Cyber Defense eMagazine May 2019

Traffic Analysis Engine
These are the work horses of NTA. There are many analytical techniques that can be applied ranging
from simple statistical analysis to much more complicated machine learning based algorithms. The goal
is to identify the applications and services whose traffic patterns exceed the derivation thresholds from
the established baselines.
Output Module
As the results of traffic analysis, logs and alerts are generated, they are presented visually in the user
interface for security analysts and admins to take mitigation actions, such as pushing firewall policies,
blocking suspicious hosts or performing traffic control associated with compromised hosts.
NTA technology is critical to cyber security. It provides an effective and powerful tool to gain insights of
real time network and application traffic, especially east and west network traffic, which is often
associated with lateral traffic movement and data exfiltration after an attacker breaches the corporate
network. This is critical in detecting post-breach threats, as well as those unauthorized activities from
inside the corporate network, whether done intentionally or unintentionally, by corporate employees.
Hillstone delivers on and helps you understand and act on network traffic analysis
In Gartner’s NTA Market Guide, the Server Breach Detection System (sBDS) from Hillstone Networks
was selected by Gartner as the leading product after comprehensive reviews.
The sBDS platform integrates multiple threat detection engines such as Intrusion Prevention System
(IPS) and antivirus. Without decrypting SSL/TLS traffic, layer 7 traffic metadata are collected and
baselines are established during what is called the learning mode. Subsequently, real time traffic is
continuously monitored and analyzed during what is called the detection mode. Using advanced
mathematical algorithms to identify deviations from normal activity, any abnormal activities can be
effectively detected and flagged. sBDS also integrates with Hillstone Next Generation Firewalls to add
blocking capabilities.
In addition, Hillstone’s NTA solution has self-adaptive capabilities. Any false positives or known
exceptions such as holidays and vacations periods can be marked and applied to the future relearning
and analysis either manually or automatically. The Hillstone NTA solution primarily targets the data
center, with many dashboards focused on this use case. It can be deployed inside the corporate network
as well as near protected server farms or host groups.
Hilstone’s NTA solution is part of the full Hillstone Networks security and risk mitigation platform,
delivering layered protection that allows enterprises to detect abnormal user and application behavior,
thereby protecting enterprises from attacks, especially insider threats.
65