Qosmos

DPI For Lateral Movement Detection White Paper

WHITE PAPER
Protecting
Against Malware: Using DPI Inside Security Solutions to Detect Lateral Movements

 

This white paper looks at attack techniques, the vulnerability of an attack during the lateral movement phase, the ability of DPI to detect infiltration during this phase and different techniques for doing so.

When malware successfully infiltrates a network, it typically evolves through the cyber kill chain in an attempt to reach the final goal of data exfiltration, a ransom request and so on. During the lateral movement stage, when it tries to propagate the network and access resources, it generates specific types of network traffic. It is here that it becomes most vulnerable to detection. However, distinguishing potential threats from legitimate traffic requires the management and analysis of huge amounts of data often complicated by the high number of false positives.

DPI software, embedded in security solutions, is highly effective in accurately detecting network-based lateral movement, allowing rapid containment of attacks and remediation. The protocol information and metadata can be used to improve the results of user behavior analysis and machine learning, and to enable mitigation at each stage of the kill chain, improving the effectiveness of security solutions.

>> Download the white paper

We use cookies to improve and personalize your browsing experience. This site may also include cookies from third parties. By using this site, you consent to the use of cookies. Read more

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close