Data Driven Cybersecurity Research in NICT Daisuke INOUE Cybersecurity Laboratory Cybersecurity Research Institute National Institute of Information and Communications Technology (NICT) 1 NICTER Network Incident analysis Center for Tactical Emergency Response NICT - the sole national research institute in the field of ICT in Japan - l ICT for sustainable world and human happiness l Promoting its own research and development l Cooperating with and supporting industry and academia 2 NICTER Network Incident analysis Center for Tactical Emergency Response Research Topics in NICT Japan Standard Time (JST) Optical Communication Satellite Communication Science Cloud Remote Sensing （Leap second on Jan 1, 2017） (Peta bps class multi-core fiber) （Internet Satellite WINDS） （Reai-time Web of Himawari-8） （Pi-SAR2 image after 3.11） Bio/Nano ICT Brain ICT Multi-lingual Machine Translation Ultra Realistic Communication Cybersecurity (Self-organizing bio molecule) (Brain-machine Interface) (VoiceTra) (Electronic Holography) (DAEDALUS) 3 NICTER Network Incident analysis Center for Tactical Emergency Response Cybersecurity Research is ... Data Driven Research üreal-time data collection üreal-time data analytics üno data no cybersecurity research 4 NICTER Network Incident analysis Center for Tactical Emergency Response Research Map of Cybersecurity Laboratory in NICT Network Incident analysis Center for Tactical Emergency Response Passive NICTER Real-network Visual ANAlyzer KAI NICTER NIRVANA改 Direct Alert Environment for Darknet And Livenet Unified Security NICTER Real-network Visual ANAlyzer KAI-II DAEDALUS Dark net NIRVANA改弐 Live Blogs net DNS News DB Asset Proxy Info From Security Big Data Log Vulnera Honey lobal (indiscriminate attack) bility pot (targeted attack) ocal G CURE L Amp Alerts Pot Honeypot for Amplification Attack # IoT AmpPOT Events PoT To Security Intelligence Mal Honeypot for IoT Malware ware SPAM (result) Mal Web # ware Crawl (exe) C&C IoTPOT DBD Web-based Attack Response with Practical URL Large-scale Deception Framework and Deployable Research InitiatiVE Cybersecurity Universal REpository STARDUST (Commission Research) 5 NICTER # Collaborative research with Yokohama National Univ. and Saarland Univ. Active Network Incident analysis Center for Tactical Emergency Response NICTER Network Incident analysis Center for Tactical Emergency Response 6 NICTER Network Incident analysis Center for Tactical Emergency Response NICTER - is an integrated security system for countering indiscriminate cyberattacks - based on a large-scale darknet monitoring, an automated malware analysis and their correlation 7 NICTER Network Incident analysis Center for Tactical Emergency Response Yearly Stats of Darknet Traffic (Last 10 Years) Number of packets par Number of IP address for Number of packets par 1 IP address Year year darknet per year 2011 4.54 billion 120 thousands 40,654 2012 7.79 billion 190 thousands 53,085 2013 12.9 billion 210 thousands 63,655 2014 25.7 billion 240 thousands 115,323 2015 54.5 billion 280 thousands 213,523 2016 128.1 billion 300 thousands 469,104 2017 150.4 billion 300 thousands 559,125 2018 212.1 billion 300 thousands 789,876 2019 322.0 billion 300 thousands 1,187,935 2020 500.1 billion 300 thousands 1,820,722 2,000,000 1,800,000 1,600,000 1,400,000 1,200,000 1,000,000 800,000 600,000 400,000 200,000 0 8 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 NICTER Number of packets per IP address per year Network Incident analysis Center for Tactical Emergency Response Top 10 Dst Ports observed by NICTER (2020) Port Number Target Service 23/TCP 23/TCP IoT (Web Camera, etc.) 16.3% 445/TCP Windows (Server Service) Web Server (HTTP) .8% 80/TCP 4 IoT (Web Interface) 445/TCP 3.1% 22/TCP IoT (Router, etc.) 2019 Other Ports 80/TCP 1433/TCP Windows (MS-SQL） 22/TCP 2.4% 62.9% 1433/TCP 2 8080/TCP IoT (Web Camera, etc.) 8080/TCP .2% 81/TCP 1.9% 81/TCP IoT (Home Router, etc.) 5555/TCP 1.9% 8545/TCP 5555/TCP Android (Set Top Box, etc.) 3389/TCP 1.8% 1.6% 8545/TCP Ethereum (Cryptocurrency) 1 .3% 3389/TCP Windows (Remote Desktop) 9 2020 NICTER Network Incident analysis Center for Tactical Emergency Response Practical Use of Darknet Monitoring Results l SIGMON (Special Interest Group of Network Monitoring) ü Partners: JPCERT/CC, IPA, @Police, NICT, Universities ü Sharing analysis results of darknet traffic (since 2004) l ICT-ISAC Japan ü ICT Information Sharing and Analysis Center ü Sharing DDoS related information (since 2011) l Information Sharing for Tokyo 2020 ü Preparation for Tokyo Olympic and Paralympic Games by NISC ü Sharing DDoS related information (since 2015) l Information Sharing for General Public ü NICTERWEB (http://www.nicter.jp/) NICTERWEB NICTER ü Report (http://www.nict.go.jp/cyber/report.html) https://www.nicter.jp/en ü NICTER Blog (http://blog.nicter.jp) 10 NICTER Network Incident analysis Center for Tactical Emergency Response NIRVANA改 (KAI) NICTER Real-network Visual ANAlyzer KAI 11 NICTER Network Incident analysis Center for Tactical Emergency Response NIRVANA改 - is an integrated security platform against APT - collects security alerts from many types of security appliances and end point security software 12 NICTER Network Incident analysis Center for Tactical Emergency Response NIRVANA改 System Overview NIRVANA改 = Traffic Monitoring + Alert Aggregation + Auto Actuation + Visualization NIRVANA改 Auto Actuation Commands Actuator DB Interface Access Visualization Engine Actuators Alerts Alert (FW, IDS, AV) Correlator Operator ・・・ Syslog Alert Security Alerts Appliances Aggregator Monitor Alerts End Point Anti-Virus Monitor Software End Point Information Traffic Traffic Monitor 13 Network NICTER Network Incident analysis Center for Tactical Emergency Response 14 NICTER Network Incident analysis Center for Tactical Emergency Response NIRVANA改 2019 - Security Orchestration @Interop Tokyo 2019 - l Alert generators: 23 appliances (12 companies) Vendor Name Product Name Vendor Name Product Name DAEDALUS FireEye NX5500 NICT CURE Flow FortiGate 3601E Future Vuls FortiGate 601E Fortinet FFRI yarai FortiSandbox 3000E TippingPoint TPS FortiDeceptor 1000F TippingPoint SMS Juniper Networks JATP400 TrendMicro Deep Discovery Inspector Lastline Defender Deep Discovery Analyzer PA-5280 Security Appliances Palo Alto Networks PA-5260 Check Point Smart-1 525 M-600 SandBlast TE2000X A10 Networks Thunder 3230 CFW DAMBALLA Network Insight 15 NICTER Network Incident analysis Center for Tactical Emergency Response Web-based Attack Response with Practical and Deployable Research InitiatiVE 16 NICTER Network Incident analysis Center for Tactical Emergency Response Indiscriminate Attack NICTER Web-based Attack DAEDALUS NIRVANA改 17 NICTER TargetedNetwork Incident analysis Center forAttack Tactical Emergency Response Web-based Attack Response with Practical and Deployable Research InitiatiVE A Tachikoma is a fictional walker with artificial intelligence (AI) from the Ghost in the Shell universe, appearing in the manga (created by Masamune Shirow) and in the Stand Alone Complex sub-universe. Nine of them are initially deployed to Section 9. They are spider-like, multi-legged combat vehicles, and are equipped with adaptive artificial intelligence. (Wikipedia, Jun 18, 2018) WarpDrive project makes Tachikoma as... 1. Sensor in the browser 2. Actuator to block web-based attacks 3. Communicator with users 18 ©⼠郎正宗・Production I.G／講談社・攻殻機動隊製作委員会 NICTER ©攻殻機動隊 REALIZE PROJECT Network Incident analysis Center for Tactical Emergency Response Web-based Attack Response with Practical and Deployable Research InitiatiVE 1. Install “Tachikoma Security Agent” into user’s browser (Chrome in Windows or Mac) 19 ©⼠郎正宗・Production I.G／講談社・攻殻機動隊製作委員会 NICTER ©攻殻機動隊 REALIZE PROJECT Network Incident analysis Center for Tactical Emergency Response Web-based Attack Response with Practical and Deployable Research InitiatiVE 2. Tachikoma SA collects user’s web accesses in real-time manner 20 ©⼠郎正宗・Production I.G／講談社・攻殻機動隊製作委員会 NICTER ©攻殻機動隊 REALIZE PROJECT Network Incident analysis Center for Tactical Emergency Response Web-based Attack Response with Practical and Deployable Research InitiatiVE 3. Tachikoma SA prevents anD alerts user’s access to malicious Web sites 21 ©⼠郎正宗・Production I.G／講談社・攻殻機動隊製作委員会 NICTER ©攻殻機動隊 REALIZE PROJECT Network Incident analysis Center for Tactical Emergency Response Web-based Attack Response with Practical and Deployable Research InitiatiVE 4. Tachikoma SA has expanded the coverage to smart phones (Android) 22 ©⼠郎正宗・Production I.G／講談社・攻殻機動隊製作委員会 NICTER ©攻殻機動隊 REALIZE PROJECT Network Incident analysis Center for Tactical Emergency Response lExperiment started Jun 1st 2018 üNumber of Installation 13,000 üCollecting URLs 5-10 million /day üFinding Unknown Malicious Sites 428 /day 23 NICTER Network Incident analysis Center for Tactical Emergency Response CURE Cybersecurity Universal REepository 24 NICTER Network Incident analysis Center for Tactical Emergency Response Security Big Data in NICT Category Examples of accumulated data Data on the traffic sent to unused IP address spaces. This includes pcap files, statistical Darknet related data information, and malicious host information. Traffic data within NICT. This includes pcap files, flow data, security alerts generated by Livenet related data security appliances. Malware related data Malware samples, static and dynamic analysis results, etc. Spam related data Spam (double bounce) mail data, statistical information, etc. Android related data APK files and applications’ metadata, e.g.,