@techreport{oai:ipsj.ixsq.nii.ac.jp:00213619,
 author = {黄, 緒平 and 望月, 俊輔 and 吉岡, 克成},
 issue = {18},
 month = {Nov},
 note = {近年，IoT 機器を狙ったサイバー攻撃が増加している．マルウェアに感染した機器が踏み台として悪用され，不正な無線通信を大量に発生させる恐れがある．本研究はマルウェア感染による不正無線通信を抑制するため，収集した感染ログデータを解析し，IP アドレスから通信形態及びアップリンク通信速度を推定する手法を提案する．具体的に，GeoIP2 Connection Type DB による有線無線判定と自律システム（AS）番号を組み合わせてアドレスブロックを分割し，それぞれの範囲で Network Diagnostic Tool（NDT）の計測データと紐づけを行い，アップリンク通信速度を推定するメカニズムである．また，提案手法を IoT ハニーポットの実測値に適用し，接続形態を特定した後，無線通信の平均アップリンク推定速度が 40.6Mbps になり，プロバイダーの公称データと概ね合致した．, IoT botnets such as Mirai and its variants continue to evolve and keep consuming network resources, especially valuable radio resources. We show our approach to estimate the radio resources wasted by the IoT botnets. This paper proposes a cellular threats identification mechanism to identify the connection types, and to estimate the wireless uplink speed using IoT honeypot log, aiming developing a novel system to simulate the threat, by crosschecking Connection Type Database of Maxmind's GeoIP2, a well-known industrial resource for IP address related information, with uplink speed measurement data. Mobile Network Identification is approached by dividing IP addresses into IP ranges using Autonomous System (AS) numbers, combining the reverse DNS lookup solution. Network diagnostic tool database using IP ranges is used to calculate the uplink speed. To evaluate and verify the precision of the proposed method, we analyzed the IoT honeypot log as an alternation target application. The connection types are classified as ”Cable/DSL”, ”Corporate”, and ”Cellular”, and the maximum average uplink speed of cellular connection of the infected IPs is 40.6 Mbps, which is aligned with the average uplink speed of smartphone users of Softbank survey as 32 Mbps. Connection types and uplink speed is available using IP address as the input data by the proposed method, which may be used to estimate the attack scale.},
 title = {IoTマルウェア感染解析における通信形態及びアップリンク速度の推定手法},
 year = {2021}
}