After Lancopes StealthWatch G1 intrusion detection appliance won eWeek and PC Magazines i3 Awards Security category at NetWorld+Interop, I met with the original author of the software, Lancope Chairman John Copeland, to see the technology for myself.
New in StealthWatch 2.0, which started shipping last month, is the ability to set alarm policies that allow specified servers to communicate with a specified, trusted range of client IP addresses without alarms; connections from any other clients raise alarms. A corporation can now set policies that treat internal desktop IP addresses differently from those of VPN clients or outside IP addresses, for example.
StealthWatch uses two techniques to flag possible attackers. First, it detects port scans and unusual or illegal IP packet flag settings and marks sending hosts as possibly dangerous. If one of these hosts then follows up with a larger data transfer to a probed machine, its flagged as a possible follow-on attack.
Second, StealthWatch tracks the ports used by all machines to send and receive data (its as much a network mapping and monitoring device as an IDS). StealthWatch then builds a cross-network profile during a learning phase. This enables it to determine which ports are sending or receiving traffic from the client and server machines during normal operation.
When switched into alarm mode, the software will detect changes if, say, a client system suddenly starts accepting traffic from other clients (evidence of a possible unauthorized Web server installation or a running Trojan) or if a server starts listening on a new port (evidence of a possible root kit).
It wont catch nonscanning attacks against ports on systems already classified as servers—outside Web servers, for example. For these, signature-based systems are needed.
Because StealthWatch is a stateless device and doesnt look deep into packets (it reads only down to the header of the transport layer), it is much faster than other IDS systems—the $35,000 G1 version can monitor gigabit links, and the $20,000 M100 version can handle links as fast as 100M bps.