The detection of APT has recently become an urgent problem needing to be resolved. Attackers use Remote Access Trojan/Remote Administration Tools (RATs), which often bypass general security measures, and the traditional detection techniques don't consider reconnaissance activities after RAT infections. We analyzed the behavior of the reconnaissance for this paper so that RAT-based malicious activities on internal networks can be divided from the operations of normal users. Based on the features of their behaviors, we propose a detection technique that monitors the communications on internal networks and extracts the communication sequences of the reconnaissance. The result from our evaluation showed that the proposed technique can detect 99.26 % of the experimental reconnaissance communications by using the real 34 RATs (29 families) and 4 SMB-based remote management methods, and also work without false-positive on an actual organization's internal network.

No abstract

We propose a privacy-preserving scheme to outsource zero-knowledge proof generation to a party that we call a worker. Our scheme can be applied to zk-SNARKs with a trusted setup, zero-knowledge proofs deployed in many applications. Compared to known privacy-preserving outsourcing schemes, our scheme is more practical in the sense that the computational and memory load on the worker is almost the same as that on the prover in cases where the provers generate proofs on their own.

The total number of solar power-producing facilities whose Feed-in Tariff (FIT) Program-based ten-year contracts will expire by 2023 is expected to reach approximately 1.65 million in Japan. If the facilities that produce or consume renewable energy would increase to reach a large number, e.g., two million, blockchain would not be capable of processing all the transactions. In this work, we propose a blockchainbased electricity-tracking platform for renewable energy, called 'ZGridBC,' which consists of mutually cooperative two novel decentralized schemes to solve scalability, storage cost, and privacy issues at the same time. One is the electricity production resource management, which is an efficient data management scheme that manages electricity production resources (EPRs) on the blockchain by using UTXO tokens extended to two-dimension (period and electricity amount) to prevent double-spending. The other is the electricity-tracking proof, which is a massive data aggregation scheme that significantly reduces the amount of data managed on the blockchain by using zero-knowledge proof (ZKP). Thereafter, we illustrate the architecture of ZGridBC, consider its scalability, security, and privacy, and illustrate the implementation of ZGridBC. Finally, we evaluate the scalability of ZGridBC, which handles two million electricity facilities with far less cost per environmental value compared with the price of the environmental value proposed by METI (= 0.3 yen/kWh).

Abstract. This paper introduces the high-speed forensics technology that promptly analyzes the damage after the targeted cyber attack had been detected and visualizes the whole picture of the attack by binding the communication packets and users' logs.