<![CDATA[[SecurityRatty] tag: performance]]> http://securityratty.com/tag/performance Tue, 05 Aug 2008 12:34:35 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Magic Quadrant for Application Delivery Controllers]]> http://securityratty.com/article/224089e5d76323e4bbe5b8297445e9f4 http://securityratty.com/article/224089e5d76323e4bbe5b8297445e9f4 (Source: Citrix) Gartner summarizes its view on Application Delivery Controllers, evaluates strengths and weaknesses of solutions, and provides Magic Quadrant reporting for a quick comparison across all vendors. Learn from Gartner how you can benefit from an all-in-one device like Citrix NetScaler that delivers the highest levels of availability, performance and security.

]]> Fri, 29 Aug 2008 09:00:00 +0000 application delivery controllers magic quadrant citrix citrix netscaler gartner quick comparison all-in-one device source solutions Magic Quadrant for Application Delivery Controllers <![CDATA[How do you Manage Virtualization if you cant see Performance?]]> http://securityratty.com/article/ed2ef4931f690c62b02f28e517c0aa0d http://securityratty.com/article/ed2ef4931f690c62b02f28e517c0aa0d NetIQ, which seemed to drop off the planet not long after being bought by Attachmate, is back with the results of a very interesting virtualization survey. Now, you know that you need to take all surveys with a big grain of salt (e.g., the majority of respondents to this one were less than 10% virtualized), but it’s still good to take temperatures whenever possible.

The numbers we found interesting:

- only 21% currently deploying virtualization have any kind of systems management solutions for their virtual infrastructure

- about 27% are managing performance/ability of virtual systems with same tools they use for physical servers (Nothing wrong with that as long as they’re seeing what they need to see but…)

- 40 percent of those surveyed do not report the performance of their virtualized applications, hardware, operating systems, or their virtual machines in any measureable way (which rather undercuts the whole point)

Get the full results here.

]]> Thu, 28 Aug 2008 21:15:41 +0000 virtualization systems systems management solutions virtual systems virtualization survey virtual machines physical servers virtual infrastructure performance How do you Manage Virtualization if you cant see Performance? <![CDATA[Web Based Botnet Command and Control Kit 2.0]]> http://securityratty.com/article/4f945955ba8a424fe6b9352583602062 http://securityratty.com/article/4f945955ba8a424fe6b9352583602062
The average web based command and control kit for a botnet consisting of single user, single campaign functions only, has just lost its charm, with a recent discovery of a proprietary botnet kit whose features clearly indicate that the kit's coder know exactly which niches to fill - presumably based on his personal experience or market research into competing products.

What are some its key differentiation factors? Multitasking at its best, for instance, the kits provides the botnet master with the opportunity to manage numerous different task such as several malware campaigns and DDoS attacks simultaneously, where each of these gets a separate metrics page.  

Automation of malicious tasks, by setting up tasks, and issuing notices on the status of the task, when it was run and when it was ended. Just consider the possibilities for a scheduling malware and DDoS attacks for different quarters.  

Segmentation in every aspect of the tasks, for instance, a DDoS attacks against a particular site can be scheduled to launched on a specific date from infected hosts based in chosen countries only.  

Customized DDoS in the sense of empowering the botnet master with point'n'click ability to dedicate a precise number of the bots to participate, which countries they should be based in, and for how long the attack should remain active. Quality and assurance in DDoS attacks based on the measurement of the bot's bandwidth against a particular country, in this case the object of the attack, so theoretically bots from neighboring countries would DDoS the country in question far more efficiently.  

Historical malware campaign performance, is perhaps the most quality assurance feature in the entire kit, presumably created in order to allow the person behind it to measure which were the most effective malware and DDoS campaigns that he executed in the past. From an OSINT perspective, sacrificing his operational security by maintaing detailed logs from previous attacks is a gold mine directly establishing his relationships with previous malware campaigns.

Bot Description:  
1. Completely invisible Bot work in the system.
2. Not loads system.
3. Invisible in the process.
4. Workaround all firewall.
5. Bot implemented as a driver.
Functions Bot (constantly updated): 
1. Downloading a file (many options).
2. HTTP DDoS (many options, including http authentication).
The web interface 
-- Convenient manager tasks.
-- Every task can be stopped, put on pause, etc. ...
-- Interest and visual scale of the task.  
-- A task manager for DDoS and Loader
    
-- For DDoS tasks
Bots involved in DDoS 'f.
Condition of the victim (works, fell).
2. Bots manager
-- Displays a list of bots (postranichno).
-- Obratseniya date of the first and last.
-- ID Bot.
-- Country Bot.
-- Type Bot.
-- The status Bot (online / offline).
-- Bot bandwidth to different parts of the world (europe, asia).
-- The possibility of removing bots
-- When you click on ID Bot loadable still a wealth of information about it
3. Statistics botneta
-- Statistics both common and build Bot.
-- Information on the growth and decline botneta dates (and build).
-- Bots online
-- All bots
-- Dead bots.

4. Statistics botneta country
-- All countries to work on 
-- New work by country 
-- Online work from country to country
-- Dead bots by country
5. Detailed history botneta 
6. Convenient user-friendly interface adding teams
8. Admin minimal server loads
-- Use php5/mysql
Upcoming features :
1. Form grabber (price increase substantially), for old customers will be charged as an upgrade
2. Public key cryptography
3. Clustering campaigns and DDoS attacks

Despite it's proprietary nature, it's quality and innovative features will sooner or later leak out for everyone to take advantage of, a rather common lifecycle for the majority of proprietary malware kits in general.

Related posts:
]]> Fri, 22 Aug 2008 10:02:15 +0000 ddos attacks based ddos attacks malware previous malware campaigns ddos attacks simultaneously botnet country country bot ddos Web Based Botnet Command and Control Kit 2.0 <![CDATA[CEP and Analytics]]> http://securityratty.com/article/7167551d00ca26f4a0df8a91ba7a3054 http://securityratty.com/article/7167551d00ca26f4a0df8a91ba7a3054 Peter Lin comments in A Complex Event = Sum (Events) + Situational Knowledge, continuing the discussion by asking ”What is the definition of analytics? Is it purely a calculation, or something else?”

A good place to being to look for clues to an answer is Wikipedia, where the opinion of the author there is,

 ”A simple and practical definition, however, would be how an entity (i.e., business) arrives at an optimal or realistic decision based on existing data.”

Quoting the Wikipedia author(s) further,

“Common applications of Analytics include the study of business data using statistical analysis in order to discover and understand historical patterns with an eye to predicting and improving business performance in the future. Also, some people use the term to denote the use of mathematics in business. Others hold that field of analytics include the use of Operations Research, Statistics and Probability. However, it would be erroneous to limit the field of analytics to only statistics and mathematics.”

The Wikipedia author(s) continue their discussion of analytics, as follows;

“Analytics closely resembles statistical analysis and data mining, but tends to be based on modeling involving extensive computation. Some fields within the area of analytics are enterprise decision management, marketing analytics, predictive science, strategy science, credit risk analysis and fraud analytics.”

All of these topics above are CEP-related areas involving complex events and situations based on the need for optimal and reliable real-time capabilities to make meaningful (business) decisions. 

Simple pattern matching, event mediation and routing, and basic mathematical calculations do not really fall into the realm of complex event processing.  Instead, CEP is real-time decision support based on modeling and “extensive” computation.  In a nutshell, complex events and situations require analytical models that are non-trivial and that is why without analytics, there is no true “complex event processing.”

See also:

WIkipedia on Predictive Analytics

]]> Tue, 19 Aug 2008 10:09:59 +0000 analytics wikipedia author quotingthe wikipedia author fraud analytics author predictive analytics analytics include business data business CEP and Analytics <![CDATA[Sensitive data on 100,000 students exposed by Princeton Review]]> http://securityratty.com/article/f69164e1c912b55fdbf81ba3b82021ad http://securityratty.com/article/f69164e1c912b55fdbf81ba3b82021ad

]]> Tue, 19 Aug 2008 09:00:00 +0000 princeton review test preparation provider data educational service performance results students birth names inadvertently Sensitive data on 100,000 students exposed by Princeton Review <![CDATA[Defense Spooks: Let's Control Enemy Minds]]> http://securityratty.com/article/2405600bcfe670aac40e16295c673819 http://securityratty.com/article/2405600bcfe670aac40e16295c673819
]]> Sat, 16 Aug 2008 09:03:00 +0000 report recommends investment enemies drugs defense agents neuroscience research fight soldiers commands reveal Defense Spooks: Let's Control Enemy Minds <![CDATA[Encryption bottleneck: Lessons from performance analysis]]> http://securityratty.com/article/f3dcec3250e22c457f2cf403403fce8c http://securityratty.com/article/f3dcec3250e22c457f2cf403403fce8c Wed, 13 Aug 2008 20:00:00 +0000 necessarily faster processor strong encryption encryption keylength slowly increase computer Encryption bottleneck: Lessons from performance analysis <![CDATA[XTM? YAUSA, or Yet Another Useless Security Acronym]]> http://securityratty.com/article/1cfad76faecbff53ca0cd9b7d4b3dcda http://securityratty.com/article/1cfad76faecbff53ca0cd9b7d4b3dcda
1. You can't (and wouldn't want to) manage threats.
2. UTM originally applied to products for small and midsize businesses (SMBs), but UTM has been recently co-opted by some enterprise security vendors under the guise of fresh marketing.
3. There is little evidence that many of the components in these platforms are integrated, much less "unified." Now, there is some promotion of the new acronym XTM (that is, eXtensible threat management) as a new generation of UTM. We're not referring to any product name, but the attempt to create a new and confusing acronym, and create another artificial market to size and make predictions about.

No matter what you call it, the arc of advancement of network security products for the SMB will continue: New threats will drive the development of new safeguards that will be included as an option in that same appliance. This is not true for the enterprise, where best-of-breed buying of point solutions will continue, with consolidation of products occurring in three places, aligned by buying center and safeguard profile (see "Introducing the Secure Web Gateway").

The next-generation firewall (NGFW) will serve the enterprise and combine firewall and IPS,; however, there will be no UTM for the enterprise (see "Magic Quadrant for Enterprise Network Firewalls, 2H07"). We are already seeing SMB multifunction firewall vendors optimizing performance by assigning separate ASICs, emphasizing that the inspection tasks on content and network processing are very different (see "MarketScope for Multifunction Firewalls for Small and Midsize Businesses"). Even among SMBs, we are seeing little evidence that many are deploying network, content and e-mail processing in the same platform, usually leaving e-mail security to a separate product or service.]]> Mon, 11 Aug 2008 13:06:29 +0000 network enterprise network firewalls enterprise network security products enterprise security vendors utm acronym term utm products XTM? YAUSA, or Yet Another Useless Security Acronym <![CDATA[The Secret Sauce is the Situation Models]]> http://securityratty.com/article/e137f84c371e05c9a9841a0cc1ff27ec http://securityratty.com/article/e137f84c371e05c9a9841a0cc1ff27ec Alan Lundberg wrote, Intelligent Business Process Platform? in response to Bringing Order to Chaos where someone from PWC linked event processing to business intelligence and business process management.  In turn, James Taylor penned Using decision management to deliver intelligent business performance where James rightly said that it does not require “heroic efforts” to integrate event processing, BI, BPM and other decision support tools.  

As a reference, you may have seen this briefing, one of many where I show these functional relationships, Mythbusters: Event Stream Processing Versus Complex Event Processing, from DEBS2007.  For example slide 23 shows the functional relationship between events, pre-processing, event tracking, situational detection, historical patterns (the output of BI tools, for example), visualization and business process management.

In Faithful Representation, Richard Veryard reminds his readers that the most challenging part is in the situation models (not the system integration).  Unfortunately, by accident, Richard incorrectly attributes Opher Etzion’s “first order situation model approximation” to both Opher and I in this quote from Richard’s post, “a simple situation model of complex events, in which events (including derived, composite and complex events) represent the “situation”.   

Actually, that simple situation model above is Opher’s, not mine.  I have offered a more general and comprehensive (first draft) situation model, in A Simple Situation Model for Complex Events based on a cognitive situation model used by researchers at the University of Notre Dame.  I do not believe that complex events and situations can be modelled accurately using Opher’s simple model of derived, composite and complex events.   This model is overly simple, in my opinion. to represent the vast majority of CEP classes of problems, perhaps explaining why Opher and I do not agree on the state-of-the-art of CEP.  Opher tends to view CEP as mostly an extension of active database technology where I see CEP as a technology that is much more closely aligned with the cognitive models represented in the art-and-science of multi-sensor data fusion (MSDF).  

Complex events represent situations, and situations must be accurately modelled if we are going to accurately detect them in real-time.  If your business cannot model a complex event (situation) then it does not matter what software you buy, how much money you spend, or what event processing and integration platform you use.   The models are hard.  The system integration is relatively easy.

The secret sauce is the situation and complex event models.

As mentioned here a few times, it does not matter how fast you process events in real-time, if your model is wrong, you just detect the wrong thing very fast.  This is very bad and quite dangerous.  You will make bad decisions fast.  You will waste time, money and resources.

This is why CEP benchmarks should be based on accuracy in situation detection, not in latency and other low-level performance metrics.   First, get the models right; then refine to detect faster, if speed is required.   What has happened in CEP to date, is that the models are so simple, they do not really detect complex events, they just process and act on simple events that are easy to model. 

]]> Sat, 09 Aug 2008 06:23:08 +0000 situation situation detection cognitive situation model simple situation model model situation models situation model approximation events complex events based The Secret Sauce is the Situation Models <![CDATA[Q&A with Sergey Katsev of Coyote Point Systems]]> http://securityratty.com/article/e57e1ace426f0aef838f8f362c558571 http://securityratty.com/article/e57e1ace426f0aef838f8f362c558571 I recently had the opportunity to sit down with Sergey Katsev, an Engineering Project Manager at Coyote Point Systems and discuss his experiences with InteropNet and talk about the Coyote Point products.  With a couple of years of experience as a vendor for Interop, he had some interesting insights in to how participating in the InteropNet can help a vendor.

ScienceLogic: How long have you been involved in InteropNet?

Katsev: I started at Coyote Point 3 years ago and InteropNet 2006 was my first “big” assignment.  This was the first time Coyote Point had put in a proposal to participate, so we were very excited when we were selected.

ScienceLogic: How long has Coyote Point been involved in Interop overall?

Katsev: We’ve been exhibiting at Interop for a number of years, and after seeing the InteropNet in action, we decided to submit a proposal in ‘06.  We were actually one of the first companies in the load balancing/traffic management space (we’ve been doing this for almost 10 years), so we have a lot of experience to share with InteropNet.

ScienceLogic: What is your role at Coyote Point?

My official title is “Engineering Project Manager”.  Basically, that means that I’m in charge of product releases and maintenance.  It sounds like a weird title for someone participating in InteropNet, but I’ve actually found it extremely useful since my position means that I don’t get to see our systems out in the field a lot.  We’ve added several features and have ideas for others just from my experiences at InteropNet.

ScienceLogic: What do the Coyote Point products do?

Katsev: Coyote Point makes a Traffic Management appliance called Equalizer.  What this means is that any traffic destined for a datacenter’s servers goes through our appliances and we make sure that the server which is best equipped to handle it, does.  Our systems sit between the clients and the servers and monitor the client traffic and the state of the servers.  If the clients start sending more traffic, we’ll balance it out so that no server is overloaded.  If one of the servers stops responding or starts responding very slowly, we’ll steer traffic away from that server.

ScienceLogic: In what way are your products being used as part of InteropNet?

Katsev: In the InteropNet, we’re utilizing a lot of our expertise:  We’re making sure that traffic is balanced and servers are redundant for show services such as DNS and SMTP.  We’re also using our geographic load balancing technology to ensure that the ScienceLogic EM7 appliances and some other internal NOC services are available from anywhere, with the lowest latency, with our SSL acceleration and GZIP compression technology.  Finally, we’re helping logistics in the NOC by allowing a physical separation between systems located in the NOC and those in an emergency rack outside of the NOC.  If either of these two locations were to fail, the network will continue operating without a glitch.

ScienceLogic: Are there any special considerations for Interop that cause you to deploy your systems there differently that any other place?

Katsev: Interop is definitely different than most of our customer installations.   One difference from a standard environment is that the network (at least this year) is one large flat network, with pieces carved out where extra security is needed.  Because of this, we can actually run our failover pairs of Equalizer systems in a non-standard configuration where the two peers are in different racks, or even on different floors.  That’s one of the things that I really like about InteropNet — it definitely brings new ideas to mind, which end up becoming ’special configuration’ white papers after the show.

ScienceLogic: Has InteropNet taught you anything that caused you to actually change your product?

Katsev: In addition to the failover configuration differences I mentioned above, participating in InteropNet has actually caused us to add several new features and allowed configurations.  One example is the “no-spoof” option for Layer 4 clusters.  Prior to the 2006 shows, we always ’spoofed’ the client’s IP address when talking to a server so that the server would see the client’s IP address instead of our own.  At Interop, we ran into a special configuration which would’ve been very difficult to set up in this manner, so our engineers added this feature, and it’s been very a very popular configuration with our customers ever since.

We have also had a couple of business relationships that extended outside of the show.  In 2006, we had a good experience using Spirent Communications gear to benchmark the network, so we ended up purchasing a couple of these systems to test our products.  More recently, we have found a way to bundle our Equalizer e350si load balancers with the ScienceLogic EM7 collector appliances to help ScienceLogic get the best performance in load balancing large quantities of syslog messages to be processed.  If it wasn’t for our participation in InteropNet, neither of these relationships would’ve happened.

ScienceLogic: What’s the best part of being involved with InteropNet?  What do you most look forward to?

Katsev: InteropNet is an amazing networking opportunity (no pun intended).  The group of engineers that put the network together every year is, well, amazing.  There is so much combined experience that any question instantly has several possible answers, and the best answer is chosen very quickly.  One of the ’sayings’ at Interop is “if you run into a problem, ask someone… we’ve probably seen that problem before… five times.”  One would think that being part of InteropNet is the same thing, year after year.  However, in the two years that I’ve been part of this (for four shows), there have been huge differences in the way that the network is designed and put together.  These are both because the vendors selected every year are different, and because the engineers who design the network change from year to year.  Somehow, though, when all is said and done, we have a network that works.

ScienceLogic: You don’t have to answer this one if you’re not comfortable… What would you like to see changed with the way things are done at InteropNet?

Katsev: This isn’t a cop-out… I really can’t think of anything I would do differently.  Sure, there are small problems that pop up sometimes, but every project has those, and the people at InteropNet are more than capable of figuring them all out.  In fact, I know that Interop started out as a show to test the interoperability of devices… but I’m still amazed that all of these devices actually talk to each other and “play nice” together.

ShareThis

]]> Tue, 05 Aug 2008 12:34:35 +0000 katsev sergey katsev interopnet coyote systems sciencelogic sciencelogic em7 appliances network client traffic Q&A with Sergey Katsev of Coyote Point Systems