Symantec 10268947 User Guide - Page 88

the network, independent of the exploit tool. This results in earlier prevention

Get Symantec 10268947 - Network Security 7160 PDF manuals and user guides
UPC - 037648243766
View all Symantec 10268947 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 88 highlights

88 Detection Methods About signature detection About Symantec signatures Symantec Network Security uses network pattern matching, or signatures, to provide a powerful layer of detection. Signature detection involves detecting threats by looking for a specific pattern or fingerprint of a known bad or harmful thing. This known-bad pattern is called a signature. These patterns are traditionally based on the observed network behavior of a specific tool or tools. Signature detection operates on the basic premise that each threat has some observable property that can be used to uniquely identify it. This can be based on any property of the particular network packet or packets that carry the threat. In some cases, this may be a literal string of characters found in one packet, or it may be a known sequence of packets that are seen together. In any case, every packet is compared against the pattern. Matches trigger an alert, while failure to match is processed as non-threatening traffic. Symantec Network Security uses signatures as a compliment to PAD. The combination provides robust detection without the weaknesses of either PAD alone or signatures alone. Symantec Network Security's high performance is maintained by matching against the smallest set of signatures as is possible given the current context. Since many threats are detected and refined through the PAD functionality, Symantec Network Security minimizes the set of required signatures to maximize performance. Symantec Network Security also uses methods of rapid response in creating signatures that detect attempts to exploit new vulnerabilities as soon as they hit the network, independent of the exploit tool. This results in earlier prevention of threats and more complete coverage. About user-defined signatures The Network Security console provides a way to configure and enable additional user-defined signatures on a per-sensor basis, as well as global signature variables, such as creating the variable name port to stand for a value of 2600. User-defined signatures are synchronized across clusters so that each node has the title, severity, and definition of the user-defined signature. SuperUsers can create, define, edit, and delete user-defined signatures. All users can view them. Note: Both StandardUsers and RestrictedUsers can view user-defined signatures, but cannot add, edit, or delete them.

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
88
Detection Methods
About signature detection
About Symantec signatures
Symantec Network Security uses network pattern matching, or signatures, to
provide a powerful layer of detection. Signature detection involves detecting
threats by looking for a specific pattern or fingerprint of a known bad or
harmful thing. This known-bad pattern is called a signature. These patterns are
traditionally based on the observed network behavior of a specific tool or tools.
Signature detection operates on the basic premise that each threat has some
observable property that can be used to uniquely identify it. This can be based
on any property of the particular network packet or packets that carry the
threat. In some cases, this may be a literal string of characters found in one
packet, or it may be a known sequence of packets that are seen together. In any
case, every packet is compared against the pattern. Matches trigger an alert,
while failure to match is processed as non-threatening traffic.
Symantec Network Security uses signatures as a compliment to PAD. The
combination provides robust detection without the weaknesses of either PAD
alone or signatures alone. Symantec Network Security's high performance is
maintained by matching against the smallest set of signatures as is possible
given the current context. Since many threats are detected and refined through
the PAD functionality, Symantec Network Security minimizes the set of
required signatures to maximize performance.
Symantec Network Security also uses methods of rapid response in creating
signatures that detect attempts to exploit new vulnerabilities as soon as they hit
the network, independent of the exploit tool. This results in earlier prevention
of threats and more complete coverage.
About user-defined signatures
The Network Security console provides a way to configure and enable additional
user-defined signatures on a per-sensor basis, as well as global signature
variables, such as creating the variable name
port
to stand for a value of 2600.
User-defined signatures are synchronized across clusters so that each node has
the title, severity, and definition of the user-defined signature. SuperUsers can
create, define, edit, and delete user-defined signatures. All users can view them.
Note:
Both StandardUsers and RestrictedUsers can view user-defined
signatures, but cannot add, edit, or delete them.