Mar 28, 2005 12:00 AM,

ARBOR CREATES CARRIER GROUP TO SHARE NETWORK ATTACK INFO

By Tim McElligott

Many vendors organize customer alliances, but with a sizable market share in intrusion prevention and with security as its focus, Arbor Networks' Fingerprint Sharing Alliance, launched this week, may prove a necessary group for carriers.

More on this Topic

Industry News

Blogs

Briefing Room

Founded in 2001, Arbor Networks has grown quickly into a market leader in the field of intrusion prevention. With the launch of the new alliance, participating carriers — Arbor Networks customers — will be able to automatically share detailed attack profiles or information about malicious network traffic — so-called fingerprints — with other carriers.

“We formed this alliance of service providers around the globe in order to form a community to share information about threats and to mitigate them at their source,” said Tom Schuster, Arbor Networks president.

Sharing knowledge of attacks happens all the time, but it is ad hoc, informal and often back-channel stuff, said Jim Slaby, senior analyst with Yankee Group. “This is a way of bringing the network-effect to it. You get a lot more information coming from a lot more sources, and it's all automated.”

Carriers also are seeing more attacks on their networks. What used to be one or two attacks per month greater than 1 Gb/s has become a regular barrage of 10 Gb/s attacks.

“The attacks are more substantial, more directed and there is more organized criminal activity behind them,” Schuster said.

Users of Arbor Networks' PeakFlow SP product, which is a platform that provides denial-of-service (DOS) and traffic and routing capabilities, are taking advantage of an enhanced version of the product that allows them to share attack fingerprints automatically across network boundaries without revealing competitive information.

“The beauty of the alliance is the separation of mechanism from policy,” said Farnam Jahanian, founder and chairman of Arbor Networks. “We provide the mechanism so providers can collect the information on attacks and share it in an efficient, automated way.”

The information collected using the PeakFlow product is not typical of intrusion prevention systems, which usually identify potential threats either by acting as a policy server that allows certain things and blocks everything else or looks at specific streams of data that match known patterns of attack. Slaby said that's fine until the system comes across an attack for which it doesn't yet have a signature. But, behavioral systems like Arbor Networks' monitor the network over extended periods of time and build huge databases of normal traffic flows that allow them to spot anomalous traffic.

“[This] helps you identify something as a threat, even though you haven't seen that signature before,” Slaby said.

MCI uses the PeakFlow product as a component in the notification portion of its wide area network defense product, which does DoS mitigation and notification.

“We have certainly had back-channel communications with our partners and peers for some time. This has helped us expedite the sharing of information,” said Rob Rigby, director of managed services for MCI.

Mark Sitko, vice president of security services product management for MCI, said Arbor's effort will be followed by a draft standard called RID (Real-Time Inter-Network Defense) that is vendor-agnostic. “Arbor has embraced that concept, and we envision the next step will be acceptance of RID and creating a more open environment,” Sitko said.

For now, the alliance provides the Arbor community with another tool to fight network attacks. “The importance of this announcement is that very large companies that are highly competitive with each other have seen that the benefits of mitigating threats far outweigh the downside to working with their competitors,” Schuster said.