Wanguard 6.2 User Guide
Configuration » General Settings » Anomaly Detection
Configuration » General Settings » Anomaly Detection
The global settings for the anomaly detection engine can be edited in Configuration » General Settings »
Anomalies. The detection of anomalies also needs to be enabled individually, for each subnet defined in the IP Zone
(details on page 34).
The
Deduplication
feature must be enabled to avoid detection of multiple anomalies for the same attack
when the attack is matched by multiple decoders included within each other. Without this feature, if you define a
500k pps threshold for the TOTAL decoder, a 400k pps threshold for the TCP decoder and a 30k pps threshold for the
TCP+SYN decoder, and a 600k pps TCP+SYN attack is being received, the Sensor will detect three anomalies, one for
each decoder. With this feature on, the Sensor will report a single anomaly for the TCP+SYN decoder because it is the
most specific. Select the first option to disable this feature. Select the second option to enable it. Select the third
option also to ignore anomalies for bits/s thresholds when similar anomalies exist for packets/s thresholds.
The
Delay Reporting
option can be used to avoid reporting of anomalies that last for less than a number of
ticks (1 tick = 5 seconds for Packet Sensor. For Flow Sensor 1 tick = the value of the Graphs Accuracy parameter).
The
Expiration Time
option lets you select the number of minutes of inactivity before anomalies expire. The
default value is 5 minutes.
The
Expiration Type
option can be used to increase linearly or exponentially the number of minutes of
inactivity before recurring anomalies expire.
Wanguard Sensor detects traffic anomalies using two different and non-exclusive methods:
●
Threshold Anomalies
– Detected for user-defined threshold values. Thresholds can be defined inside IP
Zones for the decoders enabled in the
Threshold Anomaly Decoders
list. Decoders are explained in the
previous chapter. Enable only the decoders for which you will define thresholds.
Thresholds can include either absolute values (e.g. IP receives 100k UDP packets/s) or percentage values
(e.g. IP receives 30% UDP packets/s). To prevent
Percentage Thresholds
from being triggered for small
amounts of traffic, configure minimum packets/s and bits/s values. Percentage values are calculated
based on the rates of the monitored interface, for the same decoder. E.g. For an interface that receives
100k UDP packets/s, a 30% UDP packets/s threshold defined for a single IP triggers an anomaly when
the IP receives over 30k UDP packets/s.
●
Profile Anomalies
– Detected through a behavioral recognition approach. After enabling in IP Zone the
profile anomaly detection for a subnet/host, the Console builds a behavioral traffic graph for a 24 hour
period. You can see the graph in Reports » IP Addresses » [Any Subnet/IP] » Profile Graphs. Wanguard
Sensor detects any activity that deviates from the expected traffic received by the protected subnets.
Profile anomaly detection is recommended only for hosts and subnets that have a predictable traffic
pattern. Larger subnets are usually more predictable. To prevent false positives, adjust the deviation
percent and minimum packet and bit rates.
The
Deviation %
represents the maximum allowed deviation from the expected traffic before triggering
a profile anomaly. The default value of 100 allows traffic up to twice (100% ex 100% deviation)
the expected value.
Users should not modify the values from the
Advanced Profiling Parameters
panel.
- 23 -
Summary of Contents for wanguard 6.2
Page 1: ......
