Feeds

Intel bakes super-snooper to stop industrial espionage

Hadoop-based tool sniffs 4bn network events a day, may end up as McAfee product

  • alert
  • submit to reddit

The essential guide to IT transformation

Intel has created a Hadoop-based rig that analyses just about every network event in the company – four to six billion of them on business days - in close to real time so it can spot threats including industrial espionage.

Intel officials declined to name the tool, saying it would not be "productive" to disclose its name, but said it was created by an 80-strong team of big data specialists working from its Israel offices and makes extensive use of Apache Hadoop. Ron Kasabian, Chipzilla's general manager of Big Data, said the tool was developed because conventional malware detection tools – even those from Intel's security-focussed subsidiary McAfee – can't find the especially novel or subtle attacks Intel fears.

Kasabian described the tool as analysing “every access request by every employee, every time they access a file, sharepoint, email or ERP”. Watching all those activities is important because Intel's intellectual property like product designs and manufacturing processes must be very closely guarded.

Moty Fania, Chipzilla's principal engineer for big data analytics and a member of the team that built the tool, told The Reg the software collects data from many devices around Intel's global networks, aggregates them and then analyses the results in close to real time.

“We were able to find with quite significant precision malicious activity that no other tool could find, with very high true positives across very, very large volumes of data,” Fania said.

Intel didn't reveal details of the hardware powering the snooper, but did say it may consider releasing the software's code and design to McAfee for conversion into a commercial product. If that happens, Fania feels it will be a tough sell as his team enjoyed easy access to Intel's innards. A third party, he opined, may not enjoy the same level of open access to would-be clients and may therefore struggle to tune the tool to optimal effectiveness.

All is not lost, however, as Intel feels the work it did to build the tool has wider applications. Speakers at Intel's Big Data and Cloud Summit in Ho Chi Minh City* made several references to an un-named “second tier Chinese city”** that has installed eight video cameras in every set of traffic lights. Intel feels the resulting data, when scaled across the city, resembles the challenge posed by monitoring its own networks to a sufficient degree that its work on the un-named security tool may be applicable elsewhere.

Those with suspicious minds may wonder if that “elsewhere” includes somewhere like the NSA, which has famously been revealed to be practising wide-scale collection and rapid analysis of data.

The Reg is in no way suggesting Intel is conducting surveillance of its staff, any third parties or is assisting any other entity to do surveil anyone. But given Edward Snowden's revelations about PRISM and other NSA programs, this un-named tool's capabilities represent an interesting proof of concept for ubiquitous surveillance being comfortably achievable with the resources of a colossal and technology-savvy multinational. Governments may struggle to match Intel for the latter quality, but probably have rather more people and money to throw at the problem than the 80 folks and "millions of dollars" we were told Chipzilla put to work on this project. ®

*The author attended the summit as a guest of Intel, which paid for flights and accommodation.

** Four Chinese cities - Shanghai, Beijing, Guangzhou and Shenzhen – are considered first tier. The Middle Kingdom has more than 150 cities with populations over a million. Second tier cities include Chongqing (pop 10m) and Chengdu (pop 5.5m), the local governments of which would both represent top-tier customers for most enterprise vendors.

Next gen security for virtualised datacentres

More from The Register

next story
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.