2‑72 Telecommunication Radio Broadcast

Features of Traffic Generated in the Large‑scale
Events and Its Impact to the Security Operation
SUDOH Toshiaki

Large‑scale international events generate a variety of traffic including communications related to event operations
communications generated by spectators at the event and media‑related communications such as news coverage andstreaming which have different characteristics from those generated by general organizations and companies Therefore
in security operations it is necessary to consider policy definitions baseline concepts for analysis and singularity detection
methods in accordance with the characteristics of the traffic This article analyzes the traffic observed during the security
operations of the Tokyo 2020 Olympic and Paralympic Games and discusses its impact on security operations during
international events
Keywords：Tokyo 2020 Games Network Management Security Operation Traffic Analysis DNS

1．Introduction

drawn about four days after the start of the event with apeak on the sixth day and a gradual decrease within theWe analyze the characteristics of Internet traffic

estimated traffic range As shown in Figures 3 thegenerated from the network related to the Olympic andaverage daily traffic peaked at around 15 : 30 and theParalympic Games Tokyo 2020 We also analyze DNS

second and third highest amounts were recorded at 12 :traffic and discuss the impact of these characteristics on

00 and 22 : 00 p m This is due to the concentration ofsecurity measures

media‑related information and content transmission andreception during these hours The singularity at around2．Traffic Characteristics Analysis
21

Time Series Characteristics

2 : 00 and the reversal of uplink and downlink traffic
amount between 3 : 30 and 5 : 00 are also partiallyattributable to media‑related communications

Figures 1 and 2 show the traffic volume during theOlympic and Paralympic GamesIn many events the peak traffic is observed at the22

Destination Country

Table 1 shows the percentage of traffic by country

timing of the opening and closing ceremonies but theThe U S and Japan account for 84 9% and 71 3% of

Olympic and Paralympic Games do not show any

the traffic as a source and destination respectively due

remarkable characteristics and a saturation curve isto the influence of major SNS CDN and cloud services
Other common trends were seen in international events

SUDOH Toshiaki
Information Security NTT Communications Corporation
E‑mail t sudou@ntt com

where communication with CDNs media‑related andsecurity service providers etc were common

The Journal of The Institute of Electronics Information and Communication Engineers Vol 105 No 8 Supplement pp 63‑66 August 2022
© 2022 The Institute of Electronics Information and Communication Engineers

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 202063Figures 1

Figures 2

Traffic during the Olympic Games

Traffic during the Paralympics Games

Figures 3

Table 123

Average Traffic by Time Period

Traffic Volume by Country

Source%Destination%UnitedStates

45 16%

Japan

49 00%

Japan

39 74%

UnitedStates

22 31%

Singapore

1 89%

Mexico2 69%

UnitedKingdom

1 65%

UnitedKingdom

2 50%

Netherlands

1 16%

Spain

2 43%

Australia

1 10%SouthKorea

2 07%

Germany

0 90%

Netherlands

2 06%

Spain

0 82%

Malaysia

1 38%

Russia0 74%

Singapore

1 36%

France0 65%

Germany

1 23%

Other

6 17%

Other

12 99%

Transport Protocol Analysis

Table 2 shows the ratio of send/receive transport
protocols

sending and receiving and the use of other protocols for
closed connections

such as GRE and ESP

wasnegligible

The ratios of TCP and UDP were very high for both
64THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

Table 2

Transport Protocol Ratio

ReceivedTransmit

Protocol6%
63 5060%

617UDP36 1982%

1ICMP

0 2910%

47GRE

50
─

No

Receiving Port Number%

TCP

52 84489%

17

UDP

46 74986%

1ICMP

0 40227%

0 0033%50ESP

0 00255%

ESP

0 0011%47GRE

0 00042%

Other

0 0004%─Other0 00001%

Table 324Protocol

TCP

Communication Port Ratio%NoOutgoing Port Number%

1TCP

443

55 93%

1TCP

443

49 55%

2UDP44320 77%

2UDP

443

10 42%

3TCP

80

5 98%

3UDP

4500

2 02%

4UDP

3480

1 54%

4UDP

2088

1 60%

5UDP

4500

1 22%

5UDP

3480

1 55%

6UDP

3481

0 88%

6UDP

16393

1 40%

7UDP

16393

0 59%

7UDP

40000

1 11%

8UDP

33001

0 56%

8TCP

80

1 06%

9UDP

53

0 41%

9UCP

6000

0 71%

10UDP

3478

0 27%

10─

50

0 64%

Table 4

DNS Resolvers

Communication Protocol Analysis

Table 3 shows the top 10 traffic by receiving andNo

DNS Resolver

Percentage of Total Queries

sending port number with TCP443 being the most1

Designated DNS

99 55%

common accounting for 55 93% of incoming traffic and2

Public DNS

0 31%

49 55% of outgoing traffic UDP443 was next accounting

3

Secure DNS

0 02%

4

VPN/Proxy

0 02%

5

Other

0 10%

for 20 77% of incoming traffic and 10 42% of outgoingtraffic
SSL communication using TCP443 is used for various
purposes such as Web access and VPN communicationand is one of the factors that increase the percentage Inof malicious DNS use due to the execution of undesirable

addition voice and video distribution several types ofprograms as well as queries sent to specific DNS

VPNs that use different port numbers and remoteresolvers for the purpose of amplification

collaboration tools were frequently observed

We also observed a large number of DoH (DNS overHTTPS) name resolution cases which also increased

3．Analysis of DNS Communication
31

TCP443 traffic and may have circumvented normal DNS
protection

Analysis of DNS Resolvers Used

The number of DNS resolvers used during the period

4．Summarywas 5315 IPs and their classification is summarized inTable 4 In this environment the use of designated DNSThe traffic characteristics were less peculiar and moreis the basic policy which means that 99 55% of all

stable than for normal international events However

queries were protected by appropriate DNS security

there were some unexpected traffic due to changes inmeasures In addition original security measures suchthe implementation of DoH and other new communica-

as the use of public DNS paid Secure DNS VPN andtions VPNs and enhanced endpoint security features

Proxy were also observed We also observed a few casessuch as encryption Such traffic may circumvent existingSpecial Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 202065

security countermeasures and analysis techniques andtherefore

security operations that combine traffic

analysis techniques are required to detect and respond
immediately to unexpected traffic(Received February 28 2022 Revised March 7 2022)

SUDOH Toshiaki
SUDOH Toshiaki graduated from Ehime
University in 1995 with a bachelorʼs degree inelectrical and electronic engineering He joined
NTT in the same year He currently engages insecurity service development operation consulting etc at NTT Communications Corporation㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇66THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS