Roskomnadzor to Pilot Intrusion Detection System Built on National DDoS Protection Platform

The new intrusion detection tool will be built on Russia’s National System for Protection Against DDoS Attacks, which has been operating since 2024. According to Vladislav Smirnov, director of the Center for Monitoring and Management of the Public Communications Network, the tool will analyze traffic to resources protected by the system and identify signs that their infrastructure has been compromised. Owners of those resources will be able to access personal dashboards with attack data and tools for managing their defenses.

The agency is also developing DNS analytics. It plans to compile databases of malicious and suspicious domains and the IP addresses associated with them. According to Smirnov, data from the National Domain Name System will help identify phishing campaigns and command-and-control channels used by malware.

Smirnov also highlighted emerging threats involving large language models and AI agents. These tools can dramatically accelerate reconnaissance of IT infrastructure and quickly identify even subtle misconfigurations. This makes proactive perimeter monitoring, timely vulnerability remediation and the rapid detection and disruption of such activity increasingly important.