ACTIONABLE
INSIGHTS

Anomaly
Detection
SystemUNCOVERINGTHREATSBEHAVIORANALYSIS

NETWORKTRAFFIC

Deal with security threats
and operational issues confidently
Flowmon ADS (Anomaly Detection System) is a network security solution poweredby an intelligent detection engine designed to complement traditional security
tools. It seals the gap between perimeter and endpoint protection where attackers
can often lurk. Unlike conventional solutions based on statistical detection, it uses
behavior analysis algorithms to detect anomalies that are hidden in network traffic.
These algorithms can reveal malicious behaviors, attacks against mission-criticalapplications, data breaches and a spectrum of indicators of compromise.

“Thanks to Flowmon, we are provided withnetwork visibility we previously lacked.
Now we can identify the causes of network
issues easier than ever before.”
Masahiro Sato, CTO at SEGA

Confident action,clear strategy
Flowmon’s detection capabilities combined with detailed analytics results in a solutionthat is useful throughout the incident lifespan:

Detection of insider threats
Whether incidents are caused by a careless user or malicious intent, protect yournetwork from the inside.

Unknown threat detection
Thanks to behavior pattern recognition the system can discover unknown threatsin early stages before any damage is done, providing zero-day protection.

Incident investigation and response
Machine learning and data analytics work in unison to provide administratorswith contextualized intelligence to reduce response time.

Troubleshooting and forensics
Flowmon ADS retains a wealth of information for deep post-compromise
analysis and creates evidence for auditing and prevention purposes.

KEY FEATURES AND BENEFITS

Automation

Noiseless insight

The solution detects threats

Flowmon provides accurate insight

immediately without placing theusing sophisticated algorithms,

burden of interpretation on the user.

machine learning, heuristics,and artificial intelligence.

DEE

SP

Zero-day threat detection

Short incident response time

Users learn about threats early due toIncidents are detected in near

behavior pattern recognition, which canreal-time, providing context

detect anomalies in their infancy, preventing

including information forthe danger from escalating.

remediation.

Integrations
There are many possibilities to integrate the solution with complementary security
tools and platforms, whether it is through syslog, SNMP, email, REST API or custom
scripts. Flowmon serves as a critical source of information to log management, SIEM,
big data platforms, incident handling or response tools.

Advantage at every stageof compromiseIt’s important to layer the security so that it is able to monitor the perimeter, endpoint,and network, and use a combination of detection approaches. Flowmon not only
detects threats but enables response and forensic analysis.

Exploitation

Privileges& AccessDiscovery

LateralMovementCollection

Perimeter

Endpoint

Network

CoveredContributes

Command& Control

Exfiltration

Impact1

How it works
Detection Process – Flowmon ADS uses several detection mechanisms that combine
into one versatile capability that can examine network traffic from several points ofview and thus cover a wider array of scenarios.

Data Source

Detection

Proprietary Enriched
Network Telemetry

Machine Learning

3rd-Party NetFlow/IPFIXand Compatible Standards

Adaptive Baselining

Raw Packet Data

Heuristics
Threat and Anomaly
AlertsUser Identity

Behavior Patterns

IDS SignaturesReputation

Built-in and Custom ThreatIntelligence

234

Report and Visualize – The analytical view provides context-rich visualization ofattacks with drill-down analysis for a detailed understanding of what is happening.

Segmentation and Prioritization – Incidents are ranked according to your priorities
with an easy-to-use customization wizard that builds upon battle-tested out-of-thebox configuration.

Response – Flowmon ADS can be integrated with network access control,
authentication, firewall or other tools for immediate incident response.

www.flowmon.com