NetScout defends against outbound DDoS attacks

NetScout has launched an outbound-traffic update to Adaptive DDoS Protection (ADP), the cybersecurity company’s DDoS defence capability. The update enables service providers to automatically detect and mitigate distributed denial-of-service (DDoS) traffic generated by compromised broadband and IoT devices.

According to NetScout, consumer broadband routers, cameras and other IoT devices are increasingly being weaponised by Turbo-Mirai class botnets capable of generating multi-terabit attacks. These outbound attacks can cause costly service outages, reputational damage and customer loss, and damage to peering relationships risking a large increase in transit costs at service providers around the world. Service providers can detect and mitigate malicious traffic generated by compromised device populations before it leaves their networks. This can reduce abuse complaints and infrastructure costs, protect their own networks and services, and help lower subscriber churn and regulatory risk.

“The combination of higher-speed broadband connectivity and vulnerable IoT devices has been weaponised by a new class of massive DDoS botnets,” says Patrick Donegan, HardenStance founder and principal analyst. “Source-side mitigation, or attack suppression as it’s sometimes known, is a critical part of the equation. NETSCOUT’s approach, backed by its ATLAS Intelligence Feed (AIF) and ASERT analysts, gives service providers the tools they need to detect and stop attacks before they have an impact, protecting their customers and the broader internet from the large-scale DDoS attacks we have seen.”

NetScout says the ADP update extends automated detection and mitigation to outbound traffic in Arbor Sightline and Arbor Threat Mitigation System. The company lists the following capabilities:

• Automatically detects and mitigates ever evolving attacks through dynamic detection, intelligent redirection and adaptive mitigation.
• Extends these capabilities to outbound traffic, combining enhanced, customised detection with comprehensive threat intelligence tailored for each ISP.
• Uses NETSCOUT’s proprietary AI/ML-powered DDoS detection to analyse massive volumes of outbound internet traffic to uncover attacks designed to hide within legitimate flows.
• Draws on unique global real-time intelligence of DDoS activity covering approximately half of all internet traffic to rapidly detect and mitigate DDoS attacks and pinpoint the responsible, compromised devices.

Darren Anstee, NetScout CTO for security, says: “We are extending DDoS defence from the target to the source. By using our internet-scale visibility to derive localised threat intelligence for our customers, NetScout can identify and precisely suppress attacks at their origin, before they cause problems locally or at their target. This capability gives our customers a new level of comprehensive defence across their peering, transit, cloud and customer edges.”