1. Periodic Observation Report

SOC Report

1.1 Introduction

Section 1.2 describes information on threats revealed via

IIJ announced its new security business brand wizSafe*1 on

the Data Analytics Platform in 2018, and Section 1.3 de-October 31, 2016 and is constantly working to bring about

scribes new initiatives using the Data Analytics Platform.

a world in which customers can use the Internet safely. As

The observations for 2018 are summarized in wizSafe

part of such efforts, we release up-to-date information on

Security Signal*4.

security threats observed at our SOC in blog format via wizSafe Security Signal*2. This includes some information on

1.2 Observational Data

threats identified through IIJ’s Data Analytics Platform. For

First, we look at activity identified using the Data Analytics

an overview of the Data Analytics Platform, see Internet

Platform that is particularly noteworthy. This information is

Infrastructure Review (IIR) Vol. 38*3.

taken from wizSafe Security Signal posts from last year.

Here, we give an overview of analysis using the Data

1.2.1 Attacks Involving Cryptocurrencies

Analytics Platform. The logs collected on the platform nat-

Attempts to monetize attacks using cryptocurrencies at-urally include those from security devices such as firewalls,

tracted attention in 2018. Analysis on IIJ’s Data Analytics

IPS/IDS, and antivirus solutions provided as IIJ services, as

Platform also revealed several cases of attackers attempting

well as logs of DNS queries, Web access, incoming/outgo-

to exploit cryptocurrencies.

ing email, and so forth. Characteristically, these logs contain
only a tiny amount of abnormal traffic (threats) among a

The first example involves manipulating a website to embedlarge amount of normal traffic. We therefore need to thinka mining script. Our SOC’s observations uncovered multiple

about how to go about aggregating and visualizing the datacases of mining scripts embedded in websites that do not

so that we can identify threats clearly.

appear to have been put there intentionally by the website

WebLogic server
1.Attack

DL.ps1

DL & run

3.DL & run

Attacker

Neutrino.ps1

C2 traffic part
Mining part2.Download & run

DL.php3.DL & run

WMI.ps1

3.DL

Runs

lsass.eXe

One of:*x86.exe*x86_VMP.exe*64.exe*x64_VMP.exe

Figure 1: Overview of GhostMiner Attack

4

Response*1

IIJ announces new security business brand wizSafe (https://www.iij.ad.jp/en/news/pressrelease/2016/1031.html).

*2

wizSafe (in Japanese at https://wizsafe.iij.ad.jp).

*3

IIJ, Internet Infrastructure Review (IIR) Vol. 38 (https://www.iij.ad.jp/en/dev/iir/038.html).

*4

wizSafe, “wizSafe Security Signal 2018 Annual Summary” (in Japanese at https://wizsafe.iij.ad.jp/2019/03/601/).

© Internet Initiative Japan Inc.

C2 server

May 2019

Vol.

42

1. Periodic Observation Reportadministrator. By exploiting website vulnerabilities and so

Yet another example involves not mining but attempts toforth, attackers can embed mining scripts into Web pages.

illegally transfer funds. In December 2018, we observed

When a user views a tainted site, the user’s computer runs

scanning activity (Figure 2) targeting the JSON-RPC pro-the cryptocurrency mining script, and any mined proceeds

tocol used in an Ethereum client*8. The scanning activity

go to the attacker.

was looking for Ethereum clients that are accessible via theInternet due to a misconfiguration. We note that a number

The above is an example of an attack aimed at clients,of conditions must be met for the funds transfer to actually

but we have also observed cryptocurrency mining attacks

complete successfully.

on servers. One specific example is an attack campaign*5
called GhostMiner (Figure 1). The GhostMiner campaign

Cryptocurrencies are appealing to attackers because attacks

was observed in March 2018 and exploits a vulnerabilityon them can be monetized directly and because, depending(CVE-2017-10271) in Oracle WebLogic Server. The vulner-

on the type, they offer a high degree of anonymity. Also,

ability allows the execution of remote code, so the attacker

any environment that has computational resources can be

ultimately attempts to get the Web server to mine crypto-

attacked, as evidenced by the variety of attacks geared

currency. We have also observed several other attempts toto cryptocurrency mining, which target both clients anduse remote code execution vulnerabilities to get servers toservers. We expect attackers to continue to target crypto-mine cryptocurrency

currencies as one means of monetizing attacks.

.

*6*7

(Number of detections)
1400
1200
1000
800
600
400
■BG
■US
■RU
■Other200

2000h, Dec. 31, ’180000h, Dec. 31, ’18

0400h, Dec. 30, ’18

0800h, Dec. 29, ’18

1200h, Dec. 28, ’18

1600h, Dec. 27, ’18

2000h, Dec. 26, ’180000h, Dec. 26, ’18

0400h, Dec. 25, ’18

0800h, Dec. 24, ’18

1200h, Dec. 23, ’18

1600h, Dec. 22, ’18

2000h, Dec. 21, ’180000h, Dec. 21, ’18

0400h, Dec. 20, ’18

0800h, Dec. 19, ’18

1200h, Dec. 18, ’18

1600h, Dec. 17, ’18

2000h, Dec. 16, ’180000h, Dec. 16, ’18

0400h, Dec. 15, ’18

0800h, Dec. 14, ’18

1200h, Dec. 13, ’18

1600h, Dec. 12, ’18

2000h, Dec. 11, ’180000h, Dec. 11, ’18

0400h, Dec. 10, ’18

0800h, Dec. 9, ’18

1200h, Dec. 8, ’18

1600h, Dec. 7, ’18

2000h, Dec. 6, ’180000h, Dec. 6, ’18

0400h, Dec. 5, ’18

0800h, Dec. 4, ’18

1200h, Dec. 3, ’18

1600h, Dec. 2, ’18

2000h, Dec. 1, ’180000h, Dec. 1, ’180(Date & time)

Figure 2: Scanning of 8545/TCP (Dec. 2018)*5

wizSafe, “GhostMiner infections spreading” (in Japanese at https://wizsafe.iij.ad.jp/2018/04/323/).

*6

wizSafe, “wizSafe Security Signal January 2018 Observation Report” (in Japanese at https://wizsafe.iij.ad.jp/2018/02/247/).

*7

wizSafe, “wizSafe Security Signal February 2018 Observation Report” (in Japanese at https://wizsafe.iij.ad.jp/2018/03/286/).

*8

wizSafe, “Ethereum JSON-RPC scans observed” (in Japanese at https://wizsafe.iij.ad.jp/2019/01/541/).

© Internet Initiative Japan Inc.

5

1.2.2 SYN/ACK Reflection Attack

not be able to realize an attack of the scale envisaged. Also,

One peculiar example of a DDoS attack that the SOC ob-

because only a small volume of SYN packets is received perserved in 2018 is a SYN/ACK reflection attack using 80/

server, one can infer that the attacker is probably sending

TCP. This was included in wizSafe Security Signal forout SYN packets far and wide.

September 2018*9 (Figure 3). The attack sends TCP SYN
packets with a spoofed source address to many addresses

The attack described above uses port 80/TCP, and servers

simultaneously, thereby effectively recruiting the resulting

on which 80/TCP is open can generally be considered to

SYN/ACK packet responses to perform a DDoS attack on

be Web servers. Hence, normal Web access traffic on suchthe source address.

servers do contain a small amount of SYN packets, the typeof packet used in a SYN/ACK reflection attack, and it isThis SYN/ACK reflection attack was observed by the SOC

thus difficult to determine whether any of those packets areon September 26, 2018, but it has also been observed on abeing used in an attack. In this example, we detected thesmall scale since October, and attacks of the same type areattack by cross-analyzing the multiple customer firewall logs

detected daily via the Data Analytics Platform. One featurepresent on our Data Analytics Platform.

of the DDoS attack observed on September 26 is that thesource invokes the attack by sending a small amount of SYN

Because firewall logs reveal information about internal andpackets to servers on which the 80/TCP port is open to theexternal access, such attacks can be detected when multi-Internet. If an attacker sends a high volume of SYN packets

ple firewall logs indicate that 80/TCP responses are being

to a single server, the administrator of the receiving server

generated for a single specific IP address (the spoofed IP ad-

is liable to think that a TCP SYN flood attack*10 is underway

dress being attacked). However, this feature could indicate

and block further traffic. If this happens, the attacker may

scanning activity rather than a DDoS attack. We therefore■ Traffic count for the single IP address■ Traffic count for other IP addresses

(%)
14
12
10
8
6
4
2

00
00
h,
Se
p.
01
26
00
,’
h,
18
Se
p
02
.2
00
6,
h,
’
18
Se
p.
03
26
00
,
h,
’
18
Se
p.
04
26
00
,’
h,
18
Se
p.
05
2
00
6,
h,
’
18
Se
p.
06
2
00
6,
h,
’
18
Se
p.
07
26
00
,’
h,
18
Se
p.
08
26
00
,’
h,
18
Se
p.
09
2
00
6,
h,
’
18
Se
p.
10
2
00
6,
h,
’
18
Se
p.
11
26
00
,’
h,
18
Se
p.
12
26
00
,’
h,
18
Se
p.
13
2
00
6,
h,
’
18
Se
p.
14
26
00
,
h,
’
18
Se
p.
15
26
00
,’
h,
18
Se
p.
16
2
00
6,
h,
’
18
Se
p.
17
2
00
6,
h,
’
18
Se
p.
18
26
00
,’
h,
18
Se
p.
19
26
00
,’
h,
18
Se
p.
20
2
00
6,
h,
’
18
Se
p.
21
2
00
6,
h,
’
18
Se
p.
22
26
00
,’
h,
18
Se
p.
23
26
00
,’
h,
18
Se
p.
26
,’
18

0

(Date & time)

Figure 3: Increase in 80/TCP Traffic from a Single IP Address*9*10

wizSafe, “wizSafe Security Signal September 2018 Observation Report” (in Japanese at https://wizsafe.iij.ad.jp/2018/10/470/).
In a TCP SYN flood attack, the attacker sends a large amount of SYN packets—requests used to establish a TCP connection—to the target system, causing it toprepare for a large number of connections and thereby wasting processing power, memory, etc.

6

© Internet Initiative Japan Inc.

May 2019

Vol.

42

1. Periodic Observation Report

differentiate between DDoS attacks and scanning activity

The vulnerability that the malware exploits is a buffer over-based on total bytes sent/received, duration, and so on as

flow issue with the Microsoft Office Equation Editor that

calculated from the firewall logs.

allows remote code execution. Microsoft issued a patch thatfixes this vulnerability in November 2017. As a workaround,

The SYN/ACK reflection attack that we wrote about inusers can also disable the Equation Editor as a means of

September 2018 was also observed in IIJ’s honeypots. We

avoiding this attack without applying the patch.

reported about this in detail in an IIJ-SECT blog post (inJapanese): “SYN/ACK reflection attack using IoT devices as

We observed an attack targeting this vulnerability via thea springboard”*11. The post describes changes in the ports

Data Analytics Platform in September 2018, almost a year

used in the attack and reveals that it is a complex DDoS

after the fix had been issued (Figure 4)*12. The attackers

attack that uses the UDP protocol, so we encourage you tosent malware that exploits the vulnerability as an email

read through it.

attachment. We think this was a deliberate attempt to target systems in which a fix was never applied or in which

1.2.3 Resurgence of Attacks Targeting Known Vulnerabilities

the Equation Editor had only temporarily been disabled as

One notable of the 2018 analysis performed on the Dataa means of avoiding the attack, and that it was timed for

Analytics Platform is that some attacks targeting vulnerabili-

when awareness of this vulnerability had faded somewhat.

ties that have already been disclosed and for which patches
have been made available have re-emerged after being dor-In addition to the Microsoft Office vulnerability discussed

mant for some time. One example is malware that exploits

here, we have observed multiple other similar cases via thea vulnerability (CVE-2017-11822) in the Microsoft Office

Data Analytics Platform*13. A lesson to be learned from theseEquation Editor.

observations is that whether one implements a fundamental

Other

5.03%

Trojan.Win32.Neurevt
1.26%
Trojan.HTML.Phish
Trojan.Java.Agent

Email-Worm.Win32.Mydoom
42.88%

1.28%
1.91%

Trojan-Spy.Win32.Zbot
2.10%
Trojan-Downloader.
MSWord.Agent
2.26%
Backdoor.Win32.Androm
7.93%
Trojan-PSW.Win32.Fareit
8.51%
Trojan-Spy.Win32.Noon
11.49%

Exploit.MSOffice.
CVE-2017-11882
15.35%

Figure 4: Breakdown of Malware Types Detected
in Received Emails (Sep. 2018)*11

IIJ-SECT Security Diary, “SYN/ACK reflection attack using IoT devices as a springboard” (in Japanese at https://sect.iij.ad.jp/d/2019/02/128021.html).

*12

wizSafe, “wizSafe Security Signal September 2018 Observation Report” (in Japanese at https://wizsafe.iij.ad.jp/2018/10/470/).

*13

wizSafe, “wizSafe Security Signal November 2017 Observation Report” (in Japanese at https://wizsafe.iij.ad.jp/2017/12/184/).

© Internet Initiative Japan Inc.

7

fix to a vulnerability or, depending on the circumstances,announced at USENIX Security ’18. As the conference

any of the various workarounds available, it is crucial that

paper on FANCI explains, the system combines domain fea-such measures are kept in place indefinitely.

tures inspired by those used in past research with a machinelearning algorithm known as random forests, and it general-

1.3 Detecting Malicious Transmissions		
Using Machine Learningizes very well.

Characteristically, the data analyzed on our Data Analytics

As the first step in our follow-up research, we aim to stick

Platform include only a tiny amount of abnormal traffic

to the methodology described in the paper as much as pos-(threats) among a large amount of normal traffic. Efforts are

sible and use the DNS query data available from our Databeing made to use machine learning to discover such threats.

Analytics Platform. This first step is intended to assess

The main task handled is that of detecting anomalies fromwhether the methodology can be applied unmodified to theimbalanced data. Here, we describe two such projects that

Data Analytics Platform’s data. We do this because any

are underway, along with the challenges they face.

given methodology will not necessarily produce the same
results when different data are used. Next, if we determine

1.3.1 Application to DNS Query Data

that the methodology cannot be applied as is, and that it is

The domain names of the C2 (command & control) servers

possible to investigate why and implement a solution, weused by malware may be generated algorithmically using

intend to work toward a practical implementation that may

a DGA (domain generation algorithm). The domain names

include additional performance enhancements. Potential per-generated by DGAs differ widely depending on the type offormance enhancements could, for example, come from thealgorithm and the parameters used when running it. This canuse of gradient boosting decision trees, a popular method inmake it difficult to blacklist the malware’s servers ahead ofrecent years, or ensemble learning that combines undersam-

time or to create an expression for the detection signature.

pling and bagging.

So in this project, we aim to solve the problem by combining

The volume of data passing through and processed by thethe Data Analytics Platform’s DNS query data with machine

Data Analytics Platform is large, however, so as a matterlearning. We take this approach because tasks that humansof practicality, the model needs to have high throughput.

find difficult to construct rules for can be amenable to ma-

We aim to strike a balance between the increasing compu-

chine-learning solutions. A desirable property of machine

tational load that results from the use of more complicatedlearning algorithms is that they can autonomously acquire

models and workflows and the performance enhancements

the ability to classify anomalies when provided with datathat can be obtained, and with some fine tuning, we ul-containing features that are effective in identifying those

timately aim to build the system into our Data Analytics

anomalies. For example, in IIR Vol. 41, we looked at URL

Platform to provide one means of detecting these anomalies.

strings and described an approach to identifying rogue sites
1.3.2 Application to Web Proxy Data

using neural networks*14.

One other project we are pursuing aims to detect comWe know of several attempts to use machine learning tomunications sent to C2 servers by malware in Web proxydetect DGAs, including some that have already been put

data. We are currently running validation tests with theinto real-world use. Currently, we are engaged in research

objective of applying the methodology presented by IIJ en-

that follows on from the FANCI (Feature-based Automatedgineers at Black Hat Europe 2018*16 to our Data Analytics

NXDomain

Platform’s logs. The methodology presented at BlackClassification

andIntelligence)*15

system*14

IIJ, Internet Infrastructure Review (IIR) Vol. 41 (https://www.iij.ad.jp/en/dev/iir/041.html).

*15

USENIX, “FANCI: Feature-based Automated NXDomain Classification and Intelligence” (https://www.usenix.org/conference/usenixsecurity18/ presentation/schuppen).

*16

Black Hat, “Deep Impact: Recognizing Unknown Malicious Activities from Zero Knowledge” (https://www.blackhat.com/eu-18/briefings/schedule/#deep-impact-recognizing-unknown-malicious-activities-from-zero-knowledge-12276).

8© Internet Initiative Japan Inc.

May 2019

Vol.

42

1. Periodic Observation Report

Hat Europe 2018 is described later in this edition underto improve the accuracy of machine learnings models, and“Focused Research (1): Deep-Learning Analysis of Logs to

is focused on building systems that improve quality without

Detect Malicious Communications”.

putting any additional load on current security operations.

The project uses convolutional neural networks, which are

One attempt to improve accuracy entails feature engineer-commonly applied to image recognition tasks, to discern

ing. There is a strong perception that feature engineering

trends in normal traffic and anomalous traffic (with a C2

involves adding features expected to be effective on theserver). The key here is learning model performance and its

basis of data analysis, but other approaches also exist. For

evaluation.

example, various statistics can be calculated from existing
features, combined with the data from which they were de-If there were, say, a model capable of producing 95% ac-

rived, and then used for learning and evaluation. We will

curacy or better, this would generally be regarded as good

also use various other methods to repeatedly add and eval-

performance. But because the volume of logs collected onuate features as we work to enhance model.

the Data Analytics Platform is enormous, 1% of this data
is not the sort of volume that a human could process by

1.4 Conclusioneye. Even if false positives do arise, the model needs toIn this edition, we provided an overview of analysis using

provide a level of accuracy that is tolerable when put into

the Data Analytics Platform, went over some actual obser-

operation. This, of course, is the case when only machine

vations from 2018, and described our efforts with respectlearning is used, and approaches that reduce false positives

to machine learning. The final machine learning approachthrough non-machine-learning systematic processing arethat we described has the potential to further expand thealso conceivable.

detectable range for threats where detection with conventional methods is difficult or subject to limitations. We are

Aside from accuracy, we also need to be aware of differ-able to pursue these efforts entirely because we are able

ences in the distributions of the datasets we are dealing

to use traffic logs received from customers on the Data

with. It is quite possible that the distributions of datasets

Analytics Platform, subject to customer consent. Machineused by reportedly well-performing machine learning mod-learning approaches require large volumes of data in par-els presented at conferences, academic events, and the liketicular, so it is fair to say that we are only able to pursue

are characteristically different from the dataset distributions

these efforts because we have access to these traffic logs

encountered by our SOC, so follow-up research is needed.

via the Data Analytics Platform. We will continue to provide
up-to-date information on threats through wizSafe Security

In view of the above, the SOC takes the overall design and

Signal and the IIJ-SECT blog, and we will continue striving

operation of systems that use machine learning models into

to bring about a world in which the Internet is even safer forconsideration, conducting follow-up research and working

customers to use.

Satoshi Kobayashi
Data Analyst, Security Operations Center, Security Business Department, Advanced Security Division, IIJ

Shun Morita
Data Analyst, Security Operations Center, Security Business Department, Advanced Security Division, IIJ© Internet Initiative Japan Inc.

9