政府计划在2027财年加强网络安全措施，以查明攻击者是否已经渗透并潜伏在电力公用事业和电信公司等关键基础设施运营商的系统中。
The government plans to bolster cybersecurity measures in fiscal 2027 to probe whether attackers have infiltrated and remained hidden within the systems of operators of critical infrastructure, such as power utilities and telecommunications companies.
政府将制定网络攻击威胁检测方法，并与私营部门企业共享，以防备紧急状态下基础设施停运可能引发的危机。
The government will develop methods to detect cyberattack threats and share them with private-sector firms in order to prevent possible crises caused by infrastructure shutdowns during a contingency.
所谓“威胁狩猎”是主动网络防御的关键方法之一，相关法律已于周四生效。政府下属的国家网络安全办公室将利用有关潜在威胁的具体信息，在虚拟环境中重现攻击，并开发和测试可供私营部门使用的威胁检测方法。
What is known as threat hunting is one of the key methods of active cyberdefense, for which related legislation took effect on Thursday. The government’s National Cybersecurity Office (NCO) will use specific information on possible threats to re-create attacks in a virtual environment and develop and test threat detection methods that can be used by the private sector.
国防部还将提供直接协助，包括应关键基础设施运营商请求派遣人员，并利用自卫队信息系统所开发的威胁狩猎能力。
The Defense Ministry will also provide direct assistance, including dispatching personnel to critical infrastructure operators at their request, drawing on its threat-hunting capabilities developed through the Self-Defense Forces’ information systems.
国家网络安全办公室和国防部已将相关开支列入2027财年的预算申请。
The NCO and the Defense Ministry included related expenses in their budget requests for fiscal 2027.
这些举措的背景是，人们担心私营关键基础设施遭到中断可能导致国家危机。
Such efforts come amid concerns that disruptions to privately operated critical infrastructure could lead to a national crisis.
美国当局于2024年估计，据认为受到中国政府支持的黑客组织“Volt Typhoon”已在部分美国关键基础设施中保持访问权限超过五年。
U.S. authorities estimated in 2024 that Volt Typhoon, a hacker group believed to be sponsored by the Chinese government, had maintained access to some U.S. critical infrastructure for more than five years.
该组织据称利用合法的管理工具规避检测，并一直隐藏行踪，以便在紧急状态下中断基础设施的运行。
The group apparently exploited legitimate administrative tools to evade detection and remained hidden so that it could halt infrastructure functions during a contingency.
然而，收集并分析威胁狩猎所需的日志需要投入人力，也会产生其他成本。
But accumulating and analyzing the logs needed for threat-hunting requires labor and incurs other costs.
日本NTT DATA自2024年起一直在其内部系统中开展威胁狩猎。即使没有收到警报，它也会基于某种特定攻击可能正在进行这一假设，对日志进行搜索，以查找可疑活动。
NTT Data Japan has conducted threat-hunting in its in-house systems since 2024. It searches logs for suspicious activity even when there are no warnings, based on the assumption that a specific attack could be underway.
负责威胁狩猎项目的公司官员中岛佑介表示：“为了扩大这项工作的规模，我们需要向管理层证明其成本效益。”
“To expand this activity, we need to demonstrate its cost-effectiveness to management,” Yusuke Nakajima, a company official in charge of the threat hunting program, said.
日本国家网络安全办公室（NCO）的一名官员表示，仅针对涉及隐性威胁的攻击做准备，不太可能说服企业高管投资此类措施。该官员指出，威胁狩猎也能帮助应对勒索软件这一企业更为熟悉的威胁，因为它会采用类似战术，例如在入侵系统后对系统进行探测。
An NCO official said that preparing only for attacks involving hidden threats is unlikely to persuade company executives to invest in such measures. The official pointed out that threat-hunting can also help tackle ransomware, a more familiar threat to companies, as it employs similar tactics such as probing systems after gaining entry.