Kazufumi Aoki

Nippon Telegraph and Telephone · NTT Secure Platform Laboratories

Ever-evolving malware makes it difficult to prevent it from infecting hosts. Botnets in particular are one of the most serious threats to cyber security, since they consist of a lot of malware-infected hosts. Many countermeasures against malware infection, such as generating network-based signatures or templates, have been investigated. Such templa...

Malware is constantly evolving, which makes it difficult to prevent it from infecting hosts. Many countermeasures against malware infection, such as generating network-based signatures or templates, have been investigated. Such templates are designed to introduce regular expressions to detect polymorphic attacks conducted by attackers. A potential...

The number of security incidents is increasing and many of them are derived from malware activities. However, recent malware have become so sophisticated that commercial anti-virus software is not capable of detecting 100% of them. NTT Global Threat Intelligence Report shows that more than half of malware are not detected by commercial antivirus so...

A user who accesses a compromised website is usually redirected to an adversary's website and forced to download malware. Additionally, the adversary steals the user's credentials by using information-stealing malware. Furthermore, the adversary may try to compromise public websites owned by individual users by impersonating the website administrat...

After outlining trends in cyber attacks mounted mainly through the use of malicious software (malware), we describe technology for detecting malware infections and isolating infection sources and technology for analyzing malware and extracting the features of its functions; describe how information obtained from detection and analysis can be used b...

Malware is one of the most serious threats on the Internet. Countermeasures have been developed, but still many users are infected. Detecting and preventing communication by infected users from the network side would effectively mitigate the threats of malware. For this, we need to collect information about the destinations or payloads of malware c...

This article introduces anti-malware technologies currently being researched and developed at NTT. Malware is used by cyber attackers to abuse users' personal computers and servers, such as using them as bots, which exposes computer networks to security threats. Our anti-malware technologies can detect malware infection activities, collect malware,...

Nowadays, the number of web-browser targeted attacks that lead users to adversaries' web sites and exploit web browser vulnerabilities is increasing, and a clarification of their methods and countermeasures is urgently needed. In this paper, we introduce the design and implementation of a new client honeypot for drive-by-download attacks that has t...

Nowadays, the number of web-browser targeted attacks that lead users to adver-saries' web sites and exploit web-browser vulnerabilities is increasing, and a clarification of their methods is urgently needed. In this paper, we introduce our design and implemen-tation of a client honeypot with the capacity for gathering information, and we describe o...