1. Periodic Observation Report

SOC Report

1.1 Introduction

operating the Data Analytics Platform under the headings

IIJ maintains the wizSafe security brand and works constantly“Challenges in operating and performing analysis on theto create an environment in which the Internet can be

Data Analytics Platform and the deployment of dbt” andused safely. One of its initiatives in this regard is the“Visualizing C&C communications with a focus on time

regular dissemination of information on security issues

interval variability”. As part of this discussion, Sectionin blog form via wizSafe Security Signal . IIJ also uses

1.3.1 describes the events that led us to deploy dbt toits position as an ISP to perform data analysis on its Data

address the issues of data freshness and data mart creation

Analytics Platform , which aggregates backbone traffic

and maintenance. And in Section 1.3.2, we share the results

as well as security appliance logs, focusing its effortsof our evaluation of the use of a statistical measure called

on preventive measures and swift follow-up responses

the moving coefficient of variation to deal with three issues

against the increasingly sophisticated cyberattacks out

related to the evaluation of communications time interval

there.

variability.

Section 1.2 of this report looks back at security incidents

1.2 2023 Security Summarythat occurred in 2023 and provides a security summary

Tables 1 and 2 show the security incidents that the SOC

covering key incidents of note in calendar format. Section

focused on from among those that rose to prominence in

1.3 then discusses our latest efforts to deal with emerging

2023.

*1

*2

challenges faced when performing data analysis and

4*1

wizSafe Security Signal (https://wizsafe.iij.ad.jp/).

*2

Internet Infrastructure Review (IIR) Vol. 38 (https://www.iij.ad.jp/en/dev/iir/038.html).

© Internet Initiative Japan Inc.

Jun.2024

Vol.

62

1. Periodic Observation Report

Table 1: Incident Calendar (January–June)
Month

Summary

January

Access to a local government’s official website was disrupted, and it was revealed that a group calling itself Anonymous may have been to blame
for the disruption (DDoS attack). A user claiming to be Anonymous posted content on Twitter (now X) hinting at the attack.

January

IIJ’s SOC observed an increase in attack emails with Microsoft OneNote attachments. Multiple malware infection campaigns using OneNote files
were seen from January onward.

February

Multiple organizations reported ransomware campaigns (ESXiArgs) exploiting an OpenSLP heap-overflow vulnerability (CVE-2021-21974) inVMware ESXi products. IIJ’s SOC also confirmed there to be an increase in scanning on port 427, which is used by OpenSLP, around the same time.

February

A crypto asset exchange disclosed that its employees had been subject to a social engineering attack. The attacker targeted multiple employees
via smishing and attempted to log into the exchange’s internal network using stolen employee credentials but was blocked by multi-factor
authentication (MFA). The attacker attempted to keep the attack going by calling the employees and posing as an IT staff member, but theexchange’s CSIRT was able to intervene and foil the attack.

February

Ransomware group Clop claimed to have stolen data from over 130 organizations by exploiting a zero-day vulnerability in the file transfer tool
GoAnywhere MFT. The vulnerability is identified as CVE-2023-0669. Thereafter, several organizations, including Japanese companies, announced
that they have been impacted.

March

The JPCERT Coordination Center (JPCERT/CC) issued an alert on mailouts aiming to infect systems with Emotet, which had not been observed
since November 2022. In some cases, the attached ZIP files contained a Word file that exceeded 500MB once extracted, which is likely acontrivance designed to avoid detection by security products(Note 1).

March

A foreign company that develops business communications software revealed there to be a risk of information-stealing malware infections fromthe official installer of software it provides. An investigating security vendor subsequently reported that the company had suffered a supply chain
attack, compromising its software development environment, which led to other supply chain attacks.

March

A telecommunications carrier disclosed that customer information associated with personal internet services and video streaming services had
been leaked from one of its contractors. A follow-up report revealed that the cause of the breach was not a malware infection but that a former
temp employee who worked on the services at the contractor had exfiltrated the information.

March

A company that provides information communications and system integration services disclosed that an incident occurred in which a local
government certificate issuing service it provides was issuing certificates to residents other than the certificate applicants. The service wastemporarily suspended, but in the subsequent process of fixing the system program that caused the incident, it was found that the patch had notbeen applied at some local governments, so the company said it was carrying out inspections and moving quickly to apply the patch.

April

An IT company that works on public services as a contractor disclosed that servers used in solution services it provides for local government
meetings had been subject to unauthorized access. The unauthorized access prompted several local governments to report a temporar ysuspension of Internet-based meeting live-streaming services.

May

A major automaker’s business strategy firm disclosed that customer information, including vehicle data and footage captured by drive recorders,
had been made externally accessible due to a cloud misconfiguration. A subsequent investigation of other cloud environments revealed new casesof some customer information having been made accessible.

May

Progress Software disclosed that the web application of its MOVEit Transfer file transfer service contained an SQL injection vulnerability(CVE-2023-34362), and that the vulnerability had already been exploited. The company initially advised customers to check for indicators of
unauthorized access over “at least the past 30 days”, but other security organizations subsequently disclosed that exploitation dated back to morethan 30 days prior.

June

For t inet disclosed t hat t he SSL-V PN func t ionali t y of For t iOS and For t iProx y cont ained a heap - based buf fer over f low vulnerabili t y(CVE-2023-27997), and that it may have been exploited in some limited cases. Multiple security vendors reported that the attack group Volt
Typhoon uses a zero-day vulnerability in Fortinet products to gain initial access, but it was revealed that no evidence of the heap-based buffer
overflow vulnerability being used had been found.

June

From June, there were ongoing reports of people who had made bookings through a travel booking site receiving messages directing them tophishing sites. This was traced back to unauthorized access to the accommodation booking information management system, and it was revealed
that devices used to manage the system at some accommodation facilities were infected with malware. Multiple security vendors reported that theattacker was posing as a customer and sending enquiry emails and the like to get operators to open attachments that would infect the devices withinformation-stealing malware.

Note 1: Alert Regarding Re-emergence of Emotet Malware Infection Activities (https://www.jpcert.or.jp/english/at/2022/at220006.html).

© Internet Initiative Japan Inc.

5

Table 2: Incident Calendar (July–December)
Month

Summary

July

A port transportation group announced that its terminal system was down due to a ransomware infection and that it was working to restore it.
After the outage, media outlets reported that the group had received threats from an attack group going by the name Lockbit. Operations wereresumed in short order, over the course of about two and a half days.

July

Microsoft disclosed that the attack group Storm-0558 had gained unauthorized access to Exchange Online and Outlook.com and was able toaccess emails and personal accounts of around 25 organizations, including government agencies. It revealed that the group had used a Microsoft
Service Account (MSA) signing key to forge authentication tokens that enabled it to access the services. While it did not have any concrete
evidence as to how the group obtained the signing key, Microsoft issued a subsequent report that described likely methods.

AugustMedia outlets reported that an Indonesian man had been arrested for using a phishing kit called 16shop to steal and fraudulently use otherpeople’s credit card information. This was the first case in which Japan’s National Police Agency was involved in a joint cyber investigation withanother country: it worked with INTERPOL and Indonesian police to arrest the suspect.

AugustThere were multiple incidents of login screen tampering on mobile network-compatible IoT routers used in Japan. IIJ’s SOC confirmed that theaffected login screens contained content protesting the discharge of treated water from nuclear power plants. An account on X thought to be
involved in the tampering posted an explanation of the vulnerability exploited.

September

A security company revealed that when AI researchers published open-source AI models on GitHub, a misconfiguration of the tokens that grant
access to the public data meant that 38TB of data, including researchers’ computer backups, was also exposed. It also revealed that the exposed
data included passwords to the AI researchers’ organization’s services, secret keys, and employees’ internal messages.

September

It was revealed that a domain used by a remittance and payment service had been listed on a domain registrar’s auction site, causing a stir, withpeople raising concerns of the domain potentially being acquired and misused by a third party. After speaking to the company that owned thedomain, some media outlets reported that the incident was due to internal mishandling.

September

The Zero Day Initiative (ZDI), a vulnerability discovery community, disclosed a vulnerability (CVE-2023-42115) in the mail transfer agent (MTA) Exim
that could allow remote code execution. The vulnerability had been reported by a security researcher in June of the previous year, and in
September, ZDI informed the vendor that it intended to publish it as a zero-day advisory, and subsequently did so(Note 2).

October

Google, Cloudflare, and Amazon Web Services all announced that a large-scale DDoS attack exploiting a vulnerability in the HTTP/2 protocol(CVE-2023- 44487) had been obser ved in August. The vulnerability exploits the HTTP/2 protocol’s stream multiplexing, which enables theconcurrent processing of multiple HTTP requests and responses within a single TCP connection. The attacking client sends a high volume of
HEADERS frames and RST_STREAM frames to drain server resources. This is called an HTTP/2 Rapid Reset attack.

October

Cisco Systems disclosed a vulnerability (CVE-2023-20198) in the web UI feature of Cisco IOS XE. By exploiting this vulnerability, an attacker canobtain the hightest level of access without authentication and create new local users. A few days later, it disclosed another vulnerability(CVE-2023-20273) in the web UI feature that would allow local users to execute commands with root privileges. Reports of damage from attacks
combining these two vulnerabilities were reported in Japan as well, and IIJ’s SOC observed traffic related to this vulnerability.

October

A contact center company disclosed that a person involved in the operation and maintenance of the call center system had been exfiltrating
customer information and leaking it to third parties. This breach is thought to have been ongoing for around 10 years. The root cause was that it
was possible to download customer information on operation and maintenance devices and write it to external storage media, and these
operations were not detectable via timely detection measures or routine log checks.

October

A company that provides identity management and authentication services disclosed that its support case management system had been subject
to unauthorized access. It initially said that only files uploaded by some customers had been affected, but it subsequently revealed that all users
had been affected. An investigation into the account used for unauthorized access revealed that an employee had signed in to a personal Google
account via a device managed by the company, and the account information had been synced to the employee’s personal device, suggesting thatthe account may have been stolen because the personal device was compromised.

November

It was disclosed that ownCloud, open-source software for building online storage, contained a vulnerability (CVE-2023- 49103) that allows
confidential information and settings in containerized environments to be leaked. Some days after this was revealed, several organizations
reported that the vulnerability was being exploited.

November

Akamai’s SIRT disclosed that a Mirai variant called InfectedSlurs was using a zero-day vulnerability in attacks designed to build out DDoS botnets.
A follow-up report revealed that one of the products with this vulnerability is a wall-jack-compatible wireless LAN router sold in Japan, and that it
is possible to exploit the authentication details in this device’s factory default settings. IIJ has observed DDoS attacks emanating from suchbotnets as ongoing since November.

December

Microsoft and Arkose Labs announced they had seized infrastructure used by Storm-1152, a group that sells fraudulent Microsoft accounts and
CAPTCHA bypass tools, identified the ringleaders, and filed criminal charges with law enforcement. It was also revealed that Storm-1152 had soldaround 750 million fraudulent Microsoft accounts, and was providing tutorial videos and support chat services for the tools it was selling.

December

Security consulting firm SEC Consult disclosed an SMTP implementation vulnerability called SMTP smuggling. The SMTP protocol defines an
end-of-data sequence, but many products will recognize a sequence as signaling the end of data even when an email message deviates from thestandard sequence. So by adding a second email message in the data following the sequence, an attacker can, for example, bypass sender
spoofing checks that would normally occur per the SPF sender authentication method.

Note 2: (0Day) Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability (https://www.zerodayinitiative.com/advisories/ZDI-23-1469/).

6© Internet Initiative Japan Inc.

Jun.2024

Vol.

62

1. Periodic Observation Report

1.3 Security Topics

While more fine-grained distinctions may be used at times,

This section discusses the IIJ SOC’s efforts to tackle somehere we will say that a data engineer is someone whoof the challenges it faces.

creates the data platform, and a data analyst is someone
who uses the data platform. With IIJ’s Data Analytics

1.3.1 Challenges in operating and performing analysis on
the Data Analytics Platform and the deployment of dbt
At IIJ, we operate a data platform that we call our Data

Platform too, we break the overall staff up into a teamresponsible for development and a team responsible foranalysis, and those teams collaborate with each other.

Analytics Platform, with the objective being to implement
appropriate preventive measures and post-incident re-

The current mainstream approach is to manage the data

sponses to cybersecurity threats. For additional details

stored on data platforms using the following layeredon these initiatives, refer also to the SOC Report in IIR Vol.

structure, and we manage data on our Data Analytics

38 (https://www.iij.ad.jp/en/dev/iir/038.html), published

Platform in a similar manner (Figure 1).

March 2018. We continue to operate the Data Analytics
Platform, continuously rolling out software updates and• Data lake layer

expanding data sources. Here, we describe some challenges• Data warehouse layerthat have emerged through the operation of the platform• Data mart layer

and our efforts to introduce open-source software called
dbt (data build tool) to address them.

The data lake layer stores data collected from or transferredby data sources, which generate the data, and to the extent

Before delving into the challenges, an explanation of thepossible, keeps it in the form in which it was received. The

underlying data platform operations and architecture isdata warehouse layer transforms data from the data lake

in order. Note that the discussion here is not limited tolayer into structured data to facilitate analysis. The data

the Data Analytics Platform. Firstly, in general, work onmart layer transform data from the data warehouse layer

the data platform is performed by team members serving

into specific forms tailored to specific use cases.

in the following two types of roles.
The data mart layer will be relevant to the challenges• Data engineer

discussed below, so an example from the domain of se-• Data analyst

curity is in order. Say that data collected from an IPS/IDS on a particular data platform is imported into the

Data source

Collect/transfer

Transform

Collect/transfer

Transform

Log

Collect/transfer

Data lake layer

Data warehouse layer

Data mart layer

Email filtering

Figure 1: Illustration of How Data is Managed in a Layered Structure on a Data Platform© Internet Initiative Japan Inc.

7

data warehouse layer. And let’s say that a particular data

The second challenge relates to creating and maintaining

point (record) contains information about the signature ofdata marts. Data marts are crucial when it comes to routine

and time at which a threat was detected. If you want totasks that are performed over and over again. This is because

look at daily trends based on this data, you might consider

the presence or absence of a data mart can greatly impact

producing daily counts of the type and number of detected

on work efficiency.

signatures. In this scenario, data counts that have been
generated in advance, rather than created ad hoc by a data

On the other hand, when creating data marts on the Data

analyst, constitute a data mart. For important information

Analytics Platform, there was a tendency for engineers tothat is frequently looked up, you might also consider

develop them individually. With this style of development,

adding visualization features using a dashboard or the like.

significant resources are spent on everything from development through to maintenance. And the lead time required to

Next, we look at two challenges that have emerged in

actually put the data mart into use tends to be long.

the course of operating and performing analysis on the
Data Analytics Platform. The first relates to data quality.

To address this challenge on our Data Analytics Platform,

For data analysts to perform appropriate analyses, data

we deployed the open-source version of dbt, called dbt

on the platform must remain in a healthy state. Yet there

Core. A SaaS version called dbt Cloud is also available.

is no such thing as a perfect system, and on our Data

dbt is specifically geared to the T (data transformation) in

Analytics Platform, we experienced the following types

ETL (extract, transform, load), the basic functionality of aof events.

data platform. One of its key traits is that most features
are available simply via SQL and YAML configurations*5.

• Decline in freshness of certain data

The fact that SQL and YAML configurations are all that is• Unexpected circumstances befalling certain dataneeded is quite a boon for data analysts, who tend to use
SQL extensively when performing analyses.

The concept of data freshness concerns whether data
is imported into the data platform in a timely manner

The first challenge related to data quality is addressed bywithout any delays. A decline in data freshness occurs

testing the data using dbt. Automated testing is a bestwhen data is imported into the data platform slower

practice in software engineering. And this is also a valid

than expected or when the data flow temporarily stops.

approach in data engineering.

A decline in data freshness may mean that data analysts
are unable to perform timely analysis*3.

dbt includes functionality for testing data, and the tests
can also be written in SQL and YAML. Tests in dbt are

Saying that unexpected circumstances can befall data

SELECT statements that return 0 records in a normallyis somewhat vague, but what this means is that, fromfunctioning system. In other words, if the SELECT statement

a data analyst’s perspective, something appears to be

for a particular test returns one or more records, the test

amiss with the data. Easy-to-visualize examples include

fails. You can of course write your own SELECT state-values that are supposed to be unique appearing multiple

ments from scratch, or you can use built-in test macros

times and unexpected values popping up in the data*4.

and test macros implemented by third-party plugins.

Overlooking these sorts of phenomena can affect theAdditionally, the source freshness feature can be usedreliability of analysis results.

to detect when data freshness has declined.

*3*4

The degree to which a decline in freshness can be tolerated depends on the nature of the work performed by the data analyst.
Situations that actually occur range from abnormalities that are obvious from the data definition to cases that are difficult to detect, such as changes in the distributionof data when viewed through summary statistics.

*58Differences between databases (SQL dialect etc.) are handled by adapters tailored to each database.

© Internet Initiative Japan Inc.

Jun.2024

Vol.

62

1. Periodic Observation Report

In the past, if something unexpected had happened tofrom what they were before. And laying out a more concrete

data on the Data Analytics Platform, data analysts would

path for creating data marts has streamlined our operations

typically notice this during the course of performing

and made it easier to come up with new ideas for analysis.

analyses. But when data analysts perform analyses,
they do this with an objective in mind. That is, theyusually need that data right at that moment. So discovering

1.3.2 Visualizing C&C communications with a focus ontime interval variability

something unexpected with the data at that point tended

When infecting a system, some types of malware use an

to heavily impact on workflow. Deploying dbt, however,Internet-connected command and control (C&C) server tomade it possible to efficiently discover and address suchreceive instructions from an attacker. The basic behavior

occurrences by incorporating data definitions and dataof the communications that take place (the C&C commu-

analysts’ experience-based rules into automated tests.

nications) is predetermined according to what malware
program is running. For this reason, certain patterns are

The second challenge relating to creating and maintaining

more likely to emerge than those seen in, for example,

data marts is addressed by using dbt to transform data

communications that occur when humans use a browser

with SQL. In dbt, objects called models can be definedor other such application in an ad hoc fashion.

using SQL SELECT statements. Results transformed by
the model’s SELECT statement can be accessed in the

One key characteristic that tends to reflect particularform of views and tables. The Jinja templating language

patterns is the communication time interval. A typical

can also be used to define models. So it is possible to groupexample that should make this easy to see is polling thatfrequently used content into macros, and to perform looping

occurs at regular intervals, such as a heartbeat used

and branching that is difficult to accomplish in pure SQL.

in system health monitoring. Time interval variability
tends to be low with these sorts of communications.

Deploying dbt on the Data Analytics Platform has madeTo enable security analysts to efficiently capture C&C

it possible, in many cases, to create data marts simply

communication patterns, we therefore tried out the use

by writing SQL. In some cases, we have been able toof a statistical measure that focuses on time interval

create data marts for quickly searching for security

variability to generate visualizations of communications.

IoCs (Indicators of Compromise) within a short period oftime, making certain tasks dozens of times more efficient.

It must be noted, however, that small time interval

Some processes are difficult to implement using SQL alone,variations can occur even with legitimate, non-malware

however, so individual development has not been renderedapplications. If you detect small communication timeentirely unnecessary. Meanwhile, it has become easier thaninterval variations in a production environment, it’s best

before to divide labor between data engineers and datato assume that most of that is attributable to legitimate

analysts in some respects. Specifically, data engineers canapplications. The method described here is thus intended

implement processes that are difficult to perform using SQL

to be used to help analysts visually understand what’salone as SQL user-defined functions. Data analysts cangoing on when breaches occur.

then write routines for transforming the data in dbt using
SQL that includes those user-defined functions. With thisFirst, let’s go over the problem and the tools that canworkflow, tasks follow an existing framework, so we canhelp us solve it. C&C communications can be viewed as

expect to reduce resource requirements and lead times

events that occur over the passage of time. Each event© Internet Initiative Japan Inc.

9

belongs to a specific session*6, typically identified by■ (b) Outliers have a substantial impact

the below elements in combination. The source is theIf, for example, a malware-infected computer is usedsystem infected with malware, and the destination is afor business purposes, it might only be turned on during

C&C server set up by the attacker. Note that the source

weekday daytimes. And naturally, when it’s not powered

port number is not included in the session identifier

on, no C&C communications will occur. Including the

because it may be an ephemeral port that changes fromtimes when the computer was off in the calculations

connection to connection.

would result in a long interval between events, as if.

the readings were outliers. The calculated variance andstandard deviation are likely to be larger than expected• Source IP address

as a result.

• Destination IP address■ (c) Event time intervals can change partway through• Transport layer protocol• Destination port number

sessions
Some malware shortens the time interval between events

Next, we turn to the descriptive statistical measures ofwhen the attacker is actively issuing commands. This isvariance and standard deviation, which is based on variance,

possibly because a lot of malware has autonomy overto quantify the variability in our figures. However, there arewhen it goes to the C&C server to receive commands*7,

some challenges to address when it comes to assessing

so if the polling interval is long, it will take time for opera-

variability in communication time intervals with variancetions to be reflected in the malware’s behavior. When longand standard deviation using all events in a particularand short time intervals are mixed like this, it is difficult

session.

to express the variability in terms of a single measure likevariance or standard deviation.

■ (a) Comparing values from different sessions is difficult
Consider the following situation, for example. Say that in

To address these challenges, we looked at a statisticalsession A, the average time interval between events ismeasure called the moving coefficient of variation. This

100 seconds and the standard deviation (a measure of

takes the ordinary coefficient of variation and introduces

variability) is 10 seconds. Meanwhile, say that in session

the idea of moving it over time. The smaller the moving

B, the average time interval between events is 1,000

coefficient of variation of the communications time interval,

seconds and the standard deviation is 50 seconds. If wethe more we can say that the communications have low

only compare the absolute values, we will decide thatvariability and are thus regular.

the standard deviation is lower for session A than for

10

session B. But if we consider the magnitude of variability

First, the coefficient of variation is obtained by dividing

relative to the average, we will find this to be smaller

the standard deviation by the mean. As mentioned infor session B than for session A. Hence, variance andchallenge (a) above, the standard deviation alone is notstandard deviation alone are insufficient when comparing

enough to determine variability relative to the mean size

different sessions.

of the observation. We therefore obtain a dimensionless*6

For convenience, we refer to a series of exchanges between any particular nodes as a session. This is different from a TCP session.

*7

This is possibly because if the communications originate from a C&C server on the Internet, they are likely to be hindered or blocked by NAT and firewalls.

© Internet Initiative Japan Inc.

Jun.2024

Vol.

62

1. Periodic Observation Reportmeasure by dividing the standard deviation by the mean.

We will now look at how malware-generated C&C commu-

This makes it possible to compare the variability ofnications from past infection incidents can be visualized

different sessions.

using the moving coefficient of variation. The first casedeals with malware communicating with multiple C&C

Next, in statistics, a moving measure is something thatservers at the same time. In recent times, malware

is calculated using a moving set of local (as opposed toprograms often attempt to communicate with multiple

global) data points. Such measures are used mainly for

C&C servers at the same time in the manner discussed

time series and other continuous data sets and are based

here.

on a predetermined number of data points. The range
covered by that predetermined number of data points is

In Figure 3, time elapsed since the reference time is plottedcalled the window. The window is progressively moved

on the horizontal axis, and the moving coefficient of vari-along the data set so that all of the data is eventuallyation is plotted on the vertical axis. Each line represents aused.

session, all of which constituted communications to a C&C

So the moving coefficient of variation is obtained bymoving the calculation of the coefficient of variation
along the data set. The moving coefficient of variation
is calculated by dividing the moving standard deviationby the moving average. This reduces the impact of theregards (b), outliers only affect the windows in which
they occur. And as for (c), even if the time intervals at
which events occur change during the observation period,
this should show up as changes in the statistical measureover time.

Destination IP address AS number A
Moving coefficient of variation

issues discussed in challenges (b) and (c) above. As

3
2

1
0
Destination IP address AS number B
3

2

1

Attacker0
Destination IP address AS number C

Commands
3

C&C servers

2

1

0

Internet

Destination IP address AS number D
3

C&C communications

2

1

0
500

Infected device

1000

1500

2000

2500

Time elapsed since reference time (seconds)

Figure 2: Malware Communicatingwith Multiple C&C Servers at the Same Time

Figure 3: Typical Sawtooth Wave Patternof Malware Communications to C&C Servers© Internet Initiative Japan Inc.

11

server. In this case, each session used the same source

In Figure 5, as before, time elapsed since the reference

IP address and transport layer protocol but had different

time is plotted on the horizontal axis, and the moving

destination IP addresses and port numbers. For ease ofcoefficient of variation is plotted on the vertical axis.

viewing, the graph is divided into panels by the AS number

Each line again represents a session, and the windowof the destination IP address. The window size used tosize used to calculate the moving coefficient of variation

calculate the moving coefficient of variation was 10 data

is 10 data points here also. Note, however, that elapsed

points.

time is calculated in minutes here, as opposed to seconds
in the previous graphs.

The graphs in each panel of Figure 3 show the typicalsawtooth wave pattern, oscillating around a value of 2,

Two sessions are plotted on the graph, and you can see

in the moving coefficient of variation. The waves are nottimes during which the moving coefficient of variation

perfectly aligned with each other, but they are close.

remained stable at close to zero in both cases. In other

This means that attempts to communicate with C&C

words, there are times when communication was occuring

servers happened at similar times, even across different

at regular intervals such that there was very little vari-

C&C servers.

ability in the communication time interval. In fact, during
these times, the malware was repeatedly communicat-

The second example shows malware falling back to

ing with a C&C server at intervals of around 317–320

another C&C server when the C&C server it was originallyseconds.

communicating with becomes unavailable. While thismalware only communicates with one C&C server at a

In the session indicated by the orange line, the mov-time, it likely has the ability to switch to a different C&C

ing coefficient of variation increases from around theserver if it loses contact with its current C&C server for

200-second mark*8 and the line subsequently cuts out.

some set amount of time.

A little while after this, the purple line appears. This is

Attacker
Commands
Communications with C&C server fail2

Moving coefficient of variation

C&C servers

Internet

C&C communications

Fallback

1

0

0

100

Infected device
Figure 4: Malware Falling Back to Another C&C Server

*8

300

400

500

600

700

Figure 5: Plot of Communications
When Malware Falls Back to Another C&C Server

An increase in the moving coefficient of variation indicates a breakdown in the regularity of communication intervals partway through the session. This corresponds
to challenge (c) above.

12

200

Time elapsed since reference time (minutes)© Internet Initiative Japan Inc.

Jun.2024

Vol.

62

1. Periodic Observation Reportwhat it looks like when the malware falls back to another

1.4 Conclusion

C&C server.

In the orange session, communications

In this article, we discussed several incidents that ourwith the C&C server had failed about an hour before the

SOC focused on out of those that we observed in 2023.

line cut out. The malware, it seems, therefore switched

The annual summary in Section 1.2 indicated that soft-

to sending its communications to a different C&C server.

ware vulnerabilities continue to come to light, and thatransomware attacks as well as information breaches due

Note that the examples covered here are typical ones andto configuration errors and external attacks continue tothat there is a whole range of malware communication

occur. Section 1.3.1 described how we used dbt to address

patterns in the wild. It is not uncommon, for instance,

issues related to data freshness and quality and the creation

for malware to vary communication intervals depending

and maintenance of data marts through automated testingon which C&C server it is communicating with, or toand the use of SQL for data conversion in a way that does

introduce some degree of randomness. These sorts of

not require individual development. Finally, Section 1.3.2

behaviors are likely attempts to avoid detection based on

discussed how we arrived at the idea of using the moving

communications time interval variability. We have observed

coefficient of variation, along with some actual use cases,

that, even in such cases, the shape of the graphs of the

as a means of addressing challenges that arise whenmoving coefficient of variation exhibit similarities, andassessing the variability in communications time intervals

that the coefficient will move within a particular range.

based on variance and standard deviation—namely, thechallenges of comparing different sessions, addressing

Here, we have described our work to enable visualizations

the impact of outliers, and addressing changes in timeof communications traffic using a statistical measureintervals.

that focuses on time interval variability. IIJ’s SOC willcontinue to study techniques for efficient data-based

IIJ will continue to publish information to address the

security analysis.

ever-changing array of threats out there. We hope thatyou will continue to turn to the IIR and wizSafe Security
Signal for such information and that it will prove useful
to you in your security responses and operations.

Junya Yamaguchi
Data Analytics Section, Security Operation Department, Advanced Security Division, IIJ

Hiroyuki Kamogawa
Data Analytics Section, Security Operation Department, Advanced Security Division, IIJ

Satoshi Kobayashi
Data Analytics Section, Security Operation Department, Advanced Security Division, IIJ© Internet Initiative Japan Inc.

13