News Release Archives

Fig 1. Monitoring behavior patterns

During a cyber attack, the virus has to take several steps, such as infecting a targeted computer, receiving commands from the attacker, investigating the infected computer, and then illegally obtaining access rights to further expand its activities. Each of those steps also has a set of associated behavior patterns. For example, when investigating an infected computer, the attacker determines which information should be obtained and how by searching documents, finding communication routes, and checking the configuration of security measures. Mitsubishi Electric has identified about 50 behavior patterns, and has defined dedicated log analysis rules for each that allow the system to monitor suspicious activity and accurately detect a virus for preventing information leakage. While the number of new viruses each year grows astronomical, a dozen common behavior patterns are expected to evolve each year. These patterns can quickly be added to the detection system, stopping all new viruses that might seek to exploit the pattern.

Previously, it was hard to distinguish legitimate activities from a malicious cyber attack. Mitsubishi Electric's new technology defines a sequence of behaviors as a cyber-attack scenario. By using correlation analysis to determine whether a particular sequence of activities follows the scenario or not, the technology is able to distinguish between legitimate activities that follow similar patterns and actual cyber attacks.