NetFlows Next Step: Network Behavioral Analysis
Network Behavior Analysis (aka NBA) has been brewing in the NetFlow world for over a year.
By Brad Reese on Sat, 03/01/08 - 1:10am.
During the years 2006 and 2007, reporting on NetFlow collection was a very good market for software developers.
These software developers provided tools that allowed companies to rid the network of unwanted network traffic.
They aided in the isolation of computer viruses and helped stop employee abuse of the internet, however, there are more problems to find using NetFlow.
 Network Behavior Analysis (aka NBA) has been brewing in the NetFlow world for over a year. Vendors such as venture funded Lancope have helped pioneer the concept. |
"StealthWatch uses behavioral learning, statistics and mathematical equations to pick up on patterns of malicious activity in NetFlow messages," said Adam Powers – CTO of Lancope.
Early consumers have paid dearly to get in early on the technology and ROI can be difficult to solidify on a $100K investment.
 Like the first digital watch, prices will start to drop as vendors such as Plixer International enter the market. |
"We are in the early stages of beta testing our NBA module for Scrutinizer," said Michael Patterson – Chief Executive Officer of Plixer International.
"Security algorithms that deduplicate and sniff for behavior anomalies will be in the release."
NBA is a technology where the NetFlow collector looks for unhealthy patterns in network traffic.
Hosts scanning the network with SYN floods or end systems receiving excessive RST/ACK packets send up a red flag and ultimately cause an alarm.
These behavior patterns exist in an area where the IDS may not recognize the problem and traditional thresholds set for byte or packet volumes won’t be effective.
End system behavior problems can come in the format of low volume traffic.
For example, a host receiving 100 host unreachable packets from the router is likely to go undetected without a NBA system in place.
Are YOU reporting on NetFlow and will YOU be ready for Network Behavioral Analysis?
| Reggie Grant Profile |
- About Brad Reese on Cisco
Brad Reese cofounded BradReese.Com Cisco Refurbished, which enables affordable Cisco networks globally by assuring customer satisfaction with guaranteed one year warranties on both Cisco Repair as well as Refurbished Cisco.
Don't be shy, contact Brad Reese online or call him Toll Free:
866-864-0506
International callers may wish to call Brad by dialing:
850-364-4115
- Archives
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- On The Web
Sponsored Links
- Watch a step-by-step demo of how Chinese hackers compromised brand name US high-tech companies like Google. - Zscaler
- Cisco Webcast: Leveraging 802.11n, Is your WLAN ready for Enterprise Video?- Cisco
- Turn your desk phone and mobile phone into one with Sprint Mobile Integration.- Sprint
- Discover the Four Trends Driving the Future of Data Centers - Emerson Network Power
- Visit Oberon for more information- Oberon Wireless
- Next-generation firewalls control applications and prevent threats.- Palo Alto Networks
- Troubleshoot in Minutes! Search & Report on all Network data - Free Download.- Splunk Inc.
- MoneyGram leverages Windows/Novell InteropAbility- Novell Microsoft
- VTI puts Windows & Novell interoperability to work- Novell Microsoft
- Educational Wi-Fi Reference Poster Program to help get you up to speed on Wi-Fi Standards, including 802.11n- Xirrus
-
Network World, Inc
The Leader in Network Knowledge
Security tester's take: NetFlow for endpoint security
Rodney Thayer, independent network security consultant, sees an interesting future for NetFlow.
Here's what he says:
"... seems to me that if we actually use this flow technology we could do a whole bunch of good things in network management and security. For example, it watches the network flows so you can see things such as peer-to-peer traffic, Skype and who's using your network a lot that you didn't think was. Used properly ... it would be useful for some of the kinds of things we're doing now with looking for botnets and worms, and for endpoint security, 'monitor your network' kinds of stuff."
Read more