CounterStorm Introduces the Security Industry's First Anomaly Detection Solution to Operate at Layer 7.

DHS- and DoD-Funded Technology Has Been Used in Mission-Critical Networks for 2+ Years; CounterStorm's Statistical Payload Analysis (SPA) Engine Detects Application Exploits that Deviate From the Normal Content Profile to Protect Against Politically and Criminally Motivated Targeted Attacks

NEW YORK -- CounterStorm, a leading provider of internal network security and threat analysis technology, today announced the availability of a new statistical payload analysis engine (SPA) for its flagship Advanced Threat Recognition[TM] product suite. SPA introduces new targeted threat and botnet detection capabilities for CounterStorm-1[TM] appliance customers and integrators of the Company's Active Threat Recognition SDK. The product of a U.S. Department of Homeland Security (DHS) Small Business Innovation Research (SBIR) Award, SPA dynamically builds a model for each application, flow direction, and packet size to establish a baseline of normal content usage. Deviations from an application's normal content profile indicate anomalous activity, a key sign that an application exploit is taking place. With SPA, CounterStorm provides a new security tool for organizations to combat the challenges presented by botnets and targeted threats.

Targeted attacks are aimed at specific industries or companies, with a level of customization that makes them almost impossible to detect with traditional network security products or intrusion prevention systems. "Complex targeted threats have dramatically changed the security proposition for all companies," said Jon Oltsik, senior analyst at Enterprise Strategy Group. "Detection of targeted threats requires experienced analysts to develop new specialized detection and removal techniques. In providing targeted threat detection solutions to the Federal government, CounterStorm has built substantial expertise. Its' Active Threat Recognition technology has the potential to dramatically improve enterprise security, while also reducing the costs required to protect critical assets from targeted attacks."

The industry's first and only anomaly detection technology to operate at the application layer of network traffic, or Layer 7, SPA was developed specifically to detect the low profile, slow and stealthy behavior characteristic of targeted attacks. "Unlike competitive solutions, our technology was funded by the Department of Homeland Security and Department of Defense to mitigate the types of exploits that are now being used in cyber crime," said Steve Gant, CounterStorm CEO. "SPA enhances security infrastructures with a signatureless Deep Packet Inspection solution capable of accurately identifying application layer exploits, botnet activity and rootkit behavior patterns - the primary tools of today's politically and criminally motivated attacker."

Available as an add-on to the CounterStorm-1 appliance solution or as part of CounterStorm's modular Active Threat Recognition SDK, CounterStorm's Statistical Payload Analysis Engine empowers ISVs, OEMs and system integrators to expand their offerings with a flexible, modular threat detection and mitigation engine that can be readily integrated to enhance existing systems or create new offerings. "We have enjoyed a long-standing business and technology relationship with CounterStorm," said Dr. Tiffany M. Frazier, manager for BAE Systems Advanced Information Technologies. "CounterStorm's technology components, including SPA, continue to be important parts of BAE Systems' cyber security offerings to the Federal government."

SPA represents a significant advancement in deep packet inspection technology. Existing Layer 7 solutions require prior application knowledge or known exploit signatures in order to detect a threat condition. Competitive anomaly-based solutions only function up to Layer 4. CounterStorm's statistical analysis methodology does not utilize signatures and doesn't rely on rules such as RFC compliance. Instead, SPA strengthens CounterStorm's already compelling behavioral and anomaly-based security solution with the ability to detect application exploits that deviate from the network's normal application content profile. Specifically:

* Unknown and zero-day application exploits

* Non-scanning malware, including cache-harvesting worms and bots, as well as hit-list attacks

* Application tunneling and botnet command and control

* Data exfiltration, and spyware

* Application-specific attacks against in-house developed applications

* Fuzzing attempts against both custom and off-the-shelf applications

Pricing and Availability

SPA is available immediately. Please contact CounterStorm for pricing information.

About CounterStorm

CounterStorm is a leading provider of internal network security and threat analysis technology. Headquartered in New York City, the company was formed in August 2001 to commercialize patent-pending technologies developed at Columbia University under grants from the Defense Advanced Research Projects Agency (DARPA). CounterStorm provides a suite of behavior- and anomaly-based security technologies that accurately detect and mitigate known, unknown, zero-day and targeted attacks. The Company's intellectual property is the product of 5 years of industry leading domain expertise securing environments with mission critical implications. Solutions are available as a fully-integrated internal network security appliance or as modular components for integration in 3rd party systems. Companies already using CounterStorm-1 have realized significant cost savings, limited network downtime and increased protection of valuable corporate assets. Multiple components of the technology have been licensed for use in government projects.