Feeds

Intel bakes super-snooper to stop industrial espionage

Hadoop-based tool sniffs 4bn network events a day, may end up as McAfee product

  • alert
  • submit to reddit

Top three mobile application threats

Intel has created a Hadoop-based rig that analyses just about every network event in the company – four to six billion of them on business days - in close to real time so it can spot threats including industrial espionage.

Intel officials declined to name the tool, saying it would not be "productive" to disclose its name, but said it was created by an 80-strong team of big data specialists working from its Israel offices and makes extensive use of Apache Hadoop. Ron Kasabian, Chipzilla's general manager of Big Data, said the tool was developed because conventional malware detection tools – even those from Intel's security-focussed subsidiary McAfee – can't find the especially novel or subtle attacks Intel fears.

Kasabian described the tool as analysing “every access request by every employee, every time they access a file, sharepoint, email or ERP”. Watching all those activities is important because Intel's intellectual property like product designs and manufacturing processes must be very closely guarded.

Moty Fania, Chipzilla's principal engineer for big data analytics and a member of the team that built the tool, told The Reg the software collects data from many devices around Intel's global networks, aggregates them and then analyses the results in close to real time.

“We were able to find with quite significant precision malicious activity that no other tool could find, with very high true positives across very, very large volumes of data,” Fania said.

Intel didn't reveal details of the hardware powering the snooper, but did say it may consider releasing the software's code and design to McAfee for conversion into a commercial product. If that happens, Fania feels it will be a tough sell as his team enjoyed easy access to Intel's innards. A third party, he opined, may not enjoy the same level of open access to would-be clients and may therefore struggle to tune the tool to optimal effectiveness.

All is not lost, however, as Intel feels the work it did to build the tool has wider applications. Speakers at Intel's Big Data and Cloud Summit in Ho Chi Minh City* made several references to an un-named “second tier Chinese city”** that has installed eight video cameras in every set of traffic lights. Intel feels the resulting data, when scaled across the city, resembles the challenge posed by monitoring its own networks to a sufficient degree that its work on the un-named security tool may be applicable elsewhere.

Those with suspicious minds may wonder if that “elsewhere” includes somewhere like the NSA, which has famously been revealed to be practising wide-scale collection and rapid analysis of data.

The Reg is in no way suggesting Intel is conducting surveillance of its staff, any third parties or is assisting any other entity to do surveil anyone. But given Edward Snowden's revelations about PRISM and other NSA programs, this un-named tool's capabilities represent an interesting proof of concept for ubiquitous surveillance being comfortably achievable with the resources of a colossal and technology-savvy multinational. Governments may struggle to match Intel for the latter quality, but probably have rather more people and money to throw at the problem than the 80 folks and "millions of dollars" we were told Chipzilla put to work on this project. ®

*The author attended the summit as a guest of Intel, which paid for flights and accommodation.

** Four Chinese cities - Shanghai, Beijing, Guangzhou and Shenzhen – are considered first tier. The Middle Kingdom has more than 150 cities with populations over a million. Second tier cities include Chongqing (pop 10m) and Chengdu (pop 5.5m), the local governments of which would both represent top-tier customers for most enterprise vendors.

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.