NDR solutions and their role in cyber defense

NDR–solutions (Network Detection and Response, network detection and response) — a special tool for analyzing network traffic in order to build models to determine the performance of the network and notify the responsible persons in case a deviation from the norm is detected. In his work, he is not based on the classic signatures on which most antivirus software is built, but on machine learning as part of artificial intelligence. The system is guided by the readings of network sensors and detects suspicious and anomalous traffic that indicates a cyber attack.

One of the functions of NDR solutions can also be called response. The system can send automatic responses, as well as manual ones. That is, send commands to the firewall to drop suspicious traffic, as well as provide tools to search for a potential threat and respond to it. The use of NDR solutions in practice can solve many network problems, but nevertheless, experts have established the maximum effectiveness of their use in the field of combating cyber attacks.

Now let's take a closer look at how this system is able to deal with ransomware. Let's get acquainted with the basic methods of working NDR. We will show you how to provide additional protection against unauthorized access and a high level of network security by using an additional connection to the work of such a tool as mobile proxies.

The nuances of fighting NDR against ransomware

In practice, ransomware activity has increased significantly in recent years. Both small and large organizations suffer from such attacks. And the level of damage here is often in the millions. And the point here is not only the ransom that pays the hackers, but also the decrease in the productivity of the company, the deterioration of consumer confidence in the brand. To get back up and running again, organizations often have to restore the health of the IT system, pay staff overtime in order to return to normal work in the shortest possible time.

The work of NDR is largely based on the so-called SOC (Security Operations Center) visibility triad. It is a concept that involves the deployment of a range of security tools that would complement each other, compensating for their own shortcomings. As a result, the chances of intruders to achieve their goal are significantly reduced.

There are 3 fundamental points in the SOC visibility triad:

1. EDR: Provides endpoint security.
2. SIEM: provides log processing and event correlation.
3. NDR: Analyzes streaming data parameters from a network perspective.

Every day, more and more security professionals implement models based on NDR tools into their projects. They are designed to enhance endpoint protection as well as log management capabilities. NDR components are able to complement and compensate for the weaknesses of EDR and SIEM, thereby providing absolute security and transparency, including complex IT-environments.

To achieve maximum effect, all three of these tools must work together. Only in this way will they be able to cover all parts of the anatomy of an attack and significantly increase the likelihood of early detection. Let's take a closer look at each of the components.

EDR highlights

EDR (Endpoint Detection & Response) —malware activity detection system at the endpoint. Asset compromise brings cybercriminals closer to gaining privileged access, opening up new attack opportunities for them. Unlike classic antivirus programs, which are aimed at combating mass and typical threats, EDR solutions are able to detect fairly complex threats and targeted attacks.

SIEM Features

Statistics show that over 80% of successful hacks are based on compromised credentials. Therefore, it is very important to clearly understand what is normal behavior on the network. Only in this way it will be possible to detect a deviation from the norm, that is, anomalies.

Imagine a situation where you, as a company security representative, see that someone is trying to enter your system, let's say 100 times in one second. What action will you take in this case? The most logical and fastest solution — disconnecting the device from the network. And if the work was carried out with one computer, then there would be no particular problem. But in practice, IT specialists have to work with dozens, hundreds, or even thousands of devices. And collect the corresponding logs from each of them, merge, analyze — this is an overwhelming task. It is her solution that the security event management system — SIEM.

NDR highlights

NDR (Network Detection and Response) is intended for the following tasks:

• network intrusion detection;
• concentration on the most important objects of cyber defense;
• sorting cybersecurity issues;
• Noise filtering

With the help of NDR, specialists will be able to respond to incidents in a timely manner, identify the most important aspects, thereby forestalling the appearance of a problem. That is, this tool does not fight the consequences, but works ahead of the curve. It is able to detect anomalies by barely noticeable symptoms and notify specialists about it, who, in turn, will prevent future attacks.

The NDR solution practically does not use signature-based methods in its work. They are based on machine learning and other analytics. In order to detect suspicious traffic in corporate networks, the system tools constantly analyze traffic, record flows and build models that will display the normal behavior of the network. And as soon as the first signs of deviation from the norm are noticed. An appropriate warning will be issued.

Both EDR and SIEM— effective, time-tested tools, but they still leave blind spots in operation, especially in the so-called East-West corridor. This is where attackers often hide after bypassing perimeter defenses. With a networked approach, NDR is able to cover these gaps as well, increasing visibility and coverage. That is, they will be effective when working from North to South, and from East to West. At the same time, they will be able to monitor and analyze encrypted traffic.

NDR Features

We have already mentioned that at work, the NDR solution constantly monitors network traffic and analyzes the data exchange. This is what allows them to detect anomalies and suspicious behavior in advance, respond to still implicit security threats, including those that have not been identified by other technologies. Today, attackers are actively developing malicious software for which there are no signatures. That is why NDR solutions do not rely on these very signatures, but focus on machine learning.

The operation of this service can be divided into 3 separate steps:

1. Input data. This includes network telemetry, reputation channels, full packet data, signature identifiers.
2. Algorithms. Input data processing is carried out using machine learning tools, user behavior analysis, adaptive baseline, heuristics, signatures, reputation data.
3. Processing results. At this stage, methods such as telemetry, events, alerts, forensics, experience gained from previous incidents are applied.

Let's get acquainted with the main tools from each of the above categories in more detail:

• Machine learning. This tool is constantly working on the calculation and analysis of entropy between the individual sides of the network. This is how machine learning can distinguish between human and computer actions. Thanks to this, NDR solutions can detect those types of network attacks that constantly repeat patterns in the network without generating, that is, it is characterized by very low entropy.
• Heuristics. We are talking about algorithms based on probability theory that find specific symptoms in networks. This method shows the percentage of probability that a particular malicious event is present.
• Basic adaptive level. It involves the analysis of individual hosts, the identification of their network behavior, as well as the comparison of the behavioral factors of different hosts with each other. As an example, if one of the hosts is found to generate many more emails than others from the same network, then there is a high chance of spamming, compromise, etc.
• Analysis of user behavioral factors. The system will respond to a large amount of transmitted data, uncharacteristic connections, a mismatch between the type of connection and the legitimate network template, etc.
• Incident response. We already mentioned at the beginning of the review that NDR solutions can respond to unforeseen situations in two ways: manually and automatically. In the field of manual response, NDR vendors are constantly working to improve their threat detection and incident response capabilities. They also strive to improve workflow options, suggest how to prioritize correctly, that is, which security events should be responded to in the first place. In the case of using automated tools, NDR focuses on other aspects of security, those that can be automated. So, it can be sending a firewall command to drop suspicious traffic, sending commands to isolate an endpoint, sending detected events to SIEM tools, working with compromised endpoints, collecting and correlating events, etc.
• Reputation data. To provide additional value, a number of NDR solution providers already include data with threat intelligence as a basic part of their offerings. These are open source services that can be presented as commercial feeds with malicious IP addresses, domain names, hostnames, fingerprint etc

How to provide additional protection for networking

The fact is that every time you access the network, sites identify the IP-address and geolocation of the device from which you got to them on the site. It is this data that the attackers use to get into your computer or laptop. How to prevent this? The simplest and most logical solution — hide your real IP-address. This is exactly what mobile proxies from the MobileProxy.Space service are designed to provide. They pass the entire data stream through themselves, while replacing the address and location with their own technical parameters. This ensures:

• absolute confidentiality and anonymity of work on the Internet;
• protection against any unauthorized access, hacker attacks;
• gaining access to all sites, including those that are blocked by your country at the legislative level;
• higher connection speed, which is ensured by the use of high-speed communication channels and data caching;
• the ability to work in multi-threaded mode from one device without fear of getting banned, even if you connect a program to automate actions.

When you choose mobile proxies from the MobileProxy.Space service, you get functional and easy-to-use solutions. Please visit https://mobileproxy.space/en/user.html?buyproxy to learn more about the features of this product. Among the main points, we highlight: the ability to change addresses both automatically, that is, by timer, and forcibly through a special link from your personal account, simultaneous work using HTTP (S) and Socks5 protocols, the ability to change geolocation and mobile network operator right in the workflow. Customers of the service are provided with a round-the-clock technical support service, which will quickly and professionally solve the difficulties that have arisen in the work.

Mobile proxies from MobileProxy.Space and NDR solution — the best combination for a stable, secure, efficient web experience.

Share this article: