D-Link NetDefend SOHO DFL-160, Руководство пользователя

Страница: 68 / 130

4.8. IDP Options
The Intrusion Threat
Computer servers can sometimes have vulnerabilities which leave them exposed to attacks carried
by network traffic. Worms, trojans and backdoor exploits are examples of such attacks which, if
successful, can potentially compromise or take control of a server. A generic term that can be used
to describe these server orientated threats are Intrusions.
Intrusion Detection
Intrusions differ from viruses in that a virus is normally contained in a single file download and this
is normally downloaded to a client system. An intrusion manifests itself as a malicious pattern of
Internet data aimed at bypassing server security mechanisms. Intrusions are not uncommon and they
can constantly evolve since their creation can be automated by the attacker.
With the DFL-160, servers that are accessed from the public Internet are typically situated on the
network connected to the DMZ interface. This provides one form of defense against intrusions by
isolating any server infection away from the most sensitive "inside" network which is usually
connected to the LAN interface. However, it is much better to take steps to prevent these infections
ever occurring.
The IDP Solution
Intrusion Detection and Prevention (IDP) is a NetDefendOS feature that is designed to detect and
neutralize such intrusion attempts. When IDP is enabled, it functions by monitoring network traffic
as it passes through the DFL-160's WAN interface from the public Internet, searching for patterns
that indicate an intrusion is being attempted. When such a pattern is detected, NetDefendOS IDP
can then neutralize the attempt by dropping the traffic containing the threat.
The IDP Database and Subscribing
NetDefendOS IDP uses a locally held database of threat patterns which is routinely updated by
downloads from external D-Link servers with the latest threat information as they become available.
NetDefendOS IDP is a subscription based service and yearly subscriptions can be purchased from
your local D-Link agent. After purchase, you will receive a code which is then used for activating
IDP.
4.8. IDP Options Chapter 4. The Firewall Menu
68