Will High-Speed Malware Crash the Internet?

Daniel Joseph Barry
How do we avoid the collapse of the Internet under the strain of more malware attacks at higher speeds?

Network security systems are under pressure. You might not be experiencing it yet, but you will soon. The dual challenge of dealing with more attacks at higher speeds threatens to undermine the stability of the most important commercial platforms of the 21st century, namely the Internet.

What can be done to address these challenges and avert the economic impact of an Internet collapse?

The Internet as Commercial Platform

For many, the Internet is synonymous with Web browsing, e-mail and chat. But, the Internet, and IP-based networks in general, are now the foundation for a host of commercial services with significant impact on our daily lives.

Online shopping is familiar to many, as is Internet banking, but the financial world has now become reliant on the Internet for executing banking and investment transactions, sometimes thousands per second.

Government services have also moved online. The Internet is used extensively in education and health care to provide distance services and expert consultation. The advent of cloud computing means that corporations will be more reliant than ever on the Internet to support their businesses.

In short, without the Internet, our lives would come to a grinding halt.

Cybercrime Comes of Age


The development of the Internet as a commercial platform has not gone unnoticed by criminal organizations, which are exceptionally innovative in finding new ways of generating revenue. They have displaced the amateur hacker enthusiasts as the key threat to the Internet.

The open and global advantages of the Internet are now suddenly disadvantages as cybercriminals can attack from any location in the world, beyond the reach of domestic law enforcement agencies.

To understand the scope of the network security challenge, consider figures from Trend Micro, a leading provider of network security solutions, who have reported an explosive growth in the number of unique malware samples (i.e. types of attack) over the last 20 years. Figure 1 shows this alarming development:

Network security system vendors are struggling to respond to these new attacks as quickly as they occur.

In a sense, they are playing a cat-and-mouse game with adversaries who are at least as intelligent and innovative at exploiting weaknesses in networks and applications as they are at detecting attacks.

The High-Speed Cybercrime Pursuit

Higher data rates compound the challenge facing network security system vendors. IP networks are now being upgraded from 1 Gbps to 10 Gbps link speeds with 40 Gbps and 100 Gbps on the horizon. At 1 Gbps, a network security system needs to analyze up to 1.5 million packets per second. At 10 Gbps, this becomes 15 million packets per second. This is per port and only in 1 direction.

The challenge for network security system vendors is to ensure that their systems:

  • Can handle up to 15 million packets per second per port in each direction
  • Have the necessary processing power and memory to analyze packets in real-time
  • Can scale to detect millions of new malware samples and higher line rates

Scaling Network Security Systems

The traditional approach to building network security systems is to build customized hardware including ASIC chip development. However, with the exponential growth in malware and higher line-rates, network security systems need to scale in both terms of data handling and computing power on a regular basis. This in turn means that the lifetime of a product revision will be shorter.

This begs the questions: Can network security system vendors keep up and have they got the deep pockets required to fund custom hardware and chip development on a regular basis?

It also leads to the question: Is there another way?

High-performance network security systems can be based on standard, off-the-shelf PC servers when these are combined with Intelligent Real-time Network Analysis adapters for handling full line-rate data. The advantage of this approach is that it takes advantage of the strong roadmap of PC server and CPU chip vendors who are updating their performance and the number of processing cores they support on a yearly basis.

Addressing the Dual Challenge

Basing high-performance network security system development on standard PC servers with Intelligent Real-time Network Analysis adapters provides a path to addressing the dual challenge of more malware at higher line-rates. It provides a cost-efficient, yet high-performance model that allows network security system vendors to focus on their expertise, namely combating cybercriminals and protecting the vital commercial platform that the Internet has become.
 



Add Comment      Leave a comment on this blog post

Post a comment

 

 

 

 


(Maximum characters: 1200). You have 1200 characters left.

 

null
null

 

Subscribe to our Newsletters

Sign up now and get the best business technology insights direct to your inbox.