Standard network intrusion detection systems (NIDS) often struggle to deal with heavy volumes of data. As the network gets busier, more and more packets get dropped and malicious activity is increasingly likely to pass unnoticed.

But Westboro, Massachusetts-based Top Layer Networks says its technology can not only improve the performance of NIDS,

but help to thwart distributed denial of service (DDoS) attacks as well.

Its flagship products are IDS Balancer and Attack Mitigator, security hardware appliances that plug straight into the network.

IDS Balancer helps overcome the problem of flooded intrusion detection devices by distributing network traffic to multiple NIDS so that no one device is ever overwhelmed. Furthermore, it ensures that all traffic from a particular communication goes to the one NIDS, so that the data can be properly analysed.

Attack Mitigator sits in front of the corporate firewall and filters incoming Internet traffic. In addition to detecting and filtering for common types of DDoS attacks, it will also bar HTTP worms such as Nimda and Code Red, although the flaw that enabled such worms to proliferate should ideally be patched.

Finally, data from intrusion detection systems can be exported from Attack Mitigator to the management console of Hewlett-Packard’s popular OpenView systems management suite. Alternatively, users can deploy Top Layer’s SecureWatch software to gather and store such data.

Top Layer was founded in 1997 and IDS Balancer – which is sold to major corporates and Internet service providers – accounts for almost two-thirds of the company’s revenues. The company says it has more than 300 customers.

Despite the hefty $95 million it has raised in venture capital financing – with the last tranche only handed over in August 2002 – it will face stiff competition from a number of vendors, particularly in the DDoS protection hardware niche.

And although its Attack Mitigator product is competitively priced, analysts have expressed some concern that it may not be so effective in organisations that have more than one path to the Internet.