Insight for Enterprise
Key Bridge extended our DOCSIS toolkit to also provide network applications intelligence.
Network management and intrusion detection systems measure traffic flows.
Insight for Enterprise maps application topologies, allowing users to easily trace application behavior across the enterprise.
Key benefits include rapid identification of
- Critical infrastructure (i.e. single points of failure)
- Unauthorized applications (i.e. Bittorrent servers)
Network Applications Intelligence
Network traffic monitoring and threat detection systems are increasingly important for enterprises network operators, who face formidable challenges as system speeds increase and applications become faster and more complex.
Most network intelligence tools are designed to meet specific problems and little work has been done to bring automated anomaly detection technologies to market. We therefore developed a set of tools specifically to:
- Make no impact on a network
- Incorporate automation to facilitate quick incident resolution
- Provide comprehensive information analysis and reduction
The structure of network traffic is typically not random; it is created by the tasks initiated by computer users and by the applications they employ (e.g. a file transfer or Web page download). Packet flows are signatures of purposeful higher-layer activities that can be recognized (though possibly not predicted) in patterns of timing, source and destination IP address. For example, enterprise file servers send data with large constellations of desktop PCs via the CIFS protocol while mail servers communicate with the same set of hosts via the POP, IMAP or Exchange protocols. The predictable structure of endpoint behavior is often called temporal and spatial locality to indicate correlations over time and by geography.
Temporal locality is the concept that a connection will be repeated sometime again in the near future. This implies regular patterns (hourly, daily, weekly, etc.) in host and application behavior that can be profiled and studied. In our Phase I prototype we are able to calculate and generate graphs of any detected host’s temporal locality.
Spatial locality is the concept that the likelihood of referencing a resource is higher if a resource nearby was recently referenced. This results because related are often in close logical or physical proximity to each other.