Integrating Deep Packet Inspection inside IDS transforms a traditional signature-based IDS into a comprehensive Network Detection and Response (NDR) platform.
The combination provides security teams with the deep visibility needed to detect modern threats that rely on protocol abuse, obfuscation, and legitimate application misuse—all while maintaining the performance and flexibility that IDS is known for.
In today's landscape where 80%+ of traffic is encrypted, relying solely on signature matching is insufficient.
nDPI's protocol intelligence fills this critical gap, making it an essential enhancement for any serious IDS deployment.This feature can be enabled with IDS version 8.0.2
¶ Comprehensive Protocol Coverage
Artica use nDPI that recognizes 430+ protocols and applications, including:
- Social media (Facebook, Twitter, Instagram, TikTok)
- Streaming services (Netflix, YouTube, Spotify, Twitch)
- File sharing (BitTorrent, eDonkey, Dropbox)
- Gaming protocols (Steam, Xbox Live, PlayStation Network)
- Business applications (Office365, Salesforce, WebEx, Zoom)
- Cryptocurrency mining and blockchain protocols
- Messaging apps (WhatsApp, Telegram, Signal)
- Cloud services (AWS, Azure, Google Cloud)
¶ Evasion Technique Detection
- Protocol Obfuscation: Detects when applications deliberately disguise their traffic
- Non-Standard Ports: Identifies services running on unusual ports to bypass firewalls
- Encrypted C2 Channels: Helps identify command-and-control traffic hidden in legitimate protocols
- Malware Communication: Better detection of malware beaconing and data exfiltration
¶ Improved Security Monitoring
- Identify unauthorized applications on the network
- Detect data exfiltration attempts via unusual protocols
- Spot anomalous application behavior
- Recognize zero-day exploits using protocol anomalies
¶ Policy Enforcement
- Block or alert on specific applications (e.g., P2P, social media during work hours)
- Enforce bandwidth policies based on application type
- Prevent shadow IT usage
- Monitor compliance with acceptable use policies
¶ Rich Metadata for SIEM Integration
When combined with IDS logging:
- Application-level metadata enriches security events
- Better context for incident investigation
- Enhanced correlation capabilities in SIEM platforms (like Wazuh)
- Improved threat hunting with protocol-specific indicators
¶ Artica Integration
Enable Deep Packet Inspection feature
- On the left menu, go to
IDS > Dashboard - Click on the Deep Packet Inspection and turn the option to green
When enabled the feature add the entry ndpi key in events in posted information to SIEM(s)
{ "timestamp": "2025-11-10T10:30:00.000000+0000", "flow_id": 123456789, "event_type": "alert", "src_ip": "192.168.1.100", "dest_ip": "203.0.113.50", "proto": "TCP", "ndpi": { "protocol": "TLS.Facebook", "category": "SocialNetwork", "confidence": "DPI" } }