ESR service routers. ESR-Series. Functionality description. Version 1.12.0
306
•
•
•
•
•
•
•
•
•
•
Create an extended rule:
esr(config-ips-category)# rule-advanced
1
esr(config-ips-category-rule-advanced)# description «Slow Loris rule
1
»
esr(config-ips-category-rule-advanced)# rule-text "alert tcp any any -> any
80
(msg:
'Possible
Slowloris Attack Detected'
;
flow:to_server,established; content:
'X-a|3a|'
; distance:
0
; pcre:
'/\d\d\d\d/'
; distance:
0
;
content:
'|0d 0a|'
; sid:
10000001
;)"
Create another extended rule that works on a similar algorithm to determine which rule will be more effective:
esr(config-ips-category)# rule-advanced
2
esr(config-ips-category-rule-advanced)# description «Slow Loris rule
2
»
esr(config-ips-category-rule-advanced)# rule-text «alert tcp $EXTERNAL_NET any -> $HOME_NET
$HTTP_PORTS (msg:
'SlowLoris.py DoS attempt'
; flow:established,to_server,no_stream; content:
'X-
a:'
; dsize:<
15
; detection_filter:track by_dst, count
3
, seconds
30
; classtype:denial-of-
service; sid:
10000002
; rev:
1
; )
7.8 Eltex Distribution Manager interaction configuration
EDM (Eltex Distribution Manager) is a service for distributing licensed content to devices via commercial
subscription.
Using Kaspersky Lab's security infrastructure, including the Kaspersky Security Network cloud-based
"collective intelligence" with Kaspersky SafeStream II support, the ESR service router is able to detect malware
in all types of traffic (web, email, P2P, instant messaging services, etc.). As a result, users are protected from
the most dangerous cyber threats, including zero-day threats, encryption programs, infected sites and other
types.
IPS on ESR devices can use the following sets of rules provided by Kaspersky SafeStream II:
IP address Reputation Data – a set of IP addresses with contextual information that reports suspicious
and malicious hosts;
URLs of malicious links – a set of URLs corresponding to dangerous links and websites;
URLs of phishing links – a set of URLs recognized by Kaspersky Lab as phishing. Masked and unmasked
entries are available;
URLs of botnet command servers – a set of URLs of botnet command servers and associated malicious
objects;
URLs of encryptors – set of encryptor URLs;
Hashes of malicious objects – a set of file hashes that covers the most dangerous and common, as well
as the newest malicious programs;
Hashes of malicious objects for mobile devices – a set of file hashes to detect malicious objects
infecting mobile devices;
P-SMS Trojan data – a set of Trojan hashes with contextual information to detect SMS Trojans calling
from cell phones to paid numbers, as well as allow the attacker to intercept SMS messages, respond to
them and delete them;
URLs of botnet command servers for mobile devices – a set of URLs with contextual information to
identify botnet command servers using mobile devices;
URLs of websites used to host malicious programs that infect Internet of Things (IoT) devices.
EDM Server software is provided to operate under a group license, allowing the new ESR service router to be
automatically enabled under an existing license. Thus, the user of the system can manage the allocation of
licenses to ESR devices within his organization. EDM Server software can be installed on multiple hosts to
provide scalability and fault tolerance.
