|
|
|
|
|
TOKYO, May 16, 2016 - (JCN Newswire) - Fujitsu Limited today announced that it has worked with BAE Systems--one of the largest US defense companies offering comprehensive threat analytics capabilities for managing threat intelligence, detecting and investigating unknown cyber threats, advanced persistent threats, and zero-day attacks--to develop a cyber threat intelligence (CTI) utilization system, which efficiently utilizes CTI, the details of cyber-attacks and responses in a computational format.
This system merges BAE Systems' meta-modeling technology(1), which makes CTI sharing easy, Fujitsu's automation technology, for efficient cyber-attack response, and cyber-attack response know-how being developed by both companies since 2015. The system offers CTI sharing function that enables secure and easy CTI sharing between organizations and CTI generation function, which brings together multiple CTI pieces into a more comprehensive CTI.
The aim of this system is to share knowledge related to cyber-attacks between various organizations and companies, and to offer a structure whereby effective responses are taken efficiently. It will provide functions to make it safe and easy to share CTI, and that make it possible to generate and utilize more advanced CTI by fusing multiple CTI sources.
This system will enable cyber-attack analysts(2), even those with little experience, to rapidly provide high-quality analysis and strong responses. Going forward, this system will be utilized and improved in the field, such as at the Fujitsu Advanced Artifact Analysis Laboratory(3), which is a facility providing advanced security analysis for the Fujitsu Group. Fujitsu plans to commercialize the technology in fiscal 2016.
Fujitsu is working hard to build a safe and secure ICT environment by promoting the spread of this system, contributing to the advancement of cyber-attack analysis and responses.
Background
The threat of cyber-attacks is expanding in line with the spread of computer systems and the Internet, but there is a lack of high-level cyber-attack analysts who can respond to difficult-to-detect cyber-attacks using sophisticated methods. As such, there is an increasing need for methods and technologies to efficiently utilize analysts' know-how and techniques in as many fields as possible.
CTI is created when high-level analysts put the results of their cyber-attack analysis, including the essential details of the attack (including attacker information, time, likely objectives, attack targets, and intrusion paths and methods) as well as information on response methods, into a computational format. In reality, government institutions, large companies, and even individual analysts create their own unique CTI, using it in cyber-attack responses.
By further advancing the use of CTI, integrating multiple sources of CTI, and creating CTI with even more cyber-attack and response information, it is now possible to do relational analysis between cyber-attacks, which could not be done with just one CTI source, and create more effective cyber-attack responses.
In the US, in order to promote the sharing of CTI between organizations and companies, new legislation is now in place and standardization is moving forward, including CTI frameworks and CTI information representations and protocols standards from the OASIS CTI Technical Committee(4).
About the CTI Utilization System from Fujitsu and BAE Systems
The CTI utilization system developed with BAE Systems offers the following functions.
1. Functions to safely and easily share CTI among businesses and organizations
When exchanging CTI between all sorts of organizations and companies, CTI sharing policies, which determine what sort of information is shared, are established on the basis of each company's or organization's information security policies. Then, on the basis of the CTI sharing policy, information that can be shared is extracted from their CTI, then shared through email or other methods. As a result, methods of extracting information from CTI become individualized, creating a problem in that it is difficult to extract information in a way that accurately follows the CTI sharing policy. In addition, because it is necessary to convert and store information shared through email in a format that can be used by the system, causing a lack of active CTI sharing.
The newly developed system provides a function to transmit and receive CTI information in a standard format established by the OASIS CTI Technical Committee, as well as an information extraction function that accurately implements CTI sharing policies.
2. Functions to create and use advanced CTI
1) Sample similarity scoring system to find similar malware
This system determines the similarity between multiple pieces of malware based on the structure of malware executable files obtained as samples and the characteristics of their behavior. This makes it possible to easily discover the relationship between similar cyber-attacks.
2) CTI graph analytics and editing
This system includes a function to display an overview of the constituent elements of cyber-attacks recorded in CTI information, including essential details (including attacker information, time, likely objectives, attack targets, and intrusion paths and methods) and response methods, and displays a diagram of the relationship between these elements. By extracting cyber-attacks with elements identical or similar to the original attack and displaying them side-by-side as related cyber-attacks, this system makes it possible to visually study the relationship between them. By lining up diagrams of multiple cyber-attacks, it becomes easier to discover cyber-attack elements, such as attacker information, which would previously have been difficult to find.
3) Secure private translation to support CTI sharing with European and American organizations
Because CTI information is recorded in the language of the country where it is created, translation is necessary before it can be connected with CTI created in other countries. Because using a translation function provided online would mean putting the cyber-attack information that is to be translated onto the internet, there is a possibility that attackers might detect that their cyber-attacks have already been analyzed and are being shared as CTI. In order to avoid this and to promote incorporation of CTI created in English in the US and Europe, where cyber-attack responses are very advanced, this system is equipped with a translation function of English-to-Japanese translation completely within the system.
4) Automation engine to allow efficient, advanced analysis
This system is equipped with a function that suggests analysis and response methods it thinks appropriate, based on the malware and IP addresses that come up in the analysis. This makes possible simple and rapid responses to a cyber-attack.
3. A strong partnership with BAE Systems
US defense industries have extensive experience protecting their data from advanced cyber-attacks. Through dealing with such attacks, they have accumulated know-how and established capabilities for cyber-attack analysis and response. In particular, BAE Systems has operated its Global SOC(5) for many years and with efficient security processes that enable effective security with a minimal number of senior analysts.
BAE Systems leverages their heritage in data analytics and draw upon their extensive experience gained in providing cyber protection to governments and businesses worldwide. BAE Systems offers comprehensive threat analytics capabilities to manage threat intelligence, detect and investigate unknown cyber threats, advanced persistent threats, and zero-day attacks.
Fujitsu will continue this partnership with BAE Systems and refine the system toward commercialization of this technology.
(1) Meta-modeling technology
This consists of well-known mathematical and computer science tools that enable machine readable representation of real-world entities and events. BAE Systems has more than 10 years of experience in applying meta-modeling technology to areas like cyber threat understanding, business processes, and software engineering.
(2) Cyber-attack analyst
Responsible for analyzing and addressing cyber-attack in the government, in a large company that has Security Operations Centers (SOC) or Computer Security Incident Response Teams (CSIRT), or in a large company seeking to enhance its security monitoring and operations.
(3) Fujitsu Advanced Artifact Analysis Laboratory
Jointly established by Fujitsu Limited and PFU Limited in Tokyo and Yokohama on November 18, 2015, this facility brings together and analyzes security information on a global scale.
(4) OASIS CTI Technical Committee
A technical committee of the OASIS (Organization for the Advancement of Structured Information Standards) standards organization that is responsible for formulating the three CTI sharing standards: CybOX (Cyber Observable Expression), STIX (Structured Threat Information Expression), and TAXII (Trusted Automated Exchange of Indicator Information).
(5) Global SOC
As the 3rd largest global defense contractor, with business in over 100 countries, BAE Systems, Inc. is the US part of BAE Systems plc (UK). As such, the company operates a Global SOC to manage and protect its corporate network.
Contact:
Fujitsu Limited
Public and Investor Relations
Tel: +81-3-3215-5259
URL: www.fujitsu.com/global/news/contacts/
Fujitsu Laboratories Ltd.
ICT Systems Laboratories
Server Technologies Lab
E-mail: Retimer_ISSCC2015@ml.labs.fujitsu.com
Topic: Press release summary
Source: Fujitsu Ltd
Sectors: Cloud & Enterprise, IT Individual
https://www.acnnewswire.com
From the Asia Corporate News Network
Copyright © 2024 ACN Newswire. All rights reserved. A division of Asia Corporate News Network.
|
|
|
|
|
|
|
|
