Will High-Speed Malware Crash The Internet?

Network security systems are under pressure. You might not be experiencing it yet, but you will soon. The dual challenge of dealing with more attacks at higher speeds threatens to undermine the stability of the most important commercial platforms of the 21st century; namely the Internet.

What can be done to address these challenges and avert the economic impact of an Internet collapse?

The Internet as commercial platform

For many, the Internet is synonymous with web browsing, email and chat. But, the Internet and, IP-based networks in general, are now the foundation for a host of commercial services with significant impact on our daily lives.

Online shopping is familiar to many, as is net-banking, but the financial world has now become reliant on the Internet for executing banking and investment transactions, sometimes thousands per second. Government services have also moved online. The Internet is used extensively in education and healthcare to provide distance services and expert consultation. The advent of cloud computing means that corporations will be more reliant than ever on the Internet to support their business.

In short, without the Internet, our lives would come to a grinding halt!

Cybercrime comes of age

The development of the Internet as a commercial platform has not gone un-noticed by criminal organisations, which are exceptionally innovative in finding new ways of generating revenue. They have displaced the amateur hacker enthusiasts as the key threat to the Internet.

The open and global advantages of the Internet are now suddenly disadvantages as cyber-criminals can attack from any location in the world, beyond the reach of domestic law enforcement agencies.

To understand the scope of the network security challenge, consider figures from Trend Micro, a leading provider of network security solutions, who have reported an explosive growth in the number of unique malware samples (i.e. types of attack) over the last 20 years. Figure 1 shows this alarming development:

Source: Trend Micro, Enterprise Security Whitepaper and update at InfoSecurity April 2009

Network security system vendors are struggling to respond to these new attacks as quickly as they occur. In a sense, they are playing a cat-and-mouse game with adversaries who are at least as intelligent and innovative at exploiting weaknesses in networks and applications, as they are at detecting attacks.

The high-speed cybercrime pursuit

Higher data rates compound the challenge facing network security system vendors. IP networks are now being upgraded from 1 Gbps to 10 Gbps link speeds with 40 Gbps and 100 Gbps on the horizon. At 1 Gbps, a network security system needs to analyse up to 1.5 million packets per second. At 10 Gbps, this becomes 15 million packets per second. This is per port and only in 1 direction!

The challenge for network security system vendors is to ensure that their systems:

• Can handle up to 15 million packets per second per port in each direction
• Have the necessary processing power and memory to analyse packets in real-time
• Can scale to detect millions of new malware samples and higher line rates

Scaling network security systems

The traditional approach to building network security systems is to build customised hardware including ASIC chip development. However, with the exponential growth in malware and higher line-rates, network security systems need to scale in both terms of data handling and computing power on a regular basis. This in turn means that the lifetime of a product revision will be shorter.

This begs the question: can network security system vendors keep up and have they got the deep pockets required to fund custom hardware and chip development on a regular basis?

It also leads to the question: is there another way?

High-performance network security systems can be based on standard, off-the-shelf PC servers when these are combined with Intelligent Real-time Network Analysis adapters for handling full line-rate data.The advantage of this approach is that it takes advantage of the strong roadmap of PC server and CPU chip vendors who are updating their performance and the number of processing cores they support on a yearly basis.

Addressing the dual challenge

Basing high-performance network security system development on standard PC servers with Intelligent Real-time Network Analysis adapters provides a path to addressing the dual challenge of more malware at higher line-rates. It provides a cost-efficient, yet high-performance model that allows network security system vendors to focus on their expertise, namely combating cybercriminals and protecting the vital commercial platform that the Internet has become.

Dan Joe Barry is Napatech’s VP Marketing. For more info on building high-performance network security systems see www.napatech.com