[Contents]
[Prev]
[Next]
[Index]
[Report an Error]
Time Bindings
Use time bindings to configure the time attributes for the custom
attack object. Time attributes control how the attack object identifies
attacks that repeat for a certain number of times. By configuring
the scope and count of an attack, you can detect a sequence of the
same attacks over a period of time (one minute) across sessions.
Scope
Specify the scope within which the count of an attack occurs:
- Source—Specify this option to detect attacks from
the source address for the specified number of times, regardless of
the destination address. This means that for a given attack, a threshold
value is maintained for each attack from the source address. The destination
address is ignored. For example, anomalies are detected from two different
pairs (ip-a, ip-b) and (ip-a, ip-c) that have the same source address ip-a but different destination
addresses ip-b and ip-c. Then the number of matches
for ip-a increments to 2. Suppose the threshold
value or count is also set to 2, then the signature
triggers the attack event.
- Destination—Specify this option to detect attacks
sent to the destination address for the specified number of times,
regardless of the source address. This means that for a given attack,
a threshold value is maintained for each attack from the destination
address. The source address is ignored. For example, if anomalies
are detected from two different pairs (ip-a, ip-b) and (ip-c, ip-b) that have the same destination
address ip-b but different source addresses ip-a and ip-c. Then the number of matches for ip-b increments
to 2. Suppose the threshold value or count is also set to 2, then the signature triggers the attack
event.
- Peer—Specify this option to detect attacks between
source and destination IP addresses of the sessions for the specified
number of times. This means that the threshold value is applicable
for a pair of source and destination addresses. Suppose anomalies
are detected from two different source and destination pairs (ip-a, ip-b) and (ip-a, ip-c). Then
the number of matches for each pair is set to 1, even though
both pairs have a common source address.
Count
Count or threshold value specifies the number of times that
the attack object must detect an attack within the specified scope
before the device considers the attack object to match the attack.
If you bind the attack object to multiple ports and the attack object
detects that attack on different ports, each attack on each port is
counted as a separate occurrence. For example, when the attack object
detects an attack on TCP/80 and then on TCP/8080, the count is two.
Once the count match is reached, each attack that matches
the criteria causes the attack count to increase by one. This count
cycle lasts for a duration of 60 seconds, after which the cycle repeats.
[Contents]
[Prev]
[Next]
[Index]
[Report an Error]
