In an era where cyber threats are evolving at an unprecedented pace, NETSCOUT has taken a significant step forward in DDoS protection. The company has announced an extension of its Adaptive DDoS Protection (ADP) solution, enabling service providers to automatically detect and mitigate outbound DDoS attack traffic.
This enhancement shifts the focus of DDoS defense from protecting attack targets to stopping malicious traffic before it leaves an operator’s network. By addressing the source of the problem, NETSCOUT aims to help internet service providers identify and neutralize compromised devices within their subscriber base.
Addressing the Growing Threat of Outbound Attacks
The rise of Turbo-Mirai class botnets has led to a surge in outbound attacks capable of generating multi-terabit traffic. These attacks have caused costly service outages, reputational damage, and customer loss. Moreover, they strain peering relationships and increase transit costs for service providers worldwide.
By detecting and mitigating malicious traffic generated by compromised devices before it leaves their networks, service providers can reduce abuse complaints and infrastructure costs. This proactive approach also helps protect their own networks and services, lowering subscriber churn and regulatory risk.
The Role of AI and Threat Intelligence
NETSCOUT’s ADP solution leverages AI-powered threat intelligence and automated detection and mitigation to combat these evolving threats. The solution is an addition to NETSCOUT’s Arbor Sightline and Arbor Threat Mitigation System, offering several key capabilities:
- Automatic Detection and Mitigation The system dynamically detects and mitigates attacks through intelligent redirection and adaptive mitigation.
- Enhanced Detection for Outbound Traffic The solution combines customized detection with comprehensive threat intelligence tailored for each ISP.
- AI/ML-Powered DDoS Detection NETSCOUT’s proprietary technology analyzes massive volumes of outbound internet traffic to uncover attacks designed to hide within legitimate flows.
- Global Real-Time Intelligence The system draws on unique global real-time intelligence of DDoS activity covering approximately half of all internet traffic to rapidly detect and mitigate attacks and pinpoint the responsible, compromised devices.
Expert Insights
Patrick Donegan, founder and principal analyst at HardenStance, highlights the importance of this new approach: “The combination of higher-speed broadband connectivity and vulnerable IoT devices has been weaponized by a new class of massive DDoS botnets. Source-side mitigation, or attack suppression as it’s sometimes known, is a critical part of the equation. NETSCOUT’s approach, backed by its ATLAS Intelligence Feed (AIF) and ASERT analysts, gives service providers the tools they need to detect and stop attacks before they have an impact, protecting their customers and the broader internet from the large-scale DDoS attacks we have seen.”
Extending DDoS Defense to the Source
Darren Anstee, CTO of Security at NETSCOUT, explains the significance of this expansion: “We are extending DDoS defense from the target to the source. By using our internet-scale visibility to derive localized threat intelligence for our customers, NETSCOUT can identify and precisely suppress attacks at their origin, before they cause problems locally or at their target. This capability gives our customers a new level of comprehensive defense across their peering, transit, cloud, and customer edges.”
This expansion of capabilities demonstrates how NETSCOUT is applying its global threat visibility and proven ADP solution to meet emerging service provider challenges. By extending an established inbound DDoS workflow to outbound and cross-bound threats, NETSCOUT enables operators to improve network resilience, cost controls, and revenue protection through its proven Arbor Sightline and Arbor TMS solutions.
