Freely subscribe to our NEWSLETTER

Distributed denial-of-service (DDoS) attacks targeting critical IT infrastructure and services have increased by 55 percent over the last four years. A perfect storm of AI-driven automation, evolving DDoS-for-hire services, augmented IoT botnets, and geopolitical conflicts have changed the threat landscape with more frequent, sophisticated attacks having the potential to do more damage more rapidly. To combat these attacks, organisations, enterprises and service providers require AI/ML-enabled solutions that can continually adapt to threats, using proactive, intelligence-driven security strategies to protect their networks.

NETSCOUT utilises a hybrid AI/ML strategy that combines AI/ML running at scale in the cloud, with supervision, to analyse data collected from an unprecedented 550 Tbps of Internet traffic (almost half of all Internet traffic), along with AI/ML running in our software solutions to enable automated protection from these attacks. This provides a ’best of both worlds’ approach – the computational scale of the cloud allows for large-scale analysis of threat data with supervision to ensure accuracy, while AI/ML running in our software solutions enables them to leverage that pre-analysed intelligence to make fast, accurate, automated decisions about what to detect and block.

The company’s cloud-based AI/ML drives the creation of the ATLAS Intelligence Feed**, which delivers unique capabilities in its Adaptive DDoS Protection solutions, arming them with the latest DDoS attack intelligence. The continuous analysis, which is updated multiple times per day, provides insight into the source IP addresses of devices actively conducting DDoS attacks on the internet, novel attack vectors, DDoS attack targets, and other intelligence. This enables Adaptive DDoS Protection to quickly and accurately detect even small direct-path attacks from sampled flow data and send the traffic to TMS for automated blocking.

The latest AI/ML-derived ATLAS Intelligence Feed iteration has been augmented with enhanced Geo-IP location functionality that maps IP addresses to geographic locations, enabling faster and more precise identification and blocking of malicious traffic. In addition, the ATLAS Intelligence Feed now includes NETSCOUT’s ATLAS tracking of active DDoS campaigns, enabling Adaptive DDoS Protection to automatically detect and block attacks from over 65 known DDoS threat actors carrying out active attack campaigns against a range of targets, including NoName057 and RipperSec.

AI/ML technology has also been adopted as part of the Adaptive DDoS Protection solution. New in the latest release is AI/ML-powered source host misuse detection, which enables network operators to track misbehaving subscribers, infected hosts, compromised IoT devices, and other internal attack sources. This new capability makes it easier to detect and block outbound DDoS attacks that can impact service and infrastructure performance and availability as edge connectivity speeds increase. New TMS Source Mitigations enable network operators to redirect and surgically protect against threat activity from specific sources that may be targeting the entire network without requiring fully inline solutions on all network traffic.

Service Provider Benefits
With updates to NETSCOUT’s Adaptive DDoS Protection solution, service providers can better protect their critical infrastructures and the services they provide to their customers. Other key advantages include enhanced availability, reduced downtime costs, less aggravation, and new revenue-generating opportunities.