NETSCOUT Enhances DDoS Protection to Mitigate Outbound Attacks
NETSCOUT's Adaptive DDoS Protection now detects and stops compromised devices from launching outbound attacks, bolstering network security for service providers.
NETSCOUT has expanded its Adaptive DDoS Protection (ADP) solution to automatically detect and mitigate outbound DDoS attack traffic. This significant enhancement shifts protection from solely defending against incoming threats to also identifying and neutralizing malicious traffic originating from within a service provider's network. By addressing attacks at their source, NETSCOUT aims to prevent compromised subscriber devices, such as IoT botnets, from disrupting provider networks, consuming bandwidth, and launching attacks against external targets.
The increasing weaponization of consumer IoT devices and broadband routers by sophisticated botnets like Turbo-Mirai has led to multi-terabit attacks, causing costly service outages, reputational damage, and strained peering relationships for service providers. These outbound attacks pose a significant threat, consuming valuable network capacity and potentially leading to increased transit costs. NETSCOUT's new capability allows operators to intercept and suppress this malicious traffic before it leaves their infrastructure.
"The combination of higher-speed broadband connectivity and vulnerable IoT devices has been weaponized by a new class of massive DDoS botnets," noted Patrick Donegan, principal analyst at HardenStance. "Source-side mitigation, or attack suppression as it’s sometimes known, is a critical part of the equation. NETSCOUT’s approach, backed by its ATLAS Intelligence Feed (AIF) and ASERT analysts, gives service providers the tools they need to detect and stop attacks before they have an impact, protecting their customers and the broader internet from the large-scale DDoS attacks we have seen."
NETSCOUT's enhanced ADP solution, integrated with its Arbor Sightline and Arbor Threat Mitigation System, leverages AI-powered threat intelligence and automated detection. It dynamically analyzes outbound internet traffic, using proprietary AI/ML models to uncover attacks that attempt to hide within legitimate flows. This advanced analysis, combined with NETSCOUT's global real-time intelligence on DDoS activity, enables rapid detection and mitigation, pinpointing the compromised devices responsible for generating the attacks.
Darren Anstee, CTO, Security at NETSCOUT, emphasized the shift in strategy: "We are extending DDoS defense from the target to the source. By using our internet-scale visibility to derive localized threat intelligence for our customers, NETSCOUT can identify and precisely suppress attacks at their origin, before they cause problems locally or at their target. This capability gives our customers a new level of comprehensive defense across their peering, transit, cloud and customer edges."
This expansion addresses emerging challenges faced by service providers by extending a proven inbound DDoS workflow to outbound and cross-bound threats. The solution aims to improve network resilience, enhance cost controls, and protect revenue streams for operators. By providing granular visibility and precise suppression capabilities, NETSCOUT empowers service providers to maintain a more secure and stable internet infrastructure.
The move signifies a proactive approach to cybersecurity, recognizing that the origin of an attack is as critical to mitigate as the attack itself. As IoT devices continue to proliferate and become more powerful, the threat landscape evolves, necessitating advanced solutions that can adapt to new attack vectors and origins. NETSCOUT's updated ADP solution positions itself as a key tool for service providers navigating this complex environment.