NetFlows Next Step: Network Behavioral Analysis
Network Behavior Analysis (aka NBA) has been brewing in the NetFlow world for over a year.
By Brad Reese on Sat, 03/01/08 - 1:10am.
During the years 2006 and 2007, reporting on NetFlow collection was a very good market for software developers.
These software developers provided tools that allowed companies to rid the network of unwanted network traffic.
They aided in the isolation of computer viruses and helped stop employee abuse of the internet, however, there are more problems to find using NetFlow.
 Network Behavior Analysis (aka NBA) has been brewing in the NetFlow world for over a year. Vendors such as venture funded Lancope have helped pioneer the concept.
"StealthWatch uses behavioral learning, statistics and mathematical equations to pick up on patterns of malicious activity in NetFlow messages," said Adam Powers – CTO of Lancope. |
Early consumers have paid dearly to get in early on the technology and ROI can be difficult to solidify on a $100K investment.
 Like the first digital watch, prices will start to drop as vendors such as Plixer International enter the market.
"We are in the early stages of beta testing our NBA module for Scrutinizer," said Michael Patterson – Chief Executive Officer of Plixer International. "Security algorithms that deduplicate and sniff for behavior anomalies will be in the release." |
NBA is a technology where the NetFlow collector looks for unhealthy patterns in network traffic.
Hosts scanning the network with SYN floods or end systems receiving excessive RST/ACK packets send up a red flag and ultimately cause an alarm.
These behavior patterns exist in an area where the IDS may not recognize the problem and traditional thresholds set for byte or packet volumes won’t be effective.
End system behavior problems can come in the format of low volume traffic.
For example, a host receiving 100 host unreachable packets from the router is likely to go undetected without a NBA system in place.
Are YOU reporting on NetFlow and will YOU be ready for Network Behavioral Analysis?
| Reggie Grant Profile |
- About Brad Reese on Cisco
Brad Reese cofounded BradReese.Com Cisco Refurbished, which enables affordable Cisco networks globally by assuring customer satisfaction with guaranteed one year warranties on both Cisco Repair as well as Refurbished Cisco.
Don't be shy, contact Brad Reese online or call him at 646-827-1130.
Most Discussed Posts
- On The Web
-
Network World, Inc
The Connected Enterprise