2022 CYBERSEC Post-Event Report

The 2022 CYBERSEC was held successfully in Taipei last week. Amid the ongoing spread of the pandemic, the three-day event managed to attract more than 9,000 people to register and participate, which indicated the crucial role of the cyber security industry in Taiwan. As a leading domestic brand in DDoS security, Genie Networks made its consecutive appearance as a Gold Sponsor to participate in the full three-day event. At the exhibition, Genie introduced its pioneer GenieATM product series, the carrier-grade network traffic analysis and DDoS detection system. During the Tech Briefing session on 9/20, Genie shared some solution tips for the challenges of big data network traffic analytics.

In the past, telecom carriers and Internet Service Providers (ISPs) monitored DDoS attacks mostly through traffic analysis technologies such as NetFlow and IPFIX to detect anomalies for each IP traffic. With the advent of the 5G network era and the prevalence of the Internet of Things, the amount of network traffic has continued to increase exponentially in recent years. The emergence of various network applications (such as OTT services) and more diverse network architectures (such as CDN technology) ) are making network traffic unprecedentedly more diverse and complex, creating new challenges for carrier-grade traffic analysis. At the technical session, Genie’s CTO Jacob Chiang provided three practical skills which can effectively save computing and storage resources when collecting traffic samples, thereby improving the efficiency of traffic analysis. These skills include:

1. Avoid long, fixed time granularity for traffic sampling – Sampling error depends on the final number of traffic samples collected, rather than the sampling rate itself. Since DDoS attacks tend to have massive traffic volume, a sufficient number of samples can be obtained in a very short time to ensure a low error rate of detection.
2. Using Data Binning technique to distribute sampled data streams to multiple computing nodes – For example, during DDoS detection, perform preliminary calculations on each node and forward the results to second-level nodes for aggregation. This way, the original flow data can be discarded to significantly reduce the amount of memory required for traffic data storage.
3. Using Majority Algorithm for high-cardinality traffic with a long-tail distribution – Focus solely on high-traffic IPs as the possible attack source, thereby reducing computing and storage resources required for traffic analysis.

In today’s digital era, Content Delivery Network (CDN) services play a crucial role for telecom and Internet Service Providers (ISPs). In addition to IPFIX flow collection, it is essential for service providers to merge traffic details with Domain Name System (DNS) data to accurately monitor complex and diverse network traffic.

Network traffic analysis is essentially a form of big data analysis, and also the stepping stone to good network security. While traditional analysis methods struggle to handle massive and complex traffic data, Genie Networks provide three solution tips to big data traffic analysis to assist service providers in overcoming the challenges of time and resource constraints.

As the frequency and magnitude of DDoS threats increase, service providers need a fast and in-depth carrier-grade traffic analysis solution as a cornerstone of their network security. To learn more about Genie’s products and services, reach us at sales@genie-networks.com. Gratitude to every visitor at Genie’s booth and tech briefing session. We look forward to meeting you again next year.