{"metadata":{"_oai":{"id":"oai:ipsj.ixsq.nii.ac.jp:00062506","sets":["1164:3925:5646:5710"]},"path":["5710"],"owner":"10","recid":"62506","title":["実行環境による挙動変化を用いたボット検出方式の提案"],"pubdate":{"attribute_name":"公開日","attribute_value":"2009-06-25"},"_buckets":{"deposit":"10655c90-e557-4db5-aec0-6fb24ec2afb6"},"_deposit":{"id":"62506","pid":{"type":"depid","value":"62506","revision_id":0},"owners":[10],"status":"published","created_by":10},"item_title":"実行環境による挙動変化を用いたボット検出方式の提案","author_link":["0","0"],"item_titles":{"attribute_name":"タイトル","attribute_value_mlt":[{"subitem_title":"実行環境による挙動変化を用いたボット検出方式の提案"},{"subitem_title":"A bot detection based on behavior changing according to execution environment","subitem_title_language":"en"}]},"item_type_id":"4","publish_date":"2009-06-25","item_4_text_3":{"attribute_name":"著者所属","attribute_value_mlt":[{"subitem_text_value":"静岡大学大学院情報学研究科"},{"subitem_text_value":"株式会社 KDDI 研究所"},{"subitem_text_value":"独立行政法人 情報通信研究機構情報通信セキュリティ研究センター"},{"subitem_text_value":"静岡大学創造科学技術大学院／独立行政法人科学技術振興機構，CREST"}]},"item_4_text_4":{"attribute_name":"著者所属(英)","attribute_value_mlt":[{"subitem_text_value":"Graduate school of Informatics, Shizuoka University","subitem_text_language":"en"},{"subitem_text_value":"KDDI R&D Laboratories, Inc.","subitem_text_language":"en"},{"subitem_text_value":"National Institute of Information and Communication Technology, Tracable Network Group","subitem_text_language":"en"},{"subitem_text_value":"Graduate School of Science and Technology, Shizuoka University / Japan Science Technology and Agency, CREST","subitem_text_language":"en"}]},"item_language":{"attribute_name":"言語","attribute_value_mlt":[{"subitem_language":"jpn"}]},"item_publisher":{"attribute_name":"出版者","attribute_value_mlt":[{"subitem_publisher":"情報処理学会","subitem_publisher_language":"ja"}]},"publish_status":"0","weko_shared_id":-1,"item_file_price":{"attribute_name":"Billing file","attribute_type":"file","attribute_value_mlt":[{"url":{"url":"https://ipsj.ixsq.nii.ac.jp/record/62506/files/IPSJ-CSEC09046016.pdf"},"date":[{"dateType":"Available","dateValue":"2011-06-25"}],"format":"application/pdf","billing":["billing_file"],"filename":"IPSJ-CSEC09046016.pdf","filesize":[{"value":"554.7 kB"}],"mimetype":"application/pdf","priceinfo":[{"tax":["include_tax"],"price":"660","billingrole":"5"},{"tax":["include_tax"],"price":"330","billingrole":"6"},{"tax":["include_tax"],"price":"0","billingrole":"30"},{"tax":["include_tax"],"price":"0","billingrole":"44"}],"accessrole":"open_date","version_id":"f9c5e214-ec2f-4a31-8411-603e0420d749","displaytype":"detail","licensetype":"license_note","license_note":"Copyright (c) 2009 by the Information Processing Society of Japan"}]},"item_4_creator_5":{"attribute_name":"著者名","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"酒井, 崇裕"},{"creatorName":"竹森, 敬祐"},{"creatorName":"安藤, 類央"},{"creatorName":"西垣, 正勝"}],"nameIdentifiers":[{}]}]},"item_4_creator_6":{"attribute_name":"著者名(英)","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"Takahiro, Sakai","creatorNameLang":"en"},{"creatorName":"Keisuke, Takemori","creatorNameLang":"en"},{"creatorName":"Ruo, Ando","creatorNameLang":"en"},{"creatorName":"Masakatsu, Nishigaki","creatorNameLang":"en"}],"nameIdentifiers":[{}]}]},"item_4_source_id_9":{"attribute_name":"書誌レコードID","attribute_value_mlt":[{"subitem_source_identifier":"AA11235941","subitem_source_identifier_type":"NCID"}]},"item_4_textarea_12":{"attribute_name":"Notice","attribute_value_mlt":[{"subitem_textarea_value":"SIG Technical Reports are nonrefereed and hence may later appear in any journals, conferences, symposia, etc."}]},"item_resource_type":{"attribute_name":"資源タイプ","attribute_value_mlt":[{"resourceuri":"http://purl.org/coar/resource_type/c_18gh","resourcetype":"technical report"}]},"item_4_description_7":{"attribute_name":"論文抄録","attribute_value_mlt":[{"subitem_description":"ボットは巧妙な手段で PC 内に潜伏するため正規プロセスとの切り分けが難しく，ボット検知のためにはボットの本質を捉えたビヘイビアの発見が求められる．そこで本研究では，ボットの多くがシステムフォルダ内への侵入と指令に従った攻撃という二つの挙動を併せ持つという特徴に注目した．ボットは自分の実行環境に応じて自らの振る舞い （侵入と攻撃） を変える．本稿では特に，ボット自身が潜伏先フォルダ内に存在するか否かによってボットの侵入／攻撃の挙動が変化することを利用し，実行場所による挙動変化を特徴的なビヘイビアとしてボット検出を行う方式を提案する．","subitem_description_type":"Other"}]},"item_4_description_8":{"attribute_name":"論文抄録(英)","attribute_value_mlt":[{"subitem_description":"Because of bot's sophisticated techniques for hiding itself, it is difficult to distinguish the bot's malicious process from legitimate process. Hence it is quite essential for bot detection to find bot's inevitable behaviors. In this paper we focus on the fact that almost all bots have both behaviors of intrusion and attack to achieve their aim, and creatively use both behaviors depends on their execution environment. Thus, we propose a new bot detection scheme which is based on bot's behavior changing according to execution environment. At the first step of the research, this paper discusses to detect bots by checking if their behavior is different when they are residing inside or outside of the system directory on the OS.","subitem_description_type":"Other"}]},"item_4_biblio_info_10":{"attribute_name":"書誌情報","attribute_value_mlt":[{"bibliographicPageEnd":"6","bibliographic_titles":[{"bibliographic_title":"研究報告コンピュータセキュリティ（CSEC）"}],"bibliographicPageStart":"1","bibliographicIssueDates":{"bibliographicIssueDate":"2009-06-25","bibliographicIssueDateType":"Issued"},"bibliographicIssueNumber":"16","bibliographicVolumeNumber":"2009-CSEC-46"}]},"relation_version_is_last":true,"weko_creator_id":"10"},"id":62506,"updated":"2025-01-22T02:36:12.379607+00:00","links":{},"created":"2025-01-18T23:24:26.989472+00:00"}