,(2;3'.*8/+671'
/90;-94.)5

1330;1410

20181217

,(2;$#"&!%$/+671' ,(2;:/+671' r.sasaki@mail.dendai.ac.jp132&#+1 
42  ! 52! 
523 AI(%-.*"
524 IoT(%-.*"
62&#+1,"'$/(%-.*"(0)1  
2

OJWaC&gRL]^TIB?=>C-CSaV`NZJ`Uh2000 ,2A@CYa[XaPC<G2000
%HMRQ+$'12000
JNSA)5bfddeNPO c2001 Code Red;SircumBEF32001
:/'12001ilnkmljib 2 4c)5gRL]^TIB?=>C-CSaV`NZJ`Uh2010 StuxnetC ((6 9#DC)2011
KJ_Q.12011 07A@DC"*\a_2015 8#!DC3

 

20001
Referencehttp://www.kogures.com/hitoshi/webtext/sec-husei-access/homepage.html
4

OJWaC&gRL]^TIB?=>C-CSaV`NZJ`Uh
2000 ,2A@CYa[XaPC<G2000
%HMRQ+$'12000
JNSA)5bfddeNPO c2001 Code Red;SircumBEF3
2001
:/'12001
ilnkmljib 2 4c)5gRL]^TIB?=>C-CSaV`NZJ`Uh2010 StuxnetC ((6 9#DC)2011
KJ_Q.1
2011 07A@DC"*\a_2015 8#!DC
5nMP^kbjZgVjaP)=3(^kbjZgV
jal2000KTm

3(^kbjZgV
jal2010Bm

0/C.

F5

% lC.
F5FHA JFP2m

6c_XklYh_Xkm

c_XkFcY`Ue\aF,4
6F\dVF<;

WEBONP7IT@:VjfhRoStuxnetp

+&/oStuxnetF]bkF
8@F !A'$pkkE oStuxnetF]bkF
8@F>#*-1 p

d^kj9"PID?OSFLGQVjfiWj[632&#+1 42  ! 52! 523 AI(%-.*"524 IoT(%-.*"
62&#+1,"'$/(%-.*"(0)1  7

()43

98$/

:8$/ / =>1/
;8%/ PC.-'2IoT.-0<8#/ 7&" !/&65,*+/ 8

.,580$!"., K/>J6PMYTNUO7F\^
4 %E ;H&]_[$E.,<!D" =?C#)=?5%F4 I:>GAE.,E 1K=?50;H!LOSRE-<8I4QMWZE '<8J51(C+*D =?5!" =?EF4.,E6VX7B42;@A9?3<" =?5

<2018127
https://mainichi.jp/articles/20180127/k00/00m/040/260000c
9

()43

98$/

:8$/ / =>1/
;8%/ PC.-'2IoT.-0<8#/ 7&" !/&65,*+/ 10!       "11()43

98$/

:8$/ / =>1/
;8%/ PC.-'2IoT.-0<8#/ 7&" !/&65,*+/ 12,.-•  #'• • *+%"$
&+$(+!•  ()
13+!DAVO[c=1404 +20151223@-PU_OX#&A'ObMcZd\_aScPWU %=1404 +7E79. +"B)A5>=794-5K4BVO[c@HJGA=/BlackEnergy0>CKJ]`PQNL29^Z=1J5>
4I3@?:<2E8.
5KBPU_OXARY`Tc 4379GA. 3IOa\_L:9VO[c@;2<B$(4,I6K<2E794-BVO[c4*@ 79F<72=8.
http://gigazine.net/news/20160106-blackenergy-trojan/

14,.-•  #'• • *+%"$
&+$(+!•  ()15,*

• Blackhat2015%Charlie Miller&Chris Valasek#5B;*71@63B*/ +<0>.$ "9A8>
:?B3*
!*2A
5A*('140>)*=4B

https://blog.kaspersky.co.jp/blackhat-jeep-cherokee-hack-explained/8480/

16IoT (*#• WEB') +.!IoT 
•  ,&"$%"- 

17

IoT$DDoS
0Mirai!#DDoS/20171telnet!"#IoT
-+'(.

DDoS%,)

620Gbps

DDoS-Dissributed Denial Of Service.
.

-%,*&18

FUZ>L@_]6-19!
•  .8%)24'`7 'X_C_+T;_?@>HUAWEI,7\_K_a/<X[C5 6
606O_K&7• 7IV_PTB]X_C_Coolpad/"(39>A]Q1Android6SMEQ<$ /#7R

https://www.ipa.go.jp/files/000044089.pdf

NEDO5FUZ>L@_]GIN
W7+IoT624F>S_^T=HC\^JDY[N=,:*19()43

98$/

:8$/ / =>1/
;8%/ PC.-'2IoT.-0<8#/ 7&" !/&65,*+/ 20

Verizon2018CGBF&
IKJ 776H/()> .! 56AE?20H,10HILJ @?DG7473I73HJ/ '7%6;<:7I LMH8'7*/+J-27.
4/$"#/+0<:7-12H/ 9382=61<"#/+0<:7verizonenterprise.com/jp

21
WQ_kE21! (BA@O?MJDH7=@%ML>7K3
4*WQ_kCE20 ' G0 ' =;?B
:-N"8+,GVi`fkYR
QhXD )&N"8+,F6K@78$F<L>7K35[1]
ZkTRSbDBAlnmckTjU\]ci4afk[ekTgQd WQ_k9ID
.#c^fPh5/ 220162p193pp186-294

22
32&#+1 
42  ! 52! 
523 AI(%-.*"
524 IoT(%-.*"
62&#+1,"'$/(%-.*"(0)1  
23






Application Area

Machine Learning

Basic Area

http://www.ai-gakkai.or.jp/whatsai/AIresearch.html



24

 AI
 



• (a) Attack using AI AI • (b) Attack by AI AI 
• (c) Attack to AI AI
• (d) Measure using AI AI 

25

4;?3:.Fde( XTUG3:+M_N`U@SLTU@$.

C@B) XTU@HJQP'@6C?+M_VZ`R0#G<4F!>=G* deG3:!@#G 256E/;-Fa20188@I`W\PNIU;@L`P;ASLTU%@HJQP@/89 &0bot796<./,bXTUc@RPJDG
4F6C@HW]L`
O[_W^K\Y@1<,XTUA^XTU@",26

 

http://eplus.jp/sys/main.jsp
27


http://atom.eplus.jp/sys/main.jsp?prm=U=82:P6=001:P1=0375:P2=000376:P5=0001:P7=1:P0=GGWC01:P3=0144&_ga=2.43604771.767253417.153508888928
1294490883.1535088889

"2OAI)4HI>@=MN HI>@=( )&13!+;7-&$
PQ 55C&CBLG'8C>KJLF$
PQ **04799(D?EA+;:( &$PQ 5#+2%4HI>@=(&.6&$3, ./"2< RMalware
ACollaborative
WorkMalware
CHow do you think ?

MalwareB

Multi-Agent29

AI
 



• (a) Attack using AI AI • (b) Attack by AI AI 
• (c) Attack to AI AI
• (d) Measure using AI AI 

30

AIU

rus

ut8\Z0\!LZ%$F2(J"*T8F.'IMY[ZRVSBE>ry) wxU 7&v; GoogleU,-/Um^p_qln^ev2045TV+0U
0F=8\56LZcoaijkf]F(K= LY4GZEXJ[SB< df]qgophq`obv+0U)V:  U
"OPN>OF T? @U"TSPQJWC 0XAZ
rzs wxU 9&v+0U#3V=1?+0V
8\5DZE@TBQ=8TJQ \4HL 0\ 31

https://ja.wikipedia.org/wiki/+0AI 

• (a) Attack using AI AI • (b) Attack by AI AI 
• (c) Attack to AI AI
• (d) Measure using AI AI 32

AIHG
0 (SUW[GKYPQ]4-,
G&J ;EDGbSUW[HGC<1 )'!J\X]G+/O*$=N

2 (F=N@?)'X_VO%F7N
ED8B4. E O:>A;I653 (\X]HX_VO
=N9CFLMO":>N`)'X_V4 #R^T^EDa
https://news.yahoo.co.jp/byline/endohomare/20170806-00074210/
OZ_UF

33   !
"Adversarial#Example!





Ian J. Goodfellow, Jonathon Shlens, Christian Szegedy“Explaining and Harnessing Adversarial Examples”
https://arxiv.org/pdf/1412.6572.pdf

34

AIHG
0 (SUW[GKYPQ]4-,G&J ;EDGbSUW[HGC<1 )'!J\X]G+/O*$=N

2 (F=N@?)'X_VO%F7N
ED8B4. E O:>A;I653 (\X]HX_VO
=N9CFLMO":>N`)'X_V4 #R^T^EDa
https://news.yahoo.co.jp/byline/endohomare/20170806-00074210/
OZ_UF

35

?J<4(3KData Poisoning Attacks/M• D57H;B@/=E>@C>@"Tay#0 7G6A;
J:I84',&)*!
•4+*FJ9%', - 42'• Tay0 42(1$.
LM-?J</ 36

AIHG
0 (SUW[GKYPQ]4-,
G&J ;EDGbSUW[HGC<1 )'!J\X]G+/O*$=N

2 (F=N@?)'X_VO%F7N
ED8B4. E O:>A;I653 (\X]HX_VO
=N9CFLMO":>N`)'X_V4 #R^T^EDa
https://news.yahoo.co.jp/byline/endohomare/20170806-00074210/
OZ_UF

37AI 

• (a) Attack using AI AI • (b) Attack by AI AI 
• (c) Attack to AI AI
• (d) Measure using AI AI 38

AI for measures against Cyber Attack 

http://it-trend.jp/cyber_attack/article/use_of_ai

39



Artificial Intelligence

Application Area

Machine Learning

Basic Area

http://www.ai-gakkai.or.jp/whatsai/AIresearch.html

40 Google Scholar 
Cyber Security AND AI Number
8000
7000
6000

 5
  

5000
4000

Number

3000
2000



1000
0

1
2007

208

309

4
10

5
11

6
12

Year

713

8
14

9
15

16

10

41

Survey Results using Google
Scholar 

Cyber Security AND Artificial Intelligence
17,700 Ryoichi Sasaki
5010    

42

AI

&".0(• ,1 !• 2$ 3•  • )/+'# 3• &".0(• %*- • 43
243    C&C!1)"$&,
253 -1-+1$"$&,+#0(%'/1 (%'/1 *.0#% "$&,44

!8'%IG&,
;&,ekh5
lTSh[Amp nq@Moo!8'%
41246cRh]gjX

1=C&C >"G
YkbD l03nm
C&CYkb GLNN< *cPShO9FEst"liW^j^U_WO
BCK#-
2m

Z[`dl.:
VjfSjZ[`dm"PC+ )7$1
Ykbl4Jm"PC?
 lak]G(/mQW\[ 81 l0125r31H0101m#.
7-A,lt`zW@P\GoogleYDN}
CYWhoisVUX Bpycf{e{oJ[RHM
ITORH\lt`zX

-A

VirusTotalTHIDB^ 2OQ*3!
sxab_X6X6X B
3;%WZ\C&Ce{olt`zXTGoogleYDNSYWhoisVUX B+(7i{x|er{kqdg{sfz/ mv{wxnhkujx
C&Ce{oSG\9KH
W_w{k)5098.9%

4C&/? CD$:E! 8W5N]WLH^2HQC&Ce{oX)5.X
'T<F1>"=,Vol.58,No.9,pp1410-1418,201746FDMNHB;
A-@ &( ECJQ:9<=:1+IQG07:0,@) KGQP0%88>;0,@3+-IQG0/:-* ;+0
LIOA56+,/6+'A%$/@?.; 4@280!7,@:LIO<"0#47


465
  C&C#3+
 98.9%$&(.
475 /3/-3&$&(.- %2*')13"*')13",!02%'"$&(.

48LIFTmqc^`j\1H
TJ<&#bdin?LU65KL?L
7;R9
VLIFTbdint3>'$
E OMr%_]kbdinu
tvu-4DxAI"F\twuN
xmqed=I4DW[ZAqa0?bdinpsg

P=mqc^`j toshX,W:WS:W 2:W/:W)Bu +Qx20139*s20183*tC+u49
86Y\[!.xT (@BmqjP= Umqed=IfljG

LIFT

I@A?KGCF>/<• I@A?KGCFMAI6( #4ELB#
• DLHJ:;I@A?KGCF6+")!+ 3,<– -=2)5)4)* >3,<–+-=04,&%.0967'&%.2)5)96+ /<4)* 8+12)<NDLHJO

NI@A?KGCFO$10.10

$2 0.10

12

$1

$1

$2

0.80



0.90



0.20





0.80





0.80



 0.2051





LIFT



Ryoichi Sasaki et al.Development and Evaluation of Intelligent Network Forensic System LIFT Using Bayesian Network
for Targeted Attack Detection and Prevention International Journal of Cyber-Security and Digital Forensics (IJCSDF) 7(4):pp344-353, 2018to appearDBILECJKGA6AI
9$!8$/?
MON Cybersecurity 8$.4<%HLF+'>%AI9135'? +*?=)7:5<&12.% 8 +
MPN HLF+7(8 .4: ,;-;
7+
MQN (0@8.4<%DBILECJKGA9AI
: <"7#53
32&#+1 
42  ! 52! 523 AI(%-.*"
524 IoT(%-.*"
62&#+1,"'$/(%-.*"(0)1  54

IoT C^-`_)C2% \246 749@
^-a_IoT  CWJUNJMY6.49@^-b_IoT  B;F"+6*77B849@^-c_IoT  @TPRZ]MCDC#,6?3F9@^-d_IoT  C(\(60EG>4F9@^-e_/!'6:>4A5=<&6*HG
F(63F9@
$6 1
IoTOLVXQIKJSWJ[ 287
http://www.soumu.go.jp/main_content/000428393.pdf

55

IoT%E,BHDG1"
IIoT45:A=9<F|0$' !6/CD:+ $#(J3H?5E,BH
;H7
E,BH

=9<FH
0E,BH
;>,
5E,BH

%IoT


%%#&)

6/C*
2H<.,6/C*89@

 
IoT45:A IoT45:A
56

&$IoT! cdlyM2$IAW}da/"N5'8 e`{}l[;esl[;z\lor}l[LK%LW Y?-@=W  }davdN+( Y$  JLW6Sq{x^|GCILBb\pMTWRNR+(M.1IAW_\nlu~\mN
9 IoT! cdlyO*Y P;NZgjak}NT?LRNGCIOesl[N/@ 7 MITNoc~tfNSTAMP/STPA"e`{}l[O0Y,DH$: }daY/EWFQMO>X>XLZui@=V;4)@=W  3(ZuiJ#3(ZuiN+
 wmyZjuZuiJmjuh]ZuiN+
<U@5'

57

#-,$), '(!$*-%+-3&") . 3&")

http://www.meti.go.jp/press/2018/10/20181001004/20181001004-3.pdf

58

IoT,S6NQV<)
S6NW



%/21YX?WKBS6NW

MP6J@WL5F@V<# >VHTWR+*ZXGWDS6NWGWD, )
JF;4FM$&3# GADRL9SVAF;+*[XIFHUW;S6NW !+GWD,L5R C:O4=WH786
DQV<$ , "+*\XGJ6BS6NW

CV?W.4;EO8W C:O4EFM+*
D+*,+0(-'#59NEDO 

http://www.nedo.go.jp/content/100863674.pdf

60

32&#+1 
42  ! 52! 523 AI(%-.*"
524 IoT(%-.*"
62&#+1,"'$/(%-.*"(0)1  61

7/• B>LT1 4&$.8
•  .E@OPH= "2'2'/
• KTJSFMIS<QAPDN.-/
;+B>LTM=C?QE@OPH=
ERGT/ '8401• 0*%,1.$)96;!2$
3:(57#. /6263