Startup Offers Cloud-Based Bot Detection Service

A startup headed by former IBM ISS X-Force team members has come out of stealth mode and launched a new cloud-based botnet and malware detection service. The company, ipTrust, is a new commercial subsidiary of Endgame Systems.

"Our mission is to collect and understand as much as we possibly can on the open Internet--we do a lot of botnet sinkholing and intercepting [traffic] between botnets and drones. We do a lot of work on the collection of firewall logs and IDS logs ... to associate an IP address with a security event," for example, says Daniel Ingevaldson, COO of ipTrust and the former director of technology strategy for IBM ISS.

The services employ an API, he says, that queries traffic on its IP address and other specific information. "Is the IP bot'ed with Zeus or Conficker? Is it [executing] SSH-brute force attacks? Is there anonymous Web proxying coming through it?" Ingevaldson says. "The reputation information lets me know if I should let this person log in."

The company offer ipTrust Professional, an enterprise- and service-class service, as well as ipTrust Web, a SaaS-type service that provides pure cloud-based monitoring, notification, and reporting to a company about malicious activity on its network. A free beta version of ipTrust Web is available here.

"We want to make it available to a wide audience," Ingevaldson says. "We're not putting an appliance there or an agent ... You log into the portal, sign up, and provide your IP ranges. We provide analytics and comparative scoring in their peer groups," for example, he says.

iPTrust Professional is a more comprehensive service that analyzes whether any IP address is trustworthy. It includes real-time intelligence that can be integrated with existing security systems or anti-fraud systems.

Ingevaldson says this is no blacklisting system: "Our customers are interested in better insight, monitoring user accounts associated with dangerous or risky surfing, [for instance], and making greylisting-style decisions where you don't block, but instead restrict, how much they can transfer," for example, he says.

iPTrust's API can be used to integrate the service with other applications in an enterprise, or to work as part of other managed security service vendors' offerings. "We are focused on decreasing the amount of time and energy to mate security intelligence with actual problem-solving in the enterprise," Ingevaldson says.

Endgame also announced it has secured $29 million in Series A funding from Bessemer Ventures, Columbia Capital, Kleiner Perkins Caufield & Byers (KPCB), and TechOperators.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.