Deep Packet Inspection inside IDS

The advanced Layer 7 (application layer) protocol detection significantly enhances the IDS/IPS capabilities beyond traditional pattern matching

Back the IDS main section

Integrating Deep Packet Inspection inside IDS transforms a traditional signature-based IDS into a comprehensive Network Detection and Response (NDR) platform.
The combination provides security teams with the deep visibility needed to detect modern threats that rely on protocol abuse, obfuscation, and legitimate application misuse—all while maintaining the performance and flexibility that IDS is known for.
In today's landscape where 80%+ of traffic is encrypted, relying solely on signature matching is insufficient.
nDPI's protocol intelligence fills this critical gap, making it an essential enhancement for any serious IDS deployment.

This feature can be enabled with IDS version 8.0.2

Comprehensive Protocol Coverage

Artica use nDPI that recognizes 430+ protocols and applications, including:

Social media (Facebook, Twitter, Instagram, TikTok)
Streaming services (Netflix, YouTube, Spotify, Twitch)
File sharing (BitTorrent, eDonkey, Dropbox)
Gaming protocols (Steam, Xbox Live, PlayStation Network)
Business applications (Office365, Salesforce, WebEx, Zoom)
Cryptocurrency mining and blockchain protocols
Messaging apps (WhatsApp, Telegram, Signal)
Cloud services (AWS, Azure, Google Cloud)

Evasion Technique Detection

Protocol Obfuscation: Detects when applications deliberately disguise their traffic
Non-Standard Ports: Identifies services running on unusual ports to bypass firewalls
Encrypted C2 Channels: Helps identify command-and-control traffic hidden in legitimate protocols
Malware Communication: Better detection of malware beaconing and data exfiltration

Improved Security Monitoring

Identify unauthorized applications on the network
Detect data exfiltration attempts via unusual protocols
Spot anomalous application behavior
Recognize zero-day exploits using protocol anomalies

Policy Enforcement

Block or alert on specific applications (e.g., P2P, social media during work hours)
Enforce bandwidth policies based on application type
Prevent shadow IT usage
Monitor compliance with acceptable use policies

Rich Metadata for SIEM Integration

When combined with IDS logging:

Application-level metadata enriches security events
Better context for incident investigation
Enhanced correlation capabilities in SIEM platforms (like Wazuh)
Improved threat hunting with protocol-specific indicators

Artica Integration

Enable Deep Packet Inspection feature

On the left menu, go to IDS > Dashboard
Click on the Deep Packet Inspection and turn the option to green

When enabled the feature add the entry ndpi key in events in posted information to SIEM(s)

  {
   "timestamp": "2025-11-10T10:30:00.000000+0000",
   "flow_id": 123456789,
   "event_type": "alert",
   "src_ip": "192.168.1.100",
   "dest_ip": "203.0.113.50",
   "proto": "TCP",
   "ndpi": {
   "protocol": "TLS.Facebook",
   "category": "SocialNetwork",
   "confidence": "DPI"
   }
  }