How GÉANT Tailored Network Security for 43 Institutions

Network anomalies detection project

High service availability and service quality operations are the key characteristics of GÉANT’s infrastructure. Over 1,000 terabytes are transferred every day via the GÉANT IP backbone covering the entire Europe. 100 Gbps connectivity services are being operated across the core network that is designed to support up to 8 Tb/s, ensuring the network remains ahead of user demand and the data deluge. GÉANT is using a variety of different router models at different versions and thus the entire environment is sensitive to precise integration.

The goal of implementing Flowmon was to provide security reporting to GÉANT’s users - represented by the 43 national research and education institutions. The scope of the solution is to discover attacks on network services, botnets, port scans, vulnerable services, infected devices and other malicious activity. It had been decided to integrate Flowmon into GÉANT’s infrastructure by collecting flow data from existing backbone routers. To insure redundancy, two Flowmon collectors were deployed in parallel, hosting security intelligence module Flowmon ADS. Outputs from the system in the form of security events are exported to an automated ticket handling system, which notifies respective NREN’s in the event of an incident being detected in their network. Customer specific development activities were carried to reflect the customers’ needs for special detection methods. The entire solution was deployed in a matter of hours; followed by two months of custom development, customer testing and integration. Thereafter these activities transformed into the pilot program and the service officially went into production three months later.