Flame Threat Detection System

TopFLAME integrates multiple rule libraries, including threat intelligence libraries, advanced threat libraries, botnet host rule libraries, attack detection rule libraries, and asset identification libraries. These ten dimensions do not exist in isolation but are interwoven and operate synergistically, forming a rigorous detection matrix that enables comprehensive monitoring of network threats.

The system supports AI assistant capabilities, enabling AI-based analysis of massive environmental data and intelligent AI interaction. Utilizing NLP algorithms and embedding model technologies, it semantically interprets user inquiries. Through interactive dialogue, it intelligently analyzes user intent and provides rapid graphical and textual responses to user needs. When security personnel query data, they can input natural language to quickly obtain answers to current issues, significantly simplifying manual operations and empowering security analysis through the integration of data and intelligence.

The Topsec Flame Threat Detection System conducts in-depth analysis of logs and sample data related to security incidents such as attack behaviors, malicious program transmissions, abnormal traffic, and data leaks, examining them from multiple perspectives including the attacker, victim, and data breach. Key information such as network attack distribution, risk levels, attack paths, and virus propagation trajectories is visually presented in chart formats, empowering security personnel to quickly grasp the network landscape and respond effectively to security threats.

The Flame system leverages an advanced threat library that integrates the long-term practical experience of professional security service personnel and continuously optimizes its rules based on real-world attack scenarios. This threat library covers eight major categories, including APTs, HTTP anomalies, malware, command and control, and lateral movement, significantly enhancing the efficiency and accuracy of threat detection.

The system employs a combination of active scanning and passive discovery to comprehensively map online assets within the network. The types of assets scanned and discovered include database assets, web application assets, and various IT hardware assets, among others. These two asset discovery methods—active scanning and passive traffic analysis—work synergistically. This approach generates a detailed and accurate network asset inventory, providing robust support for a thorough understanding of the network asset landscape and helping users better manage and maintain network resources.

Traditional security detection relies on auditing traffic via bypass mirroring. However, as traffic within cloud platforms is often difficult to mirror to security devices, addressing the increasingly complex cloud environment requires adaptive measures. In addition to auditing traffic by installing agents on application servers for traffic redirection, the Flame system also features a reverse proxy capability. By leveraging built-in reverse proxy policies, it captures operational traffic between clients and cloud servers, enabling the detection of traffic-based threats within cloud platforms.