Abstract: The analysis of malware mainly focuses on the functions and behaviors of malware itself, such as C&C server connections, information leaks, backdoors, etc. However, such analyses do not consider the perspective of the threat actors. Under a targeted attack such as an APT, the actions of threat actors and attribution should be the focus of analysis. In this presentation, I firstly introduce the background of the problem, then our Behavior Observable System (BOS) for the countermeasures of targeted attack generation and some Observable Threat Actors Activities. Secondly, I introduce "BOS_2014 and BOS_2015" as the research data set of the emulated targeted attacks for MWS activities.

Abstract: In order to maintain a safety over the society of the Internet, ISPs play an important role in the proper operation of the Internet. However, cyber attacks have become more sophisticated and the Internet faces various types of security threats. As a result, providing stable Internet services becomes more difficult for ISPs. In order to provide stable Internet services, ISPs need to fight against cyber threats by collaborating with other organizations. A single organization can do only so much towards that goal. On the other hand, collaboration efforts between several organizations can potentially yield better results for the purpose of defending against large scale cyber attacks. In this presentation, I will explain the situation of ISPs who face cyber threats, as well as the roles of Telecom-ISAC Japan and ISPs’ activities through Public-Private Partnership projects. I will also show what type of cyber attack data is shared among ISPs and is being utilized for response measures..