NetScout, a cybersecurity vendor whose real-time intelligence network covers approximately half of all internet traffic, announced an update to its Adaptive DDoS Protection platform. The software allows service providers to detect and mitigate outbound distributed denial-of-service attack traffic. By targeting the source of the traffic rather than just the destination, the system prevents compromised subscriber devices from consuming network capacity and attacking external organizations.
Threat actors weaponize consumer broadband routers, cameras and other connected hardware using Turbo-Mirai class botnets. These networks generate multi-terabit attacks that result in service outages and damaged peering relationships, increasing transit costs for service providers. By identifying malicious traffic generated by compromised devices before it exits the local infrastructure, network operators can lower infrastructure expenses and reduce regulatory risk.
“The combination of higher-speed broadband connectivity and vulnerable IoT devices has been weaponised by a new class of massive DDoS botnets,” said Patrick Donegan, founder and principal analyst at HardenStance. “Source-side mitigation, or attack suppression as it’s sometimes known, is a critical part of the equation. NetScout’s approach, backed by its ATLAS Intelligence Feed (AIF) and ASERT analysts, gives service providers the tools they need to detect and stop attacks before they have an impact, protecting their customers and the broader internet from the large-scale DDoS attacks we have seen.”
The expanded capability integrates with the company's Arbor Sightline and Arbor Threat Mitigation System products. The architecture applies artificial intelligence and machine learning protocols to analyze outbound internet traffic volumes and uncover attacks designed to hide within legitimate data flows. The system combines this localized detection with customized threat intelligence to apply dynamic identification, traffic redirection and adaptive mitigation for each internet service provider.
“We are extending DDoS defence from the target to the source,” stated Darren Anstee, CTO, Security, NetScout. “By using our internet-scale visibility to derive localised threat intelligence for our customers, NetScout can identify and precisely suppress attacks at their origin, before they cause problems locally or at their target. This capability gives our customers a new level of comprehensive defence across their peering, transit, cloud and customer edges.”
This deployment applies established inbound mitigation workflows to outbound threats. The approach helps operators secure their infrastructure against abuse complaints and customer churn by containing compromised device populations at the network edge.
