Katsunari Yoshioka

Academic Background

Katsunari Yoshioka holds a Doctor of Engineering degree and is a professor at the Graduate School of Environment and Information Sciences and the Institute of Advanced Sciences at Yokohama National University (YNU), where he also serves as the university's Chief Information Security Officer. His research centers on network security, malware analysis, and honeypot-based measurement of large-scale attacks.

NICTER and Internet-Scale Monitoring

From 2005, Yoshioka was involved in NICTER (the Network Incident analysis Center for Tactical Emergency Response) at Japan's National Institute of Information and Communications Technology (NICT), a large-scale darknet-monitoring project designed to observe scanning and attack traffic across unused IP address space and detect emerging malware activity in near real time. That work gave Yoshioka's research group a long institutional grounding in measuring malicious traffic at internet scale before IoT devices became a major source of it.

IoTPOT: A Honeypot for IoT Threats

As Telnet-based attacks against IoT devices sharply increased from 2014 onward, Yoshioka and collaborators, including Yin Minn Pa Pa, Shogo Suzuki, Tsutomu Matsumoto, Takahiro Kasama, and Christian Rossow, built IoTPOT, a honeypot system designed specifically to attract and analyze these attacks. IoTPOT combined a lightweight, low-interaction frontend that mimicked vulnerable Telnet services with a backend called IoTBOX, the first malware-analysis sandbox built to execute captured IoT malware samples across multiple CPU architectures, including ARM, MIPS, and PPC. The team first presented the work at the USENIX Workshop on Offensive Technologies (WOOT) in 2015, with an expanded version later published in the Journal of Information Processing in 2016.

Findings and Significance

Over an 81-day operational period, IoTPOT logged 481,521 malware download attempts originating from 79,935 distinct IP addresses, and the researchers identified at least five distinct DDoS-oriented malware families targeting Telnet-enabled IoT devices, one of which had evolved to run on as many as nine different CPU architectures. This gave the security community concrete, measured evidence that a large and diversifying wave of IoT-targeting botnet malware was already active well before the Mirai botnet's public emergence in August 2016 made mass Telnet-based IoT compromise a headline-level internet security event; IoTPOT's methodology and data have been widely cited in subsequent research on IoT botnets.

Recognition and Continuing Work

Yoshioka received a Commendation for Science and Technology from Japan's Minister of Education, Culture, Sports, Science and Technology in 2009, and an award from the Minister of Internal Affairs and Communications in 2016 for distinguished industry-academia-government collaboration. He has continued to lead IoT and network security research at Yokohama National University, publishing further work on malware capability classification and large-scale device fingerprinting.

Impact and Legacy

IoTPOT's data and design became a reference point for the wave of research that followed Mirai, illustrating how honeypot-based measurement could reveal the scale of insecure, internet-connected embedded devices before those devices were weaponized into some of the largest DDoS botnets ever recorded.

Timeline

• 2005Began work on NICTER, NICT's large-scale darknet-monitoring project for internet-wide attack traffic, at Yokohama National University.
• 2009Received Japan's Commendation for Science and Technology from the Minister of Education, Culture, Sports, Science and Technology.
• 2015Presented IoTPOT, an IoT-specific honeypot and malware-analysis sandbox, at the USENIX Workshop on Offensive Technologies (WOOT).
• 2016Published an expanded IoTPOT paper in the Journal of Information Processing; received a Minister of Internal Affairs and Communications award for industry-academia-government collaboration.
• 2016-08The Mirai botnet's public emergence brought mass exploitation of Telnet-exposed IoT devices — the same threat class IoTPOT had already documented — to global attention.