Fact-checked by Grok 2 weeks ago

Arbor Networks

Arbor Networks is an American cybersecurity company specializing in the detection, mitigation, and prevention of distributed denial-of-service (DDoS) attacks and advanced network threats, providing visibility and security solutions for enterprise, service provider, and cloud networks.^[1]^[2] Founded in 2000 by Farnam Jahanian, a professor at the University of Michigan, and Robert Malan, a graduate student, Arbor Networks originated from research on large-scale network monitoring and security conducted at the university in Ann Arbor, Michigan.^[3]^[4] Initially backed by investors including DARPA, Cisco, and Intel, the company developed early products like Peakflow for network traffic analysis and the Threat Mitigation System for DDoS protection, establishing itself as a leader in securing complex global networks.^[3] Headquartered in Burlington, Massachusetts, Arbor Networks grew to serve over 550 customers worldwide, offering visibility into up to 800 terabits per second (Tbps) of traffic—covering approximately 50% of the world's internet—and operating in more than 200 countries and 375 industry verticals.^[1]^[2]^[5] In 2015, Arbor Networks was acquired by NETSCOUT Systems as part of a larger transaction involving Danaher Corporation's communications business unit, integrating its DDoS expertise with NETSCOUT's network performance and observability technologies.^[6]^[7] Today, under NETSCOUT, Arbor's portfolio includes the Arbor DDoS Protection platforms for service providers and enterprises, Arbor Cloud for managed DDoS services, and the ATLAS and ASERT global threat intelligence feeds, which have been recognized for leadership in DDoS mitigation by independent analysts.^[1]^[8]

History

Founding

Arbor Networks was founded in 2000 by University of Michigan professor Farnam Jahanian and his doctoral student Rob Malan, who spun out research on network security from the university.^[9]^[10] The founding team was joined by industry veterans Ted Julian, who served as chief strategist, and Dug Song, who served as chief security architect, bringing expertise in cybersecurity and entrepreneurship.^[11]^[12] The company established its initial headquarters in Burlington, Massachusetts, USA, positioning itself near key technology hubs to attract talent and partners.^[2] This location supported the firm's early operations focused on developing software solutions for detecting and mitigating denial-of-service (DoS) attacks and other network threats.^[3] Arbor Networks' creation was motivated by the escalating internet threats of the late 1990s, including high-profile DDoS attacks that exposed vulnerabilities in global networks and disrupted online services.^[3] The founders drew on DARPA-sponsored research from the University of Michigan to pioneer proactive defenses, addressing a problem that was not yet widely understood but critically needed scalable solutions.^[13]

Early Development and Funding

Following its founding in 2000, Arbor Networks concentrated its early efforts on developing network monitoring tools designed to detect and mitigate denial-of-service (DoS) attacks, leveraging innovations in traffic analysis such as NetFlow technology. The company's flagship product, Peakflow, emerged as a key solution for identifying network anomalies and DoS threats in real time, enabling service providers to maintain operational continuity during early internet-scale attacks. This focus addressed the growing prevalence of distributed DoS (DDoS) incidents, positioning Arbor as a pioneer in out-of-band detection methods that avoided disrupting legitimate traffic.^[14]^[15] To fuel this product development and expansion, Arbor Networks secured significant venture capital funding in the early 2000s. In August 2002, the company raised $22 million in an oversubscribed Series B round led by Thomas Weisel Venture Partners, with participation from existing investors Battery Ventures and Cisco Systems, as well as new strategic backers including Comcast Interactive Capital. This infusion brought Arbor's total funding to $33 million at the time, supporting enhancements to its Peakflow platform and scaling sales efforts toward internet service providers (ISPs). No additional major funding rounds occurred through 2008, allowing the company to prioritize internal growth and market penetration.^[15]^[16]^[17] By the mid-2000s, Arbor Networks had established itself as a leading provider of network protection solutions for ISPs, with its tools deployed across a substantial portion of global backbone networks to counter escalating DoS threats. A 2006 survey conducted by Arbor involving 55 ISPs across North America, Europe, and Asia highlighted the rising scale of multi-gigabit attacks and underscored the company's role in enabling effective defenses, solidifying its reputation through widespread adoption among carriers. This early leadership in ISP security laid the groundwork for broader industry influence in threat intelligence and mitigation.^[18]^[3]

Key Milestones

In March 2009, Arbor Networks launched ATLAS 2.0, an enhanced global threat monitoring system developed in collaboration with over 100 Internet service providers (ISPs) worldwide, including British Telecom, Nextgen Networks, and Tata Communications, to collect and analyze real-time data on Internet traffic, routing, and application performance exceeding 3 terabits per second.^[19] This initiative expanded beyond DDoS attack detection to provide ISPs with actionable business intelligence for network planning and peer-to-peer traffic management.^[19] Following the integration of advanced traffic management technologies in 2008, Arbor Networks broadened its offerings into broadband traffic management solutions, such as the eSeries platform, enabling ISPs to optimize bandwidth allocation and handle surging data demands in the post-broadband expansion era. By the 2010s, Arbor Networks' security solutions had achieved widespread adoption, securing over 90% of the world's Tier 1 ISPs and supporting more than 1,200 customers across 107 countries in mitigating DDoS threats and ensuring network availability.^[20] In 2010, Arbor Networks was acquired by Tektronix Communications, and in 2015, it became part of NETSCOUT Systems as part of Danaher Corporation's divestiture of its communications business unit, integrating its DDoS expertise with NETSCOUT's network performance technologies.^[6]^[7] In 2025, Arbor Networks marked its 25th anniversary, celebrating its foundational role in DDoS protection innovation, from DARPA-backed research origins to AI-driven defenses that now safeguard the majority of global ISP networks against evolving cyber threats.^[3]

Products and Technologies

Core Security Solutions

Arbor Networks' core security solutions center on a suite of products designed to provide network operators with robust protection against distributed denial-of-service (DDoS) attacks and other cyber threats. These solutions emphasize real-time traffic analysis, anomaly detection, and automated mitigation to ensure network availability and performance. Initially developed as on-premises hardware and software platforms, the offerings have evolved under NetScout Systems—following the 2015 acquisition—to include cloud-integrated options that enhance scalability and deployment flexibility. In 2025, NETSCOUT further innovated these solutions with advanced AI and machine learning enhancements, particularly in adaptive DDoS protection for products like Arbor Edge Defense.^[3]^[21] The foundational product for traffic analysis and anomaly detection is Peakflow, which provides comprehensive visibility into network traffic patterns to identify deviations indicative of threats such as DDoS attacks, botnets, and worms. Peakflow employs flow-based monitoring technologies like NetFlow, sFlow, and IPFIX to deliver real-time insights, enabling proactive detection of volumetric floods, application-layer exploits, and unusual traffic behaviors without disrupting legitimate flows. This platform targets internet service providers (ISPs), large enterprises, and government networks, where high-volume traffic demands precise anomaly baselining and alerting. Over time, Peakflow has transitioned into Arbor Sightline, the current iteration that incorporates AI and machine learning for enhanced threat detection and capacity planning, offering a unified dashboard for geographic and customer-specific reporting.^[22]^[22] For direct threat mitigation, Arbor Networks offers the Threat Mitigation System (TMS), a series of appliances that surgically block malicious traffic while preserving legitimate communications. TMS supports mitigation capacities up to 500 Gbps per unit, scalable to 50 Tbps in clustered deployments, and handles diverse attack vectors including TCP state exhaustion, IoT-based assaults, and multi-vector DDoS campaigns through adaptive filtering and behavioral analysis. Key features include automated response orchestration, integration with detection tools for seamless handoff, and support for both physical and virtual environments to protect edge and core network segments. Primarily deployed by ISPs, cloud providers, and enterprises, TMS ensures rapid recovery from attacks, often within seconds, minimizing downtime for critical infrastructure.^[23]^[23] These solutions collectively address the need for end-to-end network protection, with Peakflow/Sightline focusing on visibility and early warning, and TMS on active defense. Brief integration with the ATLAS system provides enriched context from global threat data to refine detection accuracy. The shift toward cloud options under NetScout has expanded accessibility, allowing hybrid deployments that combine on-premises resilience with elastic scaling for dynamic threat landscapes.^[24]

ATLAS Threat Intelligence System

The Active Threat Level Analysis System (ATLAS) is a global threat monitoring platform developed by Arbor Networks, now part of NETSCOUT, designed to collect and analyze anonymized internet traffic data for identifying emerging cybersecurity threats. Launched in 2009 in collaboration with over 100 initial Internet Service Providers (ISPs), ATLAS expanded through ongoing ISP partnerships to enhance its data-sharing network, enabling broader visibility into worldwide network activities.^[3]^[25] ATLAS operates through a distributed architecture that aggregates anonymized traffic data from global networks, utilizing sensors embedded in participating ISP and enterprise infrastructures to capture real-time telemetry without compromising user privacy. Key components include data collection pipelines that ingest traffic flows, advanced analytics engines for pattern recognition—particularly for distributed denial-of-service (DDoS) attacks, botnets, and malware propagation—and a centralized processing system that correlates insights across datasets. This setup allows ATLAS to detect anomalies such as unusual traffic spikes or attack vectors by examining packet headers, flow statistics, and behavioral indicators from diverse sources.^[26]^[27] At scale, ATLAS monitors over 800 Tbps of internet traffic in real-time, drawn from more than 500 ISPs and 3,000 enterprise sites across 125+ countries, representing up to 50% of global internet traffic and covering two-thirds of the routable IP address space. This vast dataset equates to processing petabytes of data daily, with hundreds of sensors worldwide contributing to the network's observational capacity. The system's reach into 125+ countries, 600+ industry verticals, and over 31,000 Autonomous System Numbers (ASNs) provides a comprehensive view of threat landscapes.^[26]^[28] In applications, ATLAS generates threat intelligence reports that detail attack trends, sources, and mitigation strategies, while offering predictive analytics to forecast evolving threats like DDoS campaign shifts based on historical and real-time patterns. These outputs, including bi-annual reports and feeds like the ATLAS Intelligence Feed (AIF), support proactive defenses by integrating insights into security tools for automated responses. For instance, it tracks tens of millions of attacks annually, enabling organizations to anticipate and counter sophisticated threats through data-driven foresight.^[26]^[29]

Acquisitions and Ownership

Companies Acquired by Arbor Networks

Arbor Networks expanded its capabilities in network security and management through strategic acquisitions, notably targeting technologies that complemented its core offerings in traffic analysis and threat mitigation. In January 2008, Arbor Networks announced the acquisition of Ellacoya Networks, a provider of carrier-class broadband service optimization solutions, with the deal completed in February 2008.^[30] This move integrated Ellacoya's deep packet inspection (DPI) and traffic shaping technologies, enabling Arbor to address growing demands for bandwidth management among broadband service providers.^[31] The acquisition enhanced Arbor's portfolio by combining Ellacoya's service optimization tools with its existing security platforms, facilitating more comprehensive traffic visibility and control for enterprise and service provider networks.^[32] In September 2013, Arbor Networks acquired Packetloop, an Australian-based innovator in security analytics focused on big data processing for network threat detection.^[33] Packetloop's platform specialized in real-time analysis of network packet captures to identify anomalies, advanced persistent threats, and misuse patterns, complementing Arbor's NetFlow-based visibility and anomaly detection capabilities.^[34] Following the integration, Packetloop's technology was incorporated into Arbor's Peakflow SP security platform, bolstering advanced analytics for proactive threat hunting and incident response.^[35] These acquisitions significantly strengthened Arbor Networks' product ecosystem, particularly in traffic management and security analytics, by merging specialized technologies that improved overall network performance monitoring and defense against sophisticated attacks.^[36] The integrations allowed Arbor to deliver unified solutions that combined optimization, visibility, and intelligence, supporting its growth in serving global service providers and enterprises.^[37]

Ownership Transitions

Arbor Networks was acquired by Tektronix Communications, a subsidiary of Danaher Corporation, on August 31, 2010.^[38] This transaction integrated Arbor into Danaher's portfolio of communications and enterprise companies, allowing it to operate as an independent subsidiary while benefiting from broader corporate resources.^[38] In 2015, as part of Danaher's divestiture of its communications business, NetScout Systems completed the acquisition of Arbor Networks on July 14.^[39] The deal, valued at approximately $2.6 billion based on NetScout's stock price at announcement, combined Arbor with other Danaher entities including Tektronix Communications and parts of Fluke Networks to form a larger entity focused on network performance and cybersecurity.^[7] This merger shifted Arbor from an independent operation under Danaher to an integrated component of NetScout, enhancing its scale through combined technologies and market reach.^[39] Since the 2015 acquisition, Arbor Networks has operated as the security division of NetScout Systems, continuing to develop and innovate in DDoS protection and threat intelligence solutions.^[1] This integration has provided expanded resources for research and development, enabling Arbor's technologies to support a wider range of enterprise and service provider customers globally.^[3]

References

[1]
Arbor DDoS Detection & Defense - Netscout
NETSCOUT/Arbor DDoS is the most powerful DDoS detector on the market. Identify, mitigate, and defend against DDoS attacks with powerful protection.Arbor Threat Mitigation System · Arbor Sightline · Arbor Insight · Arbor Cloud
[2]
Arbor Networks - Crunchbase Company Profile & Funding
Company Description. Arbor Networks secures the world's most demanding and complex networks from DDoS attacks and advanced threats. Solutions Overview.
[3]
25 Years of Arbor (Networks) Innovation & DDoS Protection
Sep 16, 2025 · Arbor Networks then released its own DDoS attack mitigation product, called the Threat Mitigation System (TMS), to complement Peakflow SP's DDoS ...
[4]
A Primer on Ann Arbor's Tech History
Aug 24, 2018 · In 2000, Arbor Networks was born when co-founders Farnam Jahanian and Rob Malan spun the company out of the University of Michigan. The ...
[5]
Arbor Networks's Competitors, Revenue, Number of Employees ...
Arbor Networks was founded in 2000. Arbor Networks' headquarters is located in Burlington, Massachusetts, USA 01803. Arbor Networks has an estima...
[6]
NetScout Systems To Acquire Danaher's Communications Arm ...
Oct 17, 2014 · The acquisition, expected to close in 2015, will give NetScout full ownership of Danaher's communications business, which, in addition to Arbor ...
[7]
Danaher And NetScout Systems Announce Business Combination
Oct 13, 2014 · - Danaher plans to merge its Communications business (including Tektronix Communications, Arbor Networks, and Fluke Networks) with NetScout in a ...
[8]
https://www.netscout.com/reports/spark-matrix-ddos-mitigation
[9]
University of Michigan spinoff Arbor Networks sold to Tektronix ...
Aug 9, 2010 · Arbor Networks, founded by U-M engineering professor Farnam Jahanian and then-doctoral student Rob Malan in 2000, is a major source of network ...<|control11|><|separator|>
[10]
Duo of CSE Alums Form and Grow Security Company in Ann Arbor
Aug 12, 2012 · ... Arbor. The company joins security industry heavyweights Arbor Networks – co-founded by Prof. Farnam Jahanian and G. Robert Malan (MSE PhD ...
[11]
Dug Song - Crain's Detroit Business
Dug Song. Founder, CEO. Duo Security Inc. Duo Security, which ... In 2000 he was one of five self-proclaimed geeks and hackers who co-founded Arbor Networks ...<|separator|>
[12]
Devo Adds Security Industry Trailblazer Ted Julian to Accelerate ...
Jan 21, 2021 · (acquired by Trustwave), and cofounded and was on the executive teams of Arbor Networks (acquired by Danaher) and @Stake (acquired by Symantec).Missing: founder | Show results with:founder
[13]
Carnegie Mellon makes network security guru Jahanian president
Mar 8, 2018 · Carnegie Mellon University has named computer science professor and Arbor Networks founder Farnam Jahanian as its new president.
[14]
DDoS: Evolving Threats, Solutions - BankInfoSecurity
MORALES: Arbor has been doing DDoS basically since it was founded in the year 2000. We're a pioneer in using NetFlow technology to detect those statistical ...Characteristics Of Recent... · Gaps In Perimeter Defense · Arbor's Ddos Detection &...
[15]
Arbor Scores $22M - Light Reading
Arbor Scores $22M. Arbor Networks' oversubscribed series B funding round was led by Thomas Weisel Venture Partners; Arbor names Thomas Arthur CEO.<|control11|><|separator|>
[16]
Network security firm raises $22 million - CNET
Aug 5, 2002 · Arbor Networks has now raised a total of $33 million. The company, based in Lexington, Mass., also said it has hired Thomas Arthur as its new ...Missing: 2002-2008 | Show results with:2002-2008
[17]
https://www.wsj.com/articles/SB1028561431690872280
[18]
Massive DoS Attacks Against ISPs On the Rise - CRN
Sep 12, 2006 · According to the Arbor poll of 55 ISPs in North America, Europe, and Asia, multi-gigabit, supra-backbone DoS attacks are on the upswing.
[19]
Arbor Networks bolsters Internet monitoring system - InfoWorld
Atlas 2.0 culls data from more than 100 ISPs, monitoring and collecting real-time data for global Internet traffic, routing, and application ...
[20]
Arbor Networks Upgrades DDoS Detection and Mitigation Platform
Jun 8, 2017 · The new release, Arbor APS v5.11, is designed to help organizations manage multiple APS devices and reduce the time to attack mitigation.<|control11|><|separator|>
[21]
Arbor Sightline DDoS Attack Detection Solution - NetScout Systems
Arbor Sightline is a DDoS attack detection solution that provides robust capabilities from network-wide capacity planning, to identifying and managing the ...
[22]
Arbor Threat Mitigation System for DDoS Attacks | NETSCOUT
Features. Arbor Threat Mitigation System surgically removes up to 50Tbps of DDoS attack traffic in a single deployment, while enabling the flow of legitimate ...
[23]
Adaptive DDoS Protection Solutions - NetScout Systems
Powerful DDoS protection solutions are here with NETSCOUT/Arbor. Our adaptive DDoS attack mitigation protects networks of all sizes from dynamic attacks.Ai-And Ml-Powered Ddos... · World's Broadest View Of The... · Industry-Leading Ddos...
[24]
Arbor Networks ATLAS(R) Threat Monitoring System Turns Six ...
Feb 25, 2013 · "Since 2009, we've seen a 3X increase in the number of participants and a 14X increase in the amount of Internet traffic monitored, totaling 43 ...
[25]
NETSCOUT Real-Time Advanced Threat Intelligence
NETSCOUT's bi-annual Threat Intelligence Report offers statistics and unique insight into worldwide DDoS attack activity.
[26]
Introducing NETSCOUT's Threat Intelligence Report
Aug 7, 2018 · NETSCOUT's Arbor Active Threat Level Analysis System (ATLAS®) has actively monitored the global internet threat landscape since 2007.
[27]
DDoS Threat Intelligence Report - NetScout Systems
NETSCOUT's ATLAS platform has visibility into an average of 401 Tbps of internet traffic, a staggering aggregate average of 34.6 exabits per day and greater ...
[28]
NETSCOUT DDoS Threat Intelligence Report
Vertical industry DDoS attack data and regional cyber threat activity for the US, UK, Brazil, France, Germany, Japan, Latin America, EMEA and more.
[29]
Arbor Networks purchases Ellacoya - Network World
Jan 17, 2008 · Arbor CEO says his company will benefit from Ellacoya's extensive DPI product set. ... In an effort to meet increased demand for traffic and ...Missing: details | Show results with:details<|control11|><|separator|>
[30]
Arbor Networks buys networking company Ellacoya - Computerworld
Jan 17, 2008 · The acquisition allows Arbor to take advantage of an increased focus on traffic and service management by broadband providers, the company said.
[31]
Arbor Networks To Merge With Ellacoya - CRN
Jan 18, 2008 · In acquiring Ellacoya, Arbor execs say that they are fulfilling a company mission by implementing a three-fold growth strategy that includes ...
[32]
Arbor Networks Buys Security Analytics Startup Packetloop
Sep 3, 2013 · Arbor Networks said Tuesday that it has acquired Packetloop, a Sydney, Australia-based startup focused on security analytics.Missing: details | Show results with:details
[33]
Arbor Networks Acquires Security Analytics Company, Packetloop
Packetloop's capabilities complement Arbor's market leading NetFlow visibility, anomaly detection, application intelligence and identity tracking. Arbor will ...
[34]
Arbor Networks acquires security analytics innovator Packetloop
Sep 3, 2013 · Global network security firm Arbor Networks Inc. has acquired privately-held Packetloop – an innovator and leader in the field of security ( ...
[35]
Arbor Networks - M&A Summary, Ownership, and Business Overview
Arbor Networks has acquired 2 companies of its own. Arbor Networks has acquired in 1 US state, and 2 countries. The Company's most targeted sectors include ...
[36]
Arbor Networks Acquires Ellacoya - Dark Reading
It has signed a definitive agreement to acquire Ellacoya Networks, a leading provider of carrier-class broadband service optimization solutions.Missing: details | Show results with:details
[37]
Tektronix Communications Completes Acquisition of Arbor Networks
Aug 31, 2010 · The terms of the acquisition are not disclosed. Upon completion of the acquisition, Arbor Networks joins Danaher's portfolio of communications ...
[38]
NETSCOUT Systems Completes Acquisition of Danaher's ...
NETSCOUT Systems Completes Acquisition of Danaher's Communications Business. July 14, 2015 ... press release or with respect to the announcements described herein ...