FlowMatrix is Network Behavioral Analysis (NBA) System, which in fully automatic mode constantly monitors your network using NetFlow records from your routers and other network devices in order to identify relevant anomalous security and network events.

How it works

The FlowMatrix receives NetFlow records from routers or other network devices you configure to send NetFlow to FlowMatrix. It processes NetFlow records and after learning period of 5-7 days builds detailed multidimensional behavioral models of your network. Later it compares measured parameters from incoming NetFlow records to built models and identifies relevant anomalous events which significantly deviate from what is expected by the models and logs an event.

To help you identify what each logged event means FlowMatrix performs (when possible) classification of each event to corresponding class of attack or network events.

In order to provide relevant possible information about each logged event FlowMatrix logs relevant filtered detailed information which can be used for more detailed investigation of the event.

FlowMatrix has following key features:

• Performs continuous 27x7 fully automatic behavioral analysis of your network traffic to identify relevant anomaly security and network events.
• Classifies each reported anomaly event (when possible) as belonging to proper class of security or network events (DDoS, Scans, Alpha flows, network outages etc.).
• Collects and presents relevant detailed information for each anomalous event so you can drill down to investigate each reported event to decide on proper set of actions.
• Utilizes NetFlow records collected by network devices such as routers and switches. This eliminates need for additional expensive network probes and as result substantially lowers price for building network security monitoring solution. Currently only NetFlow versions 1 and 5 are supported, more being added;
• Provides short response time — 1 minute, so you will know about events as they begin to happen.
• Builds multidimensional behavioral models of your network in order to lower false positive rate.
• Provides rule system for more interactive event identification so you can create rules to monitor for conditions you would like to know about (for example show host contacted by more then 100 unique hosts, show host that contacted more then 60 unique hosts etc.).
• We try to keep FlowMatrix very focused to its main goal of monitoring network for anomalous events without polluting it with unneeded features.
• Moderate hardware requirements for small and medium size networks. As an example on Pentium 4 2.4 GHZ system with 2 GB of memory: FlowMatrix is able to handle 10000 flows per second Up to 20000 flows per second is possible on more capable hardware.
  This functionality was not possible in beta version before 0.9.045

Note:

After evaluation period of 60 days, you will still keep most of the functionality available in full operational version. For example, you will have high performance rule system still available for you, basic NetFlow stats information, etc. The only functionality which will be not available to you after the evaluation period is the detailed information about anomaly events.