Q1 Labs Inc. 15 Piedmont Center, suite 1040 Atlanta, Georgia USA

Transcription

1 1. Name of the Technology and the Corporation supporting it Product: Company: RFI Contact: QVISION Q1 Labs Inc. 15 Piedmont Center, suite 1040 Atlanta, Georgia USA Mark Osborne (office) (fax) NOTE: Information presented in this report is based in good faith on information provided by the company offering the technologies described. No independent due diligence has been carried out to verify the original source information. 2. The applicable Technology Application Area (s) and Overview QVISION was developed in a university environment in an effort to determine the effects NAPSTER was causing on the network. Q1 Labs believes it can address network performance, bandwidth shaping, and provide audit tools. QVISION is software that sits on the network at the Internet connection and inside the network, monitoring network traffic flows coming in and out of the network, detecting unnatural network patterns and client behaviors. QVISION looks at networks by applications, ports, hosts, host counts, geographies and a variety of other views. A flow generator collects and breaks down packet data in real-time and then a classification engine stores the components into databases based on the concept of views, both general and specific drilled right down to the IP address and packet level to pinpoint which machine is vulnerable and which remote address is involved with the anomaly or problem. QVISION users see all traffic coming across their Internet links in near real-time, in all the ways it can be graphically viewed. QVISION can show general overviews by the standard applications and protocol breakdown, as do other security products. However, QVISION distinguishes itself from other products in its data mining and drill down capabilities to show network traffic flows based on a wide variety of component combinations right down to the IP address and packet level. QVISION also distinguishes itself from competitors in that it provides data in the form of graphical displays.

2 Q1 Labs - 2 QVISION does not contain specific traffic shaping capabilities; however, it has been used in corporations, universities and Internet service providers to create the roadmap of how routers, firewalls and traffic shaping tools should be used. 3. Detailed Technology Description 3.1 Network architecture QVISION consists of a console (which is the centralized data management system as well as a Flow-generator), using a light-weight technique that pulls flow data from the network in a passive mode. QVISION s flow generators are passively installed on one or more points of a network via a mirror port, span port or passive tap. All flow generators communicate back to the management console via a TCP socket communication with can be encrypted as desired. 3.2 Scalability There are three areas in which Q1 Labs claims QVISION s scales: 1) Network Capacity, 2) Data storage Capacity, 3) Operational scalability. 1) From a network capacity perspective, QVISION was designed to operate on networks of any size, from 10Mbps all the way to Multi-gigabit environments. QVISION comes in two primary forms: 10/100 Mbps as well as a gig (copper or fiber options). Other connection types such as PoS, ATM, ISL, etc are also supported. 2) From a Data Storage perspective, QVISION has been designed to handle the storing of data from 6 months to a year. 3) Operationally, QVISION has been designed to scale into any operation no matter how small and simple or large and complex the environment may be. The hierarchical design of managing QVISION can fit into any operation environment without requiring a redesign or redeployment of current resource utilization. 3.3 Protocol Identification

3 Q1 Labs - 3 QVISION provides both layer 7 analysis and port number identification allowing users to not only be alerted to misuse type applications but intentionally hidden applications such as Kazaa being hidden in http traffic. QVISION has another category to catch new applications as soon as they exist. Users can then extract signatures directly from the system or download updated signatures from Q1 Labs. 3.4 Granularity of Protocols QVISION provides total visibility of rates, number of packets, number of connected hosts and bandwidth rates being consumed. 3.5 Content identification To maintain efficiency of storing data, QVISION is not a full content capture device. It does capture the first x number of bytes of a flow. The number of bytes it captures is configurable by the user, however there is a minimum needed to detect the supported signatures (Q1 Labs recommends at least 512 bytes). In this information you can often derive the type of information being transferred. 3.6 Examination of network packets or file content QVISION looks at the complete packet header as well as the first x bytes of content in the flow. In the storage record, the user will have access to the time, protocol, direction, source and destination IP addresses- bytes, packets, ports, flags and additional tagged information such as IDS alerts. The amount of content stored and accessible is fully configurable by the user. Content capture is turned off by default. No content data is stored unless the user chooses to turn this functionality on 3.7 Distribution systems QVISION is able to monitor any TCP/IP based protocol or application. QVISION currently has a growing number of unique signatures, which encompasses a list of of the most used network applications. More specific applications will be added for monitoring purposes as they become more widely used or abused. See the RFI for a complete list. They specifically note that ORACLE and SQL will be available with the next release. In the meantime, ORACLE and SQL applications can still be detected through identified communication ports. 3.8 Resilience of the technology to countermeasures Since QVISION does Layer 7 protocol analysis, it can avoid port tunneling and other issues caused by manipulation of the standard p2p protocol. Also, since QVISION is not specifically targeted at peer-to-peer, it can capture all communication. QVISION is security software which deals with resolving not only peer-to-peer but also security and network related problems. 3.9 Testing and installed base QVISION has been functioning in commercial environments for approximately two years. For the past several releases, QVISION is tested in several dozen scenarios to ensure accuracy and performance. As a final test of the validity of the

4 Q1 Labs - 4 product, QVISION is placed on a live university network at the University of New Brunswick, where all university traffic is viewable to the system. QVISION currently operates in over 6 universities, 7 fortune 50 financial institutions and in many other Fortune 1000 environments Competitive approaches Q1Labs claims that what differentiates QVISION from its competitors is its ability to help an IT manager see at a glance a wide variety of abnormal traffic behavior so he can pinpoint the source of a problem that other products cannot easily account for. QVISION automatically alerts the administrator Third-Party Components QVISION may be offered as an appliance with all hardware, software, NIC cards, licenses, etc. included in the package. 4. Intellectual Property Q1 Labs has 4 patents pending with USPTO with 195+ IP claims in security and networking related technology. 5. Corporate Characteristics Q1 Labs Inc., a Delaware corporation, has US headquarters in Atlanta, Georgia and international headquarters in Saint John, New Brunswick Canada. Q1 Labs Inc. began operations in February Q1 Labs Canada Inc. began operations in November Q1 Labs currently has 40 employees, including company representatives in Texas, Florida, Atlanta, Washington DC, New York and Massachusetts. It has Canadian representatives in New Brunswick and Ontario. Q1 Labs Research and Development facility are in Fredericton, NB with a team of 15 programmers, technical writers and quality assurance specialists. Q1 Labs received approximately $ 3.3 million, USD in its initial round of financing led by Business Development Bank of Canada (BDC) and New Brunswick Investment Management Corporation (NBIMC). 6. Pilot Testing Q1 Labs provides some hardware with the pre-configured software at no cost for testing and evaluation prior to deployment. There is no time frame specified for this period. Clients may also choose to install the software on their own hardware. In most cases, organizations can install and configure the devices themselves; however, Q1 Labs will provide support remotely at no additional cost and possibly on site depending on location and availability. 7. Commercial Terms Customers purchase from Q1 Labs a one-time perpetual software license to acquire the rights to individual use of the software application, QVISION. The RFI response does not contain specific pricing information. It does indicate that the license fees range from that of a starter-pack solution (for a 10/100 Mbps

5 Q1 Labs - 5 environment) to deployments monitoring ISP networks. QVISION is priced according to the number of flow generators and consoles required to monitor the customer s network. Educational discounts are available for Colleges and Universities and Q1 gives volume discounts. In addition to the license fee, there is an annual maintenance fee equivalent to 20% of the list price of the perpetual license. This fee pays for updates, customer support and ongoing services. Subscription (or monthly leasing) of software license is available. Monthly fees are based on an Individual Case Basis. 8. Other Information