Overview

SDN and NFV technologies offer service providers and network operators numerous widely publicized operational and business benefits. With SDN and NFV infrastructures, service providers can reduce operational costs through simplified network management and increase revenue streams by offering virtualized IT services to their enterprise customers.

However, the rollout of new SDN and NFV technologies and infrastructures also exposes service providers to a range of “IT-like” security vulnerabilities. Unlike traditional communications networks, which are closed infrastructures protected by readily-available and mature security solutions, SDN and NFV networks are open, software-based and designed to be programmed and controlled remotely. This creates inherent security vulnerabilities, including ongoing threats of hacking, malware and other cyber-security related attacks.

NFV CyberGuard consists of advanced network monitoring sensors embedded on a virtualization platform, a big data analytics engine and an SDN controller. NFV CyberGuard’s advanced network monitoring sensors continuously gather application-level session information from across the entire network and organize an ongoing database of expected network behavior. This information is then fed into a big data analytics engine, which in real-time monitors and alerts for anomalous network behaviors or activities, such as Advance Persistent Threats (APTs), flooding and direct denial of service (DDoS) attempts on the network function virtualization infrastructure (NFVI), remote access threats and specific attacks on the application (VMs) plane and spoofing attacks on all open network layers.

When anomalies are identified, NFV CyberGuard instantaneously activates the SDN controller to apply predefined policies and take immediate network-wide action to neutralize threats before they cause damage.

By running NFV CyberGuard as a network function virtualization (NFV), the solution provides security professionals at service providers with advanced detection forensics and a real-time monitoring and analysis of network threats, complete visibility of the entire network and the ability to apply cyber-security policies and efforts to the entire infrastructure.