9-37
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter9 Configuring Anomaly Detection
Configuring Learning Accept Mode
Note
Learning accept mode uses the sensor local time.
The scanner threshold defines the maximum number of zone IP addresses that a single source IP address
can scan. The histogram threshold defines the maximum number of source IP addresses that can scan
more than the specified numbers of zone IP addresses.
Anomaly detection identifies a worm attack when there is a deviation from the histogram that it has
learned when no attack was in progress (that is, when the number of source IP addresses that
concurrently scan more than the defined zone destination IP address is exceeded). For example, if the
scanning threshold is 300 and the histogram for port 445, if ano maly detection identifies a scanner that
scans 350 zone destination IP addresses, it produces an action ind icating that a mass scanner was
detected. However, this scanner does not yet verify that a worm attack is in progress. Tabl e 9-2 describes
this example.
When anomaly detection identifies six concurrent source IP addresses that scan more than 20 zone
destination IP addresses on port 445, it produces an action with an unspecified source IP address that
indicates anomaly detection has identified a worm attack on port 445. The dynamic filter threshold, 20,
specifies the new internal scanning threshold and causes anomaly detection to lower the threshold
definition of a scanner so that anomaly detection produces additional dynamic filters for each source IP
address that scans more than the new scanning threshold (20).
You can override what the KB learned per anomaly detection policy and per zone. If you understand your
network traffic, you may want to use overrides to limit false positives.
Triggering the High Category Histogram Before th e Single-Scanner Threshold
Based on the default histogram (nonlearned knowledge base [KB]) values, histogram-based detection
can occur before single-scanner detection.
Single scanner detection is based on the scanner threshold settings. The scanner threshold setting is a
single number for that port or protocol and zone. Any single I P address scanning more than that number
of hosts of that port or protocol in that zone is alerted as a scan ner.
There is a histogram for that port or protocol an d zone that tracks how many systems normally scan a
smaller number of hosts (10 hosts, 20 hosts, or 100 hosts). Whe n more than that normal number of
scanners are seen, then a worm is declared and all IPs scanning more than the associated number of hosts
are alerted on as being a worm scanner.
Note
An IP source address can be alerted on as being a worm scanner without ever reaching the scanner
threshold. The scanner threshold is used to detect single systems scanning a large number o f hosts and
is tracked separately from the algorithms for detecting worms.
Table9-2 Example Histogram
Number of source IP addresses 10 5 2
Number of destination IP addresses 5 20 100