Botnet Filter & Statistics Module

Overview

It’s well-known that the threat of cyber attacks, such as denial-of-service or spam, which can paralyze a site, is a harsh reality of doing business in today's technological world. As a service provider, government, or large enterprise, the cost to your organization from an attack can be excessive in many ways, beyond short-term financial, as hackers quickly take advantage of network vulnerabilities. For this reason it is essential to implement protection against malicious network attack mechanisms. One of the more insidious attack mechanisms that has caused massive disruption in recent times are botnets.

A botnet is a global network of infected "slave" computers, possibly hundreds of thousands or millions in number, all controlled by rogue servers that are adept at hiding their locations and existence. These servers provide instructions to compromised PCs to initiate a unified attack on a target network site, possibly a distributed denial-of-service (DDoS) attack. The best defense is early detection and rapid response, ideally before the attack even takes place.

Why traditional defense mechanisms don’t work

Timing. One of the typical approaches to dealing with botnets is to inspect Internet traffic in a network and identify communications occurring with a database of known or suspected botnet command and control hosts (i.e. blacklisting). Typically, an organization will receive periodic database updates from its central processing division (or third-party data feeds) that have taken the time to analyze and announce the latest cyber threat. These list-classification methods are limited by the accuracy and timeliness of the list, and may introduce an unnecessary time lag in implementing protective measures.

Furthermore, sophisticated botnets, utilizing fast flux techniques to obfuscate their location are not amenable to fixed list identification approaches.

Technique. Another standard approach to detecting botnet activity is to examine network traffic for specific activities coming out of suspected proxy PCs. While this approach may catch the botnet as it is involved in performing an attack, it is deficient in detecting botnets as they are still forming.

Location. Some DNS servers have software features to help detect suspected botnet traffic passing through them. Even if the DNS servers in your network have these features, botnets may simply be bypassing them and using other DNS servers outside your network.

Response. If you are relying on traditional techniques, by the time botnet activity is detected on your network, your ability to mitigate infection is greatly reduced, if not already too late. While you may be able to contain the attack or prevent its spread beyond the local network/segment, the local resources are still consumed by the attack.

The expressXG^™ Framework solution provides an innovative, scalable approach to network security

The best defense against botnets and other malicious software is rapid, early detection that enables a swift response. The Botnet Filter and Statistics Module gives you the ability to do this in a powerful, scalable way that the traditional list-classification methods can’t match. Take action to secure your network by using the expressXG Framework solution.

Its main features and benefits include:

Available Platforms

The expressXG Framework from AdvancedIO Systems runs across a variety of platforms, bringing high performance and scalability to networks of variable size. Its transparent porting capability safeguards a company's investment in application development.

Benefits

Features

Applications