NetForts aims to allow networks to react in real-time to evolving threats by creating products and services that can detect and contain zero-day worms. Their solution monitors network traffic to detect worms within seconds, even stealthy or passive ones, and dynamically extracts signatures without false positives. This allows automatic and manual containment actions including blocking ports and isolating infected systems, protecting enterprises from costly data loss and downtime from worms.

1. Corporate Presentation
Ashar Aziz (ashar@netforts.com)

2. NetForts, Inc. Proprietary and Confidential 2
NetForts Mission Statement
Create Products and Services to Allow
Networks to React in Real-Time to
Rapidly Evolving Threats

3. NetForts, Inc. Proprietary and Confidential 3
L3 Cloud
Access Layer
Switches
Biggest Cyber-threat:
Enterprise-Scale
Worm in Minutes
1. Zero-day worm outbreak
2. No patches
3. No worm signatures
4. Rapid worm proliferation
5. Complete compromise of
vulnerable systems
6. Manual repair & recovery
7. Possible loss of data
8. Downtime for critical systems
Layer 3 Cloud
NOC
1
2
3
4
5
?!!?
6
7 8

4. NetForts, Inc. Proprietary and Confidential 4
Worms are World’s Biggest Cyber-threat
 A single worst-case worm can cause direct damages in
excess of $120B for US alone (DARPA study)
 Next-Gen Worms will:
 Target flaws on patch release day (first-day attacks)
 Target unknown flaws (zero-day attacks)
 Spread very fast, Internet scale in minutes
 Have malicious payloads: delete, modify, expose data
 Be able to launch a massive DDOS attack on the Internet
 Any human mediated response inadequate

5. NetForts, Inc. Proprietary and Confidential 5
Stopping Worms: The Challenges
 Zero-day attack, no signatures
 Active propagation techniques
 Scanning
 Topological direction
 Hit-List Direction: flash worms
 Extremely fast spread rates
 Conversely: slow and stealthy motion
 Passive propagation techniques
 Piggyback existing traffic
 Infect via contagion
 Cause no unusual traffic pattern
 Easily cross firewall defenses
 Worms may use multiple vectors

6. NetForts, Inc. Proprietary and Confidential 6
Existing Approaches
 Signature Based NIDS/NIDP
 Inadequate against worms with no previously known signature
 Protocol Anomaly Based NIDP
 Primarily designed for intrusion detection, not worms
 False positives and False Negatives for unknown protocols/bugs
 Need protocol anomaly detection updates
 May not detect/block all kinds of worms
 Statistical Anomaly Based NIDS
 Long training & false positives/negatives for improper training
 Will not detect worms that don’t trigger statistical anomalies
 Worm oriented Traffic Analysis
 Typically fast horizontal scan detection
 Difficult to use against stealthy worms
 False positives for increased sensitivity, false negatives otherwise
 Host Based IDP
 Require every host to be correctly configured
 Performance penalty for normal operations
 Need behavior blocking template updates
 May not detect/block all kinds of network worms

7. NetForts, Inc. Proprietary and Confidential 7
 Zero-day worm detection &
containment at network level
 Detects and contains ALL kinds of
worms: fast, stealthy, passive etc.
 Dynamic signature extraction
 Zero false positive rate
 No manual signature updates
required
 No performance or availability
penalty
NetForts Solution:
Network-Level Worm Containment

8. NetForts, Inc. Proprietary and Confidential 8
Inline Content
Filtering Device
L3 Cloud
Access Layer
Switches
Virtual Network/ Signature
Extractor
Traffic Anomaly Sensor
Traffic
Anomaly
Sensor
Tap
Network Deployment Scenario A:
Out-of-Data-Path
1. Monitor network
2. Detect worm
3. Confirm worm
4. Extract signature
5. Alert NOC, recommend actions
6. Isolate infected systems
7. Distribute signatures
8. Generate worm removal scripts
1
Layer 3 Cloud
NOC
2
3 4
5
6
7
7
7
8

9. NetForts, Inc. Proprietary and Confidential 9
Worm
Sensor/Filter
L3 Cloud
Access Layer
Switches
Virtual Network/ Signature
Extractor
Worm Sensor/Filter
Tap
Network Deployment Scenario B:
Inline-to-Data-Path
1. Monitor network
2. Detect worm
3. Confirm worm
4. Extract signature
5. Alert NOC, recommend actions
6. Isolate infected systems
7. Distribute signatures
8. Generate worm removal scripts
1
Layer 3 Cloud
NOC
2
3 4
5
6
7
7
7
8
Worm Sensor/Filter

10. NetForts, Inc. Proprietary and Confidential 10
Worm
Sensor/Filter
L3 Cloud
Access Layer
Switches
Tap
Network Deployment
Scenario C: Signatures
from Internet Sensors
in Real-Time
1. Monitor Internet (Early
Warning System)
2. Detect & Confirm Worm
3. Extract worm signatures
4. Alert NOC, recommend
actions
5. Distribute Signatures
1
Intranet
NOC
2
5
5
Worm Sensor/Filter
Internet
Internet Based Sensors
3
4

11. NetForts, Inc. Proprietary and Confidential 11
Real-time Worm Attack Notification
NOC
Worm Attack Detected 4:35:30 pm
First Detected Infection: 4:35:27 pm (3 secs ago)
Detection Using : Traffic Analysis
Positive Confirmation: Yes
Subnets affected: 192.34.5.X, 195.33.7.X
Confirmed Infections: 3
Payload: None Detected
Spread rate: 15 scans/sec
Vulnerable Systems: Windows XP, Windows 2000
Ports affected: 135/tcp, 2233/tcp, 5556/tcp
Worm signature: 0x9678903897956729, port 135/tcp
Recommended Actions:
Block worm signature for Port 135/tcp
Block ports 2233/tcp, 5556/tcp
Isolate 192.34.5.78 (laptop1.xx.yy.com)
Isolate 192.34.5.9 (laptop2.xx.yy.com)
Isolate 195.33.7.4 (server2.xx.yy.com)
Isolate infections since report
Approve All Checked Actions
Worm Attack Detected 4:35:30 pm
First Detected Infection: 4:35:27 pm (3 secs ago)
Detection Using : Traffic Analysis
Positive Confirmation: Yes
Subnets affected: 192.34.5.X, 195.33.7.X
Confirmed Infections: 3
Payload: None Detected
Spread rate: 15 scans/sec
Vulnerable Systems: Windows XP, Windows 2000
Ports affected: 135/tcp, 2233/tcp, 5556/tcp
Worm signature: 0x9678903897956729, port 135/tcp
Recommended Actions:
Block worm signature for Port 135/tcp
Block ports 2233/tcp, 5556/tcp
Isolate 192.34.5.78 (laptop1.xx.yy.com)
Isolate 192.34.5.9 (laptop2.xx.yy.com)
Isolate 195.33.7.4 (server2.xx.yy.com)
Isolate infections since report
Approve All Checked Actions OK Cancel

12. NetForts, Inc. Proprietary and Confidential 12
Unique Features
 Zero-day worm detection and containment
 Fast worm detection
 Stealth worm detection
 Slow active
 Passive
 Polymorphic worms
 Worm containment for
 Scanning worms
 Topological worms
 Passive worms
 Real-time payload analysis
 Time-delayed action and payload analysis
 Real-time worm signature determination
 Integration with existing infrastructure elements
 Operator in-the-loop & automated policy actions
 Zero False Positives