1

Overview of Cybersecurity Research in NICT

Daisuke Inoue
Cybersecurity Research InstituteNational Institute of Information and Communications Technology (NICT)2

NICT - the sole national research institute in the field of ICT in Japan l ICT for sustainable world and human happinessl Promoting its own research and developmentl Cooperating with and supporting industry and academia

Research Topics in NICT

Japan Standard Time (JST)（Leap second on Jan 1, 2017）

Bio/Nano ICT(Self-organizing bio molecule)

Optical Communication(Peta bps class multi-core fiber)

Brain ICT(Brain-machine Interface)

Satellite Communication（Internet Satellite WINDS）Multi-lingual Machine Translation(VoiceTra)

Science Cloud（Reai-time Web of Himawari-8）

Ultra Realistic Communication(Electronic Holography)

3Remote Sensing（Pi-SAR2 image after 3.11）

Cybersecurity(DAEDALUS)

4

Cybersecurity Laboratory

5

Research Map of Cybersecurity Laboratory (since 2005)

Passive

Network Incident analysis Center for Tactical Emergency Response

NICTER
Direct Alert Environment for Darknet And Livenet Unified Security

DarknetBlogs

AssetInfoNIRVANA改弐Livenet
DNSDBNewsGProxyLog

From Security Big Data

Honeypot

Vulnerability

CURE

Alerts(targeted attack)

AmpPotEventsTo Security Intelligence
MalwareIoT
PoTSPAM

(result)

Malware(exe)

Web-based Attack Response with Practicaland Deployable Research InitiatiVENIRVANA改NICTER Real-network Visual ANAlyzer KAI-IIDAEDALUS
lobal (indiscriminate attack)

NICTER Real-network Visual ANAlyzer KAI

C&C
URL

WebCrawl
DBD

Cybersecurity Universal REpository

Large-scale Deception Framework

STARDUST(Commission Research)#Collaborative research with Yokohama National Univ. and Saarland Univ.

ActiveLocal

6

Research Topics (2021-2026)(1) Data-driven Cybersecurity Researchü Next-gen STARDUST
ü Sustainable evolution of CURE
ü AI x Cybersecurity, etc.

Security
Big DataAutomation

NewObservation
Technology(2) Emerging Security Researchü 5G/B5G security
ü Low-layer security
ü Usable security

Response

MachineLearning

Analysis/Visualization

5G/Beyond 5G

Devices

HumanCloud

Connected Car

7• マスタ テキストの書式設定– 第 2 レベル• 第 3 レベル– 第 4 レベル» 第 5 レベルNICTER- is an integrated security system for countering indiscriminate cyberattacks- based on a large-scale darknet monitoring, an automated malware analysis and their correlation

Yearly Stats of Darknet Traffic (Last 10 Years)
Year

Number of packets par year

Number of IP address for darknet

Number of packets par 1 IP address per year2013

12.9 billion

209,174

63,682

2014

24.1 billion

212,878

115,335

2015

63.2 billion

270,973245,5402016

144.0 billion

274,872

527,8882017

155.9 billion

253,086

578,7502018

216.9 billion

273,292

806,8772019

375.6 billion

309,769

1,231,3312020

570.5 billion

307,985

1,849,817

2021

518.0 billion

289,946

1,747,685

2022

522.6 billion

288,042

1,833,012

200
2,000,000
180
1,800,000
1601,600,000
140
1,400,000
120
1,200,000
100
1,000,000
80
800,000
60
600,000
40
400,000
20
200,000
00

2013

2014

2015

2016

20172018

2019

Number of packets per IP address per year

2020

2021

2022

8

Top 10 Dst Ports observed by NICTER (2022)
23/TCP
increasedagain!!
2020

2021

Dst Port

Target23/TCP

Telnet (Router, Web Camera, etc.)

22/TCP

SSH (Server, Router)

80/TCPHTTP (Web UI)

5555/TCPADB (Android Debug Bridge)

6379/TCP

Redis

2375/TCP

Docker REST API

443/TCPHTTPS (Web Server)

445/TCPMicrosoft-DS (SMB, etc.)

2376/TCP

Docker REST API

81/TCPHTTP (Home Router, etc.)(Excluding packets from large-scale scanners)

2022

9

Number of Attacking Hosts from ASEAN and JP
Results of NICTER Darknet Monitoring from Jan to Sep 2023

10

11

Challenges for Cybersecurity ResearchlData collectionücontinuous and large-scale data collection is crucial

lTalent acquisitionühow to deal with talent competition against private sector?

lImplementation to societyüonly a few domestic companies make their own products

12Challenges for AI x Cybersecurity
lGround Truthü how do we collect enough volume of labeled data?

lFalse Positive Reduction
ü true positive 99.9% → 100 thousand false positives in 100 million security alerts

lExplainable AI (XAI)ü explainability is the most important for real incident handlinglReal-time ML Enginesü security operation needs real-time and 24/7 ML engines