Engineering:Network detection and response
Network detection and response (NDR) refers to a category of network security products that detect abnormal system behaviors by continuously analyzing network traffic. NDR solutions apply behavioral analytics to inspect raw network packets and metadata for both internal (east-west) and external (north-south) network communications.[1]
Description
NDR is delivered through a combination of hardware and software sensors, along with a software or SaaS management console. Organizations use NDR to detect and contain malicious post-breach activity, such as ransomware, as well as insider attacks. NDR focuses on identifying abnormal behavior patterns and anomalies rather than relying solely on signature-based threat detection. This allows NDR to spot weak signals and unknown threats from network traffic, like lateral movement or data exfiltration.[1]
NDR provides visibility into network activities to identify anomalies using machine learning algorithms. The automated response capabilities can help reduce the workload for security teams. NDR also assists incident responders with threat hunting by supplying context and analysis.[1]
Deployment options include physical or virtual sensors. Sensors are typically out-of-band, positioned to monitor network flows without impacting performance. Cloud-based NDR options integrate with IaaS providers to gain visibility across hybrid environments. Ongoing tuning helps reduce false positives. NDR competes against broader platforms like SIEM and XDR for security budgets.[1]
Key capabilities offered by NDR solutions include: Real-time threat detection through continuous monitoring, Rapid incident response workflows to minimize damage, Reduced complexity versus managing multiple point solutions, Improved visibility for compliance and risk management, Automated detection and response, Endpoint and user behavior analytics, Integration with SIEM for centralized monitoring.[2]
History
The origins of NDR trace back to network traffic analysis (NTA) solutions that emerged around 2019. NTA provided greater visibility into network activities to quickly identify and respond to potential threats.[2]
By 2020, NTA adoption was growing for real-time threat detection. That year, a study found 87% of organizations used NTA, with 43% considering it a "first line of defense." The NTA market was valued at US$2.9 billion in 2022, and expected to reach US$8.5 billion by 2032. NTA evolved into NDR as a distinct product category. NDR combined detection capabilities with incident response workflows. This enabled detecting and reacting to threats across networks in real-time.[2]
Major attacks like WannaCry in 2017 and the SolarWinds breach in 2020 highlighted the need for solutions like NDR. Traditional perimeter defenses and signature-based tools proved insufficient against modern threats.[2]
AI applications
The use of artificial intelligence in NDR tools is growing, as security teams explore AI's potential to enhance NDR capabilities. Key AI use cases for NDR include:[3]
- Improved threat detection : AI can analyze large volumes of data on vulnerabilities, threats, and attack tactics to identify anomalous network activities. This allows NDR to detect emerging attack patterns with greater accuracy and fewer false positives.[3]
- Alert prioritization : AI models can evaluate the criticality of NDR alerts based on factors like affected assets, exploitability, and potential impact. This enables security teams to triage alerts effectively despite staff shortages.[3]
- Analyst workflow optimization : AI assistants can provide guidance to analysts during incident response, suggesting relevant investigation steps based on details of the threat. This amplifies analyst efficiency, especially for junior staff lacking specialized expertise.[3]
- Automated response : Although not yet widely adopted, AI could enable NDR platforms to autonomously execute containment measures like quarantining endpoints. AI would identify and recommend response actions for analyst approval.[3]
- Security team communications : NDR vendors are exploring integrations with natural language AI to generate incident reports and metrics digestible for business leaders, not just technical security staff.[3]
NDR Vendors
According to Gartner, NDR vendors include Cisco, Corelight, Darktrace, ExtraHop, Fortinet, IronNet, MixMode, Plixer, Trend Micro, Trellix, Vectra AI.[1]
References
- ↑ 1.0 1.1 1.2 1.3 1.4 Jonathan Nunez, Andrew Davies (20 July 2023). "Hype Cycle for Security Operations, 2023". https://www.gartner.com/doc/reprints?id=1-2EIN4TVS&ct=230721&st=sb&__hstc=45788219.57a590308de95e51d2f62b49fac710ef.1691078838873.1691078838873.1691078838873.1&__hssc=45788219.1.1691078838873&__hsfp=3812163218&hsCtaTracking=51e2e4ef-078c-41c0-a8bf-673c4e38176a%7C2cb608e8-3bb2-41fb-96a8-b3d410ee1978.
- ↑ 2.0 2.1 2.2 2.3 Wiens, Christian (2023-02-02). "A Comprehensive Guide to Network Detection & Response (NDR) — What CIOs & Security Analysts Should Know" (in en-US). https://securityboulevard.com/2023/02/a-comprehensive-guide-to-network-detection-response-ndr-what-cios-security-analysts-should-know/.
- ↑ 3.0 3.1 3.2 3.3 3.4 3.5 Grady, John. "How AI benefits network detection and response" (in en). https://www.techtarget.com/searchsecurity/opinion/How-AI-benefits-network-detection-and-response.
See also
 |  |
