Network behavior analysis (NBA) is a way to enhance the security of a proprietary network by monitoring traffic and noting unusual actions or departures from normal operation. Conventional intrusion prevention system solutions defend a network's perimeter by using packet inspection, signature detection and real-time blocking. NBA solutions watch what's happening inside the network, aggregating data from many points to support offline analysis.

After establishing a benchmark for normal traffic, the NBA program passively monitors network activity and flags unknown, new or unusual patterns that might indicate the presence of a threat. The program can also monitor and record trends in bandwidth and protocol use. Network behavior analysis is particularly good for spotting new malware and zero day exploits.

A good NBA program can help a network administrator minimize the time and labor involved in locating and resolving problems. It should be used as an enhancement to the protection provided by the network's firewall, intrusion detection system, antivirus software and spyware-detection program. 

Most companies rely on legacy IT systems, consisting of perimeter security and endpoint protection. However, they dismiss the significant infrastructure located between these two areas. In the world where threats have more opportunities than ever to bypass traditional solutions and sneak in, where 70% of attacks come from an internal network, this approach is not enough anymore. How do you secure your systems and data from sophisticated, ever changing threats that are undetectable by traditional solutions?

The answer to this challenge recommended by respected authorities such as Gartner is a proactive detection and mitigation of network anomalies and undesirable behavior. This is provided by network monitoring solutions equipped with powerful artificial intelligence called Network Behavior Anomaly Detection. NBAD solutions permanently observe network traffic, analysing communication to seek anomalies and reveal suspicious behavior. This enables a response to yet unknown security threats undetectable by other technologies.

• Have a detailed awarenessof what is happening in the network.

• Utilize network traffic statisticsexported by routers/switches or network probes (NetFlow, jFlow, IPFIX, NetStream and other flow data standards) to detect malicious behavior.

• Complete the security circle by a complementary solutionfor detecting advanced threats bypassing traditional solutions, e.g. targeted attacks, botnets, unknown malware, insider threats -data leakage, etc.

• Streamline network operations by the automatic detection of anomalies and operational issues.