{"id":1887,"date":"2025-02-11T16:31:16","date_gmt":"2025-02-11T16:31:16","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=1887"},"modified":"2025-02-11T16:31:16","modified_gmt":"2025-02-11T16:31:16","slug":"how-is-deep-session-inspection-a-game-changer-for-threat-detection","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=1887","title":{"rendered":"How is Deep Session Inspection a Game Changer for Threat Detection?"},"content":{"rendered":"
\n
\n
\n
\n
\n

Deep Session Inspection (DSI) is like having a security guard who watches the entire conversation between two people, instead of focusing on just a few sentences or words.<\/span>\u00a0<\/span><\/p>\n

Let\u2019s see how!<\/strong><\/em><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n

Traditional Threat Detection<\/h2>\n<\/div>\n<\/div>\n
\n
\n

Traditional network monitoring and threat detection methods, such as Deep Packet Inspection (DPI)<\/a>, examine individual data packets. However, these methods are limited in their data processing, as they are analyzing packets separately without considering the full context of the communication.\u00a0<\/span>\u00a0<\/span><\/p>\n

While this approach helps detect errors or threats in individual packets, it may overlook threats that unfold over time or across multiple steps. Network administrators and security teams often rely on these traditional methods, but they may struggle to detect advanced, multi-step attacks.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n

What is Deep Session Inspection (DSI)?<\/h2>\n<\/div>\n<\/div>\n
\n
\n

DSI looks at the entire data stream and communication session between two endpoints. This makes it more effective at identifying threats like malware and data breaches.<\/span>\u00a0<\/span><\/p>\n

Its reach extends across network choke points, proxied traffic, email systems, and internal data centre access points, delivering a strong defense against attacks.\u00a0<\/span>\u00a0<\/span><\/p>\n

Unlike traditional intrusion detection systems, which primarily focus on packet-by-packet analysis, DSI inspects full communication sessions, providing a deeper level of threat detection.<\/span><\/p>\n<\/div>\n<\/div>\n

\n
\n

What Makes DSI Better than DPI?<\/h2>\n<\/div>\n<\/div>\n
\n
\n

The holistic nature of DSI helps with anomaly detection<\/a><\/span>\u00a0and uncovers threats that traditional systems might miss. By analyzing the full context of a network session, DSI can spot more sophisticated attacks that unfold over time and detect subtle or slow-moving threats before they cause significant damage.\u00a0<\/span>\u00a0<\/span><\/p>\n

In contrast, traditional systems like DPI focus on individual packets, which may seem harmless when considered individually, and pass through the network while attackers plan larger attacks.<\/span>\u00a0<\/span><\/p>\n

For example, an attacker might gradually send seemingly harmless messages to test the system\u2019s security or slowly gain entry. While a DPI system inspects only these packets, DSI examines the entire session, allowing it to quickly flag suspicious behavior, even when individual packets seem fine.<\/span>\u00a0<\/span><\/p>\n

To better understand how DSI differs from DPI, here\u2019s a quick overview of their key differences:<\/span><\/p>\n<\/div>\n<\/div>\n

\n
\n

\t\t\t\t\tFeatureDeep Packet Inspection (DPI)Deep Session Inspection (DSI)\t\t\t\t<\/p>\n

\t\t\t\t\tScope of AnalysisExamines individual network packets.Analyzes entire network sessions (all packets within the session).Content InspectionLimited to packet headers and payloads; often lacks full content visibility.Fully reconstructs network traffic for detailed inspection.Encoding and Obfuscation HandlingStruggles with encoded, obfuscated, or complexly layered data.Capable of handling and decoding multiple layers of encoding (e.g., embedded documents, web traffic).Application AreasCommon in firewalls, intrusion prevention systems, and secure web gateways.Can be applied to network choke points, email systems, proxied traffic, and internal data center access points.Real-Time AnalysisProcesses packets as they flow through the network, often with minimal delay.Analyzes network sessions in real-time or retrospectively, providing immediate and long-term threat detection.Metadata CollectionLimited network metadata collection, often restricted to packet-level information.Collects and stores extensive metadata<\/a> for every network session, enabling retrospective analysis of many sessions. Context AwarenessLacks the ability to correlate context over time, limiting detection capabilities.Combines content with context (e.g., sender\/receiver info) for more accurate and actionable security policies.Security CoverageEffective at detecting single-packet attacks, like buffer overflow or DDoS.Provides comprehensive coverage across the entire attack kill chain, from initial attack to data leakage.Flexibility in ApplicationTypically used for detecting known threats in isolated packets.Offers broader use cases, such as identifying low-and-slow attacks, data leakage, and sophisticated multi-session threats.\t\t\t\t<\/p><\/div>\n<\/div>\n

\n
\n

Overall:<\/span>\u00a0<\/span><\/p>\n

DSI enables better detection of advanced threats, data leakage attempts, and sophisticated attack methods, providing a level of visibility that packet filtering systems alone cannot achieve.<\/span>\u00a0<\/span><\/p>\n

Now that we have seen the impact of DSI on network security, let\u2019s dive into how Fidelis Network\u00ae applies this advanced method to strengthen its threat detection<\/a> and response capabilities.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n

Fidelis Network\u00ae and Deep Session Inspection\u00ae (DSI)<\/h2>\n<\/div>\n<\/div>\n
\n
\n

Fidelis Network<\/a>\u00ae Detection and Response (NDR) provides a unified, robust cybersecurity solution with comprehensive visibility and advanced threat detection across all network ports and protocols.<\/span>\u00a0<\/span><\/p>\n

Fidelis Network\u00ae leverages its patented Deep Session Inspection (DSI) method that extracts and analyzes embedded files, enabling precise detection of data exfiltration attempts.<\/span>\u00a0<\/span><\/p>\n

For example, if an employee attempts to send a large file to an external email address\u2014an action that seems unusual for their role\u2014DSI will not only flag the file transfer but also correlate it with the session context. This includes analyzing the sender\u2019s access patterns and determining whether such activity aligns with their usual behavior.<\/span>\u00a0<\/span><\/p>\n

By inspecting not only individual packets but also the context of entire network interactions across the corporate network, Fidelis Network\u00ae enhances its ability to detect sophisticated threats like data leakage and complex attack strategies, ensuring comprehensive protection across the network.<\/span>\u00a0<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
Explore Fidelis DSI: Advanced Threat Detection & Data Leak Prevention <\/div>\n<\/div>\n<\/div>\n
\n
\n

See how Fidelis DSI helps you:<\/span><\/span><\/p>\n<\/div>\n<\/div>\n

\n
\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tReassemble and analyze network, email, and web traffic in real-time<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tIdentify threats and data leaks by decoding session content <\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tEnhance threat detection with context and metadata <\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tAutomate responses, such as alerts and quarantines <\/span><\/p><\/div>\n<\/div>\n

\n
\n
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tDownload the Whitepaper<\/span>
\n\t\t\t\t\t<\/span>
\n\t\t\t\t\t<\/a>\n\t\t<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n

To understand how this works, <\/span>let\u2019s<\/span> explore the process in more detail.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n

\n
\n

Sensors Used in Fidelis Network\u00ae<\/h3>\n<\/div>\n<\/div>\n
\n
\n

Fidelis Network\u00ae uses 2 sensors\u2014Direct Sensors and Internal Sensors, to analyze network traffic in real-time<\/a> as it passes through the network.<\/span>\u00a0<\/span><\/p>\n

Direct Sensors: <\/span>Optimized for boundary traffic between internal and external networks. They handle many small, fast sessions (e.g., web or email traffic).<\/span>\u00a0<\/span>Internal Sensors:<\/span> Optimized for internal network traffic, handling fewer but longer sessions, like file-sharing, often lasting days or weeks.<\/span>\u00a0<\/span>\t\t\t\t\t\t<\/p><\/div>\n<\/div>\n

\n
\n

These sensors operate without holding or delaying traffic, ensuring near-zero latency. However, since they analyze a copy of the traffic rather than the original, prevention of attacks cannot be guaranteed.<\/span><\/p>\n<\/div>\n<\/div>\n

\n
\n

Analysis Engines: Enhancing DSI’s Detection Capabilities<\/h3>\n<\/div>\n<\/div>\n
\n
\n

Both Direct and Internal Sensors use 3 analysis engines to inspect the traffic:<\/span>\u00a0<\/span><\/p>\n

Deep Session Inspection\u00ae (DSI) Engine: <\/span>This is the core engine that reassembles network traffic into a session buffer, allowing for deep inspection of file formats, emails, and other data types. It can even handle compressed files, revealing content that other analysis methods might overlook.<\/span>\u00a0<\/span>Deep Packet Inspection (DPI) Engine: <\/span>The DPI engine examines each packet using predefined rules with minimal delay. However, since it works on a copy of the packet, it can only take preventive action on the next packet, not the current one.\u00a0<\/span>\u00a0<\/span>Malware Detection Engine (MDE): <\/span>The MDE scans files detected during the DSI decoding process using various methods to identify malware, helping to prevent potential damage before it occurs.<\/span>\t\t\t\t\t\t<\/p><\/div>\n<\/div>\n

\n
\n

Here, let\u2019s focus on the DSI engine.<\/span>\u00a0<\/span><\/p>\n

The DSI engine places each packet\u2019s data into a session buffer as it arrives. As more packets are processed, the buffer grows. This allows Fidelis to identify the application protocol, content, and file types, and decode everything\u2014including compressed files\u2014to uncover the full content of files, emails, and other data.<\/span>\u00a0<\/span><\/p>\n

Also, in Fidelis Network\u00ae, DPI and DSI engines are used in parallel to ensure thorough inspection.\u00a0<\/span>\u00a0<\/span><\/p>\n

DPI, which relies on packet-by-packet analysis, drops the next packet if it finds an issue, while DSI works on analyzing the complete session, for full content inspection.<\/span><\/p>\n<\/div>\n<\/div>\n

\n
\n
A Step-by-Step Breakdown of How the DSI Engine Operates in Fidelis Network\u00ae Upon Receiving a Packet<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n

<\/span>
\n <\/span>
\n <\/span><\/p>\n

\n
\n

\t\t\t\t\t\t\t\t<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/p><\/div>\n<\/div>\n

\n
Session Reassembly<\/h5>\n

DSI pulls the payload from each packet and reassembles it into a session buffer, creating a complete view of the transmitted data. This reassembled session provides an accurate snapshot of the data flowing between endpoints. <\/p>\n<\/div>\n

<\/span>
\n <\/span>
\n <\/span><\/p>\n

\n
\n

\t\t\t\t\t\t\t\t<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/p><\/div>\n<\/div>\n

\n
Decoding Process<\/h5>\n

After reassembly, DSI decodes the content and identifies the application protocols and formats in use. It creates a decoding tree to map the structure of the session, including all packets, files, and data transferred, allowing DSI to fully comprehend the session\u2019s content.<\/p>\n<\/div>\n

<\/span>
\n <\/span>
\n <\/span><\/p>\n

\n
\n

\t\t\t\t\t\t\t\t<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/p><\/div>\n<\/div>\n

\n
Rule Application<\/h5>\n

DSI uses custom security rules to check for potential threats as the session progresses, such as detecting malware or data breaches, in real-time.<\/p>\n<\/div>\n

<\/span>
\n <\/span>
\n <\/span><\/p>\n

\n
\n

\t\t\t\t\t\t\t\t<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/p><\/div>\n<\/div>\n

\n
Prevention<\/h5>\n

When a rule violation is detected, an action (either alert or prevention) is triggered. To prevent a threat, the violation must be detected while the session is still ongoing; if detection occurs too late, prevention cannot take place.<\/p>\n<\/div>\n

<\/span>
\n <\/span>
\n <\/span><\/p>\n

\n
\n

\t\t\t\t\t\t\t\t<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/p><\/div>\n<\/div>\n

\n
File Detection<\/h5>\n

If a file is identified during decoding, it is forwarded to the Malware Detection Engine (MDE) for further inspection.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
Explore Fidelis Network Prevention \u2013 Block Malware & Prevent Data Leaks<\/div>\n<\/div>\n<\/div>\n
\n
\n

See how Fidelis Network helps you:<\/span><\/span><\/em><\/p>\n<\/div>\n<\/div>\n

\n
\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tBlock malware and limit data leaks<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tSecure internal and external access with specialized sensors <\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tPrevent breaches with real-time threat detection<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tConfigure sensors for optimal protection<\/span><\/p><\/div>\n<\/div>\n

\n
\n
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tDownload the Whitepaper<\/span>
\n\t\t\t\t\t<\/span>
\n\t\t\t\t\t<\/a>\n\t\t<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n

With these steps, the DSI engine in Fidelis Network\u00ae ensures robust threat detection and helps prevent attacks, providing comprehensive protection against potential cyberattacks in real-time.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n

Wrapping Up,<\/h2>\n<\/div>\n<\/div>\n
\n
\n

Deep Session Inspection is a transformative approach in the cybersecurity industry, going beyond traditional methods of individual packet analysis. This holistic approach to examining entire communication sessions enables organizations to uncover advanced threats, suspicious actions, and data breaches that might otherwise slip through the cracks. With its ability to detect nuanced attack strategies and handle complex, encoded traffic data, DSI strengthens security at every network level.\u00a0<\/span>\u00a0<\/span><\/p>\n

By leveraging DSI through solutions like Fidelis Network\u00ae, businesses can achieve enhanced protection, proactive threat detection, and faster response times, ensuring a safer, more resilient network environment.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

The post How is Deep Session Inspection a Game Changer for Threat Detection?<\/a> appeared first on Fidelis Security<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Deep Session Inspection (DSI) is like having a security guard who watches the entire conversation between two people, instead of focusing on just a few sentences or words.\u00a0 Let\u2019s see how! Traditional Threat Detection Traditional network monitoring and threat detection methods, such as Deep Packet Inspection (DPI), examine individual data packets. However, these methods are […]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-1887","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/1887"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1887"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/1887\/revisions"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}