Allot adds security option to DPI portfolio

Allot Communications today launched ServiceProtector, a new security offering that targets denial of service attacks, worms, viruses and botnet attacks using Allot’s deep packet inspection technology, along with technology from Esphion, a company acquired by Allot earlier this year.

ServiceProtector 4.0, which is available as a stand-alone solution and will soon be available as a blade in Allot’s ServiceGateway, is based on Allot’s ability to examine each individual packet in a 10 Gb/s stream at near-real-time and detect patterns of behavior that indicate problems, said Bill Mello, director of marketing for the Americas for Allot.

“Rather than taking a signature-based approach, which is what some of the current solutions do, we do what we call behavioral anomaly detection,” Mello said. “We are looking at every single packet and identifying patterns of activity that look abnormal. We can then quarantine the traffic and leave it to the service provider to determine how to handle it. Do they want to block it, rate-limit it or dump it into a specific site and then say to the user, ‘We have software that will clean your PC because it looks like you have a virus?’”

The primary benefit of this approach, Mello said, is that it avoids the time lag required to generate a specific signature for a new threat and then publish that signature for detection. By looking at every single packet, instead of using a sampling method, Allot also ensures that botnet attacks, which may use a small number of packets in a large stream, can still be detected, Mello added.

Providers can use the Allot ServiceProtector 4.0 capabilities both to clean up their networks and to offer a service to customers, Mello said. “They can offer to provide their customers with the cleansing software for free, or they can say, ‘For $2 a month, we’ll make sure you never get hit by botnet software,’” Mello said. Currently, service providers must depend on their customers to buy and implement software protection, and many don’t, making it easier for botnet attacks to proliferate, Mello said.