Search

Some of the most serious threats to network security involve malware. One common way to detect malware-infected machines in a network is by monitoring communications based on blacklists. However, such detection is problematic because (1) no blacklist is completely reliable, and (2) blacklists do not provide the sufficient evidence to allow administrators to determine the validity and accuracy of the detection results. In this paper, we propose a malicious DNS query clustering approach for blacklist-based detection. Unlike conventional classification, our cause-based classification can efficiently analyze malware communications, allowing infected machines in the network to be addressed swiftly.

Some of the most serious security threats facing computer networks involve malware. To prevent this threat, administrators need to swiftly remove the infected machines from their networks. One common way to detect infected machines in a network is by monitoring communications based on blacklists. However, detection using this method has the following two problems: no blacklist is completely reliable, and blacklists do not provide sufficient evidence to allow administrators to determine the validity and accuracy of the detection results. Therefore, simply matching communications with blacklist entries is insufficient, and administrators should pursue their detection causes by investigating the communications themselves. In this paper, we propose an approach for classifying malicious DNS queries detected through blacklists by their causes. This approach is motivated by the following observation: a malware communication is divided into several transactions, each of which generates queries related to the malware; thus, surrounding queries that occur before and after a malicious query detected through blacklists help in estimating the cause of the malicious query. Our cause-based classification drastically reduces the number of malicious queries to be investigated because the investigation scope is limited to only representative queries in the classification results. In experiments, we have confirmed that our approach could group 388 malicious queries into 3 clusters, each consisting of queries with a common cause. These results indicate that administrators can briefly pursue all the causes by investigating only representative queries of each cluster, and thereby swiftly address the problem of infected machines in the network.

When a disaster occurs, the demand for information and communication technology (ICT) services drastically increases. To meet such demands, a national project was undertaken in Japan to develop the Movable and Deployable ICT Resource Unit (MDRU). One challenge regarding the MDRU is securing operators to work the units in emergency situations. As ICT service users have diverse and frequently changing demands, strong technical skills and practical knowledge are required for the administration of MDRUs. In this paper, we propose a knowledge-based network management system to alleviate the burden on administrators. To deal with the structural changes to network systems that frequently occur with changes in ICT service demand, we introduce modularization techniques into our previous research. The proposed system can be easily reconfigured by join/disjoin modules corresponding to changes in the system configuration of the MDRU. The results of our experiments using the implemented experimental system confirm that the proposed system can be applied to MDRU operation and effectively supports administrators.

Network management tasks are increasing its complexity because of the development of the IoT environment, virtualization technologies. To keep the safety and security of the network systems, the advances of analysis method for various network data is required for the practical problem-solving. Although many IT tools to support the data analysis works in network management, it is not enough for adaptation to developing environment. Also, the solutions do not consider the knowledge variety of users. In this paper, we propose an agent-based approach for data presentation to support the analysis from multiple aspects in network management works. Concretely, we design the self-organized analysis procedure based on the cooperation among agents and the interactive requirement estimation mechanism to improve the support functions for the diverse of the users’ knowledge. The evaluation experiments show the effectiveness of the prototypical system designed according to the proposed approach.

Disaster risks are always unpredictable, and it is impossible to prepare with predefined functions of the systems including not only automatic mechanical systems but also human groups of engineers and administrators. In this paper, to tackle the problem of disaster risks reduction, we propose a practical design and demonstration of the mechanism of collaboration between humans and agents of network management systems. As an example function of the collaboration, we develop the collaborative agents mediating the human users and the agents dealing with the network management functions. From the evaluation experiments using prototypical implementations show the possibility of the actual effectiveness of the proposed mechanism.

In this paper, we introduce a network management system for autonomous service management that can be effectively utilized in emergency situations. In order to alleviate the problem of a shortage of human resources in disaster situations, approaches for autonomous service management are helpful. Such approaches require knowledge of maximum load capacity of managed server systems so that a benchmark test should be conducted to acquire knowledge. However, in a disaster recovery phase, a configuration of the server system changes frequently due to the occurrence of the secondary disaster or fluctuating user demand. Therefore, a benchmark technique should be established that can be applied even to running server systems. In our proposal, we describe a non-destructive benchmarking technique that can acquire knowledge of the maximum load capacity of the server system without imposing heavy load. A prototype system based on our proposal is designed and implemented for experiments. The results of the experiments confirm that the proposed system can stably operate a service by proactively controlling the amount of computing resource of the server system.

The model of self-organized criticality (SOC) is a useful tool to understand the complexity of natural systems in the form of the artificial life and the artificial market. However, SOC remains the question what guarantees the criticality even though the natural systems seem to keep itself in the critical state. In this paper, we focus on the locality of interaction in zero-intelligence plus (ZIP) model. The extremely localized interaction changes the behavior of the ZIP model from equilibrium to intermittency. Although the original ZIP model falls into unstable with some noise, extremely localized interaction model archives robust intermittency against the noise parameter. Further, the statistical property of intermittent behavior shows the power-law nature.

Networking is an indispensable tool for disaster situations. Since it is predictable that there are no professional technicians around the place where the faults occur, a solution of collaborative problem solving between humans and agents makes the non-professionals to improve that situation. In this paper, to address the errors of the network under the disaster situation, we propose a multi-modal interaction mechanism for temporally organized groups of humans and agents who accidentally present at a short distance. A prototypical system including the proposed mechanism and the network management support agents shows that the flexible collaboration realizes the useful restoration.

How has the interdisciplinary data mining field been practiced in Network and Systems Management (NSM)? In Science and Technology, there is a wide use of data mining in areas like bioinformatics, genetics, Web, and, more recently, astroinformatics. However, the application in NSM has been limited and inconsiderable. In this article, we provide an account of how data mining has been applied in managing networks and systems for the past four decades, presumably since its birth. We look into the field’s applications in the key NSM activities—discovery, monitoring, analysis, reporting, and domain knowledge acquisition. In the end, we discuss our perspective on the issues that are considered critical for the effective application of data mining in the modern systems which are characterized by heterogeneity and high dynamism.