Sample Page

Arbor Networks was an American network-security and network-monitoring software company founded in 2000 from University of Michigan research by Farnam Jahanian and G. Robert Malan.^[1][2] Its products detected and mitigated denial-of-service attacks and network anomalies, and were deployed by a large share of the world’s internet service providers.^[3] Arbor also operated ATLAS (Active Threat Level Analysis System), a global internet-traffic monitoring platform that aggregated anonymized flow data from hundreds of participating ISPs and powered widely cited security research.^[4]

Tektronix Communications acquired Arbor Networks in 2010.^[5] NetScout Systems subsequently acquired Arbor as part of its $2.3 billion purchase of Danaher’s Communications Business, which closed in July 2015; NETSCOUT continues to sell Arbor-branded DDoS protection products.^[6][7]

Arbor Networks was incorporated in 2000 as a spinout from the University of Michigan, commercializing network-security research by Farnam Jahanian, then a professor of electrical engineering and computer science, and G. Robert Malan, a doctoral student in the same department.^[1] The underlying research had been supported by DARPA, Cisco, and Intel.^[2][8] The company was named after Ann Arbor, Michigan, where the research was conducted.^[9]

Jahanian served as Arbor’s president and chief scientist from 2001 to 2004, taking a leave of absence from Michigan before returning to his faculty position; he remained on Arbor’s board as chairman until the 2010 Tektronix acquisition.^[8][10] Malan served as co-founder and chief technology officer.^[11] Craig Labovitz joined as a founding architect, later became chief scientist, and contributed substantially to the company’s research output before leaving in 2011 to found Nokia Deepfield.^[12]

Several other early employees were later described as part of Arbor’s founding team, including Ted Julian, described in 2002 as chief strategist and co-founder,^[13] and Dug Song, who served as founding chief security architect for approximately seven years before leaving to co-found Duo Security.^[14]

The company raised $11 million in its first round of venture financing and, in August 2002, raised $22 million in Series B financing led by Thomas Weisel Venture Partners, with participation from Battery Ventures and Cisco Systems, bringing total venture funding to $33 million.^[15][16]

Arbor was initially headquartered in Chelmsford, Massachusetts. In August 2012 the company relocated its corporate headquarters to Burlington, Massachusetts.^[17]

In January 2008, Arbor acquired Ellacoya Networks, a Chelmsford-based provider of deep packet inspection products used by Tier 1 ISPs for per-subscriber traffic management.^[18][19] In September 2013, Arbor acquired Packetloop, a security-analytics firm based in Sydney, Australia.^[20]

In August 2010, Tektronix Communications, a subsidiary of Danaher Corporation, signed a definitive agreement to acquire Arbor Networks; financial terms were not disclosed.^[5][21] Local coverage described the transaction as a substantial exit for a University of Michigan technology spinout.^[1]

In October 2014, NetScout Systems agreed to acquire Danaher’s Communications Business, a transaction that included Tektronix Communications, Arbor Networks, and parts of Fluke Networks, for $2.3 billion in NetScout stock.^[6] The deal closed on July 14, 2015. NETSCOUT maintained Arbor as a distinct security sub-brand, later renaming Peakflow SP to Arbor Sightline and Pravail APS to Arbor Edge Defense.^[22]

Arbor’s service-provider product line centered on Peakflow SP (later renamed Arbor Sightline), a carrier-grade platform for DDoS detection and network-traffic visibility. The system analyzed sampled NetFlow data, SNMP metrics, and BGP routing updates to build traffic baselines and identify anomalies. When a DDoS attack was detected, traffic was rerouted via BGP off-ramp to an Arbor TMS (Threat Mitigation System) scrubbing appliance that dropped malicious packets and returned clean traffic to the network.^[23] The TMS line scaled to 400 Gbps per appliance and up to 40 Tbps in a clustered deployment.

Arbor Cloud, introduced around 2013, provided cloud-based DDoS scrubbing as a managed service from multiple worldwide scrubbing centers, reaching more than 8 Tbps of mitigation capacity by 2017.^[24]

The enterprise product line began with Pravail APS (Availability Protection System), an on-premises appliance for application-layer DDoS mitigation. It was later renamed Arbor Edge Defense (AED) after the NetScout acquisition; AED also ingested threat intelligence from the ATLAS Intelligence Feed to block non-DDoS threats such as botnet command-and-control traffic and malware callbacks.^[25]

Arbor Spectrum, launched in February 2016, was an advanced-threat platform combining ATLAS intelligence with NetFlow analysis and packet capture for investigation of lateral movement and advanced persistent threats inside enterprise networks.^[26]

Arbor launched ATLAS (Active Threat Level Analysis System) in February 2007 with approximately 30 participating ISPs, covering roughly 3 Tbps of global internet traffic.^[27] The system aggregated anonymized flow data from service-provider networks to provide a continuous, multi-ISP view of internet traffic patterns and attack activity. ATLAS 2.0, launched in March 2009, expanded participation to more than 100 ISPs including BT and Tata Communications.^[28] By 2015 the platform monitored more than 120 Tbps of internet traffic from more than 330 participating operators, representing roughly one-third of global internet traffic.^[4]

ATLAS data powered Arbor’s public-facing Digital Attack Map and the company’s biannual threat intelligence reports, and was used in peer-reviewed academic research on internet infrastructure.

In October 2009, Arbor, the University of Michigan, and Merit Network presented the ATLAS Internet Observatory Annual Report at NANOG47 in Dearborn, Michigan. The study, authored by Craig Labovitz, Scott Iekel-Johnson, and Danny McPherson of Arbor, Jon Oberheide and Farnam Jahanian of the University of Michigan, and Manoj Karir of Merit Network, analyzed more than two years of traffic data from 110 large ISPs, cable operators, and content providers, covering 256 exabytes of traffic at peaks reaching 12 Tbps.^[12] The study found that by 2009 approximately 60 percent of all internet content originated from or terminated within 100–150 large content and hosting companies, down from thousands of contributing autonomous systems in 2007, a trend the report called the rise of “internet hyper-giants.”^[29] MIT Technology Review and Wired covered the findings at the time of their release.^[29][3]

An expanded version of the research was published at ACM SIGCOMM 2010 as “Internet Inter-Domain Traffic” (Labovitz, Iekel-Johnson, McPherson, Oberheide, Jahanian).^[30] The paper later received the ACM SIGCOMM Test of Time Paper Award for its documentation of the consolidation of internet traffic driven by large content providers.

In October 2013, Arbor and Google Ideas (later renamed Jigsaw, an Alphabet subsidiary) launched the Digital Attack Map, a public live visualization of global DDoS attack activity drawn from anonymous ATLAS data.^[31] The tool was presented at a summit on conflict and the internet hosted by Google Ideas in partnership with the Council on Foreign Relations. The Museum of Modern Art included the Digital Attack Map in its “Design and Violence” online exhibition.^[31]

Arbor published the Worldwide Infrastructure Security Report (WISR) annually from 2005, surveying network operators on attack trends, mitigation practices, and security challenges. The 10th Annual WISR, released in January 2015, reported that the largest observed DDoS attack in 2014 reached 400 Gbps, compared with 8 Gbps a decade earlier, a 50-fold increase in peak attack size over the ten-year span.^[32] The WISR series continued under the NetScout name following the 2015 acquisition.

ATLAS data also documented individual attack records. In March 2018, Arbor and NetScout confirmed a memcached UDP reflection and amplification attack reaching 1.7 Tbps against a US-based service provider, the largest volumetric DDoS attack on record at the time.^[33][34]

• Farnam Jahanian
• Dug Song
• Denial-of-service attack
• NetScout Systems
• Duo Security

• NETSCOUT Arbor