5‑9

5 Cyber Security

Cyber Security Cooperation of National
Institute to Support the Tokyo 2020 GamesINOUE Daisuke KUBO Masaki TERADA Kenjiro MORI Yoshiki
ENDO Yukiko JINGU Masato MATSUMOTO Takashi
ISHIHARA Shota MAKITA Daisuke

For the Olympic and Paralympic Games Tokyo 2020 the key issue was to ensure the security of systems related to theGames at the same time the security of organizations involved in the Games in various ways such as Japanese
government agencies local governments and critical service providers were also necessary during the Games This
article provides an overview of the cyberattack observations conducted by the National Institute of Information andCommunications Technology (NICT) in cooperation with the Tokyo 2020 Games and the results of the observations
during the Games
Keywords：Tokyo 2020 Games DAEDALUS AmpMon STARDUST Threat Intelligence

local governments and critical service providers (here-

1．Introduction

inafter referred to as “Games‑related organizations”)

For the Olympic and Paralympic Games Tokyo 2020

were also necessary during the Games(hereinafter referred to as “Tokyo 2020 Games”) theThis article provides an overview of the efforts by the

key issue was to ensure the security of systems related

National center of Incident readiness and Strategy forto the Gamesthe security ofCybersecurity (NISC) and other organizations fororganizations involved in the Tokyo 2020 Games insecuring the Games‑related organizations as well as thevarious ways such as Japanese government agencies

observations on cyberattacks conducted by the Nationalat the same time

Institute of Information and Communications Technology (NICT) in cooperation with the security operations
INOUE Daisuke (IEICE Member)
National Institute of Information and Communications Technology
KUBO Masaki (IEICE Member)
National Institute of Information and Communications Technology
TERADA Kenjiro
National Institute of Information and Communications Technology
MORI Yoshiki
National Institute of Information and Communications Technology
ENDO Yukiko
National Institute of Information and Communications Technology
JINGU Masato
National Institute of Information and Communications Technology
MATSUMOTO Takashi
National Institute of Information and Communications Technology
ISHIHARA Shota
National Institute of Information and Communications Technology
MAKITA Daisuke (IEICE Member)
National Institute of Information and Communications Technologyof the Tokyo 2020 Games
Note that the observations in this article were madeby NICT independent of the monitoring and analysis
conducted by the Organising Committee described inother articles in this special issue The events detected
by NICT were also shared with and compiled by theOrganising Committee As a result it was carefully
confirmed that there was no impact on the Gamesʼ
operations even from a different perspective

The Journal of The Institute of Electronics Information and Communication Engineers Vol 105 No 8 Supplement pp 294‑300 August 2022
© 2022 The Institute of Electronics Information and Communication Engineers

294

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

mately 1 800 people used this platform Finally about

2．Discussion Group for IR Structure andCyber Security IR Coordination Center

8 000 topics was posted on the JISP

21

operations of the Games were confirmed although some

Discussion Group for IR Structure

In 2015 the “Discussion Group for Incident Response
Structure for the 2020 Tokyo Olympic and Paralympic

As a result no cyberattacks that could affect themalicious communications

DDoS attacks

problems

with website browsing phishing etc were detected

Games” (hereinafter called “Discussion Group for IR
Structure”) was established chaired by the councillor of

3．Initiatives by NICTNISC In the group a study of a structure to promotecomprehensive security measures to ensure a stable(Note 1) (1)

NICT observed IP addresses and URLs of the Games‑in Japan was initiatedrelated organizations (including the Games‑related

From the beginning organizations such as NICT

networks provided by the Organising Committee) fromsupply of critical services

Information‑technology Promotion Agency (IPA) Ja-

July 9 to September 5

pan Computer Emergency Response Team Coordination

information to the Cyber Security IR Coordination

Center (JPCERT/CC) and Japan Cybercrime Control

CenterCenter (JC3) participated as observers in the Discussion

occurred (Figure 1)

Group for IR Structure

Since then･and cooperated in analysis when incidents･

AmpMon : Detection of DRDoS attacks against･
Cyber Security IR Coordination Center

STARDUST : Artifact analysis of malware targeting the Games‑related organizations

In 2021 after a one‑year postponement of the Games

Coordination Center (hereinafter called Cyber Security

originating from IP ad-organizations

Osaka Summit (2019)

the Cyber Security Incident Response

etc

URLs and IP addresses of the Games‑related

mony (2019) the Rugby World Cup (2019) and the G20

due to the coronavirus disease 2019 (COVID‑19)

backscatter

dresses of the Games‑related organizations

event such as the G7 Ise‑Shima Summit (2016) the
PyeongChang Olympics (2018) the coronation cere-

DAEDALUS : Detection of malicious communications

ducted by the Group for each high‑profile international

pandemic

provided observation

cyberattack

observation and information sharing have been con-

22

2021

includingdynamic and static analysis･

Threat Intelligence : Detection of threats to theGames‑related organizations based on various typesof threat intelligence

IR Coordination Center) was established as a nationalorganization to coordinate the cooperation among theGames‑related organizations based on discussions at

The following sections 3 1 to 3 5 outline each of theinitiatives by NICT

the Discussion Group for IR Structure NICT IPA
JPCERT/CC and JC3 were positioned as “Information

31

Security Related Institutions” to cooperate with the

NICT has a large‑scale darknet monitoring system

Cyber Security IR Coordination Center and observedthat observes packets arriving at about 300 000 reach-and shared information on cyberattacks regarding theable and unused IP addresses on the Internet The

Games‑related organizations

darknet monitoring system is used to detect scan

During the Games information sharing among NISCDAEDALUS

packets sent by malware‑infected hosts attack packets

Information Security Related Institutions and Games‑

containing exploit code and backscatter (i erelated organizations was conducted around the clock on

ACK packets caused by a TCP SYN flooding with

the JISP (Note 2) which has been in operation since April

spoofed source IP addresses)

2019 and ultimately 330 organizations and approxi-

SYN‑

Direct Alert Environment for Darknet And Livenet
Unified Security (DAEDALUS) is a darknet‑based alert(Note 1) Communications broadcasting finance aviation railroads
electric power gas water supply logistics credit administrative
services (local governments) sewerage airports roads marine and air
traffic control emergency reporting weather and disaster information
immigration control highways heat supply buses security travel
hospitals (to the extent of not interfering with on‑site hospital
operations) and venues

system that detects malicious activities regardingorganizations registered as alert targets The system
can detect malware infection inside organizations(Note 2)

Japan cyber security Information Sharing Platform

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020295

Figure 1

Overview of NICTʼs Cooperation During the Games

activities spreading infection outside the organizations

tion Centerand DDoS attacks on the organizations and promptly
send alerts to the relevant organizations (2)33

STARDUST

For the Tokyo 2020 Games the IP addresses of the

STARDUST is a cyberattack inducement platform

Games‑related organizations were registered withthat lures attackers such as targeted attacks and

DAEDALUS as alert targets and the status of detection

enableslong‑term(5)

observation

of

their

attackSTARDUST generates a “parallel network”

regarding the organizations was notified to the Cyber

activities

Security IR Coordination Center in real time

which is a network that elaborately simulates organizations such as governments and companies

32

In thisparallel network various servers (Web servers mailAmpMonA DDoS attack is a cyberattack that overloads theservers

file servers

DNS servers

authentication

target server or network and disrupts its services A

servers proxy servers etc ) and tens to hundreds of

DRDoS attack is a DDoS attacks that exploits DNS

PCs are in actual operation and in addition dummy

NTP

and other servers that are inappropriately

information that imitates information assets of an

exposed on the Internet as reflectors and send a largeorganization is placed on the servers and PCs making

volumes of traffic to the attack target via the reflectors

them behave as if they were a real organization When a

It is also called an amplifier attack because it amplifies

malware sample is executed on a PC called “dummy

the traffic during the reflectionnode” in the parallel network an attacker connects from

NICT

in collaboration with Yokohama National

University has proposed and operated AmpPot(3)athe outside via a backdoor installed by the malware andinfiltrates the dummy node

STARDUST enables

honeypot for observing DRDoS attacks and is conduct-detailed analysis of human‑operated attacks by observ-

ing research and development of AmpMon (4) a platform

ing the behavior of such attackers in real time

for observation of analysis and sending alert of DRDoS
attacks based on this honeypot

For the Tokyo 2020 Games NICT prepared for the
emergence of malware such as Olympic Destroyer

AmpMon is capable of real‑time notification of DRDoS

which targeted the Pyeongchang Winter Olympics inattacks based on registered IP addresses networks and2018 so as to conduct artifact analysis centered onother information During the Tokyo 2020 Games it

STARDUST

notified the DRDoS attack status regarding the Games‑
related organizations to the Cyber Security IR Coordina296

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

34

Threat Intelligenceon Slack to link alert information with relevant

Looking back on past Olympic and Paralympic Games
there have been phishing campaigns related to sponsor

information and to automate the primary triage/response for alerts

companies hacktivist activities such as DDoS attacks

Furthermore on the days of the opening and closing

against the host and participating countries that had

ceremonies of the Olympic and Paralympic Games

human rights issues and attacks on the IT infrastruc-special arrangements were made to prepare for inci-ture of the competition venues and related facilities

dents and NICT dispatched liaison personnel to the

To detect signs of such attacks NICT collected andCyber Security IR Coordination Center

analyzed Games‑related threat information transmitted
daily via social media such as Twitter In addition to
grasp the status of IT infrastructure of the Games‑
related organizations NICT utilized threat intelligencefrom sources such as Shodan (6) and routinely observed

4．Observation and Detection Results during
the Games
This section describes the observation and detection

whether or not devices and services with vulnerabilities

results by DAEDALUS AmpMon STARDUST and

were unintentionally exposed to the Internet

Threat Intelligence during the Games

35

Establishment of Analysis Team41

DAEDALUS Results

The cooperation described above was carried out by

Figure 2 shows the number of hosts detected by

setting up an analysis team within the NICT around

DAEDALUS during the Games period DAEDALUS

2015 and during the Games we established a response

detected anomalous communications from a total of 36 IP

structure consisted of analysts in the analysis team andaddresses during the period and notified approximately

some researchers

300 alerts in real time Of the approximately 300 alerts

During the Games a shift system was introduced to

22 required response For these the details of theenable each member to balance their regular work withabnormal communication were reported to the Cyber

the Tokyo 2020 Games One analyst covered from 10 : 00

Security IR Coordination Center via JISP and the sourcea m to 5 : 00 p m outside the Games period and two

hosts were requested to investigate and take action

analysts covered from the start of the Games to the end

Other alerts such as packets suspected of spoofing theduring the Games period triaging and analyzing various

source IP address (only one or two packets werealerts that occurred during the shift and sharing

observed) and packets observed due to the use of

information with the Cyber Security IR Coordination

BitTorrent (a P2P file transfer protocol) were handled

Center via the JISP and telephone calls To enable off‑

quietly after consultation with the Coordination Center

shift members to quickly grasp alerts we used Slack a

Figure 2 shows that the most significant number ofteam communication tool to notify members of alerts

hosts were detected during the period from the start ofand implemented a bot for various observation systems

the Olympic Games to the closing ceremony of the

Figure 2

DAEDALUS Detection Results

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020

297

Olympic Games In some cases the spread of infection

Regarding alerts of large‑scale attacks

was prevented by initializing the infected PC immedi-organizations were notified the alerts and appropriate

ately based on the DAEDALUS alerts

measures were taken

42

AmpMon Results

43

the target

STARDUST Results

Figure 3 shows the daily number of target IP

A malware suspected to be targeted to the Tokyo 2020

addresses of DRDoS attacks detected by AmpMon

Games was posted on VirusTotal (7)during the Games (8)against the Games‑related organizations during the

NICT obtained and analyzed the malware however itGames period AmpMon detected 1 030 DRDoS eventswas mere a simple wiper program

in total that targeted 365 unique IP addresses The

malware attacks targeting the Games‑related organiza-

figure shows that a relatively large number of attacks

tions that would require analysis by STARDUST were

were observed during the Olympic period

observed

As an example of AmpMon observation

No advanced

DRDoS

attacks that appeared to be part of OpBoycottOlympic

44

campaign by Anonymous were detected around theUsing an external threat intelligence service such as

opening and closing ceremonies of the Olympics

Figure 3

Figure 4298

ShodanThreat Intelligence Results
NICT monitored approximately 50 000 IP

AmpMon Detection Results

Threat Intelligence Detection Results

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

addresses of the Games‑related organizations

As

Figure 4 shows 843 cases (213 unique IP addresses)

References
(

)

(

)

(

)

(

)

(

)

(
(
(

)
)
)

were detected during the Games period The figure
shows that the number of detections peaked a few days
before the start of the Olympic games and gradually
decreased from there
Among the detected devices were video equipment
for domestic and foreign TV stations professional audio
equipment printers wireless access points and security appliance many of which had management userinterface accessible from the Internet without authentication Information regarding problematic devices wasshared with the Games‑related organizations

andappropriate action was taken
NICT also paid attention to anti‑Olympics posts(OpBoycottOlympics etc ) on SNS and shared information on attack statements and attack targets with the
Cyber Security IR Coordination Center

Although

AmpMon alerts coincided with the attack targets insome of the attack statements directed at Games‑relatedorganizations

there was no impact on the Games

operations

5．Conclusion
The cyberattack observation and analysis technologies researched and developed by NICT over many
years functioned effectively during the Tokyo 2020
Games We believe that the careful examination ofobservation targets and careful training in advance
between the public and private sectors led by the Cyber
Security IR Coordination Center were significant factors
in the effective functioning of the technologies

NISC, “Cyber Security Measures and Future Action Policies of theTokyo 2020 Games,” 2022.
https://www.nisc.go.jp/pdf/policy/2020/Tokyo2020houkoku.pdf
D. Inoue, M. Eto, K. Suzuki, M. Suzuki and K. Nakao, “DAEDALUSVIZ : Novel Real-Time 3D Visualization for Darknet MonitoringBased Alert System,” 9th Int. Symp. Visualization for Cyber Security(VizSec ”12), 2012.
L. Krämer, J. Krupp, D. Makita, T. Nishizoe, T. Koide, K. Yoshioka
and C. Rossow, “AmpPot : Monitoring and Defending Amplification
DDoS Attacks,” 18th Int. Symp. Research in Attacks, Intrusions andDefenses (RAID ʼ15), 2015.
D. Makita, T. Nishizoe, K. Yoshioka, T. Matsumoto, D. Inoue, and K.
Nakao, “DRDoS Attack Alert System for Early Incident Response,”
Transactions of Information Processing Society of Japan, vol. 57, no. 9,
pp. 1974-1985, 2016.
Y. Tsuda, T. Tohmine, N. Kanaya, D. Makita, H. Ushimaru, M. Jingu,
Y. Takano, S. Yasuda, R. Miura, S. Ota, T. Miyachi, M. Kamizono, M.
Eto, D. Inoue and K. Nakao, “STARDUST : Large-scale Infrastructure
for Luring Cyber Adversaries,” Computer Security Symposium(CSS2017), 2017.
Shodan, https://www.shodan.io/
VirusTotal, https://www.virustotal.com/
MBSD, “Analysis of Malware (Wiper) with Japanese File Names
Related to the Tokyo Olympics,” 2021.
https://www.mbsd.jp/research/20210721/blog/(Received April 15 2022 ; Revised May 23 2022)

INOUE Daisuke (IEICE Member)
Director General Cybersecurity Nexus
Cybersecurity Research Institute NICT He is
also the Director of the Cybersecurity Laboratory at the same institute where he is engaged
in research and development of cyber‑security
including DAEDALUS and STARDUST He issetting up an analysis team in NICT for the
Tokyo 2020 Games Ph D in Engineering
KUBO Masaki (IEICE Member)
Executive Research Engineer Cybersecurity
Laboratory Cybersecurity Research Institute
NICT He is also a member of Cybersecurity
Nexus of the same institute and an expert
member of JPCERT/CC He is the leader of theanalysis teamThe legacy of the Tokyo 2020 Games is being
reviewed and shared in various fields However thelegacy of cyberattack response is the trust among thestakeholders that was enhanced by handling various
events during the Games
NICT will continue to contribute to improving Japanʼscybersecurity by sharing the knowledge gained from theTokyo 2020 Games and continue to conduct our researchand development to provide Japanʼs cybersecurity
measures even after the Games are overAcknowledgements We would like to thank Mr
Shuichiro Takeuchi (Clwit Corporation) and Mr Yuhei
Chiba (NTT Advanced Technology Corporation) for
their assistance with the operations of the NICT analysis
team during the Tokyo 2020 GamesTERADA Kenjiro
Planning Manager Cybersecurity Laboratory Cybersecurity Research Institute NICTHe is also a member of Cybersecurity Nexus of
the same institute where he is engaged in
DRDoS attack observation and analysis During
the Games he performed alert analysis andreporting using various observation systems
MORI Yoshiki
Research Engineer Cybersecurity Laboratory Cybersecurity Research Institute NICTHe is also a member of Cybersecurity Nexus of
the same institute He is involved in darknet
monitoring and analysis and is the leader of
NICTʼs response to the Tokyo 2020 Games
During the Games he is responsible foranalyzing and reporting alerts from various
observation systems Especially during the
opening and closing ceremonies he is in chargeof liaison between NICT and NISC

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020

299

ENDO Yukiko
Senior Research Engineer Cybersecurity
Laboratory Cybersecurity Research Institute
NICT She is also a member of Cybersecurity
Nexus of the same institute She engaged in
darknet monitoring and analysis During theGames she performed alert analysis andreporting using various observation systems
JINGU Masato
Senior Research Engineer Cybersecurity
Laboratory Cybersecurity Research Institute
NICT He is also a member of Cybersecurity
Nexus of the same institute He engaged inlivenet monitoring and analysis During theGames he performed alert analysis and reporting using various observation systems
MATSUMOTO Takashi
Research Engineer Cybersecurity Laboratory Cybersecurity Research Institute NICTHe is also a member of Cybersecurity Nexus of
the same institute He engaged in malware
analysis During the Games he performed alert
analysis and reporting using various observation systems and artifact analysis

ISHIHARA Shota
Researcher Cybersecurity Laboratory Cybersecurity Research Institute NICT (seconded from Hitachi Systems Ltd ) He is alsoa member of Cybersecurity Nexus of the same
institute He engaged in livenet monitoring andanalysis During the Games he performed alert
analysis and reporting using various observation systems and information collection andanalysis using public information and threat
intelligence
MAKITA Daisuke (IEICE Member)Researcher Cybersecurity Laboratory Cybersecurity Research Institute NICT Visiting
Researcher Advanced Institute for Advanced
Studies (IAS) Yokohama National University
He is engaged in research and development ofcyber‑attack observation systems such as
AmpMon Ph D in Engineering㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇

300

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS