on distributed seeds and a co-propagation of seed information. Salient object detection is a technique which estimates important objects for human by calculating saliency values of pixels. Previous salient object detection methods often produce incorrect saliency values near salient objects in the case of images which have some objects, called the leakage of saliencies. Therefore, a method based on a co-propagation, the scale invariant feature transform, the high dimensional color transform, and machine learning is proposed to reduce the leakage. Firstly, the proposed method estimates regions clearly located in salient objects and the background, which are called as seeds and resultant seeds, are distributed over images. Next, the saliency information of seeds is simultaneously propagated, which is then referred as a co-propagation. The proposed method can reduce the leakage caused because of the above methods when the co-propagation of each information collide with each other near the boundary. Experiments show that the proposed method significantly outperforms the state-of-the-art methods in mean absolute error and F-measure, which perceptually reduces the leakage.

  • On Maximizing the Lifetime of Wireless Sensor Networks in 3D Vegetation-Covered Fields

    Wenjie YU  Xunbo LI  Zhi ZENG  Xiang LI  Jian LIU  

     
    LETTER-Fundamentals of Information Systems

      Pubricized:
    2018/03/01
      Vol:
    E101-D No:6
      Page(s):
    1677-1681

    In this paper, the problem of lifetime extension of wireless sensor networks (WSNs) with redundant sensor nodes deployed in 3D vegetation-covered fields is modeled, which includes building communication models, network model and energy model. Generally, such a problem cannot be solved by a conventional method directly. Here we propose an Artificial Bee Colony (ABC) based optimal grouping algorithm (ABC-OG) to solve it. The main contribution of the algorithm is to find the optimal number of feasible subsets (FSs) of WSN and assign them to work in rotation. It is verified that reasonably grouping sensors into FSs can average the network energy consumption and prolong the lifetime of the network. In order to further verify the effectiveness of ABC-OG, two other algorithms are included for comparison. The experimental results show that the proposed ABC-OG algorithm provides better optimization performance.

  • Two-Input Functional Encryption for Inner Products from Bilinear Maps

    Kwangsu LEE  Dong Hoon LEE  

     
    PAPER-Cryptography and Information Security

      Vol:
    E101-A No:6
      Page(s):
    915-928

    Functional encryption is a new paradigm of public-key encryption that allows a user to compute f(x) on encrypted data CT(x) with a private key SKf to finely control the revealed information. Multi-input functional encryption is an important extension of (single-input) functional encryption that allows the computation f(x1,...,xn) on multiple ciphertexts CT(x1),...,CT(xn) with a private key SKf. Although multi-input functional encryption has many interesting applications like running SQL queries on encrypted database and computation on encrypted stream, current candidates are not yet practical since many of them are built on indistinguishability obfuscation. To solve this unsatisfactory situation, we show that practical two-input functional encryption schemes for inner products can be built based on bilinear maps. In this paper, we first propose a two-input functional encryption scheme for inner products in composite-order bilinear groups and prove its selective IND-security under simple assumptions. Next, we propose a two-client functional encryption scheme for inner products where each ciphertext can be associated with a time period and prove its selective IND-security. Furthermore, we show that our two-input functional encryption schemes in composite-order bilinear groups can be converted into schemes in prime-order asymmetric bilinear groups by using the asymmetric property of asymmetric bilinear groups.

  • Stability Analysis Using Monodromy Matrix for Impacting Systems

    Hiroyuki ASAHARA  Takuji KOUSAKA  

     
    PAPER-Nonlinear Problems

      Vol:
    E101-A No:6
      Page(s):
    904-914

    In this research, we propose an effective stability analysis method to impacting systems with periodically moving borders (periodic borders). First, we describe an n-dimensional impacting system with periodic borders. Subsequently, we present an algorithm based on a stability analysis method using the monodromy matrix for calculating stability of the waveform. This approach requires the state-transition matrix be related to the impact phenomenon, which is known as the saltation matrix. In an earlier study, the expression for the saltation matrix was derived assuming a static border (fixed border). In this research, we derive an expression for the saltation matrix for a periodic border. We confirm the performance of the proposed method, which is also applicable to systems with fixed borders, by applying it to an impacting system with a periodic border. Using this approach, we analyze the bifurcation of an impacting system with a periodic border by computing the evolution of the stable and unstable periodic waveform. We demonstrate a discontinuous change of the periodic points, which occurs when a periodic point collides with a border, in the one-parameter bifurcation diagram.

  • A Simple Inter-Track Interference Subtraction Technique in Bit-Patterned Media Recording (BPMR) Systems

    Chaiwat BUAJONG  Chanon WARISARN  

     
    PAPER-Storage Technology

      Vol:
    E101-C No:5
      Page(s):
    404-408

    In this paper, we demonstrate how to subtract the intertrack interference (ITI) before the decoding process in multi-track multi-head bit-patterned media recording (BPMR) system, which can obtain a better bit error rate (BER) performance. We focus on the three-track/three-head BPMR channel and propose the ITI subtraction technique that performs together with a rate-5/6 two dimensional (2D) modulation code. Since the coded system can provide the estimated recorded bit sequence with a high reliability rate for the center track. However, the upper and lower data sequences still be interfered with their sidetracks, which results to have a low reliability rate. Therefore, we propose to feedback the data from the center and upper tracks for subtracting the ITI effect of the lower track. Meanwhile, the feedback data from the center and lower tracks will be also used to subtract the ITI effect of the upper track. The use of our proposed technique can effectively reduce the severity of ITI effect which caused from the two sidetracks. The computer simulation results in the presence of position and size fluctuations show that the proposed system yields better BER performance than a conventional coded system, especially when an areal density (AD) is ultra high.

  • A Dynamic Latched Comparator Using Area-Efficient Stochastic Offset Voltage Detection Technique

    Takayuki OKAZAWA  Ippei AKITA  

     
    PAPER-Integrated Electronics

      Vol:
    E101-C No:5
      Page(s):
    396-403

    This paper presents a self-calibrating dynamic latched comparator with a stochastic offset voltage detector that can be realized by using simple digital circuitry. An offset voltage of the comparator is compensated by using a statistical calibration scheme, and the offset voltage detector uses the uncertainty in the comparator output. Thanks to the simple offset detection technique, all the calibration circuitry can be synthesized using only standard logic cells. This paper also gives a design methodology that can provide the optimal design parameters for the detector on the basis of fundamental statistics, and the correctness of the design methodology was statistically validated through measurement. The proposed self-calibrating comparator system was fabricated in a 180 nm 1P6M CMOS process. The prototype achieved a 38 times improvement in the three-sigma of the offset voltage from 6.01 mV to 158 µV.

  • Detecting Malware-Infected Devices Using the HTTP Header Patterns

    Sho MIZUNO  Mitsuhiro HATADA  Tatsuya MORI  Shigeki GOTO  

     
    PAPER-Information Network

      Pubricized:
    2018/02/08
      Vol:
    E101-D No:5
      Page(s):
    1370-1379

    Damage caused by malware has become a serious problem. The recent rise in the spread of evasive malware has made it difficult to detect it at the pre-infection timing. Malware detection at post-infection timing is a promising approach that fulfills this gap. Given this background, this work aims to identify likely malware-infected devices from the measurement of Internet traffic. The advantage of the traffic-measurement-based approach is that it enables us to monitor a large number of endhosts. If we find an endhost as a source of malicious traffic, the endhost is likely a malware-infected device. Since the majority of malware today makes use of the web as a means to communicate with the C&C servers that reside on the external network, we leverage information recorded in the HTTP headers to discriminate between malicious and benign traffic. To make our approach scalable and robust, we develop the automatic template generation scheme that drastically reduces the amount of information to be kept while achieving the high accuracy of classification; since it does not make use of any domain knowledge, the approach should be robust against changes of malware. We apply several classifiers, which include machine learning algorithms, to the extracted templates and classify traffic into two categories: malicious and benign. Our extensive experiments demonstrate that our approach discriminates between malicious and benign traffic with up to 97.1% precision while maintaining the false positive rate below 1.0%.

1201-1220hit(8214hit)