Since indexes for anomaly detection are diverse, different baselines must be adopted in the traffic analysis system for comparison, to ensure the accuracy of traffic detection. The NSFOCUS NTA uses two baseline algorithms. It employs a periodic baseline used to check the traffic index - such as total traffic on a given port, total traffic of an application and traffic tendency of an IP address group.  It also uses a portable window baseline used to check the traffic index that remains more consistent.  These two methods provide network operators and application managers with a clear picture of the resources being used, and how best to shape the traffic to meet external and internal customer needs.  It also gives them a reliable indicator of when traffic slips outside of expected norms, which could be an advance indication of an attack or misuse.

NSFOCUS’s NTA not only provides a good picture of how the network is behaving, it is also designed with a rich set of tools for catching both known threats and "zero-day" attacks -  configurable up to 17 categories of detection indexes. Each corresponds to a detection algorithm. These indexes cover the detection of all anomaly traffic on a network.

NSFOCUS’s NTA calculation engine adopts a “frame plus” plug-in that ensures the flexibility and effectiveness of the system. Each plug-in corresponds to one or more detection algorithms. Administrators can choose the most appropriate plug-in to upload according to the network structure and service features. In addition, the system provides some predefined plug-in templates for different types of typical use cases, making setup and operation easy. For example, the operation and maintenance of a backbone network allows for less attention paid to the application layer; however, the situation may be just the opposite for content delivery providers. This flexibility provides configurable detection for any operation, and may be changed easily if the network, or services offered over the network, changes over time.

With high performance hardware and optimized underlying algorithms, NSFOCUS’s NTA has the capability of processing more than 80,000 transactions per second, satisfying the high-end requirements for traffic analysis at even the most extreme networks, such as those required by  telecommunications and e-commerce firms.

Getting the system online is simple. During configuration, analysts only need to provide a list of IP address segments as options in from the route table; no manual addressing is required. Maintenance personnel can simply choose which IP address segments will be monitored from the list. Other similar automatic processes are also built-in to help with initial configuration, and ongoing fine-tuning is just as easy.