9-6
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter9 Co nfiguring Anomaly Detection
Anomaly Detection Signatures
•
For more information on configuring anomaly detection signatures, see Anomaly Detection
Signatures, page 9-6.
•
For more information on Deny Attacker event actions, see Event Actions, page 8-4.
Anomaly Detection Signatures
The Traffic Anomaly engine contains nine anomaly detection signatures covering three protocols (TCP,
UDP, and other). Each signature has two subsignatures, one for the scanner and the other for the
worm-infected host (or a scanner under worm attack). When anomaly detection discovers an anomaly, it
triggers an alert for these signatures. All anomaly detection signatures are enabled by default and the
alert severity for each one is set to high.
When a scanner is detected but no histogram anomaly occurred, the scanner signature fires for that
attacker (scanner) IP address. If the histogram signature is triggered, the attacker addresses that are doing
the scanning each trigger the worm signature (instead of the scanner signature). The alert details state
which threshold is being used for the worm detection now that the histogram has been triggered. From
that point on, all scanners are detected as worm-infected hosts.
The following anomaly detection event actions are possible:
•
produce-alert—Writes the event to the Event Store.
•
deny-attacker-inline—(Inline only) Does not transmit this packet and future packets originating
from the attacker address for a specified period of time.
•
log-attacker-packets—Starts IP logging for packets that contain the attacker address.
•
deny-attacker-service-pair-inline—Blocks the source IP address and the destination port.
•
request-snmp-trapRequest—Sends a request to NotificationApp to perform SNMP notification.
•
request-block-host—Sends a request to ARC to block this host (the attacker).
Tabl e 9-1 lists the anomaly detection worm signatures.
Table9-1 Anomaly Detection Worm Signatures
Signature ID Subsignature ID Name Description
13000 0 Internal TCP Scanner Identified a single scanner over a TCP
protocol in the internal zone.
13000 1 Internal TCP Scanner Identified a worm attack over a TCP
protocol in the internal zone; the TCP
histogram threshold was crossed and a
scanner over a TCP protocol was
identified.
13001 0 Internal UDP Scanner Identified a single scanner over a UDP
protocol in the internal zone.
13001 1 Interna l UDP Scanner Identified a worm attack over a UDP
protocol in the internal zone; the UDP
histogram threshold was crossed and a
scanner over a UDP protocol was
identified.
13002 0 Interna l Other Scanner Identified a single scanner over an Other
protocol in the internal zone.