MITSUBISHI ELECTRIC CORPORATIONPUBLIC RELATIONS DIVISION
7-3, Marunouchi 2-chome, Chiyoda-ku, Tokyo, 100-8310 JapanFOR IMMEDIATE RELEASE

No. 3002

Customer Inquiries

Media Inquiries

Information Technology R&D Center
Mitsubishi Electric Corporation
www.MitsubishiElectric.com/ssl/contact/company/rd/form.html
www.MitsubishiElectric.com/company/rd

Public Relations Division
Mitsubishi Electric Corporation
prd.gnews@nk.MitsubishiElectric.co.jp
www.MitsubishiElectric.com/news

Mitsubishi Electric Develops Cyber Attack Detection Technology
Preventing information leakage by monitoring behavior patterns typical of viruses

TOKYO, February 17, 2016 – Mitsubishi Electric Corporation (TOKYO: 6503) announced today it hasdeveloped a cyber-attack detection technology that can classify computer virus behavior into about 50
different patterns. Symantec's latest report on Internet security suggests a million new viruses are spawned
every day, but Mitsubishi Electric's new technology offers the capability of detecting even previously
unknown viruses through their behavior, preventing information leakage and its associated damages.
Conventional technology
Comparing each type of virus with dedicated reference
information

Developed technology

Attacker

Common activities among viruses(1)
(2)

(3)

Infected
Computer(2) Investigating an
infected computer(3) Illegally obtaining anaccess right to a server・・・

Server(1) Receiving commands

Receiving
behavior
pattern

Investigation
behavior
pattern
Obtainingaccess rightbehavior
pattern

Monitoring about 50
behavior patterns

12

5

6

7

8

3

4

910 11・・・・・・・・・・・・・ 50

Fig 1. Monitoring behavior patterns

During a cyber attack, the virus has to take several steps, such as infecting a targeted computer, receiving
commands from the attacker, investigating the infected computer, and then illegally obtaining access rights
to further expand its activities. Each of those steps also has a set of associated behavior patterns. Forexample, when investigating an infected computer, the attacker determines which information should beobtained and how by searching documents, finding communication routes, and checking the configuration of

1/2

security measures. Mitsubishi Electric has identified about 50 behavior patterns, and has defined dedicatedlog analysis rules for each that allow the system to monitor suspicious activity and accurately detect a virus
for preventing information leakage. While the number of new viruses each year grows astronomical, a dozen
common behavior patterns are expected to evolve each year. These patterns can quickly be added to thedetection system, stopping all new viruses that might seek to exploit the pattern.
Previously, it was hard to distinguish legitimate activities from a malicious cyber attack. Mitsubishi Electric's
new technology defines a sequence of behaviors as a cyber-attack scenario. By using correlation analysis todetermine whether a particular sequence of activities follows the scenario or not, the technology is able todistinguish between legitimate activities that follow similar patterns and actual cyber attacks.

Information investigation activity

About 50 behavior patterns

12(2) Investigating an
infected computer

56(3) Illegally obtaining anaccess right to a server

78・・・(1) Receiving commands

3

Attack scenario

4
Log correlation analysis
based on an attack scenario

910 11Attacker !

Logs

Not attacker

・・・・・・・・・・・・・ 50

Fig 2. Cyber attack detection based on a scenario

Patents
Pending patents for the technology announced in this news release number six in Japan and six abroad.

###About Mitsubishi Electric Corporation
With over 90 years of experience in providing reliable, high-quality products, Mitsubishi Electric
Corporation (TOKYO: 6503) is a recognized world leader in the manufacture, marketing and sales ofelectrical and electronic equipment used in information processing and communications, space development
and satellite communications, consumer electronics, industrial technology, energy, transportation andbuilding equipment. Embracing the spirit of its corporate statement, Changes for the Better, and its
environmental statement, Eco Changes, Mitsubishi Electric endeavors to be a global, leading green company,enriching society with technology. The company recorded consolidated group sales of 4,323.0 billion yen(US$ 36.0 billion*) in the fiscal year ended March 31, 2015. For more information visit:
http://www.MitsubishiElectric.com*At an exchange rate of 120 yen to the US dollar, the rate given by the Tokyo Foreign Exchange Market on
March 31, 2015

2/2