Forget About the Viruses, Focus on the Bad Behavior.(The Technologist)

Byline: Karin Rives

The attack came in late September, a few weeks after a regional Swedish newspaper published cartoons by a controversial artist portraying the Prophet Muhammad as a dog. In a few days, hackers ultimately traced to IP addresses in Turkey and Canada had broken into more than 5,000 Web sites, including one featuring popular kids' cartoons, erasing some and defacing others with messages in Turkish accusing Swedes of disrespecting Muslim culture. Swedish hackers responded in October by spamming a Turkish online forum with pornographic pictures, Swedish flags and triumphant messages, such as "We have the right to draw and say whatever we want."

The incident highlighted the vulnerability of firewalls that haven't been properly maintained. Hackers, by scanning servers for vulnerabilities, are quick to locate firewalls that have security holes they know how to exploit. That's what happened with Proinet, one of several Swedish Web-hosting companies targeted in the hacker attack last month. "We had been notified by Red Hat, the manufacturer of our operating system, that there was a security hole in the core of the system," says support manager Kjetil Jensen. "They told us Sept. 27 to update the system, but we didn't get around to it right away. Three days later we got hit." With a stolen password, the hacker logged on to Proinet and erased 1,600 Web sites.

With such security breaches on the rise, companies are turning to software that doesn't need constant updating. Rather than rely on scanning programs for signatures or fingerprints of known viruses and worms, the idea is to use behavioral and cognitive science to recognize when an infiltrator is trying to do harm. These security systems inspect, in real time, all data that flow through the network and monitor them for suspicious activity. Ideally they intercept or disarm computer worms, Trojans and phishing e-mails before they strike. "It's like the guy sitting at the door to an art museum inspecting people who walk in. He doesn't have to have a picture of the bad guy, but he recognizes him when he sees him," says Yuval Ben-Itzhak, chief technology officer of San Jose, California-based Finjan.

Some security firms are building intricate user profiles based on millions of bytes of daily data traffic to catch suspicious-looking behavior. Tier-3, an Internet security firm based in ...