DPI sensor for cyber defense


As cyber attacks against public cyberspace and national infrastructure become increasingly sophisticated, effective threat analytics require accurate and detailed input from different sources. One key source of information is the network traffic itself. The more detailed the traffic visibility available to analytics solutions, the more accurate the detection and investigation capabilities will be.



A sensor (or software probe) using Deep Packet Inspection (DPI) provides the most granular detail available, delivering a complete picture of activity in any size network. By passively capturing packets, detecting applications, parsing protocols, and extracting traffic metadata, it can significantly improve detection of attacks and raise the performance of proactive threat hunting.

The Qosmos Probe is a DPI sensor that embeds the market-leading DPI engine, Qosmos ixEngine®. It leverages years of experience in cyber defense environments and is a key component of the security technology stack for government-run Security Operations Centers (SOCs). For these sensitive environments, combining DPI information with a proprietary, confidential solution creates an additional layer of security, complementing turnkey commercial products such as IDS, which have technical capabilities that can be known by attackers.

Example of Qosmos Probe DPI Sensor in a Cyber Defense SOC


1. A rich information feed to strengthen threat analytics

  • Metadata extracted from traffic flows boosts machine learning for threat analytics platforms. This translates into more accurate alerts, shorter time-to-detection, and fewer false positives.

2. An expert tool for network forensics and threat hunting 

  • A DPI sensor streamlines investigations and improves time-to-detection for network forensics and threat hunting by capturing and storing detailed traffic information in a database where it can be rapidly and easily accessed for query and visualization.
  • In addition, the sensor provides high information resolution using a fraction of the storage required for full packet capture because it only requires traffic metadata (sender, receiver, device type, file type, etc.), discarding irrelevant content, such as video.

We use cookies to improve and personalize your browsing experience. This site may also include cookies from third parties. By using this site, you consent to the use of cookies. Read More

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.