Network behavior anomaly detection (NBAD) provides one approach to network security threat detection. It is a complementary technology to systems that detect security threats based on packet signatures.
NBAD is the continuous monitoring of a network for unusual events or trends. NBAD is an integral part of network behavior analysis (NBA), which offers security in addition to that provided by traditional anti-threat applications such as firewalls, intrusion detection systems, antivirus software and spyware-detection software.
Video Network Behavior Anomaly Detection
Description
Most security monitoring systems utilize a signature-based approach to detect threats. They generally monitor packets on the network and look for patterns in the packets which match their database of signatures representing pre-identified known security threats. NBAD-based systems are particularly helpful in detecting security threat vectors in 2 instances where signature-based systems cannot (i) new zero-day attacks (ii) when the threat traffic is encrypted such as the command and control channel for certain Botnets.
An NBAD program tracks critical network characteristics in real time and generates an alarm if a strange event or trend is detected that could indicate the presence of a threat. Large-scale examples of such characteristics include traffic volume, bandwidth use and protocol use.
NBAD solutions can also monitor the behavior of individual network subscribers. In order for NBAD to be optimally effective, a baseline of normal network or user behavior must be established over a period of time. Once certain parameters have been defined as normal, any departure from one or more of them is flagged as anomalous.
NBAD should be used in addition to conventional firewalls and applications for the detection of malware. Some vendors have begun to recognize this fact by including NBA/NBAD programs as integral parts of their network security packages.
NBAD technology/techniques are applied in a number of network and security monitoring domains including: (i) Log analysis (ii) Packet inspection systems (iii) Flow monitoring systems and (iv) Route analytics.
Maps Network Behavior Anomaly Detection
Popular threat detections within NBAD
- Payload Anomaly Detection
- Protocol Anomaly: MAC Spoofing
- Protocol Anomaly: IP Spoofing
- Protocol Anomaly: TCP/UDP Fanout
- Protocol Anomaly: IP Fanout
- Protocol Anomaly: Duplicate IP
- Protocol Anomaly: Duplicate MAC
- Virus Detection
- Bandwidth Anomaly Detection
- Connection Rate Detection
Commercial NBAD products
- Arbor Networks NSI - Arbor Network Security Intelligence
- Lancope - StealthWatch (since 2001)
- IBM - QRadar (since 2003)
- Enterasys Networks - Enterasys Dragon
- Exinda - Inbuilt (Application Performance Score (APS), Application Performance Metric (APM), SLA, and Adaptive Response)
- Extrahop
- FlowTraq
- Flowmon Networks - - Flowmon ADS
- FlowNBA - NetFlow
- Juniper Networks - STRM
- Lastline
- McAfee - McAfee Network Threat Behavior Analysis
- PacketSled - PacketSled
- PathSolutions - PathSolutions VoIP and Network Performance Manager
- Plixer International - Scrutinizer
- HP ProCurve - Network Immunity Manager
- Redsocks - The RedSocks Probe
- Riverbed Technology - Riverbed Cascade
- Solana Networks - SmartFlow
- Sourcefire - Sourcefire 3D
- Symantec - Symantec Advanced Threat Protection
- ThreatTrack - ThreatSecure Network
- GreyCortex - Mendel (formerly TrustPortThreat Intelligence)
- ZOHO Corporation - ManageEngine NetFlow Analyzer's Advanced Security Analytics Module
- Microsoft Corp - Windows Defender ATP and Advanced Threat Analytics
See also
User behavior analytics
References
External links
- Network Event Detection With Entropy Measures, Dr. Raimund Eimann, University of Auckland, PDF; 5993 kB
- Flowmon Networks - Network Behavior Analysis & Anomaly Detection
Source of the article : Wikipedia
0 Comments