HP HP ProCurve Series 6600, Access Security Manual

Page: 104 / 778

3-2
Virus Throttling (Connection-Rate Filtering)
Overview of Connection-Rate Filtering
connection-rate filtering can help reduce the impact of worm-like malicious
code and give system administrators more time to isolate and eradicate the
threat. Thus, while traditional worm and virus-signature updates will still
need to be deployed to hosts, the network remains functional and the overall
distribution of the malicious code is limited.
Features and Benefits
Connection-rate filtering is a countermeasure tool you can use in your inci-
dent-management program to help detect an manage worm-type IT security
threats received in inbound IP traffic. Major benefits of this tool include:
■ Behavior-based operation that does not require identifying details
unique to the code exhibiting the worm-like operation.
■
Handles unknown worms.
■ Needs no signature updates.
■ Protects network infrastructure by slowing or stopping IP traffic from
hosts exhibiting high connection-rate behavior.
■
Allows network and individual switches to continue to operate, even
when under attack.
■ Provides Event Log and SNMP trap warnings when worm-like
behavior is detected
■ Gives IT staff more time to react before the threat escalates to a crisis.