[TechNavio]: The DPI Market will Grow at 36% CAGR

A new report by TechNavio forecasts that ".. the Global DPI market will grow at a CAGR of 36.45 percent over the period 2013-2018 .. Although at present the EMEA region is a major contributor to the market, the APAC region is expected to emerge as a strong contributor to this market. ISPs and government organizations are the biggest adopters of DPI technology in the market .. with the increase in the use of bandwidth-intense applications such as P2P traffic and real-time multimedia content over the last few years, ISPs are increasingly adopting DPI solutions to manage and monitor the network".

The report identifies Allot Communications, Cisco, Procera Networks and Sandvine as "key vendors" and Arbor Networks, Bivio Networks, Endace, Huawei Technologies, ipoque, Quosmos and Tableau Software as "Other Prominent Vendors" (although some are no longer players in the DPI/traffic management market).

A year ago TechNavio had a similar forecast (see "[TechNavio] DPI Market to Grow at 35% 2012-16" - here).

See "Global DPI Market 2014-2018" - here.

[MarketsandMarkets] Network Analytics Market to Reach $1.7B by 2018

 

A new research by MarketsandMarkets finds that the "The network analytics market is estimated to grow from $487.9 million in 2013 to $1672.5 million in 2018, at a Compound Annual Growth Rate (CAGR) of 27.9% from 2013 to 2018. In the current scenario, telecommunication vertical continues to be the largest contributor for network analytics solutions. In terms of regions, North America is expected to be the biggest market in terms of revenue contribution, while the APAC region is expected to experience increased market traction, in due course.

 

Solution providers such as IBM, HP, Sandvine, Empirix [see "Empirix Enhances Analytics" - here], Procera Networks, Accenture, Danaher Corporation [Tektoronix, Arbor Networks], and many others are expected to provide innovative solutions by continual encapsulation of multiple use cases and at competitive prices in order to fulfill the need of providing complete network analytics solution. Network operators, cloud service providers, and Banking, Financial Services, and Insurance (BFSI) sector will remain the major consumers of network analytics solutions"

 

See "Network Analytics Market worth $1672.5 Million by 2018" - here.

Arbor Acquires Packetloop (Security Analytics)

Arbor Networks announced that it has ".. acquired privately held Packetloop, an innovator and leader in the field of Security Analytics. Packetloop’s solution delivers real-time, network-wide situational awareness through a combination of packet capture, big data analytics, security forensics and visualizations that help enterprises identify malware, targeted attacks and attackers. Packetloop’s capabilities complement Arbor’s market leading NetFlow visibility, anomaly detection, application intelligence and identity tracking. Arbor will integrate Packetloop’s capabilities into its enterprise solution platform this year, delivering a broad, integrated set of network visibility; threat detection and mitigation; incident response; and forensics capabilities that become the foundation of Arbor’s next-generation threat monitoring and mitigation platform".

See "Arbor Networks Acquires Security Analytics Innovator Packetloop" - here.

VAS Deployments [246]: Allstream [Canada] Uses Arbor for DDoS Prevention Service

  

Allstream announced a ".. special offer of its Allstream Secure Internet service that will make it easy and cost-effective for customers to protect their business from a distributed denial-of-service (DDoS) attack .. With Allstream's Secure Internet offer customers get the speed, stability and affordability of Allstream's high-performance Internet with added security protection services at prices starting at $100 per month, less than $4 per day. DDoS attacks are identified, quarantined and scrubbed before they reach a customer's network, without affecting legitimate Internet traffic. Allstream customers have the advantage of only needing to work with one supplier .. Arbor Networks and Allstream are part of the Cloud Signaling Coalition (CSC), a group set up to prevent DDoS attacks or mitigate its threat".
 
Ron Rout (pictured), VP Customer Operations, Allstream said: "We want to make it easy for Canadian businesses to defend themselves against the increasing threat of DDoS attacks - we see this as an extension of our commitment to providing quality and excellence in customer service, By providing this service through the cloud Allstream is able to offer it to a broad array of customers, from very large enterprises to smaller businesses, who will now be able to protect themselves against DDoS attacks"

Allstream is a Canadian leader in IP communications and the only national communications provider that works exclusively with business customers of all sizes. With nearly 600,000 customer connections.

See "Allstream Helps Canadian Companies Connect with Confidence by Defending Against Cyber Crime" - here. 

Q1 Average DDoS Attack - 1.8 (Arbor) or 48 Gbps (Prolexic)?

 
Few days ago Prolexic reported that ".. average attack bandwidth totaled 48.25 Gbps in Q1 2013, a 718 percent increase over last quarter" (here) - indeed an amazing number, far beyond the capacity of almost any enterprise connection  and a real threat to many ISPs.

Arbor Networks shows a significantly lower numbers. While the average attack volume also shows a nice growth (+19.5%), it reaches just 1.77 Gbps (see chart below for peak attack size). Not only the number and growth rate make more sense, it is also a more reasonable use of resources by those who try to attack even the bigger enterprises.

Arbor says that ".. attacks above 10 and even 20Gb/sec now occur multiple times per day somewhere in the world. Every day hundreds, or even thousands, of attacks take place utilizing different attack vectors, having different levels of complexity and different motivations and resources behind them. For enterprise network operators, it is important to have a broad view of what is going on out there .. Proportion of attacks in the 2 – 10Gb/sec range grows from 15% to 21.5%" 

See "Q1 Key Findings from ATLAS" -here.

[Arbor]: DDoS Attacks are Becoming more Complex; No Awareness in Mobile

Arbor Networks published its 2012 security report (based on survey data provided by network operators from around the world - see "The Arbor Networks 8th Annual Worldwide Infrastructure Security Report Finds DDoS Has Become Part of Advanced Threat Landscape" - here, presentation below) with some interesting findings on DDoS attacks and traffic:

• Largest attack reported was 60 Gbps, same as 2011; 2010 attack peak was 100 Gbps
• 46 percent reported multi-vector attacks
• 94 percent of data center operators reported attacks
• Mobile Providers continue to be reactive
• 60 percent do not have visibility into the traffic on their mobile/evolved packet cores
• 27 percent experienced customer-impacting DDoS attacks on their DNS infrastructure—a significant increase over the 12 percent of respondents from last year’s survey 

Other 2012 security reports: Akamai (here) and Prolexic (here)

[Renesys]: Countries Ranked by Risk of Disconnection

Few days ago we saw it is possible to disconnect a country from the Internet (see "The World is Disconnected from Syria since Thursday" - here - Syria was connected again on Saturday - here). Sophisticated DPI was not needed here - a (single?) cord cut was probably enough.

A research by James Cowie (pictured), CTO, Renesys, tries to evaluate which countries are in risk of being disconnected easily.

"The key to the Internet's survival is the Internet's decentralization — and it's not uniform across the world .. There may be only one or two companies who hold official licenses to carry voice and Internet traffic to and from the outside world, and they are required by law to mediate access for everyone else .. [The map below] with countries colored according to the Internet diversity at the international frontier. We did a census, from our own view of the global Internet routing table, of all the domestic providers in each country who have direct connections (visible in routing) to foreign providers"

"If you have only 1 or 2 companies at your international frontier, we classify your country as being at severe risk of Internet disconnection .. If you have fewer than 10 service providers at your international frontier, your country is probably exposed to some significant risk of Internet disconnection .. If you have more than 10 internationally-connected service providers, but fewer than about 40, your risk of disconnection is fairly low .. Finally, if you have more than 40 providers at your frontier, your country is likely to be extremely resistant to Internet disconnection"

See "Could It Happen In Your Country?" - here.

The World is Disconnected from Syria since Thursday

According to Arbor Networks' ATLAS system, showing information of traffic crossing the boundaries of 246 of its customers's networks, traffic to and from Syria has dropped - ".. to virtually nothing .. likely to have occurred between 1000 and 1100 [on November 29] .. the graphs show traffic interruption an hour later than this due to the variable, hourly reporting from ATLAS participants to our servers".

 

See "Syria goes dark" - here. 

DDoS Deployments [194]: DreamHost Selects Arbor Networks

  

Arbor Networks announced that DreamHost has ".. selected Arbor's Peakflow SP platform, the industry's leading network-wide infrastructure security and traffic-monitoring platform .. Hosting providers often have a higher risk of DDoS attacks than other online businesses because they aggregate the risk of all their customers .. DreamHost's deployment of the Peakflow SP platform helps ensure that DDoS attacks are identified and mitigated before they get to customer premises".

DreamHost is a leading global web hosting and cloud services provider with over 330,000 customers and 1.2 million websites, blogs and applications hosted.

See "Web and Cloud Hosting Provider DreamHost Selects Arbor Networks' Peakflow® SP Platform for Infrastructure Visibility and Security" - here.

Arbor Presents: DDoS Attacks Growth During A Decade

Nice video by Arbor Networks showing the "evolution of DDoS attacks — from nuisance to menace" in which DDoS attacks "have broken the 100 Gbps barrier, up 1000%".

See "A Decade of DDoS" - here.

MSSP/DDoS Deployments [185]: RedSpam[UK] Expands its Managed Service with Arbor's CPE

 
Along the rising trend of cloud based security services (see "[Infonetics]: Cloud-Based Security to Grow by 83% by 2016" - here), Arbor Networks announced that UK-Based MSSP, RedSpam, extends its DDoS protection services to include also a Customer Premises Equipment (CPE) adding protection against "low and slow" application-layer attacks on enterprises' data centers.

 ".. RedSpam has selected Arbor's Pravail Availability Protection System (APS) for its new distributed denial-of-service (DDoS) managed service offering .. This exciting initiative builds upon the existing relationship between the two organizations, which sees the MSSP utilize Arbor Network's Peakflow® SP for cloud-based DDoS mitigation for protection against volumetric DDoS attacks"
 
"Arbor's technology, coupled with RedSpam's fixed pricing model -- based on each user's traffic profile and a pay-as-you-grow approach -- makes it a compelling service for companies who want to protect themselves from DDoS attacks that are causing damage to so many brands in the market today. Furthermore, the on-premise design eliminates the need for specialist expertise and further investment in hardware purchases".
 
See "RedSpam Selects Arbor Networks' Pravail™ Availability Protection System for New DDoS Managed Service Offering" - here.

ALU and Arbor Establish CSP DDoS Mitigation Test Lab

   

Following their previously announced OEM relations (see "ALU Integrated Arbor's DDoS Mitigation into its Routers" - here), Arbor Networks and Alcatel-Lucent announced "..the establishment of a new Proof of Concept (POC) Laboratory in Singapore for communications service providers to conduct testing of technologies to mitigate distributed denial of service (DDoS) attacks.. The POC Laboratory gives customers the ability to see live demonstrations of this integrated technology, as well as to test various DDoS attacks and techniques, allowing customers to conduct POC trials to better understand the technologies and best practices for DDoS mitigation".

See "Alcatel-Lucent and Arbor Networks Open Test Lab to Help Communications Service Providers Mitigate Cyber Attacks" - here.

Security Deployments [180]: SK Telecom [S. Korea] Selected Arbor to Protect Service

Arbor Networks announced that "SK Telecom .. the largest mobile service provider in Korea, has selected Arbor’s Peakflow SP platform in order to maintain the performance and availability of their mobile network and services ..  Managing the rise in mobile data and signaling traffic due to the ever increasing usage of 3G and 4G devices such as smartphones and tablets and protecting their network from DDoS attacks and mobile application anomalies are just some of the many challenges SK Telecom faces on a daily basis".

See also "SK Telecom [Korea] Selected Fortinet for Security Services" - here.

".. SK Telecom has invested heavily into the access, backhaul and core of their mobile network. By leveraging IP flow data (i.e Netflow, sFlow etc.) embedded in network backbone and peering/transit edge routers, Peakflow SP enables SK Telecom to gain cost effective visibility into where their mobile network traffic is going to and coming from"

SK Telecom has more than 26 million subscribers.

SK Telecom: Subscribers and Market Share, Q2 2012

See "South Korea’s Largest Mobile Operator, SK Telecom,Selects Arbor Networks’ Peakflow® SP Platform for Mobile Infrastructure & Service Protection" - here.

[Infonetics]: DDoS Prevention Market Grows; Challenged by Hosted/SaaS Solutions

A new research by Jeff Wilson, principal analyst for security, Infonetics Research, concludes that "Sustained DDoS activity will drive the prevention market to 24% growth in 2012 over 2011 .. Combined, all segments of the DDoS prevention market—data center, carrier transport, mobile, and government—are forecast by Infonetics to top $420 million by 2016 .. The data center segment of the DDoS prevention market is growing fast and is expected to pass the carrier transport segment by the end of 2012".

"While the market for dedicated DDoS prevention solutions remains strong, going forward the overall performance of the market and the vendors in it will be challenged by the widening availability of hosted/SaaS solutions and new integrated security platforms that include DDoS prevention as a feature".

"Arbor Networks, the largest vendor in the DDoS prevention appliance market, maintains a commanding overall lead with nearly 3/5 of global revenue, although Radware [see "Radware Adds SSL Support" - here] is challenging in the government network segment"
   

See "Infonetics Research forecasts DDoS prevention market to grow 24% in 2012 as competition heats up" - here.

DPI Reports: IPv6 Gaining Share - YouTube Leads

This year's IPv6 day (or IPv6 Launch Day) was not just testing (see 2011 report here) but for real: "Major Internet service providers (ISPs), home networking equipment manufacturers, and web companies around the world are coming together to permanently enable IPv6 for their products and services by 6 June 2012".

Don Bowman from Sandvine provides some statistics on this D Day - "Looking at the preliminary data, this year’s World IPv6 Day was not simply turned on with one big flick of a switch, instead it looks as though yesterday’s date simply served as a deadline that many websites have been working towards over the past year to meet".

 

Source: Sandvine

Cam Cullen from Procera Networks shows similar findings: " The growth in “normal” IPv6 traffic started to ramp in April, with more users taking advantage of native IPv6 services being offered by this operator, as well as the content providers, most notably YouTube, as shown below, but with Facebook and Amazon making an appearance" 

 

Source: Procera

Darren Anstee from Arbor Networks saw a "..doubling of the amount of IPv6 traffic tracked by the ATLAS system during the day, which represented a change from approximately 0.012% of internet traffic to 0.024% of internet traffic .. things are moving forward over the past year with the amount of IPv6 traffic we are tracking having increased substantially. IPv6 now peaks at around 0.1%".

Source: Arbor Networks

According to Sandvine - ".. YouTube accounted for more than half of all Native IPv6 traffic, while Facebook (fbcdn.net and facebook.com) leapt up the list. Some notable domains that tumbled down the rankings (or disappeared entirely) include: edgesuite.net, llnwd.net (Limelight), apple.com, playstation.net, hbogo.com, and pandora.com"

See "World IPv6 Day 2012: A Preview" - here, "World IPv6 Day…We Have Liftoff" - here and "World IPv6 Launch Day: The view from ATLAS" - here.

Arbor: Likelihood of DDoS Attacks Increases

  A recent presentation by Arbor Networks.

DDoS Attacks and the Ostrich Mentality

Updates to the DPI Products Page

 
The DPI products page (here) was updated with the following:

• Information on Alcatel-Lucent 7750 product updated
• Arbor Networks and Ericsson SE-1200 products removed, as they no longer appear at the respective vendors' sites 

Security Deployments [123]: KDDI [Japan] Uses Arbor for DDoS Prevention

Arbor Networks announced that "Japan’s KDDI .. has deployed Arbor’s Peakflow SP platform .. among the first providers in the world to include the new ATLAS Intelligence Feed (AIF) in a service offering. The AIF provides automated, up-to-date protection against the growing threat of distributed denial of service (DDoS) attacks ensuring that KDDI is offering leading edge security solutions".

"Peakflow SP combines network-wide anomaly detection and traffic engineering with TMS’s carrier-class threat management capabilities. When Peakflow SP identifies an attack, customer traffic is diverted to the Arbor Threat Management System where it is scrubbed, and network and application-layer attack traffic surgically removed, while legitimate business traffic is passed through to the customer without interrupting services. This powerful combination of visibility and security helps enable KDDI to maintain availability, reduce support costs and optimize current or future business service .. A new feature within the Peakflow platform is the ATLAS Intelligence Feed (AIF) which delivers deep DDoS signatures in real-time to keep networks protected against hundreds of botnet-fueled DDoS attack toolsets and their variants".

See "Japan’s KDDI Deploys Arbor Networks’ Peakflow SP Platform" - here.

Arbor Networks: How Popular was Megaupload(2)?

   
Jose Nazario, Senior Manager of Security Research, Arbor Networks, helps us to analyze if what " Friends of mine from elsewhere in the world have been joking that the Internet seems to be running a bit smoother today. That may be, given how much bandwidth appears to have been freed up." it true, line Sandvine did 2 days ago (here).

 

"..  With enough global data, you can actually see the traffic drop when the shutdown occurs. Based strictly on the traffic rates it appears that the shutdown started just after 19:00 GMT on January 19, with traffic plummeting down over the next two hours. The graphic here shows three main client regions – Asia-Pacific, Europe, and the US. Over the past 24 hours, the top countries (in aggregate) using MegaUpload were the United States, France, Germany, Brazil, Great Britain, Turkey, Italy, and Spain, although dozens more countries are represented".

While the Sandvine chart seems to show an immediate drop to 0 bps at time of closure, Arbor shows a slowdown, and even some growth, in the hours following the disconnection. 

 

See "The MegaUpload Shutdown Effect" -here.

Security Announcements: ALU Integrated Arbor's DDoS Mitigation into its Routers

   
Alcatel-Lucent and Arbor Networks announced that are ".. offering a joint solution that provides advanced DDoS protection and security capabilities to help address this escalating challenge .. Service providers can deliver denial-of-service ‘scrubbing’ as a cloud-based service from the same platform as virtual private network (VPN) and business Internet services, with minimal incremental investment"

ALU integrates Arbor's Peaklflow SP TMS into its 7750 Service Router. Recently, ALU positioned the 7750 as a mobile gateway (here) and published some data on it DPI capabilities (here).

ALU solution page explains the DDoS mitigation facility protects ".. networks and enterprise services from a wide range of threats, including:

• TCP stack/generic flood attacks
• Fragmentation attacks
• Application layer attacks
• Vulnerability exploit attacks
• Malware pipes
  

See "Alcatel-Lucent and Arbor Networks team up in the fight against ‘denial-of-service’ attacks" - here.