5‑7

5 Cyber Security

Impact Analysis of Cyberattacks to the
Critical Sites by External Monitoring
SUDOH Toshiaki

During large‑scale international events cyberattacks by attackers with various agendas occur everywhere from thereal world to the Internet and have a significant impact on the event itself and its stakeholders Attack targets are notlimited to the direct event environment but also include important sites of the host country the host municipality
sponsors and other related companies and various critical infrastructures such as transportation communication andelectricity This article analyzes the external monitoring of the Olympic and Paralympic Games Tokyo 2020 related sites
and its results and discusses effective monitoring methods
Keywords：Tokyo 2020 Games Network management Security Alive monitoring Port scan

1．Introduction

when some abnormality is detected the cause may vary
widely such as access concentration maintenance andTo monitor the heath and quality of a system it isnetwork failure Therefore it is necessary to monitor

more efficient to conduct external monitoring in which

the website for cyber‑attacks in order to grasp thethe system is actively checked from the userʼs point of

impact of cyberattacks promptly Therefore we added aview from the outside than passive methods such as log

function to quickly identify the effects of cyberattacks

analysis The same applies to detecting the damage andand conducted monitoring

impact of cyberattacks In this report we discuss theresults of monitoring by the following two systems :211

Elimination of Monitoring Environment Dependency()

Critical site monitoring using a decentralized
external monitoring systemservices for monitoring environmental dependence of()monitoring agents can be eliminated and the scale ofPort scanning by a wide‑area scanning system

By connecting multiple agents to multiple network

impact can be estimated through simultaneous detec-

2．Decentralized External Monitoring System21Monitoring Methodology

The purpose of website monitoring is to confirm
availability and quality among other aspects However

tion
212

Correlation with Cyberattack Trigger Information

By analyzing attack threats posted on SNS and attack
information obtained through malware analysis

thepossibility of an attack occurring on a monitored target
SUDOH Toshiaki
Information Security NTT Communications Corporation
E‑mail t sudou@ntt comcan be traced

The Journal of The Institute of Electronics Information and Communication Engineers Vol 105 No 8 Supplement pp 288‑290 August 2022
© 2022 The Institute of Electronics Information and Communication Engineers

288

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

Figure 1213

Example of Monitoring Screen

Correlation with Attack Occurrence Information

The occurrence of Distributed Denial of Service(DDoS) attacks in which a large amount of traffic issent from multiple computers to a target website orserver by honeypots and traffic analysis to make theservice unavailable

Figure 2Number of IPs Responding

is confirmed and a correlation

analysis is performed Check the occurrence of DDoS
attacks and perform correlation analysis
214Others

A dashboard as shown in Figure 1 will be prepared formonitoring information and Chatbot will be used for
notifications Automatic operation is also performed tocheck the alerted informationand the results ofsecondary analysis are automatically notified via Chat-Figure 3

bot
22

Trends in Response Port Numbers

Monitoring Results

We selected 48 sites related to the convention as well
as 489 important sites in Japan including governmentagencies

public organizations

work was extracted from the results of the wide‑areascanning system across Japan and was analyzed

telecommunications

broadcasting electric power transportation Internet
service providers SNS services and streaming serv-31

Consideration of the Number of Responding IPs
and Port Numbers

which are vulnerable to attacks and may be

Figure 2 shows the number of IPs with at least one

affected As a result we detected six attack threats six

port reachable via the Internet The number of uniquecases of unstable communication after detecting anIPs detected during the period was 239 with a dailyattack and two cases of failure of the Content Delivery

maximum of 179ices

Network (CDN) service used by the websites for

Figure 3 shows the number of response port numbers

efficient content delivery during the period Most of theduring the Olympic period and Table 1 shows a list ofcases were detected within several tens of minutes andport numbers As the number of users increased many

the longest was about two hours and the service itself

undesirable ports including TCP22 (ssh) and TCP23

was not affected(telnet) began to return responses but both the numberof responding IPs and port numbers gradually decreased

3．Wide‑Area Scanning System

as corrective measures were taken

Next information related to the event‑related netSpecial Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020289

Table 1

Top 10 Response Port Numbers

devices

and audio encoders were detected mostNo

Port NoService Name

Number of IPs

frequently in the Tokyo 2020 Games as well In addition180

http111

printers and wireless access points were also detected

222ssh94

Since login prompts are also displayed security meas-353dns48ures and vulnerability diagnostics for special devices

4443

https

45523

telnet2068080

http alt

1779002

Unknown

178554

Rtsp

1691935

Rtmp

16108000

Unknown

13

used in such events need to be considered

4．Conclusion
In this article

we have developed a distributed

external monitoring system and a wide‑area scanningsystem with additional functions and adjusted forcyberattacks The monitoring and investigation func-Table 2No

tions of these systems functioned effectively and led toEquipment Estimation

improved speed and accuracy of various security

Device Estimation

Number of IPs

1

Voice Encoder

113

operations from a broad perspective

2

Wireless Access Points

64

impact on sites directly or indirectly related to the event

3Routers

8

In order to further improve responsiveness we aim to

4Printers

2

achieve even more accurate security monitoring and5

Firewall2

operations by taking an approach that enhances

6

Server8

correlation between synthetic monitoring which mimics

7

Other

113

user behavior and even more security intelligence

including the(Received February 28 2022 ; Revised March 7 2022)

32

Estimation of Connected Devices

It is possible to estimate the connected devices not
only by the simple port open status but also by thebanner information sent in response Table 2 shows theestimated connected device information Many events
detect a large number of responses from audio and videoSUDOH Toshiaki
Toshiaki Sudoh graduated from Ehime University in 1995 with a bachelorʼs degree inelectrical and electronic engineering He joined
NTT in the same year He currently engages insecurity service development operation consulting etc at NTT Communications Corporation㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇290

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS