1 Introduction

As a result of recent advances in three-dimensional (3D) video technology and stereo sound systems, virtual reality (VR) has become a familiar part of people’s lives. Concurrent with these advances has been a wealth of research on touch interface technology [1], and educators have begun exploring ways to incorporate teaching tools utilizing touch properties in their curriculums [5, 6]. However, when used as teaching tools, it is important that a touch interface provide a “feel” that is as close to reality as possible. This will make replacing familiar teaching tools with digital media incorporating VR seem more attractive.

For example, various learning support systems that utilize virtually reality (VR) technology [7] are being studied. Examples include a system that utilizes a stereoscopic image and writing brush display to teach the brush strokes used in calligraphy [8, 9], the utilization of a robot arm with the same calligraphy learning system [10], a system that uses a “SPIDAR” haptic device to enable remote calligraphy instruction [11], and systems that analyze the learning process involved in piano instruction [12] or in the use of virtual chopsticks [13].

Additionally, since it is a basic rule of pen-drawn characters that even a slight displacement of the pen tip is impermissible, pen-drawn character reproductions must be within 1 mm tolerances and will appear out of balance if drawn too long or too short. In response, support system ems for penmanship instruction and similar applications on tablet PCs have been developed [14], and associated research indicates that both the curriculum and content are important factors for creating VR materials [5]. Penmanship instruction systems and similar applications using interactive haptic devices connected to networks have been devised, and various experiments have been performed into their usage [15]. To facilitate the passing down of technical skills, various operations have been analyzed and the application of those analyses is being investigated. Soldering work by skilled workers and unskilled workers is also being analyzed. (1) For workers having a certain amount of experience, there is diversity of right wrist motions. (2) For beginners, various soldering iron insertion angles and motions of each wrist, and a tendency for instability are observed. (3) For skilled workers, the soldering iron insertion angle and wrist motions are stable, and soldering is completed in nearly a single operation. On the basis of the above, the soldering iron insertion angle, wrist motion stability, and the timing with which to remove the soldering iron are suggested to be three operation characteristics [21].

It can be seen that the number of users who feel a difference in the program begins to increase when, due to delays, the haptic–visual data time difference begins to exceed 10 ms or the haptic–auditory data time difference begins to exceed 40 ms. Visual sense is said to have a greater impact than auditory sense, and that statement is consistent with these findings. Moreover, for visual sense, there exists research showing that people begin to sense network latency when the delay reaches approximately 30 ms, and this is consistent with the finding that 50% of the test subjects began to feel a difference at this level [22].

Cyber attacks use several methods and threaten social infrastracture. Especially, malware is highly sophisticated to steal more valuable information, and the victimes are not aware of it’s infection. Thus, it is difficult to detect and distinct malware infections by physical sence. Kaneko’s paper [16], we geographical visualize malware’s attack point with CCC DATAset 2011’s Attack-Connection Data and Attack-Source Data, and creates support system for integrate analysis malware to obvious attacker’s purpose. The antivirus software, which is one of the security technology, can analyze the network and detect an information leakage and killer virus software. If malware is detected in the network, visualization of security technology enlighten them. Haptization of security technology has most been reported previously. However, no study has been found so far as to the integration of security technology with hapitization and visualization of them. Accordingly, we developed the system which analyze an IP address to cope with an attack to Web and can express the offensive ability from an opponent sensuously in haptic devices.

2 Apparatus

Haptic device is PHANToM Omni (Omni) made by SensAble co., Ltd. The personal computer controlling the system have Intel corei7-2600 CPU@3.40 GHz, 4 GB memory and Windows7 Professional. The system was developed by Microsoft VisualC++ 2008. The library used Open Haptics and WinPcap. Open Haptics control Omni. Figure 1 shows the PHANToM omni.

Fig. 1.
figure 1

PHANToM omni

Full size image

3 System Overview

The system consists of 4 blocks: ①capture, ②analyze, ③draw and ④provision. The first block captured packets. The system automatically captured packets using WinPcap. The second block analyzed the packets. The captured packets searched an IP addles and time to live (TTL). The third block drew the packet flow image. This image is important for feeling feedback force. The fourth block provisioned a feedback force with user. User touched the image by moving the haptic device. At that time, the user could sense packet volume.

It is known that an IP packet passes through less than 30 routers before it reaches the destination host. According to our observation, some IP packets have an abnormal TTL value that is decreased more than 30 from the initial TTL. These packets are likely to be generated by special software. We assume that IP packets with a strange TTL value are malicious. Yamada’s paper investigates this conjecture through several experiments. As a results, we show that it is possible to discriminate malicious packets from legitimate ones only by observing TTL values. The system analyzed the TTL according to the criterion employed in the previous study used [17], which reports that a pop count over 50 is judged as abnormal packet. This paper employs this calculation method.

4 Experiment

We began by modeling images of the surface texture for notebook and other paper types using friction experiments. When creating friction via the haptic display, it was first necessary to determine what level of friction was discernible. Weinstein and Weber [18, 19] report that Weber ratio of the haptic is about 0.2. However, Omni provision force is not necessarily liner. We apply the function from 0.0 to 1.0 in this paper. The extremes of 0.0 and 1.0 are excluded from the unit of force. The rest is called haptic force level in this report. Thus, this experiment estimated determination criteria of the haptic force by using discriminated packet volume of touch.

Measurements were performed using one test subject at a time. The subject was seated in front of the PHANToM unit and given the pen component to hold. They then followed instructions displayed by the computer and moved their arm to draw a straight line on the model board using an arbitrary amount of force. Subjects were then asked to evaluate a total of 50 randomly presented stimuli combinations comprising five combinations, including an SS pair, each shown 10 times. As the PHANToM only guarantees forces up to 3.0 (kg-m/s2) (3.0[N]) [2], the unit was restricted because the application of normal force greater than this level would not register.

Figure 2 shows the experiment system window. It has right and left areas. Both areas show difference forces. Taking the stylus of Omni, subjects move in the system window. The one side has a standard stimulus. The other side shows 4 comparative stimuli and a standard stimulus. In total, 5 different stimuli are displayed on the screen. Participants compare right area force and left area force. They answer one of the three choices, “stronger right force”, “same” or “stronger left force”. The answer data were processed by maximum likelihood method [3, 4].

Fig. 2.
figure 2

Experiment system window

Full size image

5 Experimental Results

The stimulus on which comparisons were based was called the standard stimulus (SS). For frictional forces, the SS was limited to one type of stimulus with a fixed range of physical quantities. The stimulus used for comparison with the SS was called the comparative stimulus (CS). A number of CS types were prepared in incremental quantities centered on the stimulus quantity of the SS.

Measurements were performed using one test subject at a time. The subject was seated in front of the PHANToM unit and given the pen component to hold. They then followed instructions displayed by the computer and moved their arm to draw a straight line on the model board using an arbitrary amount of force.

Fourteen people participated as test subjects, with age ranging from 18 to 21 years. The standard stimulus applied to this experiment was the 0.4 amplitude stimulus, and five types of comparative haptic stimuli ware presented, from 0.0 to 0.8 in step of 0.2. Table 1 shows the measurement example. The horizontal axis indicates the presented stimulus values and the vertical axis indicates the determination probability. Data values are represented with small circles: a green circle is a determination of “weaker than the standard stimulus” (a > xi), a purple circle is a determination of “same as the standard stimulus” (a ≈ xi), and a blue circles is a determination of “stronger than the standard stimulus” (a < xi). The curves show determination probabilities based on parameter values obtained from experimental data.

Table 1. Example of reaction force experiment
Full size table

The standard stimulus has an amplitude of 0.4, the point of subjective equality is 0.44. There is little error between the standard stimulus and the point of subjective equality. Moreover, the amplitude threshold for which a test subject can perceive differences in haptic sensation is said to be within the range of 0.395 to 0.485. However, since the change in amplitude was large, there was sufficient width to distinguish the stimuli. Figure 3 shows the Result of maximum likelihood method.

Fig. 3.
figure 3

Analysis results for reaction force experiment (Color figure online)

Full size image

6 System Prototype

The system can analyze packets and provision user a reaction force. Figure 4 shows the system. The center denotes personal computer to control the system. Lines which lengthen from the center is network image. The blue cone is the pointer which a user moves. Figure 4 demonstrates the system automatically captures packets. The IP address is represented as numbers near the line.

Fig. 4.
figure 4

Basic system by captures packets (Color figure online)

Full size image

When a user touch the line and press a button in Omni, the user sense the force like packet volume. Haptic force level and line color are provided in Table 2. Color difference represents the preference about temperature according to the study [20], which states about emotional color. We used technique [17] that a pop count over 50 is regarded as abnormal packet.

Table 2. Parameter values for reaction force experiment
Full size table

Discriminant expression was calculated with the five-day experiment on the data of packet volume. First, we recorded the number of transmission/reception times of packets. That unit is counted per minute. However, it is slow moving to provision force. Thus, we decided that we provision the updated data every 10 s. In addition, the value of discriminant expression was arranged described in Table 3 for simplicity.

Table 3. Discriminant expression, color and force level
Full size table

Next step, a visualization tool, which shows network traffic by a 2D plane of days and times, is shown. And we express the degree of threat by color, shown in Fig. 5.

Fig. 5.
figure 5

Color image (Color figure online)

Full size image

We propose a malware classification method that focuses on the network behavior of malwares. The behavior is translated into reaction force pattern. By modifying two-dimension time-day pattern algorithms, the behavior is analyzed to find out the most similar traffic data. We also performed evaluation by using reaction force traffic collected from the real environment.

The same system can analyze packets and provision user a reaction force. Figure 6 shows the new system. The center denotes personal computer to control the system. Blocks which lengthen from the center is network image. The blue cone is the pointer which a user moves. Figure 5 demonstrates the system automatically captures packets. The IP address is represented as numbers near the block number and color.

Fig. 6.
figure 6

View of new system image (Color figure online)

Full size image

When a user touch the block and press a stylus button in Omni, the user sense the force like packet volume. Haptic force level and block color are provided in Table 3 by same. A visualization tool, which shows network traffic by a 2D plane of days and times, is shown.

The unit of system provisioning force should also be newton. We propose about the representation scheme of the relationships between reaction force and functions in a program. Figure 7 shows the experiment results.

Fig. 7.
figure 7

The relationships between reaction force and functions value in a program

Full size image

7 Conclusions

In this system can analyze packets and provision user a reaction force. The center denotes personal computer to control the system. Lines which lengthen from the center is network image. The blue cone is the pointer which a user moves. The system automatically captures packets. The IP address is represented as numbers near the line.

The same system can analyze packets and provision user a reaction force. When a user touch the block and press a stylus button in Omni, the user sense the force like packet volume. Haptic force level and block color are provided. A visualization tool, which shows network traffic by a 2D plane of days and times, is shown.

Discriminant expression was calculated with the five-day experiment on the data of packet volume. First, we recorded the number of transmission/reception times of packets. That unit is counted per minute. However, it is slow moving to provision force. Thus, we decided that we provision the updated data every 10 s. In addition, the value of discriminant expression was arranged described in simplicity.

Next step, A visualization tool, which shows network traffic by a 2D plane of days and times, is shown. And we express the degree of threat by color.

We propose a malware classification method that focuses on the network behavior of malwares. The behavior is translated into reaction force pattern. By modifying two-dimension time-day pattern algorithms, the behavior is analyzed to find out the most similar traffic data. We also performed evaluation by using reaction force traffic collected from the real environment.

The system can express packet volume in reaction force. Nevertheless, the present system does not confirm bite size. Therefore, the system provisioned force after assessing packet volume and bite size. Furthermore, discriminant expression was determined under personal experimental environment. It needs to be generalized to other environments. Next step, A visualization tool, which shows network traffic by a 2D plane of days and times, is shown. And we express the degree of threat by color. The unit of system provisioning force should also be newton. These are the issues for our future research.