Symantec 10521146 - Network Security 7120, Administration Manual

Page: 27 / 392

27 Architecture
About the core architecture
Users can increase the detection capabilities by using Flow Alert Rules and
adding user-defined signatures. Flow alert rules allow users to monitor network
policy and respond to traffic to or from IP address and port combinations.
User-defined signatures allow users to add network patterns to the supported
set, and tune them to a specific network environment. Examples include
monitoring proprietary protocols, searching for honey-tokens, or detecting
disallowed application versions.
Symantec Network Security can also integrate event data from third-party
devices, enabling you to combine existing intrusion detection products with
Symantec Network Security’s high speed and zero-day attack detection
capabilities.
This section describes the layers of the detection model:
■
About protocol anomaly detection
■
About Symantec signatures
■
About user-defined signatures
■
Monitoring traffic rate
■
About DoS detection
■
About external EDP
About protocol anomaly detection
Symantec Network Security's Protocol Anomaly Detection (PAD) is a form of
anomaly detection. PAD detects threats by noting deviations from expected
activity, rather than known forms of misuse. Anomaly detection looks for
expected or acceptable traffic, and alerts when it does not see it. This is the
compliment of a signature-based approach, which looks for abnormal,
unexpected, or unacceptable traffic.
Symantec Network Security provides in-depth models of the most frequently
used network protocols, providing extensive detection capability that goes
beyond simpler forms of protocol analysis. These models provide much deeper
detection and fewer false positives because they are able to follow a client-server
exchange throughout the life of the connection. For example, if a protocol
defines the size of a field, and Symantec Network Security detects a field that
breaches the defined size, it will trigger an alert.
Symantec Network Security has overcome the issue of overly generic alerts,
which is one of the major issues surrounding PAD. During a zero-day attack, a
general PAD alert is often all that is possible. However, soon after a new threat is
discovered, it is often identified by a name and assigned a unique identifier by
authorities. These organizations publish descriptions of the threat and provide