As several home appliances, such as air conditioners, heaters, and refrigerators, were connecting to the Internet, they became targets of cyberattacks, which cause serious problems such as compromising safety and even harming users. We have proposed a method to detect such attacks based on user behavior. This method models user behavior as sequences of user events including operation of home IoT (Internet of Things) devices and other monitored activities. Considering users behave depending on the condition of the home such as time and temperature, our method learns event sequences for each condition. To mitigate the impact of events of other users in the home included in the monitored sequence, our method generates multiple event sequences by removing some events and learning the frequently observed sequences. For evaluation, we constructed an experimental network of home IoT devices and recorded time data for four users entering/leaving a room and operating devices. We obtained detection ratios exceeding 90% for anomalous operations with less than 10% of misdetections when our method observed event sequences related to the operation. In this paper, we also discuss the effectiveness of our method by comparing with a method learning users’ behavior by Hidden Markov Models.

Distributed denial-of-service attacks on public servers have recently become more serious. More are SYN flood attacks, since the malicious attackers can easily exploit the TCP specification to generate traffic making public servers unavailable. To assure that network services will not be interrupted, we need faster and more accurate defense mechanisms against malicious traffic, especially SYN floods. One of the problems in detecting SYN flood traffic is that server nodes or firewalls cannot distinguish the SYN packets of normal TCP connections from those of SYN flood attack. Moreover, since the rate of normal network traffic may vary, we cannot use an explicit threshold of SYN arrival rates to detect SYN flood traffic. In this paper we introduce a mechanism for detecting SYN flood traffic more accurately by taking into consideration the the time variation of arrival traffic. We first investigate the statistics of the arrival rates of both normal TCP SYN packets and SYN flood attack packets. We then describe our new detection mechanism based on the statistics of SYN arrival rates. Our analytical results show that the arrival rate of normal TCP SYN packets can be modeled by a normal distribution and that our proposed mechanism can detect SYN flood traffic quickly and accurately regardless of time variance of the traffic.

Subjective well-being (SWB) describes how well people experience and evaluate their current condition. Previous studies with electroencephalography (EEG) have shown that SWB can be related to frontal alpha asymmetry (FAA). While those studies only considered a single SWB score for each experimental session, our goal is to investigate such a correlation for individuals with a possibly different SWB every 60 or 30 s. Therefore, we conducted two experiments with 30 participants each. We used different temperature and humidity settings and asked the participants to periodically rate their SWB. We computed the FAA from EEG over different time intervals and associated the given SWB, leading to pairs of (FAA, SWB) values. After correcting the imbalance in the data with the Synthetic Minority Over-sampling Technique (SMOTE), we performed a linear regression and found a positive linear correlation between FAA and SWB. We also studied the best time interval sizes for determining FAA around each SWB score. We found that using an interval of 10 s before recording the SWB score yields the best results.

A disaggregated data center (DDC) can efficiently use resources such as CPU and memory. In a DDC, because each resource is independent and connected by a network, communication between resources is required for task execution. Communication delays can be an overhead for task execution, causing performance degradation. Because communication delays depend on the correspondence between resources on the network and the paths over which they communicate, an efficient resource allocation method is required to determine this relationship. Herein, we propose a resource allocation method called RA-CNP to execute many tasks simultaneously while satisfying performance requirements. This method models the impact of the network on the performance of tasks for the provided service. Furthermore, this method defines a resource allocation problem to avoid the allocation of resources that will be requested in the future. We evaluated the effectiveness of our method by simulating various DDC networks, assuming a DDC at the edge. The results demonstrated that RA-CNP could execute more tasks than conventional methods could, without violating performance requirements, based only on current network information in both networks configured by circuit and packet switches. RA-CNP could allocate resources in less than 10 s, even in a relatively large network configured with 64 switches; this capability demonstrates its practicality.

Recently, artificial intelligence (AI) based on IoT sensors has been widely used, which has increased the risk of attacks targeting AI. Adversarial examples are among the most serious types of attacks in which the attacker designs inputs that can cause the machine learning system to generate incorrect outputs. Considering the architecture using multiple sensor devices, hacking even a few sensors can create a significant risk; an attacker can attack the machine learning model through the hacked sensors. Some studies demonstrated the possibility of adversarial examples on the deep neural network (DNN) model based on IoT sensors, but it was assumed that an attacker must access all features. The impact of hacking only a few sensors has not been discussed thus far. Therefore, in this study, we discuss the possibility of attacks on DNN models by hacking only a small number of sensors. In this scenario, the attacker first hacks few sensors in the system, obtains the values of the hacked sensors, and changes them to manipulate the system, but the attacker cannot obtain and change the values of the other sensors. We perform experiments using the human activity recognition model with three sensor devices attached to the chest, wrist, and ankle of a user, and demonstrate that attacks are possible by hacking a small number of sensors.

Although the use of software-defined networking (SDN) enables routes of packets to be controlled with finer granularity (down to the individual flow level) by using traffic engineering (TE) and thereby enables better balancing of the link loads, the corresponding increase in the number of states that need to be managed at routers and controller is problematic in large-scale networks. Aggregating flows into macro flows and assigning routes by macro flow should be an effective approach to solving this problem. However, when macro flows are constructed as TE targets, variations of traffic rates in each macro flow should be minimized to improve route stability. We propose two methods for generating macro flows: one is based on a greedy algorithm that minimizes the variation in rates, and the other clusters micro flows with similar traffic variation patterns into groups and optimizes the traffic ratio of extracted from each cluster to aggregate into each macro flow. Evaluation using traffic demand matrixes for 48 hours of Internet2 traffic demonstrated that the proposed methods can reduce the number of TE targets to about 1/50 ~ 1/400 without degrading the link-load balancing effect of TE.