Cross-ministerial Strategic Innovation Promotion Program (SIP)

Fujitsu

1-2 Minimize Impact on Businesses by Revealing Intrinsic Threatsin Early Stages
Operation
monitoringand analysis
technologies

Support highly skilled operations that reveal, in early stages, intrinsic threatsslipped through the existing security measures and monitor and analyze suchthreats.

Technology used for measures internally taken to complement (defense in depth) the measuresagainst threats at entry and exit points
Defense in depth technology used for making intrinsic threats that have slipped through the entry/exit and endpoint
measures surface faster in order to capture such threats before the threat level is escalated

Entry/exit measures

Internal measures

Endpoint measures

Reliable detection by collatingwith threat information
at entry/exit

Faster surfacing of intrinsic threats
and threats slipped through checks

Reliable detection by collatingwith threat information at endpoints

Known threats

Known threats

Unknown threats

Known threats

Threat detection on theassumption of intrusion

Defense at the network borders

Detection of infectionin each device

Support highly skilled operation that monitors and analyzes threatsAlong with the increase in intrinsic unknown threats, highly skilled operation in Level-2/3 has increased.
Support is systematically provided for Level-1 engineers to be able to perform Level-2/3 operations.
Decision-maker for
Measures

Perspective ofMeasures
Business continuity(BCP)

Level-5

Detection of abnormalities in operation services

Responsible person
ManagerLevel-4

Detection of inhibition of the health of the overall
operation system

Risk committee（CISO）

Soundness of thesystem

Level-3

Detection of abnormal diffusion (deep intrusion) ininternal networks (ex. measures of C&C)

CSIRT

Stability of thesystem

Level-2

Detection of abnormal communication (C&C servercommunication) with external networks (ex. existence ofC&C, information leakage)

Security expert (SOC)

Identification ofinfluence area

Level-1

Detection of changes in communications within internal
networks (ex. Possibility and target area of C&Ccommunication)

Network operator(NOC)

Identification/remov
al of damage

Level-0

Notification of security threats from external networks(ex. occurrence of attacks)

Tools (devices)

Identification/remov
al of damage

Low ← Difficulty in addressing → High(Influence on business)
Low ← Defense against threats → HighThreat Detection Level (definition)

Difference from the existing technologies
Application of mathematical models that do not require prior learning in a large-scale network
Technical Factors

Existing Technologies

Technologies for the Research Theme

Detection method

Difference from past behaviors

Difference from behaviors of other devices

Detection model

Machine learning (prior learning required) Mathematical models (prior learning not required)

Applicable network

Small to large scale

Large scale

Communications to bemonitored

Monitoring for each network

Support for different devices mixed: from old tovirtualization devicesCopyright © 2020 FUJITSU Limited All Rights Reserved.

Cross-ministerial Strategic Innovation Promotion Program (SIP)

Fujitsu

1-2 Minimize Impact on Businesses by Revealing Intrinsic Threatsin Early Stages
Operation
monitoringand analysis
technologies

Support highly skilled operations that reveal, in the early stages, intrinsic
threats that slipped through the existing security measures and monitor andanalyze such threats.

Functional Cycle and Deployment of Internal Measures
Functional cycle

Technical key pointes

Collect
Accumulate

Control
Analyze

Collect

Collect

Critical infrastructure(Internal network)
Accumulate

Analyze1.
2.

Control

In a large-scale network where physical and virtual devices coexist,
a four-function cycle (collection, accumulation, analysis, control) has
been achieved.
(i) TAP collection technology of high-speed capturing at 10 Gbps from a virtualnetwork(ii) Technology of high-speed and large capacity accumulation technology at
100 Gbps(iii) Analysis technology using mathematical models that do not require priorleaning(iv) Control technology supporting highly skilled operation for measuresagainst threats

Technology of High-speed Capturing and Accumulation of Communication from Virtual Networks- Add-on technology to a virtual switch can capture highspeed packets and transfer multiple packets that aregrouped together, preventing congestion at virtual switches.
- High-speed access is achieved by reading/writing of disks
on a session basis.

Accumulate

Search processing

Virtual TAP
Transfer a group of packets

Accumulation for each session

Analysis Technology Detecting Suspicious Communication in Normal Communication-CollectanalyzeBy focusing on the regularity of communication (right figure), the types and transfer operations ofcommunication destinations are indexed for more reliably differentiating normal from abnormal communications.

-With a unique threshold adjustment method (patent pending), both increase in immediacy and decrease inaccuracy deterioration have been achieved.

-Suspicious communication, which was overlooked by the existing security technologies, has been successfully
identified. (Press released on November 29, 2019, by NEDO. Fujitsu, and NII)Time

Automatic Extraction of Influence Investigation Range by System- Communications related to suspicious
communications are analyzed and madevisible by the system to determine the rangeof investigation of the damage by threats toreduce operators’ investigation operation.

External network

Control

C&C server

i. Detected suspicious
communication (primary(iv)(i) Suspicious communication threat)(ii)(start point)
ii. Communication with the C&C
server (secondary threat)
SteppingSteppingiii.Communication with theDevicestone devicestone device
stepping-stone device server(iii)
Internal network(secondary threat)(iii) Device
iv.Communication with the SBY
C&C server (secondary threat)
C&C server

Product Roll Out Plan
Product commercialization: collection/accumulation technology in FY2019; analysis/control technology in FY2020
Contact: Network Solution Division 044-280-9861 fj-ci-procontact@dl.jp.fujitsu.com
Copyright © 2020 FUJITSU Limited All Rights Reserved.