AntiDDoS

The solution utilizes an intelligent distributed traffic analysis module, enabling detection and blocking of a wide range of cyber threats in real time.

How It Works

All operator traffic passes through the Stingray DPI system, which forwards IPFIX Fullflow to the QoE module for detailed analysis. Based on this analysis, the module creates a reference profile of “healthy” traffic, free of attacks and botnet activity.

Using neural networks and machine learning algorithms, the detector identifies deviations from the norm, classifies threats, and identifies their sources. When an attack is detected, an “Attacks” container is created, containing the IP addresses of the attackers and the ports they use. DPI creates specific protocols for each threat type, which it then uses to either completely block this traffic or limit its bandwidth.

The “Attacks” container is updated in real time: if the attack stops, the corresponding IP addresses are removed from the list.

For additional protection, blackhole integration is provided: if the operator’s equipment cannot handle the load, the Attacks container can be passed to a script that automatically adds attackers to the blackhole, ensuring maximum infrastructure protection.