Organizational Strength of Research Teams Help Protect Japanese Companies from Targeted Attacks

NTT Security Japan supports the cyber security response of its customers by quickly detecting signs of cyberattacks, which are getting more sophisticated all the time. This is done by advanced monitoring and attack analysis at Security Operation Center (SOC) using own proprietary detection engine with highly sophisticated threat intelligence.

Kazu Yozawa of NTT Security Holdings explains his company’s work as follows. “Each month, we capture over 800 billion logs and analyze them using machine learning at our own SIEM engine. After the SIEM engine narrow our focus down and pick up malicious indication to about one in a million data points, our analysts further narrow down and determine the threat level and kill chain stage. We then do additional analysis with EDR and reduce false positive through detailed threat hunting whenever available. Final number of reports is around 300.”

Even using AI-based security tools, however, the last line of defense is the “eye” of a highly skilled and knowledgeable analyst. Hiroki Hada of NTT Security Japan explained: “Our all SOC analysts are also involved in cyber threat research that our SOC does, we create custom signatures and IoC’s. With our IPS signatures, we were able to detect 39% of events which other security vendors tool failed to detect; also, with our EDR IoC’s, our success rate was 27%.”

A strong focus of NTT Security research activity is targeted attacks to Japanese companies. An example of our research activity is that we were the first team to discover and report the attack tool Bottle Exploit Kit (Bottle EK). Hada pointed out, “Bottle EK included checks for Japanese-language environment and time zone filtering, which foreign security vendor products are hardly detect.”

Through closer collaboration between our SOC and clients’ CSIRT, NTT aims to speed up the incident response process. Yozawa concluded with emphasis on this point: “We are committed providing comprehensive security services, built on the steady and solid research capabilities of our analysts and NTT’s unique organizational strengths.”