Hubbry Logo
Narus Inc.Narus Inc.Main
Open search
Narus Inc.
Community hub
Narus Inc.
logo
7 pages, 0 posts
0 subscribers
Be the first to start a discussion here.
Be the first to start a discussion here.
Narus Inc.
Narus Inc.
from Wikipedia

Narus Inc. was a software company and vendor of big data analytics for cybersecurity.

Key Information

History

[edit]

In 1997, Ori Cohen, Vice President of Business and Technology Development for VDONet, founded Narus with Stas Khirman in Israel.[1] Presently, they are employed with Deutsche Telekom AG and are not members of Narus' executive team.[2][3] In 2010, Narus became a subsidiary of Boeing, located in Sunnyvale, California.[4] In 2015, Narus was sold to Symantec.[5][6]

Management

[edit]

In 2004, Narus employed former Deputy Director of the National Security Agency, William Crowell as a director.[7]

Narus software

[edit]

Narus software primarily captures various computer network traffic in real-time and analyzes results.[8][9]

Before 9/11 Narus built carrier-grade tools to analyze IP network traffic for billing purposes, to prevent what Narus called "revenue leakage". Post-9/11 Narus added more "semantic monitoring abilities" for surveillance.

Mobile

[edit]

Narus provided Telecom Egypt with deep packet inspection equipment, a content-filtering technology that allows network managers to inspect, track and target content from users of the Internet and mobile phones, as it passes through routers. The national telecommunications authorities of both Pakistan and Saudi Arabia are global Narus customers.[10]

Controversies

[edit]

AT&T wiretapping room

[edit]

Narus supplied the software and hardware used at AT&T wiretapping rooms, according to whistleblowers Thomas Drake,[11] and Mark Klein.[12]

See also

[edit]

References

[edit]
[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia
from Grokipedia
Narus Inc. was an American software company founded in 1997 in Sunnyvale, California, specializing in real-time network traffic analytics and cybersecurity solutions for telecommunications and intelligence applications. The company developed patented technologies for deep packet inspection, enabling comprehensive monitoring, threat detection, and lawful interception of internet protocol traffic on large-scale networks. Narus's flagship product, NarusInsight, provided advanced data analytics for identifying cyber threats and managing network operations, serving enterprise and government clients worldwide. Acquired by Boeing in July 2010 to enhance its intelligence capabilities, Narus operated as a subsidiary until its purchase by Symantec Corporation in January 2015, after which its technologies were integrated into broader cybersecurity offerings. Its defining characteristics include pioneering scalable surveillance tools that raised discussions on privacy versus security in digital communications, though primarily marketed for protective and compliance purposes.

Origins and Development

Founding and Initial Innovations (1997–2000s)

Narus Inc. was founded in 1997 in by Dr. Ori , Stas Khirman, and a team of four other engineers specializing in network technologies. , previously Vice President of Business and Technology Development at VDONet, led the effort to address emerging challenges in IP for carriers. The company established its headquarters in , to tap into the U.S. market for software solutions in high-speed data networks. In its early years, Narus focused on developing carrier-grade tools for analyzing IP traffic to support accurate billing and prevent revenue leakage from unmonitored data usage. The core innovation was the Narus Business Infrastructure (IBI) platform, which employed semantic to gather, process, and correlate detailed network usage information directly from high-speed links without disrupting service flow. This approach allowed carriers to track granular metrics such as session durations, data volumes, and protocol behaviors in real time, addressing limitations in traditional billing systems reliant on sampled or aggregated data. By , Narus demonstrated the IBI platform's applications at industry events, highlighting its ability to handle petabyte-scale for and service optimization. A key partnership with that year advanced IP services billing accuracy, integrating Narus's analysis capabilities with customer care systems to enable precise of voice, data, and emerging . These developments positioned Narus as an early pioneer in scalable, protocol-agnostic IP , laying groundwork for broader network analytics amid the internet's rapid expansion in the late and early .

Expansion into Network Analytics

In the mid-2000s, Narus shifted from foundational semantic toward advanced network analytics, incorporating and correlation to address growing demands for cybersecurity and traffic optimization in large-scale IP networks. This evolution built on early technologies for media streaming and network mediation, enabling the company to offer solutions that reconstructed sessions, identified anomalies, and supported applications in both commercial service providers and government surveillance. Central to this expansion was the NarusInsight platform, which processed petabytes of traffic data in real time, providing granular insights into user behaviors, application usage, and potential s through features like keyword-based capture and byte . By 2009, Narus significantly upgraded NarusInsight, introducing extensible monitoring modules, operator-defined alerts for application-layer s, and for 10 Gbps networks, alongside integration with third-party systems such as ArcSight for enhanced reporting and across distributed environments. These enhancements expanded beyond basic traffic scanning to proactive cyber detection and intercept capabilities. This period of development solidified Narus's position in network analytics, with NarusInsight deployed globally for protecting against persistent cyber attacks and enabling precise traffic intelligence on backbone . The platform's ability to handle massive volumes while maintaining performance underscored its role in scaling analytics for enterprise and needs, paving the way for subsequent product extensions like CyberAnalytics applications focused on detailed security querying.

Core Technologies and Products

NarusInsight Platform

The NarusInsight platform is a scalable, real-time IP network intelligence system developed by Narus Inc. for capturing, analyzing, and correlating across large-scale networks. Introduced in 2005, it superseded the FBI's tool and supports monitoring of high-volume streams, including up to 10 Gbit/s equivalent to from 39,000 DSL lines. The platform employs (DPI) and semantic analysis to process payloads in real time, enabling reconstruction of full network sessions for investigative or protective purposes. It monitors over 30% of global through distributed processing modules and open interfaces for third-party integration. Core capabilities include real-time precision targeting, behavioral , and content reconstruction, such as playback of VoIP streams, rendering of visited web pages, and examination of attachments or instant messages. NarusInsight facilitates detection of threats like , unauthorized services (e.g., gray VoIP or rogue servers), and policy violations via customizable alert rules based on keywords, byte patterns, or application-layer protocols. For lawful intercept and compliance, it adheres to standards like CALEA and ETSI, supporting selective traffic capture and correlation across multiple network elements. In cybersecurity applications, the 2011 NarusInsight CyberAnalytics module provides detailed forensic insights into network anomalies, processing petabytes of data to identify attack vectors or insider risks. A 2009 upgrade enhanced extensibility with operator-defined monitoring rules, integration with tools like ArcSight for automated , and for 10 Gb networks, allowing simultaneous analysis of diverse traffic types without performance degradation. The platform's architecture emphasizes full session reconstruction and cross-link correlation, distinguishing it from header-only inspection tools by enabling payload-level scrutiny for geolocation, tracing, and . Following Narus's 2010 acquisition by , NarusInsight's were leveraged for enterprise , with further integration into Symantec's portfolio by 2015 to bolster big data-driven threat intelligence.

Semantic Traffic Analysis (STA) Systems

Semantic Traffic Analysis (STA) refers to Narus Inc.'s proprietary technology for real-time monitoring and interpretation of network traffic, enabling the capture, dissection, and semantic reconstruction of IP data streams beyond mere volume or . Developed in the late , STA software processes traffic on high-performance servers, such as workstations or Linux-based and systems, to identify protocols, reconstruct sessions, and extract actionable intelligence like user behaviors, content types, and application-specific details. This approach leverages to "understand" traffic semantics, distinguishing it from traditional statistical sampling by providing comprehensive, protocol-agnostic analysis across diverse network environments. The flagship implementation, the Narus STA 6400, exemplifies this capability by handling traffic volumes exceeding 622 megabits per second in real time as of May 2000, scaling to support heavily trafficked IP networks for tasks including billing , fraud detection, and resource optimization. STA systems employ configurable toolkits, such as the Narus VA Toolkit, to customize data capture for specific protocols like HTTP, SMTP, or VoIP, transforming raw packets into structured insights via correlation and . This semantic layer allows operators to target queries by attributes including IP addresses, email domains, or phone numbers, facilitating precision filtering without exhaustive storage of all data. In enterprise applications, STA integrates with mediation platforms to generate usage records for and ISPs, supporting revenue assurance by accurately attributing complex traffic like streams or encrypted tunnels where feasible. Its architecture emphasizes scalability, with modular components for ingestion, analysis, and visualization, often deployed in rack-mounted hardware for carrier-grade performance. Early partnerships, such as with in December 1999, embedded STA into IP mediation solutions to enhance network intelligence for service providers. "Semantic Traffic Analysis" was registered as a by Narus in 2002, underscoring its centrality to the company's .

Mobile and Intercept Capabilities

Narus Inc.'s mobile capabilities centered on its NarusInsight platform, which supported real-time intelligence for tier-one mobile, prepaid, and wireless networks through and traffic mediation. The system enabled operators to monitor and manage IP-based mobile data traffic, including VoIP calls, over IP, and webmail, by reconstructing full sessions and correlating data across network elements. Intercept functionalities, integrated into NarusInsight modules like NarusIntercept, allowed targeted capture of communications by criteria such as phone numbers, URIs, accounts, keywords, or byte patterns, facilitating lawful intercepts for and intelligence purposes. This included geolocation, tracing, and analysis of mobile-originated traffic streams, applicable to both voice and data in IP networks. In a 2009 upgrade, enhanced interception supported investigations into criminal activity and by processing multiple petabytes of traffic in real time on 10 Gb networks, with detection of tunneling and application-layer evasion tactics. These tools extended to mass surveillance scenarios, where the Narus STA 6400 device performed semantic traffic analysis to sift through high-volume data for actionable patterns, often deployed at network choke points for comprehensive monitoring. agencies utilized them for network , including in international deployments like Egypt Telecom, where they aided in controlling data streams across web, , and protocols. The platform's design prioritized scalability for mobile backbone mediation, transforming raw usage data into intelligence while complying with carrier-grade intercept standards.

Corporate Trajectory

Acquisition by Boeing (2010)

On July 7, 2010, Boeing announced an agreement to acquire Narus Inc., a privately held company specializing in real-time network traffic analysis and monitoring technologies for IP networks. The deal aimed to bolster Boeing's cybersecurity offerings by integrating Narus's analytics capabilities, which enable detection of threats through behavioral patterns in network data, into its Network and Space Systems division. Terms of the transaction, including the purchase price, were not disclosed. The acquisition followed a prior partnership between and Narus, which had demonstrated compatibility in delivering cyber defense solutions to and enterprise clients. positioned the move as a strategic expansion into proactive network protection, emphasizing Narus's role in providing scalable, high-performance tools for analyzing massive data volumes in real time. Narus, based in , continued operations as a wholly owned post-acquisition, retaining its focus on software for and applications. Boeing completed the acquisition on July 29, 2010, integrating Narus to support broader missions in cyber intelligence and systems resilience. This transaction marked 's deepening commitment to cybersecurity amid rising threats to , with Narus's technology contributing to and without relying on predefined signatures. No immediate changes to Narus's product lineup or customer contracts were reported, preserving continuity in its deployments for purposes.

Integration into Symantec (2015) and Beyond

In January 2015, Symantec entered an agreement with to acquire technology rights and hire 65 engineers and data scientists from Narus, Boeing's cybersecurity , thereby transferring key operational capabilities focused on analytics and real-time network . This arrangement effectively ended Narus's independent operations, which had ceased as a non-integrated Boeing unit by December 2014, while retained ownership of Narus's and licensing rights. The deal, valued undisclosed but positioned as a strategic talent and tech infusion, aimed to strengthen Symantec's defenses against advanced persistent threats by leveraging Narus's expertise in processing massive network data volumes for and remediation. Post-integration, Narus's semantic and intercept technologies were incorporated into Symantec's Integrated Cyber Defense platform, enhancing capabilities in endpoint protection, threat intelligence, and behavioral to unify detection across enterprise networks. This bolstered Symantec's shift toward proactive, data-driven cybersecurity amid rising state-sponsored and sophisticated attacks, with the acquired team's contributions accelerating development of advanced threat protection (ATP) features that correlated network metadata with endpoint signals for faster incident response. Symantec's enterprise security revenue, incorporating these enhancements, grew modestly in subsequent quarters despite broader restructuring, reflecting the value of Narus-derived in combating evolving threats like and nation-state intrusions. In November 2016, Symantec completed a corporate split, separating its cybersecurity operations (including Narus-integrated technologies) from its storage business, with the security division rebranded under Symantec Corporation. The enterprise security unit, encompassing these analytics tools, was acquired by in 2019 for $10.7 billion, integrating further into 's portfolio before transitioning to Inc. (formerly NortonLifeLock) following a 2022 merger. Narus as a distinct entity dissolved post-2015, with its core innovations persisting anonymously within modern (EDR) systems, though no public branding or standalone products under the Narus name have emerged since.

Applications in Cybersecurity and Intelligence

Domestic Security Deployments

Narus technologies have been deployed in the United States to support domestic security through real-time network and capabilities compliant with the Communications Assistance for Act (CALEA). The NarusInsight Intercept module facilitates court-authorized by enabling carriers to deliver intercepted communications to agencies, preserving the ability to monitor voice, data, and IP traffic for criminal investigations. These systems integrate with carrier networks to ensure efficient handling of wiretap orders, supporting federal agencies in targeting threats such as and without requiring extensive manual intervention. In cybersecurity applications, NarusInsight has been utilized to protect by providing early-warning detection of cyber attacks on large IP networks operated within the . Following the acquisition by , the platform was enhanced for government customers to analyze traffic patterns, identify anomalies indicative of advanced persistent threats, and mitigate insider risks in sensitive environments. Deployments include monitoring systems capable of processing up to 10 gigabits of IP packets per second, allowing for proactive defense against distributed denial-of-service attacks and attempts targeting domestic networks. These deployments emphasize scalable analytics for actionable , with Narus software managing traffic across major carriers and enterprise networks to bolster national resilience against cyber espionage and . While primarily oriented toward authorized operations, the technology's features enable comprehensive visibility into encrypted and unencrypted flows, aiding in the correlation of network events with potential domestic threats.

International and Government Use Cases

Narus technologies, particularly the NarusInsight platform, have been deployed by foreign governments and state-affiliated providers for real-time and intelligence gathering. Following its acquisition by in , Narus reported installations supporting government operations across multiple continents, enabling capabilities such as cyber threat detection, traffic interception, and behavioral analytics on large-scale IP networks. In , Narus equipment was supplied to Egypt Telecom, facilitating for geolocation, voice interception, and analysis, which Egyptian authorities used to monitor and suppress opposition during the 2011 uprising. Reports from privacy organizations documented the system's role in enabling , with Narus openly listing Egypt Telecom among its managed networks as a subsidiary. Saudi Arabian telecommunications firms also received Narus systems, supporting government-directed monitoring of communications for purposes. These deployments aligned with broader patterns of Narus providing intercept and tools to authoritarian regimes seeking to track dissidents and enforce content controls, as evidenced by sales to entities in the region prior to and following U.S. export oversight. Beyond the , Narus solutions have underpinned government use cases in and network protection frameworks internationally, though specific contracts remain proprietary; privacy advocates have critiqued such exports for empowering repressive without adequate safeguards.

Controversies and Debates

AT&T Room 641A and NSA Surveillance Revelations

In 2003, the (NSA) collaborated with to install surveillance equipment in , a secure facility within 's switching center at 611 Folsom Street in , . This room, measuring approximately 24 by 48 feet and containing racks of specialized hardware, enabled the interception of high-speed fiber-optic internet traffic flowing through 's , including both domestic and international communications. The setup involved fiber-optic splitters that duplicated incoming and outgoing signals, routing copies to NSA analyzers without disrupting primary traffic flow. Former AT&T technician Mark Klein, who worked on the WorldNet Internet service from 2002 to 2004, documented the installation process through internal company memos and equipment lists he obtained. Klein observed NSA personnel overseeing the wiring of Narus STA 6400 Semantic Traffic Analyzers into the room's equipment racks, devices capable of performing deep packet inspection to capture, decode, and analyze VoIP calls, web browsing, emails, and other data in real time at speeds up to 10 gigabits per second. Narus, a provider of network intelligence software, marketed its NarusInsight platform—including the STA 6400—for lawful intercept and traffic monitoring, allowing operators to target specific content, metadata, or patterns across vast data streams. In a 2006 declaration to the Electronic Frontier Foundation (EFF), Klein alleged that the system provided the NSA with "unfiltered access to AT&T's peering traffic," encompassing communications of millions of users, without individualized warrants. The revelations emerged publicly in April 2006 when Wired published Klein's evidence, sparking lawsuits such as Hepting v. AT&T, where plaintiffs accused AT&T of aiding warrantless surveillance under the NSA's post-9/11 Terrorist Surveillance Program. Narus officials responded by declining to confirm or deny the equipment's use for NSA purposes, emphasizing that their technology complied with legal intercept standards and was designed for authorized government applications. While the Bush administration defended the program as essential for counterterrorism, citing its role in monitoring al-Qaeda-linked threats, critics argued it violated the Fourth Amendment by enabling bulk collection absent probable cause. Subsequent 2015 disclosures from Edward Snowden's documents, reported by The Intercept, confirmed Room 641A as part of a broader NSA-AT&T arrangement spanning multiple U.S. facilities, though they did not specify Narus hardware in all cases. The Room 641A setup exemplified early 2000s advancements in semantic , where Narus's tools processed packet payloads for content-based filtering rather than mere metadata, raising debates over and potential for abuse in domestic monitoring. Legal challenges were largely dismissed under the and later retroactive immunity via the 2008 FISA Amendments Act, but the episode highlighted tensions between intelligence efficacy—evidenced by NSA claims of thwarted plots—and privacy safeguards, influencing reforms like the of 2015. Independent analyses, such as those from cybersecurity experts, noted that Narus technology's precision in real-time interception could enhance threat detection but required robust oversight to prevent overreach.

Privacy Critiques Versus Security Efficacy

Privacy advocates, notably the , contended that Narus' Semantic Traffic Analysis (STA) systems, such as the STA 6400 deployed by , facilitated unconstitutional by enabling the capture of domestic communications without warrants. In the 2006 Hepting v. lawsuit, EFF presented evidence from AT&T technician Mark Klein's affidavit, describing how Narus equipment in San Francisco's used optical splitters to duplicate fiber-optic traffic—encompassing emails, web browsing, and —for NSA analysis, potentially affecting millions of users indiscriminately. This setup, operational since at least February 2003, bypassed (FISA) requirements, raising Fourth Amendment concerns over unreasonable searches and the risk of on non-suspects. Defenders of Narus' technology emphasized its role in bolstering security efficacy against post-9/11 threats, highlighting capabilities like real-time and geolocation to sift petabytes of traffic for anomalies indicative of or cyberattacks. Narus promoted STA as a tool for actionable intelligence, capable of monitoring over 622 Mbps in 2000 and scaling to detect encrypted patterns or dissident communications without disrupting network flow. A 2010 Narus survey of cybersecurity professionals found 90% favored detection-and-analysis solutions like STA over reactive measures, underscoring perceived value in preempting threats amid rising cyber risks. Government assertions, including NSA claims of thwarting plots through warrantless programs, positioned such tools as vital for countering non-state actors operating via global networks, though declassified details rarely isolate Narus' contributions. The tension persists in evaluations of net benefits: privacy critiques, rooted in documented overcollection and judicial rebukes (e.g., FISA court findings of statutory violations in related NSA efforts), highlight and minimal safeguards, while security efficacy remains contested due to classified outcomes. Independent analyses, such as a review of NSA bulk programs, attributed only one of 54 claimed disruptions directly to metadata collection akin to Narus-enabled intercepts, suggesting limited prevention relative to costs, though proponents argue indirect gains from volume analysis outweigh verifiable plot foils. This underscores causal challenges in attributing prevented attacks amid alternative sources, with empirical favoring targeted over bulk methods for efficiency.

References

Add your contribution
Related Hubs
User Avatar
No comments yet.