新一代应用与安全测试方案

新一代

业务与安全评估方案

DocumentNumber:915-3562-01,RevA March2016APP应用性能直接影响经营业绩2*Source:SteveSouders@VelocityConference2009foundthata2SECONDSLOWDOWN$1.6MINYEARLOST

REVENUE/USERreducedpageloadtimesfrom

~7secondsto~2secondsINCREASEINREVENUE7-12%REDUCTIONINHW&SWCOSTS*50%+foundthatASECONDSLOWDOWN4.3%REDUCTIONIN

REVENUE/USER*安全隐患损失的不只是金钱DatacompromisedSeeminglyeverythingstoredinthenetwork.Howtheygotin–Unknown.Howlongtheywentundetected–Unknown.Howtheywerediscovered–OnNov.22employeecomputersreceivedmessagesthreateningpublicdistributionofstolendataanddisplaysofskullsontheirscreens.Datacompromised-40millioncreditanddebitcards,70millionphonenumbers,mailingaddressesandemailaddresses.Howtheygotin–Hackingthecredentialsofalegitimatebusinessassociate,anHVACcompany,togetonTarget’snetwork,theninstallingmalwareonpoint-of-salemachines..Howlongtheywentundetected–Abouttwoweeks.Howtheywerediscovered–Howtheywerediscovered–TheDepartmentofJusticetoldthemaboutit,butanti-malwaresoftwareflaggedtheproblemaswell.Datacompromised-Asmanyas

56millioncreditcardsputatrisk;53millionemailaddressesHowtheygotin–Viaathird-partyvendor’scredentialsfollowedupbyexploitinganunpatchedWindowsflaw.Howlongtheywentundetected–FromApriltoSeptember.Howtheywerediscovered–Thestores’executivesweretoldbybankandlaw-enforcementofficials.Datacompromised-Anunconfirmednumberofcreditcardnumbers,butpossiblyasmanyasanestimated7millionHowtheygotin–Undisclosedbutpoint-of-salessystemswerecompromisedHowlongtheywentundetected–Ninemonths.Howtheywerediscovered–TheSecretServicetoldthemaboutthebreach漏过一个攻击,上一次头条Gartnerbelievesthat,in2017,morethanhalfofthenetworkattackstargetingenterpriseswilluseencryptedtraffictobypasscontrols,upfromlessthan5%today.能否提供良好的客户体验业务的成功取决于可靠快速安全市场趋势+面临的挑战应用流量增长网络安全与不断变化的应用场景保持一致实时核心业务的用户体验真实再现现网环境升级到40G,25G和100G速率加快NFV/SDV迁移现网测试保障服务质量在不同的私有和公有云进行部署不断变化的攻击场景数据泄露网络安全培训和流程演练BYOD和IOT需要基于用户和设备的策略ICS迁移到Ethernet/IP增加了安全风险

分布式IoT交付架构的安全&性能流量加密虚拟化和云计算工业控制系统和物联网对于因特网交互进行默认加密升级到HTTP/2新的加密标准-2/4Kkeys,ECCciphersSSL/IPsec审查变成了主流端到端业务交付在网络威胁不断演变下验证网络安全状况验证核心业务的SLAs和用户体验质量Deliverapplicationswithconfidence从设计到生产需要一直测试规则验证测试新技术采用管理系统变更验证优化威胁应对能力实际操作练习人员和流程培训培训人流程技术设计产品设计验证供应商/方案选型容量和性能评估SLA基准测试业务上线验证应用/业务性能部署越早发现投入越少降低修复Bug的投入成本$59.5Billion美国经济一年支出用于修复BUGSSources:NIST,PonemonInstitute$240/

defect编译阶段$960/

defectQA/测试阶段生产阶段$7,600/defect$80/

defect研发阶段90x

投资回报率

尽早发现去除未知因素，最小化风险&最大化节省成本基于事实来做出决策

TCOSAVINGSin36Months$2.5M+10X成本差距

–每兆拥有成本从$50到$541

NSSLabsBreachDetectionSystemsComparativeReport,Aug2015优化流程，较少宕机时间

AcceleratingMTTR($300k+downtimeperhour)

PonemonInstitute,2015ROI:40x安全有效性99.2%到51.8%increasesbreachexposurerisk

PonemonInstitute,2015AVERAGEDATABREACHCOST$7.2MIxia协助完成为现代网络打造的统一测试平台，最高可达Tbps级别规模

应用级安全

测试TerabitscalewiththePerfectStormplatformHighestSSLandIPsecencryptionperformance

1/10/40/100Gapplications&securitysolutionsApplicationintelligencetorecreateyournetworksApplicationandsecuritytestinginvirtualenvironmentsFlexible,simple,andfastdeploymentsacrosscloudplatformsElasticitytobuildtestbedsatanyscale,atanytime,anywhereLargelibraryoflatestsecurityattacks,livemalware100+evasiontechniquesCombinelegitimate,malicious&malformedtrafficContinuousresearchandfrequentupdates虚拟化+云计算网络安全Realisticemulationofvoice,video,data,andstorageservicesFasterinsightwithper-user,per-applicationreal-timeQoEmeasurementsApplicationsoverVPN,broadbandaccess,&wireless业务融合验证应用性能BreakingPointIxLoadDDOS攻击和应用攻击仿真识别未知应用发现流量来源6000+活跃攻击35,000+活跃恶意软件100+逃逸手段应用和威胁情报(ATI)

研究中心ATI

RESEARCHCENTERIXIA研究安全实验室遍布全球的蜜罐和网络爬虫大数据研究IxiaengineersSecurityvendorsPacketbrokerflowsNEMInteractionsBillionsofIPsandURLsMillionsofSPAMOpensourcedatasetsNetworkintrusionsNEW26NEWbiweeklyupdatesapplicationsDDoS/APT是什么让Ixia成为领航者?在应用与安全测试市场高度灵活

PerfectStorm

平台满足各种需求最新应用以及真实内容最全面的安全攻击覆盖和逃逸技术完整应用仿真和用户体验质量指标评估无缝对接虚拟/硬件，无线/有线环境PerfectStorm™介绍

业界第一IndustryFirstsHighestdensityL4-7testingsolution

–11u@nearly1TerabitHighestdensityL4-7blade–80Gbps1stL4-7testingsolutionwith100Gbps&40Gbpsnetworkingsupport1stsecuritytestingsolutionwith100Gbps&40Gbpsnetworkingsupport1stcomprehensivedata,voice,video,storage,mobile,andsecuritytestingsolution国家级别性能仿真Nation-ScalePerformance960Gbpsapplicationthroughput720MconcurrentHTTPsessions24Mnewconnectionspersecond1.1MconcurrentSIPcalls480Gbpsvideothroughput12MconcurrentSSLsession480GbpsIPsecthroughput480GbpsGTPthroughputPerfectStorm–国家级别性能PerfectStormONE™介绍便携，低电量消耗(1.5U)统一架构支持IxLoad和BreakingPoint应用业界领先性能–每台80Gbps应用吞吐量和20GbpsSSL吞吐,40GbpsIPsec性能统一的应用和安全测试平台PerfectStormONEFusionPerfectStormONENon-FusionBreakingPointIxLoadIxLoad8-portsof1/10GEwithSFP+interface2-portsof40GEwithQSFP+interfacePerfectStorm™介绍12槽位或2槽位多用户系统统一架构支持IxLoad和BreakingPoint应用业界领先性能–每张卡80Gbps应用吞吐量和20GbpsSSL吞吐,40GbpsIPsec性能统一的应用和安全测试平台XGS12,12slots2-portsof40GEwithQSFP+interface8-portsof1/10GEwithSFP+interface1-portof100GEwithCXPinterfacePerfectStormFusionPerfectStormNon-FusionBreakingPointIxLoadIxLoadXGS12-HSChassisXGS2-HSChassisXGS12-SD/HSChassisXGS2-SD/HSChassisXGS2,2slots按需扩展

按需付费模式可以显著减少CAPEX现场升级 Non-FusionFusion LowportcountsFullypopulatedsystems LowspeedHighspeed(1G10G)灵活的分出（fan-out）功能让投资更进一步PerfectStorm平台可以按需扩展PerfectStormBreakingPoint性能

BreakingPointKPIPerfectStormApplicationThroughput80GbpsApplicationFlowRate(Open)2Mflows/secTCPCPS(Sustain)1.5MCPSConcurrentApplicationFlows60MSSLThroughput20GbpsSSLCC1MSSLHandshakesPerSecond190KIPsecThroughput25GbpsIPsecTunnels500KtunnelsIPsecTunnelRate2000/secSCTPThroughput14GbpsGTPThroughput80GbpsPerfectStormIxLoad性能

IxLoadKPIPerfectStormApplicationThroughput(AppLib)64GbpsHTTPUni/Bi-DirectionalThroughput40Gbps/76GbpsHTTPCPS1.5MCPSHTTPTPS5.5MTPSHTTPCC30MSSLThroughput20GbpsSSLCC1MSSLCPS200KIPsecThroughput40GbpsIPsecTunnels500KtunnelsIPsecTunnelRate10000/secIPTV/OTTThroughput20GbpsIPTV/OTTSimUsers150,000SIP/RTPActiveCalls96,000SIP/SRTPActiveCalls24,000SIPCalls/Sec10,000PerfectStorm亮点业界最全面和通用的应用和网络安全测试平台最高性能和规模–80Gbps混合应用吞吐,20GbpsSSL吞吐,40GbpsIpsec吞吐,40Gbps高清视频,96,000VoIP会话高通用平台，支持1/10/40/100GE测试接口并能按需扩展和接口分出用户案例案例1

验证DDoS清洗能力–金融交易所客户国际领先的金融衍生市场一年30亿交易合约需要验证供应商的DDoS清洗能力降低清洗时间提高网络攻击防护能力

结果DDoS防护响应速度提高10x提高了抵御网络攻击的准备能力案例1

验证DDoS清洗能力–金融交易所BreakingPointLoadGenerationDDoS流量正常

应用流量DDoS清洗供应商目标网站服务器DDoS抑制Forensics案例2

可靠视频会议–咨询公司客户排名前10的全球资讯公司一年签超过$300亿合同需求CEO在IT没有发现问题前提下任然不能举行全球的视频会议IT团队需要证明视频系统能力ResultsIT能可靠的测试和隔离问题全球视频会议系统可靠运行中案例3

产品评估–跨国企业客户100,000员工专注在能源，消费和金融领域需求最大限度提高网络升级可靠性确保“不出乱子”结果客户避免了一个导致性能下降80%的补丁客户根据测试报告选择供应商BreakingPoint简介BreakingPoint介绍–市场领导者BreakingPoint再现真实网络的规模和内容等方方面面来验证网络安全态势客户怎么使用BreakingPoint?Makerapiddecisionsaboutcompetingproducts&technologieswithdata-drivenPoCsRight-sizeyourinvestmentwithscaleandcapacitytestingVerifythatnetworkupgradesandsoftwarepatchesdon’tdegradeapplicationperformanceValidatetheQoEofnewapplicationrolloutsanditsimpactonexistingservicesAccelerateNFV/SDDCdeployments方案部署前技术验证研发测试OptimizesecurityposturebyunderstandingtheimpactofchangestosecuritypoliciesTrainyourpeopleandimprovecyberresiliencyandreadiness

培训&优化真实应用+高性能300+applications&3500+userscenariostocreateyouruniquerepresentativetrafficprofiles100’sofpredefinedprofilesbasedoninternalATIresearch,partnerships,andthird-partyresearchLoadprofilestomodelthedynamicnatureoftrafficUltra-highperformancewithmixedapplicationtrafficprofilesBreakingPoint应用流的概念内容真实化ContentimpactsDPIperformanceEasilyparametrizeapplicationswithrepresentativepayloadsBreakingPointsupportsMarkovtextgenerationDictionaryDynamicfilegenerationMulti-LanguagecapabilitiesExampleRealContentHTML+Markov+RandomCSSMarkov+ChatConversationMarkovinEmailwith‘Target’WordInsertion灵活变化Applicationsandactionscanbesequencedtogetherandparameterizedtosimulatethedynamicbehaviorsofusersandapplications:Customize¶meterizeapplicationflowsSequenceapplicationstosimulatecompleteuserinteractionsFlexibilitytocontroleveryaspectoftheapplication:ConditionalRequestsDictionarycommandsRawcommands#2Dictionarycommandsletsyouinsertuserspecifiedvalues#1Conditionalrequestsinapplications#3Rawactionsletyoucraftyourowncommandwithinanapplication.不同内容对DPI性能的影响CustomerUseCaseExample#1:RealProxyDevice–parsingrandompayloads(dumbdata)Example#2:NGNFirewallwithIPSStaticcontentcanlooksuspicious,impactingperformance!!!HTTPpayloadwithall‘0000s’vs‘012345..9’完整安全覆盖充分验证你的网络安全状况LargestCollectionofExploits,MalwareMostCompleteSetofEvasionsDDoS,Botnet,andAPTSimulation6,000+exploits35,000+malwareMobilemalwareStrikefuzzingUniqueattackpayloadsineachtransaction100+evasiontechniquesValidateagainstmalwarepolymorphismBotnetsemulatingzombietoC&CcommunicationVolumetric,protocol,andapplication-layerDDoSattacksDDoSComprehensivesetofstateless,TCP/UDP,andapplication-layerDDoSsimulationConsistentworkflowtosimplifyemulationofrelevantDDoSscenarios:EasilyblendapplicationandDDoStrafficQuickaccesstoIxiapredefinedattackpatternsGeo-locationsupport基于用户的流量策略User-identity-basedpolicing,asopposedtoanIPaddress,isingprevalenttocombatBYODEmulatedclientsareauthenticatedwithanexternalLDAPserverpriortoallowingthoseclientstogenerateapplicationtraffic数据泄露和合法监听Injecttargetedkeywordsatacontrolledrate(e.g.:everyXsecondsorevery#offlows)Detailedreportshighlightsuccessforeachattemptedkeywordinjection网络健壮性ValidatesintegrityofprotocolstacksandrobustnessofyourdeviceswithmalformedpacketsGeneratescorruptdatabymodifyingpartofthepacketRandomoruser-definedpayloadDatarates:constant,range,randomBadIPversion,checksum,options;badTCPoptions,urgentpointer,etc.Pseudorandomnumbergenerator(PRNG)seedforrepeatabletestingFuzzingApplicationProtocols完整网络接入仿真SubscribernetworkconnectionemulationacrossmultipleunderplayinginfrastructuresDHCPv4/6VLAN(802.1Q,QinQ)VirtualRouterinstancesGTPv1/v2ExtendapplicationandsecurityvalidationinthecontextofIPv6readinessIntegratewithIPv6transitioningtechnologies:DS-Lite,6rdDHCP-PDSLAACipSECVPN技术RealisticIPsecemulationaddressingacrossindustryscenariosSite-to-siteandremoteaccessVPNIPsecencapsulatedapplicationandsecuritytrafficTrafficfuzzingoverIPsecUnifiedtestsolutionforfirewalls,UTMs,andintegratedsecurityappliances专业测试方法Assesssecurity,performance,andresiliencyinyournetworkenvironmentsusingNSSLabsproven,turn-keymethodologiesReducedtestdevelopmenttime–focusyourtimeandresourcesonrunningtestsinsteadofdevelopingthemNetworkIntrusionPreventionSystem(IPS),TestMethodologyv.7.2NextGenerationFirewall,TestMethodologyv.6IxiaBreakingPointResiliencyScore-EndstheVendorDataSheetGuessingGameTestPacks网络靶场仿真Provenmethodtoimprovecyberreadinessbyoptimizingprocessandproceduresto“detect,react,andimprove”RealisticTargetSimulationsRealisticExploitSimulationsRealisticEvasionSimulationsRealisticTrafficSimulation44©2016IXIAAND/ORITSAFFILIATES.ALLRIGHTSRESERVED.|RemarkablylikeyourproductionnetworkAsandboxtotestnetworkinfrastructurewithoutcausingproblemsonproductionnetworkPutspeopleundertestPopulationandCountryUserBaseMobileSubscriberUserBaseDataofInterestforDLPEnterpriseandITservicesBreakingPoint–更多高级功能

SupportedonphysicalandvirtualplatformsHTLM5userinterface(noclientsoftwareinstallationneeded)All-inclusivelicensingRESTAPIandTCLAPIforautomationandorchestrationBuilt-inreportingandreal-timestatsTACACS+baseduserloginintothetestsystemwithprivilegemodes

IxLoad简介IxLoaD介绍IxLoad提供融合的多业务仿真来验证企业关键业务的用户体验质量无线/有线网络的多种业务仿真应用交付视频交付语音交付

安全存储客户怎么使用IxLoad?Makerapiddecisionsaboutcompetingproducts&technologieswithdata-drivenPoCsRight-sizeyourinvestmentwithscaleandcapacitytestingVerifythatnetworkupgradesandsoftwarepatchesdon’tdegradeapplicationperformanceOptimizeSLAsbyanalyzingtheimpactofnewrollouts&subscribergrowthonexistingservicesAccelerateNFVdeployments部署前技术验证研发测试ValidateQoEofbusinessreal-timeandbusiness-criticalapplicationservicesinadistrustednetworkarchitecture分布式业务验证用户模型仿真

基于用户仿真多种应用业务Multiprotocolcommandeditorwithsynchronizedflow-controlControlofwhatapplicationssubscribersuseandhowitbehaves真实业务仿真为每种应用配置不同的流量模型真实接入网络仿真Applicationserviceoverbroadbandaccess,tunnelingsecurityandwirelessCompletecontroloverhowemulatedusersconnecttothenetwork(i.e.IP,DHCP,PPP/L2TP,IPsec,GTP,VLAN,802.1P,802.1x,DSCP/TOS)DynamicControlPlaneenablesemulateduserstobeconnect/disconnectfromthenetworkdynamicallylikeinreal-world用户体验质量指标评估Fasterinsightwithper-subscriber,per-applicationmeasurementsAnalyzetheimpactofservicesonperUser,IPorperVLANSetfiltersonstatisticsbasedbyspecifyingconditionsinordertoisolateerrorsandfailures数据业务仿真FullystatefulandscalableprotocolemulationsfordetailedfunctionalandperformancetestingSupportforthelatestHTTP,HTTP/2andSSLfeaturesandfunctionalityHighestIPv4/IPv6HTTP,SSL,HTTP/2andAppReplayperformance流媒体(OTT)视频业务全面的OTT视频客户端仿真–Flash,HLS,Silverlight,HDSandDASHCreaterealisticscenarioswithuserbehaviortoseekandpause/resumeplaybackUseadaptivestreamingtomodelrealdevicebehaviorthatconsidersnetworkbandwidthtoupshiftordownshiftautomaticallyCompleteapplication-levelmetricsincludemanifestandvideo/audiofragments+VQmonQoEmetricsDASHRTSPFLASHSILVERLIGHTAppleHLSAdobeHDSStreamingclientsHTTP,Adaptive视频点播(VOD)+IPTV业务High-performancetrafficgenerationforIPTVIntuitivereal-timevideoanalysisandQoEreportingScenarioeditortodefinesubscribers’activitiesFlexiblechannelviewingsequenceExtensivelistofcommandsIntelligent,real-timeissueisolationmechanism

VoIPIMS+VoLTE业务RealworlddeviceanduserbehavioremulationComprehensivesignalingandmediaprotocolsCapabletovalidateIVRsystemsHighperformancemediatrafficgenerationExtensivequalitymetricsonentiretrafficIntuitivereal-timeQoEreportinganddebuggingWebRTC=Web

Real-TimeCommunicationsBrowser-to-Browsermultimediaconnection NoneedforpluginsordedicatedapplicationsRe-useofexistingSIPinfrastructureIxLoademulatesWebRTCclientsWebSocketsRealworlduserbehavior Opus&vp8codecsQualityofexperiencemetricsICE,DTLS,SRTPIPSECVPN业务Industry’shighestIPsecperformance&capacitywiththePerfectStormplatformMostcomprehensiveIPsecfeaturesetwithintegratedIPsecbenchmarkingtestmethodologiesIKEv1,IKEv2&ManualKeysAllmajorIPsecciphersNSASuiteB

CryptographyDH-01toDH-25AllmajorauthenticationsComprehensivePKIsupportIPsecQuickTestSuite存储方案HighlyscalableCIFS/SMB,SMB2,SMB3NFSv3/v4,iSCSIandOpenStackSwiftemulationsFlexiblelow-levelcommandtosimulatevariousclientbehaviorSeamlessinteroperabilityagainstvarietyofexternalserversRandomdatagenerationenginesupporttovalidatethecachingmechanismsDataintegrityvalidation应用库AppLibraryissimplifiedworkflowandframeworktoemulateamixofapplications-fueledbyBreakingPointATIDeterministicmultiprotocolperformancethatadherestothedefineddistribution

Per-Flowstatisticstovalidatetrafficmanagementpolicies

AppLibraryvs.BreakingPointKeyFeaturesIxLoadAppLibraryBreakingPointAppsPerformance60GperPerfectStorm80GperPerfectStormPre-definedapplicationflowsbasedonBreakingPointATIü

1480+ü

Unlimited200+ApplicationEmulationwithcompleteflexibilitytodefinesubscriberbehaviorûüUpdatestoapplicationswithATIMonthlyBi-WeeklyDeterministicapplicationmix

performancefromasingletestinterfaceüüPerapplicationstatisticsüüPersubscriberstatisticsûü

GTPInteroperabilitywithpass-throughdevicesüüInteroperabilitywithexternalservers(onearmtesting)ûüMulti-objectiveapplicationmixesûüAppsoverSSLûüAppsoverwireless(GTPv1/GTPv2)üüAppsoverIPsecûüBreakingPointoffersamorecompletemixedapplicationsolutionKeyFeaturesIxLoadAppLibraryBreakingPointTokens&ParameterizationoftheapplicationsûüMarkovTextGenerationûüMulti-LanguageCapabilities(English,French,German,Italian,Spanish,Japanese,ChineseandFarsi)ûüDynamicfilegenerationwithMarkov-basedcontent(PDFs,XLS,DOCX,FLV,SWF,MP3,WAV,RTF,EXE,GIF,JPEG,ZIP,JAR,CSS

andmore)ûüDataLeakagePrevention&LawfulInterceptûüAppsandmalicioustraffic(exploits,malware,DDoS)runningonsametestinterfaceûüAdvancedFeatures/Regularexpressions,tokens,GOTO,loopsûüParametersexchangebetweenappsûüNegativeapplicationflowsûü安全

LineratestatelessDDoSwith1GE,10GEand40GEtestportsSecurityeffectiveness,detectionaccuracyandperformancebenchmarkin