NBAR (Network Based Application Recognition)

Network Based Application Recognition (NBAR) is a mechanism that classifies and regulates bandwidth for network applications to ensure that available resources are utilized as efficiently as possible. Cisco Systems developed NBAR as part of its Content Networking platform for implementing intelligent network services.

NBAR allows network routers to recognize programs and take various actions based on that information. For example, a router might allocate all necessary bandwidth for mission-critical applications or flag low-priority, bandwidth-intensive applications for bandwidth throttling. The network administrator can view the mix of applications in use by the network at any given time and decide how much bandwidth to allow each application. (This regulation process is called bandwidth policing.)

Other capabilities of NBAR include:

• Optimizing multiple-service performance.
• Eliminating data-flow bottlenecks.
• Minimizing latency.
• Reducing or blocking spam.
• Detecting and blocking malware.
• Enhancing network security.
• Easy addition of new protocols.
• Reducing expenses and maximizing revenue.

One real-life example of NBAR in use was during the Code Red worm attacks of 2001. Most firewalls couldn't look into the HTTP data stream to identify Code Red traffic. However, implementation of NBAR made it possible to identify the suspect traffic and block access.

Source: www.whatis.techtarget.com

More sites to visit... Shared Pool Amazing Davao Tribu Hagtik A Day Called Today

Drive By Download

A drive-by download is a program that is automatically downloaded to your computer without your consent or even your knowledge. Unlike a pop-up download, which asks for assent (albeit in a calculated manner likely to lead to a "yes"), a drive-by download can be initiated by simply visiting a Web site or viewing an HTML e-mail message. If your computer's security settings are lax, it may be possible for drive-by downloads to occur without any further action on your part.

Frequently, a drive-by download is installed along with a user-requested application. (In this case, the unwanted application is sometimes called a barnacle.) For example, a file sharing program might be included with a spyware program that tracks and reports user information for targeted marketing purposes. An associated adware program can then generate pop-up advertisements using that information.

Xupiter, an Internet Explorer toolbar program, was frequently installed as a drive-by download in the early 2000s. The program replaced a user's home page, changed browser settings, and used a redirect to take all searches to the Xupiter Web site. In some versions, the program initiated drive-by downloads of other programs. Furthermore, although it came with an uninstall utility, Xupiter was quite challenging for the average computer user to remove.

Drive-by downloads continue to be a major security issue online. In April 2007, researchers at Google discovered hundreds of thousands of Web pages that initiated drive-by downloads. One in ten pages was found to be suspect. Sophos researchers in 2008 reported that they were discovering more than 6,000 new infected Web pages every day, or about one every 14 seconds. Many of these infections are connected to botnets, in which each PC is turned into a zombie that may then be directed to further malicious activity, like spam or DDoS attacks

Source: http://whatis.techtarget.com

Honey Monkey

A honey monkey is a program that imitates a human user to lure, detect and identify malicious activity on the Internet.

According to Microsoft, who developed the concept, a honey monkey is an active client-based honey pot. The honey monkey behaves like a highly active and extremely unwary human Internet user, logging onto many suspect websites. The programs detect harmful coding that could jeopardize the security of human visitors.

Certain types of websites are more likely to contain malicious coding, whether by design or as a result of hacking. Favored targets include the home pages of celebrities, sites that offer downloadable music and videos (particularly those that operate in violation of copyright law), pornographic sites and sites with gaming cheat codes. Sophisticated hackers operate according to the principle of "minimizing the effort and maximizing the results." Effective honey monkeys take advantage of the same paradigm, scanning the Web for URLs most likely to be compromised. In some cases, individual hackers can be personally identified.

Microsoft developed a Web patrol system called Strider HoneyMonkeys to detect Web sites that frequently install spyware, Trojans and viruses on the computers of Internet users. Microsoft's system consists of multiple monkey programs running on virtual machines (VMs). Host systems have a range of patch levels to detect specific types of exploits.

In addition to identifying and isolating uniform resource locators (URLs) that propagate malware, a program called Strider Tracer can detect configuration and file changes that occur following an exploit. Using this method, interconnected communities of Web sites have been discovered that use targeted URLs to exploit client-side vulnerabilities on unpatched computers. Once such a site and the nature of its activity has been identified, a patch is generated to counter the threat.

For more information on Honey Monkeys visit Microsoft Research discusses how Strider HoneyMonkeys work. (PDF)

Source: http://whatis.techtarget.com

Squid Proxy Server

Squid is a Unix-based proxy server that caches Internet content closer to a requestor than its original point of origin. Squid supports caching of many different kinds of Web objects, including those accessed through HTTP and FTP. Caching frequently requested Web pages, media files and other content accelerates response time and reduces bandwidth congestion.

A Squid proxy server is generally installed on a separate server than the Web server with the original files. Squid works by tracking object use over the network. Squid will initially act as an intermediary, simply passing the client's request on to the server and saving a copy of the requested object. If the same client or multiple clients request the same object before it expires from Squid's cache, Squid can then immediately serve it, accelerating the download and saving bandwidth.

Internet Service Providers (ISPs) have used Squid proxy servers since the early 1990s to provide faster download speeds and reduce latency, especially for delivering rich media and streaming video. Website operators frequently will use a Squid proxy server as a content accelerator, caching frequently viewed content and easing loads on Web servers. Content delivery networks and media companies employ Squid proxy servers and deploy them throughout their networks to improve the experience of viewers requesting programming, particularly for load balancing and handling traffic spikes for popular content.

Squid is provided as free, open source software and can be used under the GNU General Public License (GPL) of the Free Software Foundation. Squid was originally designed to run on Unix-based systems but can also be run on Windows machines.

Squid was originally an outgrowth from the Harvest Project, an ARPA-funded open source information gathering and storage tool. "Squid" was the code name used to differentiate the project when development in the new direction was initially begun.

For more information on Squid proxy servers visit: http://www.squid-cache.org/

Source: http://whatis.techtarget.com

Anti-money Laundering Software (AML)

Anti-money laundering (AML) software is a type of computer program used by financial institutions to analyze customer data and detect suspicious transactions.
AML systems filter customer data, classify it according to level of suspicion and flags it for for inspection for anomalies. Such anomalies include any sudden or substantial increase in funds or a large withdrawal, and structuring - depositing multiple smaller amounts with in a certain period that sums up to a large amount.
The software flags these transaction. The software mines the data and flagged suspect transaction and generate the report, which is evaluated or will be subject for investigation and call the customer, if necessary.

Reference: http://searchfinancialsecurity.techtarget.com