TOP CYBER NEWS

  • HOME
  • ATTACKS
  • MALWARES
  • STRATEGIES
  • THREATS
    • Threat Defense
    • Threats Analysis

New IPS Architecture Uses Network Flow Data for …

by Top Cyber News / Wednesday, 24 July 2019 / Published in Threat Defense, Threats

Can a stream of data intended for network performance monitoring be the basis of network security? One company says the answer is ‘yes.’

Network control and management components communicate with one another through flows — information generated and collected in data’s passage through the routers, switches, and other network components scattered throughout the network. Now, a company is putting flow information to a new use: protecting the network.

Netography has launched the open beta of a service it’s calling Distributed IPS (Intrusion Prevention Service). The service uses multiple forms of flow data, including Sflow, NetFlow, and VPC flow, to analyze and act on network activity. “Switches, routers, and others are flow services,” says Barrett Lyon, Netography’s CEO. He explains that the flow data such items have generated traditionally has been telemetry data used for activities such as bandwidth management. “When we looked at it, you saw the you could use the information in there for other things,” Lyon says.

Flow Begins
The first flow format was NetFlow, introduced by Cisco in the mid-1990s to allow network administrators to analyze traffic sources and destinations, along with performance conditions and congestion causes. Roughly a decade later, the technology entered the IETF standards process. The standards-based flow is known as Internet Protocol Flow Information Export (IPFIX). IPFIX is used by a number of different network infrastructure vendors.

There are other flow services on the market, many of them proprietary services supported by a single vendor. One notable exception is Sflow, which is supported by more than two dozen vendors, including several — such as Cisco — that also have their own, proprietary flow formats.

Distributed IPS can be used to act on network flow information in several ways. “There are four ways you can do stuff with flow data,” says Lyon. “As we analyze it, we can trigger against different anomalies. That can go into an API that DevOps developers can develop actions around,” he says, checking off the first two. “You can subscribe to your blacklist feed via BGP or BGP flowspec, or subscribe to one of the other blacklists,” and then compare network traffic sources and destinations to the entries on those lists, Lyon continues.

Resolution Questions
Distributed IPS is able to detect distributed denial-of-service attacks, botnets, data extraction, login attempts, and other illicit network activity. The flows are collected and analyzed by Netography’s cloud-based engine, with actions then taken through APIs available through Netography or developed by (or on behalf of) the customer.

There are observers, though, who have questions about whether the technology developed for network control can be adequate for security. “The challenge with NetFlow is that it is very low resolution,” says Chris Morales, head of security analytics at Vectra, a company that uses artificial intelligence as the basis for its cybersecurity detection. “Think of trying to repaint the ‘Mona Lisa’ from a 1970s Polaroid photo. The resolution is too low to detect hidden threats with high efficacy.”

Flow Actions
Lyon says that one of the bigger problems Distributed IPS is hoped to solve is more human-based than technological. “A lot of companies have developed their own orchestration layers similar to this, but many of those were developed by individual developers who then moved on, taking details of how the layer works with them,” he says. That leaves the organization with a “black box” that can be difficult to update and impossible to patch or improve.

There seems little question that those black-box solutions can be less than perfect answers to security problems, and even off-the-shelf IPS products have wide differences in what they can provide for customers. “The usefulness, and thus the effectiveness, of current IDS/IPS technology varies greatly by vendor and rulesets,” says Terence Jackson, CISO at Thycotic. “The idea of a Netography’s Distributed IPS is intriguing, as it turns non-security appliances into a source of telemetry and threat intelligence. I think the idea could be a good one, but that depends on how the data will be used to work with current firewall technology on-premises and in the cloud.”

“The need for intrusion detection is absolutely real,” says Morales. And he agrees that “NetFlow seems like an obvious fit due to its ability to scale for size.” The question is whether the combination of flows that Distributed IPS ingests will provide the fine-grained resolution necessary for network security. The open beta period should help both Netography and its customers answer those very real questions.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

More Insights



Post Views: 113
Tagged under: Architecture, data, Flow, IPS, Network

What you can read next

Why Are We Still Celebrating World Password Day?
Uniqlo Parent Company Says Hack Compromised 461,091
First Full Antivirus Tool to Run …

4 Comments to “ New IPS Architecture Uses Network Flow Data for …”

  1. tinyurl.com says :Reply
    November 23, 2019 at 4:14 PM

    Quality content is the important to interest the users
    to pay a quick visit the site, that’s what this web page is
    providing.

  2. this coconut oil says :Reply
    November 25, 2019 at 10:25 PM

    Hi! Quick question that’s entirely off topic. Do you know how to make your
    site mobile friendly? My web site looks weird when browsing from my
    iphone 4. I’m trying to find a template or plugin that might be able to
    resolve this issue. If you have any suggestions, please share.
    Appreciate it!

  3. plenty of fish dating site says :Reply
    November 26, 2019 at 10:06 PM

    I think the admin of this web page is in fact working hard in support of his web page, as here every data is
    quality based stuff.

  4. Clement Iatarola says :Reply
    December 11, 2019 at 9:14 PM

    This web site is really a walk-through for all of the info you wanted about this and didn?t know who to ask. Glimpse here, and you?ll definitely discover it.

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recent Posts

  • Waking Up to Third-Party Security Risk

    You can’t rely on the words, intentions, ...
  • Intel Issues Fix for ‘Plundervolt’ SGX Flaw

    Researchers were able to extract AES encryption...
  • Trickbot Operators Now Selling Attack Tools to APT …

    North Korea’s Lazarus Group – of So...
  • What it takes to become a CISO

    The position of chief information security offi...
  • 5 Tips for Keeping Your Security Team on Target

    In nearly every security environment, competing...

Flights & Hotel Finder

Archives

  • December 2019
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • July 2014
  • June 2014
  • May 2014
  • July 2013
  • January 2013
  • May 2011

Categories

  • Attacks
  • Cyber Security
  • Malware
  • RESOURCES
  • Strategies
  • Threat Defense
  • Threats
  • Threats Analysis

Mission

We aim to provide you the most recent updates and news on cyber matters in this digital world.

Reach us via: [email protected]

© 2018. All rights reserved by Top Cyber News.
Creative Commons License

TOP