nicter: the Network Incident Analysis Center for Tactical Emergency Response
-- Toward a Safer and More Secure Internet Environment --
The era of safety and security
The Internet has become an integral part of our social infrastructure in recent years. Services vital to our daily lives?such as online banking and government and municipal public services?have turned the Internet into a convenient tool. On the other hand, we now see crimes associated with the Internet publicized in the news every day, such as the spread of viruses through software like Winny, unauthorized access to servers, and obstruction of services provided at specific sites.
Until now, the Internet was generally designed and implemented with a priority on being connected at all times, otherwise known as “best-effort services.” Today, however, merely being connected no longer has any special appeal, and strategies for the Internet have switched direction toward the development of services that may be accessed with guaranteed security.
The nicter project
In response to such changes in user demands, NICT has launched the nicter (Network Incident Analysis Center for Tactical Emergency Response) project. The term “network incident” here refers to activities such as unauthorized use of server programs, service obstruction (DoS attacks), data destruction or tampering, unauthorized publication of internal information, and actions leading to such activities (such as scanning). These activities may be carried out by users with malicious intent or by computers that have been infected with malware (such as viruses or worms). The purpose of nicter is to enable the early detection of such incidents, which are detrimental to networks, and to determine the quickest and most effective countermeasures.
Technologies to support nicter
Figure 1 shows the overall plan of the nicter project. The project consists of a macro-analysis phase, visualization processing, a micro-analysis phase, and an incident handling system. The functions of each will be briefly summarized below.
The macro-analysis phaseIn this network monitoring phase, various events that occur on the Internet (identified from records such as traffic data and firewall logs) are regularly collected. In this phase, automatic real-time detection of incidents is performed using algorithms such as behavior analysis and change point analysis on the acquired data.
Visualization processingTo support the intuitive detection of incidents by a human analyst, visualizations of the events are made. Figure 2 shows one example of such a visualization, in which the network traffic is displayed in a three-dimensional representation. Here, the scanning behavior conducted as a preliminary step in the attack appears with a characteristic traffic feature, and it can be used to judge the initiation of an incident and trigger the launch of detailed analysis
Micro-analysis phaseIn this phase, code analysis using reverse assembly and behavior analysis in the virtual environment is performed on samples of viruses and worms obtained in the malware sample acquisition phase to determine the behavior pattern. The information is accumulated in a database, and vaccines to create resistance to the detected malware are also produced.
The incident handling system (IHS)As stated above, the macro-analysis phase detects events associated with incidents occurring on the network, and the micro-analysis phase determines the behavior of the malware believed to be the cause of such incidents. By comparing the results of the analyses, it is possible for the incident handling system to identify the cause of an ongoing incident and thus to determine the most effective countermeasure against the detected malware.
The incident handling system provides statistical data derived from the network monitoring function and issues detailed reports on the incident’s cause and effective countermeasures to the government, public offices, communication companies such as Internet service providers (ISPs), and general users.
Future efforts
The R&D efforts up to the present have enabled the launch of the nicter system operation with the above function, although part of the system still needs to be developed. A prototype operation room (upper right-hand photo in Fig. 1) has been installed to enable traffic monitoring and development of novel analysis techniques. A test run of a part of this system was made at the Interop 2006 exhibition for network-associated instruments held at the Makuhari Messe in June 2006. The test run not only proved that the incident detection and visualization processing capacity of the system was on a level sufficient to handle the massive volumes of traffic concentrated on the Interop network, but also received high evaluations from the network operators and all those who attended the exhibition.
During this fiscal year, we plan to develop modules that have yet to be implemented, especially for the correlation analysis mechanism for micro/macro phases and malware sample collection, and to conduct studies on how to operate the nicter system effectively overall.
Fig. 1. Overall design of the nicter project
Fig. 2. 3-D representation of network traffic
Source: NICT NEWS 2006 July, The National Institute of Information and Communications Technology
MIC Announces New Competition Promotion Program 2010
Outline
The “Process Program for the Reform of the Communications and Broadcasting Field” (announced September 1, 2006) was formulated taking into consideration the “Agreement of the Government and the Ruling Party Concerning the Framework of Communications and Broadcasting” (June 20, 2006). In the program, implementation is being carried out in order on the conclusions based on the report of the Study Group on a framework for competition rules to address the transition to IP-based networks (announced on September 15, 2006) on putting in place rules for fair competition.
The “New Competition Promotion Program 2010” is a roadmap to put in place fair competition rules in the telecommunications markets by the early 2010s, and has been positioned and formulated as a concrete implementation plan for the above-mentioned “Process Program for the Reform of the Communications and Broadcasting Field.”
From the viewpoint of securing transparency, a progress report of this Program shall be compiled in July every year and submitted to the Information and Communications Council for publication.
Moreover, since there is the prospect the rapid transition of the market structures, reviews (revolving) of the Program shall be implemented while at the same time assuring transparent procedures such as invitation of opinions, as necessary.
Objectives of this program
This program is a roadmap for developing fair competition rules to be implemented by the early 2010sf in telecommunications markets and is a detailed action plan of the “Process Program for the Reform of the Communications and Broadcasting Field” (announced by MIC in September 2006).
Specifically, with a full understanding of the fact that rapid changes of market structure are occurring in the transition to IP-based networks, a comprehensive review of competition rules in the overall broadband market, while keeping in mind each layer (business domain) from terminals to content and application, shall be undertaken based on this program following the report of the Study Group on a framework for competition rules to address the transition to IP-based networks (released in September 2006). MIC shall implement concluded measures expeditiously.
Specific measures
Assurance of fair competition shall become the foundation for developing competition policies. MIC shall keep an appropriate balance between facility based competition where each carrier builds its own networks such as lines and the like, and service based competition where dominant carriers are forced to make their bottleneck facilities available to competitive carriers to provide services.
In addition, attention shall be paid to a method for assuring fair competition in response to the diffusion of the vertically integrated business model which crosses different layers.
Promotion of facility based competition(a) Opening up of line infrastructure
Simplification of procedural requirements for laying out of optical fiber on telegraph poles for installation of FTTH or FTTP (Fiber-to-the-Home/ Fiber-to-the-Premises, or “last one drop”) by competitive carriers shall be promoted so that they can install their own FTTH or FTTP utilizing the main terminal lines of NTT East/West.
Specifically, MIC shall revise the "Guidelines for the Use of Infrastructure such as Telegraph Poles and Conduits Owned by Public Utilities" (April 2001) by the end of FY2006. The simplified procedural requirements shall be incorporated into this guideline and be implemented starting FY 2007.
Furthermore, an associated follow-up system comprising participating operators and the like shall be established to review the operational status of the simplified procedural requirements. The review results shall be made public regularly (once every year), followed by modifications of the above-mentioned guidelines if necessary.
In addition, a database shall be created to keep a record of disputes with regard to these guidelines after FY2007 to promote information sharing among participating operators and the like.
(b) Opening up of optical networks in local governments
Based on “IT New Reform Strategy” (decided in January 2006 by IT Strategy Headquarters) and “u-Japan Promotion Plan 2006” (September 2006), the government has set the target to achieve eliminating areas where no broadband service is available by FY2010. To achieve the target, based on “Next Generation Broadband Strategy 2010” (released by MIC in August 2006), systems to promote broadband deployment shall be established on national and regional levels consisting of relevant entities (carriers, the national Government, prefectures, municipalities and the like.)
From the viewpoint of promoting business development implemented by carriers through utilizing optical fiber networks owned by local governments, the “Standard Procedure concerning the Opening of Optical Fiber Networks Maintained and Owned by Local Governments to Telecommunications Carriers” (July 2002) shall be made known to the people concerned through the above-mentioned promotion systems. At the same time, further opening up of optical fiber networks owned by local governments shall be promoted by a variety of measures including the review of the operational status of how the portion of the optical fiber owned by local governments are utilized shall be made to provide the latest information by summer 2007.
(c) Promotion of diversification of access networks
Active introduction of new wireless access technologies shall be promoted, such as introduction of high-speed wireless LAN systems in the 5GHz band and BWA (Broadband Wireless Access) systems using the 2.5 GHz band. In addition, the necessary provisions shall be developed for fixed broadband services such as CATV as necessary.
(a) Establishment of Competition Safeguard System
In the transition of network structures from PSTN to IP-based networks and advances in market integration, a review shall be required concerning the application of dominant regulations by accurately reflecting the actual status of the markets.
To this end, a Competition Safeguard System shall be established starting FY 2007, where the coverage of designated telecommunications facilities including the platform function (authentication and charging systems, Quality of Service (QoS) control functions and the like) are to be reviewed periodically (once every year). Along with this review, the effectiveness of fair competition requirements relating to the NTT Group (including conditions relating to the approval system of NTT East and West's business expanding relief in Item 5 of Article 2 of the NTT Law) are to be reviewed. Before launching the Competition Safeguard System, the “Guideline concerning the Application of Competition Safeguard System” shall be formulated by the end of FY2006.
The review results on the competition safeguard system shall be reported to the Information and Communications Council (an advisory group to the Minister of Internal Affairs and Communications). In this review process, results of the existing “Competition Review” separately implemented every year shall be taken into consideration as much as possible.
(b) Development of competition rules to prevent abuse of joint or collective market dominance
From the viewpoint of ensuring appropriate application of the dominant regulations, the collective business operations of NTT East/West and its subsidiaries and affiliates shall be reviewed with detailed information on the actual status, and then necessary measures shall be taken as appropriate, such as establishment of competition rules.
(c) Comprehensive review of designated telecommunications facilities systems
Based on the move toward market integration along with transition to IP-based networks, a comprehensive review of designated telecommunications facilities systems (dominant regulations) shall be undertaken from the viewpoint of promoting the appropriate application of the dominant regulations. The considerations shall be undertaken along with a study on network neutrality (See (7) in the following).
Specifically, a framework to replace the current system is outlined as the process where the market definitions shall be made through competition review process and a system to recognize the existence of market dominance in each defined market. Based on this framework, more detailed systems shall be developed as much as possible by the end of FY 2007 and then the necessary systems shall be formulated as soon as practical for their application to be started by FY 2010.
(d) Consideration of fair competition requirements concerning the alliance between NTT East/West and NTT DoCoMo
With respect to Fixed Mobile Convergence (FMC) service provision in the alliance between NTT East/West and NTT DoCoMo, a requirement for ensuring fair competition shall be considered based on the application by NTT East/West and NTT DoCoMo within the procedure of the approval system of NTT Eastfs and West's business expanding relief.
To enhance policy predictability, the basic concept for securing fair competition regarding the case shall be organized by summer 2007, with a review of the “Fair Competition Guideline in relation to the Expansion of the Business Scope of NTT East/West” (December 2001).
(e) Establishment of interconnection rules concerning the Next-Generation Networks (NGNs) of NTT East/West
Based on the fact that NTT East/West aims to start full-fledged commercial services using NGNs from the latter half of FY2007, a study group to consider the framework of the interconnection rules concerning the NGNs of NTT East/West shall be set up in order to assure an environment for competitive carriers to commence provision of their services using NGNs without delay, keeping in mind the study to be concluded considering the timing for NTT East/West to launch full-fledged commercial services.
Any conclusion at the study group shall be formulated into interconnection rules after deliberation by the Information and Communications Council whenever necessary.
At the same time, with respect to the local IP-based networks of NTT East/West described as designated telecommunications facilities, the appropriateness of its designation shall be considered giving attention to the specifications on establishment of NGNs.
(f) Review of accounting system (Interconnection accounting and accounting by services)
Amid the transition of network and market structures, reviews of accounting systems shall be required in order to address such a transition of the environment. To this end, a study group to examine the framework of accounting systems in the telecommunications business (interconnection accounting and accounting by service) shall be established, with recommendations to be achieved by summer 2007, and with establishment of the necessary systems.
(g) Other matters related to interconnection rules
In addition to the above, from the viewpoint of taking specific measures to improve interconnection rules, reviews shall be undertaken, such as a review of collocation rules, preparation of rules concerning indoor wiring work, and reviews of handling information regarding the name of the owner of the line.
To this end, consultation of specific proposals concerning reviews of rules shall be invited from participating businesses, and reasonable proposals shall be selected and required rules formulated in accordance with the proposals.
As for the above-mentioned policy developments, they shall be deliberated in the Information and Communications Council with measures to be taken by summer 2007.
Review of calculation method for interconnection charges of NTT East/West(a) Review of Calculation Method for Calculating Interconnection Charge of PSTN
The calculation method for interconnection charges of PSTN (the current rules apply for three years FY2005 - FY2007) shall be deliberated in the Information and Communications Council, with recommendations to be achieved by the end of 2007.
At that time, specific recommendations concerning the framework of interconnection charge calculations for FY 2008 and FY2009 shall be achieved, and the basic direction concerning the framework of interconnection charge calculations from FY2010 onward shall be considered with certain recommendations to be achieved.
(b) Review of calculation method for interconnection charges for fiber optic networks
The interconnection charge for optical fiber currently is calculated by the forward looking cost method, in which seven years (from FY2001 to FY2007) are used as the calculation period.
As for the review of the calculation method, basically, a specific study shall not take place until the submission of an application to MIC by NTT East/West. At that time, study shall be conducted from a variety of perspectives, including the frameworks of the calculation methods, verifications of the number of core wires in operation, close inspection of prior investment costs in relation to equipment investment costs, verification of the life of optical fiber, responses to equipment investment risks due to competitive carriers and the like, followed by deliberation by the Information and Communications Council with recommendations to be achieved as soon as practical.
(c) Calculation method for interconnection charges in relation to NGNs
The calculation method for interconnection charges in relation to NGNs of NTT East/West shall also be considered in the study group to be held for considering the framework of interconnection rules regarding NGNs.
(d) Other
The preparation of application rules of the Stack Test and the review of the ex-post intercarrier compensation system and the like shall be deliberated at the Information and Communications Council, and then the necessary systems shall be prepared from those that can be put into practice by summer 2007.
(a) Revision of the "MVNO Business Guideline"
From the viewpoint of promoting further revitalization of the mobile communications market through the promotion of new market entry by MVNOs (Mobile Virtual Network Operators), the "The Guideline related to Application of Telecommunications Business Law and of the Radio Law" (June 2002) shall be revised by the end of 2006 in order to clarify the technological specifications of MNOs (Mobile Network Operators) and the conditions for transactions as well as clarification of legal status of MVNEs (Mobile Virtual Network Enablers).
(b) Review of terminal authentication system
From the viewpoint of promoting improvement in the international competitiveness of the overall IT industry in Japan through early realization of ubiquitous networks that assure openness, and through the world’s leading product development and initiatives in international standardization, a study group for examination and study shall be set up by the end of 2006 to take up the subject of the basic functions of terminal devices compatible with IP-based networks, and the frameworks for authentication systems, with recommendations to be achieved by the end of 2007.
(c) Review of business models in mobile markets
A study group shall be established to consider a diverse number of future visions and the business models in mobile markets including each of the layers from the viewpoint of ensuring and developing user benefits in mobile markets by promoting competition, and also to consider the framework of the business model in mobile markets including terminal sales incentives, SIM (Subscriber Identity Module) locking and the treatment of User ID with recommendations to be archived by around summer 2007.
Amid the emergence of diverse business models and diversification of tariff systems, the framework of the current price cap system shall be reviewed and studied together with the review of the Universal Service System. (See “Review of Universal Service System” below)
The price cap system shall be studied taking into account that a review of the standard tariff index (the current index is applied for three years starting October 2006) is scheduled for FY2009.
In addition, amid the multiple emergence of new tariff systems, from the viewpoint of facilitating protection of user interest, information concerning inappropriate cases regarding tariff settings should be collected and guidelines formulated by referring to the cases, while at the same time undertaking examinations as necessary concerning preparation of the legal system for user protection and development of standard tariff baskets, and the like.
Review of universal service systemAmid dramatic changes of market structures, such as the spreading of broadband services, essential to be considered is a review of the Universal Service System to secure the spread of fixed telephone services nationwide, which is now a telecommunications service indispensable for national life.
To this end, a study group shall be established to consider a number of assumed alternatives (“feasibility study”) in order to review this system, with recommendations to be achieved by the end of 2007.
A full review of the system shall be conducted taking into account the government’s policy of eliminating broadband-zero areas (elimination of areas without broadband access), and based on the above-mentioned study recommendations, actual system conditions, and the like, through a discussion within the Information and Communications Council in 2009, necessary system preparations shall be implemented as soon as possible.
Study concerning the framework for network neutralityIn the transition to IP-based networks, a study shall be undertaken concerning the framework for network neutrality, such as fair usage of networks (neutrality of the communications layer to the other layers) and fairness in cost sharing for the networks (neutrality of the cost sharing model for increasing network capacity).
To this end, with the principle of network neutrality as a mainstay, a study group for study and discussion shall be established from the viewpoint of identifying and organizing the issues for study in terms of competition policies on the assumption of full-scale transition to IP-based networks. This study group shall be attended by various concerned carriers and parties spanning wide-ranging fields, with the first recommendations to be achieved by summer 2007.
Based on the first recommendations, final recommendations shall be achieved by summer 2008.
Strengthening dispute settlement functionsWith the prospect of diversification of business models along with the transition to IP-based networks, strengthening of dispute settlement functions shall be promoted in order to promote smooth dispute resolution as soon as practical in broadband markets.
Specifically, with respect to submission of complaints or opinions iArticle 172 of The Telecommunications Business Lawj, a mechanism shall be introduced not to disclose information that can identify the person who submitted the complaint, in case reasonable evidence is found that the secrecy of the individual must be protected. Guidelines on the mechanism shall be formulated by the end of FY2006.
Furthermore, with respect to the expansion and replenishing of the scope of handling dispute settlement functions, the necessary system shall be prepared as soon as practical, for example, by enabling the dispute settlement functions to handle disputes between telecommunications carriers and business operators in a higher layer such as content providers. In addition, part of the functions should be a mechanism capable of intermediary action and mediation in addition to the current function of arbitration ruling concerning the use of land and the like (including telephone and electric poles, ducts, and the like.).
Review of market exit rulesWith respect to suspension and cessation of business activities of telecommunications carriers, based on the fact that this is not only due to the judgments of the management of relevant carriers, but also partly depends on the responses of interconnection operators (interconnection carriers), certain rules shall be established concerning safeguard measures (such as a deposit system) against market exit, with guidelines to be formulated by the end of 2006.
OtherAmid the transition to IP-based networks, in addition to secure further transparency of competition rules, the continuous review on the framework of telecommunications numbers shall be undertaken at study groups such as the Information and Communications Council, and the like.
Furthermore, administrations shall be actively involved in new international issues that arise as necessary, and from the viewpoint of assuring international conformity in competition rules, positively engage themselves in raising voices and diffusing information concerning policy trends not only in multilateral policy consultations such as OECD, ITU, APEC and the like, but also in bilateral policy consultations, so as to promote cultivation of consensus among regulatory authorities charged with making policy decisions in individual countries.
Follow-ups of this program
From the viewpoint of securing transparency, a progress report of this Program shall be compiled in July every year and submitted to the Information and Communications Council for publication.
Moreover, since there is the prospect the rapid transition of the market structures, reviews (revolving) of the Program shall be implemented while at the same time assuring transparent procedures such as invitation of opinions, as necessary.
Based on the status of progress of this Program, comprehensive review of the legal system pertaining to overall telecommunications legal systems shall be implemented in 2010.
Reference
In the Agreement of the Government and the Ruling Party Concerning the Framework of Communications and Broadcasting [20 July 2006], the telecommunications area is mentioned that “From the viewpoint of realizing high-quality and low-cost information and communications services, for example, required fair competition rules such as openness of networks shall be prepared”, and that “With respect to NTT’s status issue, they shall be examined at the timing of 2010 after conducting close observations of the status of the spread of broadband services and the actions based on medium-term management strategy of NTT, and then recommendations shall be made as soon as practical”. It is also mentioned that “With respect to the comprehensive legal system concerning telecommunications and broadcasting, examinations shall be started as soon as practical with the premise of maintaining the mainstay broadcasting concept, with conclusions to be achieved by 2010.”
In response, “Basic Policies for Economic and Fiscal Management and Structural Reform 2006” (7 July 2005, Approved by the Cabinet) mentions that “Based on eAgreement of the Government and the Ruling Party concerning the Framework of Communications and Broadcasting’, with full understanding of the world conditions, reform will be promoted in the telecommunications and broadcasting areas.”
State of Subscriber Numbers for Telecommunications Services (End of June 2006)
Outline
Fixed communications(1) Fixed-line phones and ISDN
The total number of subscribers for fixed telephone and ISDN was 57.452 million as of the end of June 2006.
Telephone services using NTT East and West’s metal lines (dry copper telephones) are showing steady growth.
In addition, the number of subscribers to CATV telephone topped 1.0 million as of this calculation.
(2) Usage numbers for IP telephones
The number of IP telephone users as of the end of June 2006 stood at 12.097 million, an increase of 34.2% year on year and continuing on an upward trend.
Furthermore, the number of subscribers to 0AB-J IP telephone topped 2.0 million as of this calculation.
(1) Cell phones and PHS
The number of subscribers to cell phones and PHS totaled 97.639 million, an increase of 5.5% year on year and continuing to show an upward trend.
(2) Pagers
The number of subscribers to wireless pocket pages as of the end of June 2006 stood at 474,000, showing a continuing decline.
(1) Fixed-line phones and ISDN
The total number of subscribers for fixed-line phone and ISDN was 57.452 million as of the end of June 2006, a drop of approximately 1.0% compared to the end of FY2005 (March 2006).
The particularities of this survey included that dry copper telephones within subscriber telephones topped 3.0 million, and CATV telephones topped 1.0 million.
* With regard to figures for the end of FY2005, data were corrected following close examination
NB-1: Dry copper telephones: NTT East and West’s telephone service using metal lines
NB-2: These subscriber numbers do not include the numbers registered for My Line
NB-3: Figures in parenthesis show year on year increase or decline. Furthermore, there is no previous year data for the end of June 2006 so the rate of change is compared to the end of FY2005 (end of March 2006)
NB-4: Quarterly data has been collected since September 2005
(2) Number of IP telephone uses
There were 12.097 million IP telephone uses as of the end of June 2006, an increase of 5.6% over the previous fiscal year (compared to March 2006), and an increase of 34.2% year on year (compared to the end of June 2005), showing a continuing upward trend.
Also, the particularities of the results of this survey were that users of 0AB-J IP telephones increased noticeably and topped the 2.0 million mark, showing that it is being used by over one third of FTTH subscribers (approximately 6.3 million at the end of June 2006).
On the other hand, there has been a slowdown in the increase in users of 050-IP telephones.
Note 1: This is the sum of telephone numbers for 050 and 0AB-J in use by end-users and not the exact number of subscriptions.
Note 2: Also, with regard to numbers for FY2003, these were calculated from a survey based on the FY2004 implementation details concerning the Evaluation of the State of Competition in the Telecommunications Business Field.
Mobile communications
(1) Cell phones and PHS
The number of subscribers to cell phones and PHS totaled 97.639 million as of the end of June 2006, an increase of 5.5% year on year. Penetration among the population stood at 76.4%.
The number of cell phone subscribers stood at 92.869 million and the number of PHS subscribers was 4.77 million.
* The population used to calculate population penetration rates is the nationwide population (computed population) based on the 2005 national population census announced by MIC in October 2005.
(Reference) The number of subscriptions to mobile terminal IP connection services (as of the end of June 2006) stood at 80,735,462 (86.9% of all cell phone subscriptions) (* Calculated from i-mode, EZweb and Vodafone Live!)
(2) pagers
The number of subscribers to pages as of the end of June 2006 stood at 474,000, a drop of 19.2% year on year.
