IPS/IDS

PacketStream IPS/IDS is an intrusion detection and prevention system. It inspects traffic with flow-based deep packet inspection (DPI) and AI/ML analysis to detect and block threats before they reach your servers. Packet processing runs on dedicated ASICs.

How it works

1. Inspect — Every flow is analyzed with deep packet inspection (DPI), including SSL/TLS-encrypted traffic.
2. Decide — Thousands of intrusion prevention rules, 18,000+ signatures, and machine-learning behavioral analysis identify known threats and abnormal patterns. Attacks with no signature are caught by behavior and heuristic analysis.
3. Block — Traffic judged malicious, along with low-reputation IPs and URLs, is blocked. The malicious-IP list holds 10,000+ entries and updates in real time.

Signatures and the malicious IP/URL lists update automatically, without administrator intervention.

Detection scope

• Network layer — DDoS, port scans, botnet C&C traffic, attacks over SSL/TLS channels
• Application layer — SQL injection, cross-site scripting (XSS), web shell uploads, REST API attacks
• Malware — ransomware, trojans and backdoors, rootkits, spyware

It protects Linux and Windows systems, on both the server and client sides.

Performance

Packet inspection and DPI run on dedicated ASICs. Latency stays low as traffic grows: throughput is in the tens of Gbps and latency is in microseconds.

SIEM integration

Log-Stream streams security events in real time to your existing SIEM. It supports the CEF and LEEF log formats and connects to Splunk, QRadar, ArcSight, and others.

Monitoring

A web dashboard shows threat detections and traffic, and notifies you of important events. Daily, weekly, and monthly reports, plus compliance audit reports, summarize detected threats and trends.

Pricing

You are billed by the volume of traffic processed. There are no long-term contracts or minimum-usage commitments, and because it runs in the cloud with no on-premise equipment, there is no hardware to buy or maintain. Policies apply within minutes.

Next steps

• Firewall — inbound traffic access control
• DDoS Mitigation — network-layer DDoS mitigation

Contact: [email protected] · [email protected]