Cisco Systems IPS4510K9 manual Anomaly Detection Signatures

Chapter 9 Configuring Anomaly Detection

Anomaly Detection Signatures

•For more information on configuring anomaly detection signatures, see Anomaly Detection Signatures, page 9-6.

•For more information on Deny Attacker event actions, see Event Actions, page 8-4.

Anomaly Detection Signatures

The Traffic Anomaly engine contains nine anomaly detection signatures covering three protocols (TCP, UDP, and other). Each signature has two subsignatures, one for the scanner and the other for the worm-infected host (or a scanner under worm attack). When anomaly detection discovers an anomaly, it triggers an alert for these signatures. All anomaly detection signatures are enabled by default and the alert severity for each one is set to high.

When a scanner is detected but no histogram anomaly occurred, the scanner signature fires for that attacker (scanner) IP address. If the histogram signature is triggered, the attacker addresses that are doing the scanning each trigger the worm signature (instead of the scanner signature). The alert details state which threshold is being used for the worm detection now that the histogram has been triggered. From that point on, all scanners are detected as worm-infected hosts.

The following anomaly detection event actions are possible:

•produce-alert—Writes the event to the Event Store.

•deny-attacker-inline—(Inline only) Does not transmit this packet and future packets originating from the attacker address for a specified period of time.

•log-attacker-packets—Starts IP logging for packets that contain the attacker address.

•deny-attacker-service-pair-inline—Blocks the source IP address and the destination port.

•request-snmp-trapRequest—Sends a request to NotificationApp to perform SNMP notification.

•request-block-host—Sends a request to ARC to block this host (the attacker).

Table 9-1lists the anomaly detection worm signatures.

			Table 9-1	Anomaly Detection Worm Signatures
			Signature ID	Subsignature ID	Name	Description
13000				0	Internal TCP Scanner	Identified a single scanner over a TCP
						protocol in the internal zone.
13000				1	Internal TCP Scanner	Identified a worm attack over a TCP
						protocol in the internal zone; the TCP
						histogram threshold was crossed and a
						scanner over a TCP protocol was
						identified.
13001				0	Internal UDP Scanner	Identified a single scanner over a UDP
						protocol in the internal zone.
13001				1	Internal UDP Scanner	Identified a worm attack over a UDP
						protocol in the internal zone; the UDP
						histogram threshold was crossed and a
						scanner over a UDP protocol was
						identified.
13002				0	Internal Other Scanner	Identified a single scanner over an Other
						protocol in the internal zone.
		Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
	9-6					OL-29168-01