20 Architecture
About the core architecture
Figure 2-1
Core Architecture of Symantec Network Security
This section describes the following topics:
■
About detection
■
About analysis
■
About response
About detection
Symantec Network Security uses multiple methods of threat detection that
provide both broad and deep detection of network-borne threats. These include
Protocol Anomaly Detection (PAD), traffic rate monitoring, and network pattern
matching, or signature-based detection.
Each of these methods has strengths and weaknesses. Signature-based
approaches can miss new attacks; protocol anomaly detection can miss attacks
that are not considered anomalies; traffic anomaly detection misses single-shot
or low-volume attacks; and behavioral anomaly detection misses attacks that
are difficult to differentiate from normal behavior.
Symantec Network Security combines multiple techniques and technologies
into a single solution. In addition, it adapts to the changing threat landscape by
adopting new techniques and technologies that improve upon or replace
existing ones.
Network
Traffic
External
Sources
EDP
Scan Detection
DoS Detection
User-defined
Stateful Signatures
Protocol Anomaly
Detection
Detection
Analysis
Response
C
or
re
la
ti
on
Po
lic
y
A
pp
lic
at
io
n
A
u
to
m
at
ed
R
es
p
on
se
R
ef
in
em
en
t
Signatures
Summary of Contents for 10268947 - Network Security 7160
Page 1: ...Symantec Network Security User Guide...
Page 18: ...18 Introduction Finding information...
Page 34: ...34 Architecture About management and detection architecture...
Page 46: ...46 Getting Started About deploying node clusters...
Page 64: ...64 Topology Database Viewing objects in the topology tree...
Page 124: ...124 Log Files About log files...
Page 134: ...134 Index...
