Feeds

Intel bakes super-snooper to stop industrial espionage

Hadoop-based tool sniffs 4bn network events a day, may end up as McAfee product

  • alert
  • submit to reddit

Using blade systems to cut costs and sharpen efficiencies

Intel has created a Hadoop-based rig that analyses just about every network event in the company – four to six billion of them on business days - in close to real time so it can spot threats including industrial espionage.

Intel officials declined to name the tool, saying it would not be "productive" to disclose its name, but said it was created by an 80-strong team of big data specialists working from its Israel offices and makes extensive use of Apache Hadoop. Ron Kasabian, Chipzilla's general manager of Big Data, said the tool was developed because conventional malware detection tools – even those from Intel's security-focussed subsidiary McAfee – can't find the especially novel or subtle attacks Intel fears.

Kasabian described the tool as analysing “every access request by every employee, every time they access a file, sharepoint, email or ERP”. Watching all those activities is important because Intel's intellectual property like product designs and manufacturing processes must be very closely guarded.

Moty Fania, Chipzilla's principal engineer for big data analytics and a member of the team that built the tool, told The Reg the software collects data from many devices around Intel's global networks, aggregates them and then analyses the results in close to real time.

“We were able to find with quite significant precision malicious activity that no other tool could find, with very high true positives across very, very large volumes of data,” Fania said.

Intel didn't reveal details of the hardware powering the snooper, but did say it may consider releasing the software's code and design to McAfee for conversion into a commercial product. If that happens, Fania feels it will be a tough sell as his team enjoyed easy access to Intel's innards. A third party, he opined, may not enjoy the same level of open access to would-be clients and may therefore struggle to tune the tool to optimal effectiveness.

All is not lost, however, as Intel feels the work it did to build the tool has wider applications. Speakers at Intel's Big Data and Cloud Summit in Ho Chi Minh City* made several references to an un-named “second tier Chinese city”** that has installed eight video cameras in every set of traffic lights. Intel feels the resulting data, when scaled across the city, resembles the challenge posed by monitoring its own networks to a sufficient degree that its work on the un-named security tool may be applicable elsewhere.

Those with suspicious minds may wonder if that “elsewhere” includes somewhere like the NSA, which has famously been revealed to be practising wide-scale collection and rapid analysis of data.

The Reg is in no way suggesting Intel is conducting surveillance of its staff, any third parties or is assisting any other entity to do surveil anyone. But given Edward Snowden's revelations about PRISM and other NSA programs, this un-named tool's capabilities represent an interesting proof of concept for ubiquitous surveillance being comfortably achievable with the resources of a colossal and technology-savvy multinational. Governments may struggle to match Intel for the latter quality, but probably have rather more people and money to throw at the problem than the 80 folks and "millions of dollars" we were told Chipzilla put to work on this project. ®

*The author attended the summit as a guest of Intel, which paid for flights and accommodation.

** Four Chinese cities - Shanghai, Beijing, Guangzhou and Shenzhen – are considered first tier. The Middle Kingdom has more than 150 cities with populations over a million. Second tier cities include Chongqing (pop 10m) and Chengdu (pop 5.5m), the local governments of which would both represent top-tier customers for most enterprise vendors.

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.