CYBERSECURITYRESEARCH
INSTITUTE
Cybersecurity Laboratory
Security Fundamentals Laboratory
Cybersecurity Nexus
National Cyber Training Center
National Cyber Observation Center
General Planning Office

4-2-1, Nukui-Kitamachi, Koganei, Tokyo

Akaneya-bashi

Joho-Tsushin-Kenkyu-Kiko-Mae
Bus Stop(Bus stop of NICT:
National Institute of Information& Communications Technology)

Sarejio-dori
Bus Stop

Cybersecurity Research Institute
Reception

E-mail : cyber-info@ml.nict.go.jp

Walking
route

URL : https://csri.nict.go.jp/en/

Kita-oodori Ave.
Univ.

Bus Terminal

E-mail: publicity@nict.go.jp

JR Kokubunji Sta.
To Tachikawa

Gakugeidai-kado

To KiyoseTokyo Gakugeidai

Bus Terminal (Line No.5)

Other inquiry regarding NICTTEL: +81-42-327-5392 FAX: +81-42-327-7587

Koganei-bashi

Koganei-kaido Ave.

URL : https://www.nict.go.jp/en/

Kihei-bashi

Itsukaichi-kaido Ave.

Shin-koganei-kaido Ave.

184-8795, JapanTo Haijima

JR Chuo Line

JR Musashi-Koganei Sta.
To TokyoTowards a Global
Center of Excellence
for Cybersecurity R&DC

Cybersecurity
Laboratory
OUTLINEountermeasures against increasingly sophisticated and complex cyberattacks

To contribute to the continuous improvement of cyberattack response capabilities and counter the diversifying

have become an urgent national issue, and social demands for NICTʼs role incyberattacks, we are conducting research and development around two pillars: data-driven cybersecurity technology

cybersecurity are growing. To protect Japan from a wide variety of cyberattacks, theand emerging security technology. In particular, we are working on the research and development of technologies for

Cybersecurity Research Institute aims to become a global center of excellence inattack observation, analysis, visualization, and countermeasures to address increasingly sophisticated and complex

cybersecurity research and development by leveraging NICTʼs neutrality and close
collaboration with industry and academia. Based on government policy, NICT conducts

cyberattacks, cross-analysis of large and diverse information related to cyberattacks, and verification technologies

cybersecurity training programs, promotes cybersecurity measures for IoT devices, andfor improving security in emerging network environments. We also aim to disseminate research and development

strives to become a nexus in the cybersecurity domain, connecting industry, academia,results and implement them in society.

and government.

NICT is committed to promoting research and development of technologies for thelarge-scale collection, accumulation, and cross-cutting analysis of data related tocyberattacks. Under the fifth mid-to-long-term plan launched in April 2021, we aim toimprove Japanʼs cybersecurity response capabilities by advancing these technologies,
forming a domestic community of analysts to analyze cybersecurity data, andestablishing an open platform to develop a cybersecurity workforce throughout
society.

Data-driven cybersecurity technologyEmerging security technologies

We conduct research and development of practical cybersecurity technol-

We conduct research and development on security verification technol-ogies to respond to changes in cyberattack trends. Specifically, we are

ogy to address security issues and measures related to emerging

working to establish and advance technologies for observing sophisticatedtechnologies, such as Internet of Things (IoT) devices, 5G/Beyond 5G,and increasingly complex cyberattacks including indiscriminate andand connected cars, in order to contribute to the security of new

realized. Therefore, we will evaluate the security of new cryptographic

targeted attacks from multiple aspects, supporting situational awarenesstechnologies that emerge in society. We also analyze human (user)technologies for the quantum computing era, such as post-quantum

through visualization technologies, and developing automated analysis

behavior patterns, mental models, and decision-making processes, andand countermeasure technologies that make full use of AI technologies

are engaged in research and development on usable security to achieve

such as machine learning. In addition, we are actively promoting the social

high security without compromising usability.

A

chieving a secure and safe cyberspace requires technologies that
securely utilize data while ensuring both security and privacy.

Additionally, there are concerns that the security of current cryptographic
technologies will be compromised if large-scale quantum computers are

cryptography, as well as the cryptographic technologies currently
widely used in electronic government systems.

application of the technologies we have developed, the attack data wehave collected, and the knowledge we have gained.

Director General, Cybersecurity Research Institute

I NOUE Daisuke

Cybersecuritytechnology

Cryptographictechnology

Establishment ofindustry-academia-government
collaboration base

Cyberattack observation and analysis system “NICTER”

Darknet-based real-time alert system “DAEDALUS”

Network Incident analysis Center for Tactical Emergency Response

Direct Alert Environment for Darknet And Livenet Unified Security▲

Cybersecurity Workforce
Development

Survey of vulnerable
IoT devices in Japan

Real-time visualization of cyberattacks with NICTER▲

Visualization of DAEDALUS which issues alerts for malware-infected devices

CYBERSECURITY RESEARCH INSTITUTE|03

Security Fundamentals
Laboratory

Cybersecurity
NexusOUTLINEOUTLINE

The Security Fundamentals Laboratory conducts research and development of cryptography, authentication, andCYNEX (Cybersecurity Nexus) has been newly organized to build an advanced infrastructure that will serve

privacy-preserving technologies.

as a "nexus" for industry, academia, and government in Japan's cybersecurity field, utilizing the vast amount

We also evaluate the security of currently used cryptography as well as the security of emerging ones includingof data on cyberattacks, research and development achievements, and knowledge gained from developing

post-quantum cryptography to promote proper implementation and standardization for secure information systems.

cybersecurity workforce collected by NICT. CYNEX will collect, store, analyze, and provide cybersecurity

Evaluating threats of quantum computers
to modern cryptosystems

Balancing security and usability

Meeting new social needs
Research and development of
the fundamentals ofprivacy-preserving technologies

Secure datautilization
technologies

Security
evaluation of
cryptographic
technologies

information domestically and release a common platform for nurturing cybersecurity personnel throughout society,aiming to enhance Japan's cybersecurity response capabilities.

Security evaluation of
post-quantum cryptography
Security analysis of
end-to-end encryption

CYNEX Structure: 4 Co-Nexus
CYNEX will promote four sub-projects, “Co-Nexuses,” concurrently.

Secure data utilization technologies

Security evaluation of cryptographic technologies

To ensure security and privacy at each stage of data provision,

To contribute to the appropriate implementation and secure use ofcollection, storage, analysis, and deployment, we conduct research andvarious cryptographic techniques, our laboratory has conducted

development on access control technologies such as anonymous

research and development of cryptographic infrastructure technology.

authentication and privacy-preserving data evaluation technologies

In particular, we are engaged in the research and development ofsuch as secure computation.

security evaluation of lattice-based cryptography and multivariable

By using these technologies, we aim to promote the utilization of data,

public key cryptography, which are expected to become the world

including cross-organizational collaboration, and contribute to solving

standard post-quantum cryptography, as well as RSA cryptography andsocial issues such as providing secure telework.

elliptic curve cryptography, which are currently widely used. Based on
the results, we also conduct security evaluations of cryptographic
technologies used in e-government systems and other applications.

Privacy-preserving federated
learning system:

Data collection
with several observation systems
Foster analyst communityand collaborative analysis

Co-Nexus E

Evaluation

Long-term operation and evaluationof domestic security products
Feedback to industry and academia

Co-Nexus S

Security Operation & Sharing
Advanced SOC human resource development(Online self-study and on-the-job training)
Generation and sharing of explainable
domestic threat intelligence

Co-Nexus CCYROP “Cyber Range Open Platform”
Developing original contents for cyber exercise
Acceleration of human resource developmentby providing the exercise platform

Predict when quantum computers would break many of
the currently-used public-key cryptosystems.
DSA and ECC of currently used parameters are secureagainst the latest quantum computers.

Fraud Detection in Financial Transactions
Each bank locally generates
a machine learning modelusing a deep-learning method.

Co-Nexus AAccumulation & Analysis

Each bank encryptsparameters of a learning modeland uploads it to the central server.

Attack Response with Practical and Deployable
WarpDrive Web-based
Research InitiatiVE
We are currently recruiting users to join the attack observation network.

Bank ABank B

Cyberattacks continue to become more diverse and sophisticated, and there is no end to the damage

Bank C

caused by web-based attacks that infect you with malware just by browsing a website. The Warp-Central Server

Each bank downloads
the encrypted model and obtains
a model that provides higher accuracy.

▲

Drive Project, led by CYNEX Co-Nexus A, has developed the web-based attack countermeasure

The central server
updates encrypted
machine learning model.

DeepProtect enables data analysis shared by multiple organizations
without disclosing sensitive data such as personal information.

software "Tachikoma Security Agent," inspired by the character "Tachikoma" from the anime series
DSA: Digital Signature Algorithm
ECC: Elliptic Curve Cryptography▲

NICT has succeeded in the world's first experiment in solving a DLP using
an actual quantum computer.

"Ghost in the Shell: SAC_2045." By constructing the attack observation network with user participation, we aim to clarify the actual state of attacks and develop countermeasures against them.

NationalCyber Training CenterNational CyberObservation CenterOUTLINE
In order to protect the safety of society from increasingly diverse and malicious cyberattacks, it is necessary toThe National Cyber Observation Center, as the organization responsible for investigations in the NOTICE

accelerate the development of cybersecurity workforce who will take on this responsibility on a national level.

project, conducts wide-area scans of the internet space within Japan to search for IoT devices that could poten-

Against this background, in response to the passage of the 2017 budget by the Ministry of Internal Affairs andtially be exploited for cyber attacks. The information of discovered vulnerable IoT devices is provided to internet

Communications, the National Institute of Information and Communications Technology (NICT) established theservice providers and device manufacturers, and is used to promote safety and security on the internet throughNational Cyber Training Center on April 1, 2017. The center aims to plan and promote practical cybersecurity training

raising awareness and taking measures among device users.

by maximizing the technical knowledge gained from years of research on cybersecurity.

The National Cyber Training Center promotes the following three projects:NOTICENational Operation Towards IoT Clean Environment (NOTICE) is a project aimed at suppressing the hijacking of IoT devices and the activities of botnets byimproving the security measures of IoT devices such as routers and network cameras that are connected to the internet. The Ministry of Internal Affairs andCommunications (MIC), NICT, and Internet Service Providers (ISPs) are collaborating to promote the "observation of IoT devices that are being exploited forcyber attacks, or that have the potential to be" and the "security measures for IoT devices that have potential risks".

Cyber Defense Exercise
with Recurrence

Practical Cybersecurity
Exercise Response Practicefor Cyber Incidents

Development of young
security innovators“CYDER”“RPCI”“SecHack365”

CYDER allows practical defensive

RPCI is a highly practical incident-handling

SecHack365 is a program for ICT personnel

exercises in an environment thatexercise utilizing NICT's large-scale

under the age of 25, aimed at developing

si mulates an organization's net work.

exercise environment and the expertise incybersecurity innovators who can tackle

B y p r ov i d i n g CY D E R , we a i m to t r a i n

CYDER. This is the first specific course forvarious security challenges with creative

security operators in the thousands in

Registered Information Security Specialist

ideas. The program provides full-scalenational administrative agencies, local(RISS) offered by a public institution.

guidance over the course of one year byg ove r n m e n t s , c r i t i c a l i n f r a s t r u c t u r etaking advantage of NICT's long-standing

operators, etc.

research and development expertise and theenvironment.

NICT

1

Wide-area scans to searchfor vulnerable IoT devices

2

Survey of potential risks
of prevalent IoT devices

3

internet service providers(ISPs)

4

Nortiﬁcation
to internet service
providers (ISPs)

Raising of awarenessDevice users

IoT devices (routers and network cameras) connected to the internet

5Measures(conﬁguration changes, etc.,)