Azazel System for Emergency Shelters: Rapid-Deploy Portable SOC/NOC on Raspberry Pi

Azazel System for Emergency Shelters: Rapid-Deploy Portable SOC/NOC on Raspberry Pi

Speakers: Makoto Sugita, Senior Manager, Government Agency

Conference: CODE BLUE

YouTube: https://www.youtube.com/watch?v=BhZSqQKNPA0

Overview

In an era increasingly defined by both natural disasters and geopolitical conflicts, the need for robust and secure communication infrastructure in emergency settings has become paramount. Makoto Sugita, a Senior Manager at a government agency and a passionate security researcher, presented the Azazel System at CODE BLUE, a novel solution designed to address this critical challenge. Dubbed the "AzazelPi," this system transforms a standard Raspberry Pi into a Rapid-Deploy Portable SOC/NOC (Security/Network Operations Center), specifically tailored for deployment in emergency shelters and temporary medical facilities.

The core premise of the Azazel System is to provide essential network security and visibility in environments that are inherently vulnerable and often unmonitored. Unlike traditional, large-scale security solutions, AzazelPi focuses on small-scale, rapid deployment, and an active defense posture. It aims to protect the lifeline of communication for evacuees, medical personnel, and aid workers, leveraging unique tactical philosophies to control attacker actions and buy critical time for defenders.

This talk illuminates the urgent necessity for such a system by highlighting real-world risks from both natural catastrophes and cyber warfare. Sugita demonstrates how the AzazelPi, through its blend of deception, traffic control, and on-device AI, can turn a vulnerable emergency network into a resilient one, safeguarding human lives and critical operations when they are most exposed.

Background

▶ Watch: Introducing AzazelPi: Rapid-deploy SOC/NOC for emergency shelters (0:00)

The necessity for securing emergency networks stems from two primary, high-impact scenarios: large-scale natural disasters and geopolitical conflicts. Sugita presented two compelling scenarios: the potential Nankai Trough earthquake in Japan, which could cause widespread devastation from tsunamis and strong tremors, leading to numerous temporary shelters and medical facilities; and geopolitical tensions in the Taiwan Strait, where armed conflict or cyberattacks could severely impact communication and logistics across the region, including Japan, straining government and medical services and generating a large number of displaced people. In both cases, the common thread is the inevitable establishment of emergency shelters and the critical reliance on communication infrastructure.

During such crises, existing infrastructure is often the first to fail. Physical disconnections sever communication lines, while surviving connections become overloaded, leading to severe congestion and isolation. This lack of reliable information flow not only hinders victims but also critically impedes rescue and medical efforts. In these chaotic environments, temporary Wi-Fi networks are often set up, becoming an immediate lifeline for victims but simultaneously the most attractive target for adversaries.

The speaker highlighted that the vulnerability extends beyond evacuees. Rescue teams and medical professionals, such as those using the DMAT EIS (Emergency Medical Information System), often have no choice but to rely on these same fragile, improvised networks. This means both those providing aid and those receiving it share a common, unprotected attack surface. Attackers do not discriminate, targeting the network itself, thereby endangering everyone connected. Common attack vectors include setting up fake access points to trick users into connecting, intercepting communications via Man-in-the-Middle (MitM) attacks, or even manipulating information (e.g., false aid distribution notices) to control human movement. Such attacks are not mere data breaches; they directly threaten the safety and lives of those in crisis.

International incidents underscore this growing threat. Humanitarian aid networks in conflict zones are no longer just collateral damage but deliberate targets. Reports from Ukraine indicate not only malware attacks against aid organizations and NGOs but also simultaneous jamming and interference. A specific example cited the Russian-linked group EvilJinx in 2025, which reportedly stole credentials from over 20 NGOs, compromising their operations. These cases dismantle the "good faith" assumption that aid networks are immune from targeting, demonstrating that the problem of targeted shelter networks is already a grim reality in other parts of the world.

Key Findings

▶ Watch: Azazel System's unique defense philosophy: Japanese military tactics (8:00)

The Azazel System, and its Raspberry Pi-based implementation, AzazelPi, is built upon a unique set of principles rooted in Japanese tactical philosophy, transcending conventional reactive cybersecurity. Sugita defined AzazelPi as a "Cyber Scapegoat Gateway", embodying an active defense strategy.

Two core philosophical underpinnings guide its design:

1. "Pinning the enemy in the battlefield": Derived from historical Japanese Army defensive tactics, this principle advocates not merely blocking an attack but actively detaining the adversary within the engagement zone. By restricting their movement and freedom, defenders gain precious time to prepare countermeasures or facilitate critical operations. AzazelPi applies this by luring intruders into decoys and manipulating their traffic to induce delays and waiting periods, effectively controlling the pace of the engagement.
2. "Go no Sen" (後の先): This concept from traditional Japanese martial arts emphasizes seizing the initiative by reacting to an opponent's initial move. It's about observing, utilizing, and controlling the attack to gain an advantageous position. In the cyber realm, AzazelPi implements Go no Sen by detecting intrusions and then immediately activating delayed control mechanisms, allowing the system to dictate the flow of the attack rather than simply absorbing it.

These principles collectively redefine defense not as a static barrier but as a dynamic process of controlling adversary actions and buying time. The system's architecture, as detailed below, directly translates these philosophies into technical capabilities.

Beyond its philosophical foundations, AzazelPi boasts significant practical advantages:

• Rapid Deployment: A critical feature for emergency scenarios, the system can go from power-on to full operational status in approximately 90 seconds, often even less than a minute in real-world testing. This speed ensures immediate protection when every second counts.
• Affordability: The entire hardware setup, including a Raspberry Pi 5 (16GB model), an SSD, a Wi-Fi adapter, and a power cable, costs approximately 30,000 JPY (around $200 USD). This low cost makes it accessible for resource-constrained organizations and local governments, especially those who may not have extensive budgets for sophisticated security infrastructure.
• Open-Source Foundation: The software components of AzazelPi are entirely open-source, making the solution not only cost-effective but also transparent and community-driven, aligning with the project's goal of collaborative development.

These key findings highlight AzazelPi as a pragmatic, innovative, and philosophically grounded approach to securing vulnerable networks in crisis situations.

Technical Deep Dive

▶ Watch: Live demo: Detecting SSH brute force and redirecting to decoy (15:30)

The Azazel System is architected as a Cyber Scapegoat Gateway, designed to be inserted between a vulnerable emergency Wi-Fi network and critical external services. It operates on a single Raspberry Pi 5, leveraging its compact size and processing power to perform multiple security functions.

The typical deployment scenario places the AzazelPi directly in the path of network traffic. On one side, it connects to the shelter's local area network (LAN), where evacuees' smartphones, medical staff terminals, and aid workers' devices are connected via Wi-Fi. On the other side, it interfaces with external critical services such as medical systems, administrative networks, the internet, and satellite communication links.

The internal architecture of the AzazelPi is modular, comprising four main functional blocks:

1. Defense & Deception:

• Suricata: This Network Intrusion Detection System (NIDS) actively monitors network traffic for suspicious patterns and known attack signatures. It's the primary sensor for detecting anomalous behavior.
• Open Canary: This honeypot framework creates decoy services (e.g., fake SSH, HTTP, databases). When Suricata detects an attack or suspicious probe, AzazelPi redirects the attacker's traffic to these decoys, effectively luring them away from legitimate services and into a controlled environment where their actions can be observed and contained.

1. Control & Delay:

• tc command (Traffic Control) and nftables: These Linux networking tools are fundamental to AzazelPi's ability to manipulate network traffic. They are used to implement Quality of Service (QoS), traffic shaping, and packet filtering.
• Dynamic Modes: The system operates in different security postures based on the detected threat level:
• Portal: The initial, default mode, potentially involving a captive portal for user authentication (a future integration).
• Shield: Upon detection of an attack, this mode activates delays and throttling for the attacker's traffic, slowing them down and buying time.
• Lockdown: For severe or persistent threats, this mode can severely restrict or completely block the attacker's communication, though the speaker emphasized a preference for delaying over outright blocking where possible.
• Crucially, legitimate and critical communications (e.g., medical data, administrative updates) are prioritized through these controls, ensuring essential services remain functional even under duress.

1. Intelligence & Scoring:

• Mock LLM (Rule-Based): This component acts as a preliminary, rule-based processor for alerts generated by Suricata and Open Canary. It performs rapid, initial categorization and threat assessment. The speaker clarified this is a "mock" or "artificial ignorance" component, implying a simpler, deterministic logic compared to a full-fledged AI.
• Local LLM (Actual AI): For more nuanced analysis, alerts are passed to a local Large Language Model (LLM). Currently, this is implemented using Ollama running in a Docker container on the Raspberry Pi. This LLM performs deeper analysis, categorizing attack types and assigning a threat score. This score is then used to automatically escalate the system's defensive mode (e.g., from Portal to Shield, or Shield to Lockdown) and tailor the content of alerts sent to operators. The speaker noted the tuning of this component is still in progress due to the lack of real-world field data.

1. Operations & Visibility:

• Azazel Control: This custom interface, accessible via a TUI (Text User Interface) or CLI (Command Line Interface), allows human operators to manually switch modes, monitor the system's status, and review threat levels.
• Mattermost Integration: All significant events, such as attack detections, mode changes, and status updates, are automatically pushed as notifications to Mattermost, a popular open-source team communication platform. This provides real-time situational awareness to operators, who can monitor the network's health and threat landscape from a single, dedicated screen.

The network configuration involves using the Raspberry Pi's built-in wireless capabilities to create the local Wi-Fi access point (functioning as a host AP daemon, similar to OpenWrt), while an external USB Wi-Fi adapter handles the connection to the external network. This allows the single device to act as a gateway.

Regarding scalability, AzazelPi is designed for small-scale deployments, supporting around 10 users. For larger requirements, the speaker mentioned future plans for a "stripped-down" version that removes the Raspberry Pi hardware constraints, potentially involving more powerful hardware with multiple Ethernet ports, to handle higher user loads and more complex network environments.

Demo / Proof of Concept

▶ Watch: Future plans: AI-driven QoS, secure portals, user role prioritization (21:00)

The presentation included two demonstrations illustrating the core capabilities of the Azazel System.

Demo 1: Rapid Deployment Timeline

The first demo focused on the rapid operational readiness of AzazelPi, a crucial factor in emergency situations. Sugita presented a timeline showing that the system achieves full functionality—from power-on to all services being active and ready to function as a SOC/NOC—in approximately 90 seconds. He emphasized that actual tests often show an even faster startup time, typically less than one minute. This speed is vital for environments where immediate security measures are required without extensive setup time.

Demo 2: Attack Detection and Redirection Workflow

The second, more detailed demo showcased the system's ability to detect an attack, control the attacker's traffic, and redirect it to a honeypot. The demonstration involved a simulated scenario with three distinct screens:

1. Suricata Log (Red): Displaying real-time logs from the Suricata NIDS.
2. Open Canary Log (Green): Showing activity on the honeypot services.
3. Azazel System (Blue): The custom Python-based controller managing the security logic.

The workflow proceeded as follows:

• Attack Initiation: An attacker initiates a brute-force SSH attack targeting the network protected by AzazelPi.
• Suricata Detection: Almost immediately, the Suricata log screen (red) shows a significant increase in activity, indicating that the NIDS has detected the ongoing attack attempts.
• Azazel System Handling: The Azazel System controller (blue) processes the alerts from Suricata. Using iptables and routing rules, it then actively redirects the attacker's traffic.
• Redirection to Open Canary: The redirected traffic is sent to the Open Canary honeypot. The Open Canary log screen (green) then begins to show activity, indicating that the attacker is now interacting with the decoy services rather than the legitimate network resources. This demonstrates the "pinning the enemy" and "Go no Sen" principles in action.
• Attack Cessation and Reset: When the simulated attacker stops their activity, the traffic to Open Canary naturally ceases. After a predefined period of inactivity, the Azazel System automatically clears the temporary traffic control rules and redirections, returning the network to its normal operational state.
• Real-time Notifications: Throughout this entire sequence—from attack detection to redirection and eventual return to normal—the Azazel System sends real-time notifications to Mattermost. This ensures that the operator, even if not directly monitoring the system's terminal, is immediately informed of the network's security status and any active threats.
• Logging for Future Analysis: The system also maintains detailed logs, which the speaker noted could be integrated into a SIEM (Security Information and Event Management) system for more comprehensive analysis, though this would typically require more powerful hardware than a Raspberry Pi.

This demo effectively illustrated AzazelPi's ability to provide a dynamic, active defense, quickly identifying threats, containing them, and maintaining situational awareness for on-site operators, all within a compact and rapidly deployable form factor.

Defensive Implications

▶ Watch: Q&A: System cost, access point, user capacity, detection methods (34:00)

The Azazel System offers several critical defensive implications for securing emergency networks, transforming a vulnerable environment into a more resilient one.

1. Immediate & Localized Protection: AzazelPi provides an on-device, self-contained SOC/NOC that can be deployed rapidly. This fills a significant gap in emergency scenarios where centralized security infrastructure is unavailable or compromised. Its low cost and portability make it an ideal solution for resource-constrained temporary shelters and medical facilities.

1. Active Defense and Deception: Moving beyond passive detection, AzazelPi's core philosophy of "pinning the enemy" and "Go no Sen" means it actively manipulates attacker behavior. By redirecting malicious traffic to honeypots (Open Canary) and applying delays and throttling (via tc and nftables), it buys crucial time for defenders to respond, reinforce, or allow critical communications to pass unimpeded. This strategy aims to control the attacker's freedom and pace, rather than merely blocking.

1. Prioritization of Critical Traffic: In a crisis, not all data is equal. AzazelPi ensures that essential communications for medical operations (e.g., DMAT EIS), administrative tasks, and aid coordination are prioritized, even when the network is under attack. This helps sustain core services that are vital for saving lives and managing the disaster response.

1. Enhanced Situational Awareness: With Suricata for intrusion detection, Open Canary for deception, and real-time alerts via Mattermost, on-site operators gain immediate visibility into the threat landscape. The Azazel Control TUI/CLI provides a simplified interface for monitoring threat levels and manually adjusting defense modes (Portal, Shield, Lockdown), empowering local personnel to manage network security.

1. Future-Proofing through AI and User-Centric Design:

• On-device Threat Scoring: The integration of a Mock LLM (rule-based) and a Local LLM (Ollama in Docker) for threat scoring allows for automated escalation of defense modes based on the severity of detected attacks. This reduces the burden on human operators and enables quicker, data-driven responses.
• Secure Captive Portal (Planned): Future integration of a secure captive portal with QR code login for evacuees and staff aims to prevent connections to fake SSIDs and protect against phishing attempts, enhancing user security at the access layer.
• Role-Based QoS Triage (Planned): Implementing Quality of Service (QoS) based on user roles (e.g., general evacuee, medical staff, command center) will further optimize network performance, ensuring that critical personnel have the necessary bandwidth and priority. The AI would assist in proposing policies, with final decisions made by human operators.

1. Strategic Roadmap and Ethical Considerations:

• Phased Deployment: The project's roadmap outlines a progression from lab prototypes to cyber range exercises, then small-scale pilot programs with local governments and medical institutions, and finally, broader deployment and integration with national disaster Wi-Fi initiatives (e.g., 00000JAPAN) and satellite communication. The focus is specifically on under-resourced local governments, acknowledging that larger entities often have their own solutions.
• Legal & Ethical Framework: Sugita emphasized a commitment to strict guidelines:
• Defense-Only: No "hack-back" capabilities; actions are limited to delaying, blocking, and logging.
• Transparency & Consent: Clear, documented agreements with all stakeholders (local authorities, medical personnel, volunteers) regarding the system's operation and data handling.
• Privacy-Focused Logging: Logging is restricted to metadata and statistical information, avoiding the capture of personal communication content, while still providing sufficient data for defensive purposes.
• Time & Scope Limitations: Operation is strictly limited to declared disaster periods or training exercises, with severely restricted functionality during peacetime. These considerations highlight a responsible approach to deploying such a powerful tool in sensitive environments.

Key Takeaways

• Protect Human Communication: AzazelPi's primary objective is to safeguard the communication lifeline of evacuees, medical professionals, and aid workers in crisis zones, recognizing that network security directly impacts safety and the effectiveness of humanitarian efforts.
• Active Delay and Control: The system employs a unique defense philosophy, leveraging deception and traffic control to actively detain and manipulate attackers, buying critical time for legitimate operations and recovery, rather than just passively blocking threats.
• Sustain Essential Services: Even under attack, AzazelPi is designed to maintain minimum viable network services for critical functions like medical aid and administrative operations, ensuring continuity when it matters most.
• Rapid, Portable, and Affordable Security: Built on a Raspberry Pi, the system offers rapid deployment (under 90 seconds), high portability, and low cost (approx. 30,000 JPY), making it an accessible and practical solution for emergency settings.
• On-Device Intelligence and Visibility: It provides localized SOC/NOC capabilities with on-device AI for threat scoring, real-time alerts via Mattermost, and a user-friendly interface, empowering on-site operators with immediate situational awareness.
• Open-Source and Collaborative Future: AzazelPi is an open-source project actively seeking community feedback, contributions, and pilot partners to refine its design and expand its capabilities for real-world deployment.

About the Speaker(s)

Makoto Sugita is a Senior Manager at a government agency, where he primarily handles helpdesk operations within a military organization. Outside of his professional role, Sugita is a dedicated security researcher, pursuing this field largely as a hobby. He has been actively involved in information security workshops for over a decade, notably serving as a staff member for the "Information Security Workshop in Echigo Yuzawa" for approximately 10 years.

His journey into security tool development began around 2020, and he has since presented his work at various domestic events. Sugita's talk at CODE BLUE highlighted his personal passion for solving real-world security challenges, particularly in humanitarian contexts. He explicitly stated that the Azazel System and AzazelPi are entirely his personal research and development efforts, not an official project of his employer. He profoundly thanked his wife for her unwavering support, both financially and emotionally, which enabled him to pursue this research and present at international conferences like CODE BLUE, Las Vegas, and Canada, despite a lack of recognition from his own organization.