What Is SmartAD?

Why Do We Need SmartAD?

As enterprise digitalization accelerates, the number of dumb terminals on campus networks has surged. These terminals have become primary targets of intranet attacks, which exploit the following vulnerabilities:

• Dumb terminals are particularly vulnerable because they come in many types, have a broad attack surface, and cannot run terminal security software such as endpoint detection and response (EDR), making them highly susceptible to compromise.
• Firewall probes are typically deployed at the core layer of the network, making it difficult to effectively identify threats at the access layer.
• Conventional detection methods struggle to address evolving security threats. For example, anomaly detection based on preset rules is rigid and relies heavily on expert experience; anomaly detection based on a signature database requires frequent database updates, resulting in delayed response; full-flow mirroring detection imposes high performance overhead and cost.

To address these challenges, SmartAD uses AI to analyze the traffic behavior of dumb terminals. In doing so, it comprehensively enhances the network's security protection capabilities to better cope with complex, evolving security threats.

What Are the Advantages of SmartAD?

SmartAD offers the following key advantages in intranet security protection:

• Wide applicability: SmartAD supports any IP-based dumb terminal (such as printers, IP phones, and cameras), regardless of the device type, vendor, or operating system. As long as a dumb terminal generates network traffic, it can be detected.
• Ease of deployment: AI capabilities are built directly into devices, eliminating the need to install clients on dumb terminals, mirror all network traffic, or deploy dedicated firewall probes. The administrator simply needs to enable the SmartAD function on the device interface and set detection parameters (such as terminal address range and training duration). This makes deployment simple, efficient, and quick.
• Self-evolution: Free from signature databases and manually defined rules, SmartAD automatically builds and updates each dumb terminal's behavior baseline through online learning. It not only detects new types of attacks but also identifies any deviations in terminal traffic behavior from the normal baseline. Furthermore, as data accumulates and feedback is incorporated, detection capabilities continuously evolve, eliminating the need for constant expert involvement.
• Near-source handling and quick response: Equipped with near-source anomaly handling capabilities, devices can respond within seconds.
• Comprehensive threat detection: In complex scenarios, SmartAD collaborates with iMaster NCE-Campus to handle threats, covering the four major types of threats faced by dumb terminals:
  • DDoS attacks: Detects resource abuse behaviors such as sudden increase in connections and traffic.
  • Ransomware/Malware: Identifies network-layer characteristics such as lateral movement and abnormal access.
  • Intranet penetration: Detects probing behaviors such as network scanning.
  • Data leakage: Monitors abnormal intranet access and abnormal connections to external networks.

How Is SmartAD Deployed?

SmartAD is generally deployed on access or aggregation devices. The solution comprises three primary components: terminal, switch, and iMaster NCE-Campus. The core functions of each component are as follows:

• Terminal: Refers to a dumb terminal that cannot have security software installed, making it a direct target for attacks.
• Switch: Functions as the traffic data collection point for dumb terminals. It utilizes built-in AI capabilities to learn dumb terminal behavior baselines (including the traffic baseline and access relationship baseline) online, and locally infers whether subsequent traffic behavior is abnormal based on those baselines. In addition, it can work with iMaster NCE-Campus to handle abnormal terminals at the nearest location.
• iMaster NCE-Campus: Displays the dumb terminal baseline data and anomaly events reported by switches, consolidates anomaly events and generates alarms accordingly, and collaborates with switches to handle abnormal terminals. The administrator can review anomaly events reported by a switch and send false positives back to it. The switch then modifies the baseline based on this feedback.

SmartAD architecture

How Does SmartAD Work?

SmartAD leverages AI to continuously learn normal patterns in real time and accurately identify anomalies. It uses the native AI capabilities of switches to learn traffic behaviors of dumb terminals online, establish behavior baselines, and detect abnormal behaviors in real time based on those baselines. The workflow of SmartAD can be divided into four parts: model training, model inference, anomaly feedback, and anomaly handling.

Implementation of SmartAD

1. Data collection and feature engineering:

   The switch collects traffic from connected dumb terminals. Based on the statistical data reported by the SAC flow table, it automatically extracts behavior features from terminal traffic, specifically the mean and variance of traffic time-series features.

2. Model training:
   1. The network detection algorithm learns behavior features from dumb terminal traffic and establishes terminal baselines (including the traffic baseline and access relationship baseline).
   2. The switch reports the terminal baselines to iMaster NCE-Campus through telemetry every day.
   3. iMaster NCE-Campus evaluates the model based on the daily terminal baselines reported by the switch and provides feedback. If the feedback is positive or no feedback is provided, the terminal baselines are formally incorporated. If the feedback is negative, the reported baseline data is discarded.
   4. To ensure reliability of the training baseline, the switch evaluates the model using benign samples on the last day of the training period. The traffic data on the last day of the training period is used as benign samples to verify the baseline data trained in the previous days. If the accuracy exceeds 95%, the baseline is adopted and model inference starts. If the accuracy remains below 95% for three consecutive days, the previous training baseline is discarded and retraining starts. In addition, the switch informs iMaster NCE-Campus that retraining has started and the previously reported baseline data is discarded.
3. Model inference:
   1. After model training is complete, the switch continuously collects traffic. The network detection algorithm determines whether the terminal traffic is abnormal based on the terminal baselines and generates anomaly events.
   2. The switch reports anomaly events to iMaster NCE-Campus through telemetry.
   3. iMaster NCE-Campus displays terminal anomaly events reported by the switch and consolidates them into threats such as DDoS attacks, ransomware/malware, intranet penetration, and data leakage.
4. Anomaly handling and feedback:
   1. Based on the threat alarms on iMaster NCE-Campus, the administrator configures and delivers corresponding handling measures to the switch, such as ACL-based blocking, port shutdown, MAC address blacklist, and RADIUS CoA. The switch then executes these measures to handle anomalies.
   2. The administrator can review the anomaly events reported by the switch to iMaster NCE-Campus and provide feedback on false positives. Based on this feedback, the switch corrects its baselines. During inference, the switch then matches appropriate priorities and application policies against multiple corrected baselines.