Symantec 10268947 User Guide - Page 21

About protocol anomaly detection

Get Symantec 10268947 - Network Security 7160 PDF manuals and user guides
UPC - 037648243766
View all Symantec 10268947 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 21 highlights

Architecture 21 About the core architecture Users can increase the detection capabilities by using Flow Alert Rules and adding user-defined signatures. Flow alert rules allow users to monitor network policy and respond to traffic to or from IP address and port combinations. User-defined signatures allow users to add network patterns to the supported set, and tune them to a specific network environment. Examples include monitoring proprietary protocols, searching for honey-tokens, or detecting disallowed application versions. Symantec Network Security can also integrate event data from third-party devices, enabling you to combine existing intrusion detection products with Symantec Network Security's high speed and zero-day attack detection capabilities. This section describes the layers of the detection model: ■ About protocol anomaly detection ■ About Symantec signatures ■ About user-defined signatures ■ Monitoring traffic rate ■ About DoS detection ■ About external EDP About protocol anomaly detection Symantec Network Security's Protocol Anomaly Detection (PAD) is a form of anomaly detection. PAD detects threats by noting deviations from expected activity, rather than known forms of misuse. Anomaly detection looks for expected or acceptable traffic, and alerts when it does not see it. This is the compliment of a signature-based approach, which looks for abnormal, unexpected, or unacceptable traffic. Symantec Network Security provides in-depth models of the most frequently used network protocols, providing extensive detection capability that goes beyond simpler forms of protocol analysis. These models provide much deeper detection and fewer false positives because they are able to follow a client-server exchange throughout the life of the connection. For example, if a protocol defines the size of a field, and Symantec Network Security detects a field that breaches the defined size, it will trigger an alert. Symantec Network Security has overcome the issue of overly generic alerts, which is one of the major issues surrounding PAD. During a zero-day attack, a general PAD alert is often all that is possible. However, soon after a new threat is discovered, it is often identified by a name and assigned a unique identifier by authorities. These organizations publish descriptions of the threat and provide

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
21
Architecture
About the core architecture
Users can increase the detection capabilities by using Flow Alert Rules and
adding user-defined signatures. Flow alert rules allow users to monitor network
policy and respond to traffic to or from IP address and port combinations.
User-defined signatures allow users to add network patterns to the supported
set, and tune them to a specific network environment. Examples include
monitoring proprietary protocols, searching for honey-tokens, or detecting
disallowed application versions.
Symantec Network Security can also integrate event data from third-party
devices, enabling you to combine existing intrusion detection products with
Symantec Network Security’s high speed and zero-day attack detection
capabilities.
This section describes the layers of the detection model:
■
About protocol anomaly detection
■
About Symantec signatures
■
About user-defined signatures
■
Monitoring traffic rate
■
About DoS detection
■
About external EDP
About protocol anomaly detection
Symantec Network Security's Protocol Anomaly Detection (PAD) is a form of
anomaly detection. PAD detects threats by noting deviations from expected
activity, rather than known forms of misuse. Anomaly detection looks for
expected or acceptable traffic, and alerts when it does not see it. This is the
compliment of a signature-based approach, which looks for abnormal,
unexpected, or unacceptable traffic.
Symantec Network Security provides in-depth models of the most frequently
used network protocols, providing extensive detection capability that goes
beyond simpler forms of protocol analysis. These models provide much deeper
detection and fewer false positives because they are able to follow a client-server
exchange throughout the life of the connection. For example, if a protocol
defines the size of a field, and Symantec Network Security detects a field that
breaches the defined size, it will trigger an alert.
Symantec Network Security has overcome the issue of overly generic alerts,
which is one of the major issues surrounding PAD. During a zero-day attack, a
general PAD alert is often all that is possible. However, soon after a new threat is
discovered, it is often identified by a name and assigned a unique identifier by
authorities. These organizations publish descriptions of the threat and provide