Signature Engine AIC Atomic ARP meta Engine

-

1.1.1.1 Signature Engine

A signature engine is a part of the IPS that is designed to support many signatures in a specific category. Every engine has a set of factors that have acceptable ranges or sets of values.

IPS 6.0 consist of the following signature engines:

AIC (Application Inspection of Control) Engine that provides by analysis of web traffic. The AIC engine provides control over HTTP sessions to prevent harmful traffic of the HTTP protocol. It has the ability of administrative control over different software, such as instant messaging etc. AIC can also be used to inspect FTP (File Transfer Protocol) traffic and control the commands being issued.

There are two AIC engines:

F AIC FTP

F AIC HTTP

Atomic Engine these engines are now combined into two engines with more than one level selection. Layer 3 and Layer 4 attributes can also be combined within one signature, such as IP and TCP.

Atomic ARP Engine is used to inspects Layer 2 ARP protocol. The Atomic ARP engine is quite different because mostly engines are based on Layer 3 IP protocol. They inspect IP protocol packets and are associated Layer 4 transport protocols.This engine has an option to specify values to match for fields in the IP and Layer 4 headers.

Flood Engine Detects ICMP and UDP floods directed at specific users and networks.

There are two Flood engines:

F Flood Host

F Flood Net

Meta Engine is used to describe events that occur in a related manner within a certain time interval. This engine processes events and alerts instead of packets.

Multi String Engine is used to inspects Layer 4 transport protocols and data by matching several strings for one specific signature.

This engine inspects the following categorizes

F Stream based TCP

F single UDP

F ICMP packets

Normalizer Engine is used to configure how the IP and TCP normalizer operates and provides general configuration for signature events related to the IP and TCP normalizer. It has the ability to enforce RFC compliance.

Service Engine is used to deal with certain specific protocols. Service engine has the following protocol categorizes:

F DNS is used to inspects DNS (TCP and UDP) traffic.

F FTP is used for the inspection of FTP traffic.

F Generic has a function to decode custom service and payload.

F Generic Advanced Analyzes traffic flow based on the mini-applications that are written to check the packets.

F H225 is used for the inspection of VoIP traffic.

State Engine is designed for Stateful searches of strings in protocols such as SMTP.

The state engine consists of the hidden configuration document that is used to define the state transitions so new state definitions can be delivered in a upcoming or updated signature.

String Engine is used to search on Regex strings based on ICMP, TCP, or UDP protocol.

There are three different String engines:

F String ICMP

F String TCP

F String UDP.

Sweep Engine is used to analyze sweeps from a single host (ICMP and TCP), from destination ports (UDP and TCP).

Traffic Anomaly Engine is used for the inspection UDP, TCP, and other traffic for worms or viruses.

Traffic ICMP Engine is used to analyze protocols, such as DDOS. There are only two such type of signatures with configurable parameters.

Trojan Engine is used to analyze traffic from different protocols like UDP. Users are not able to configure these engines.

Popular posts from this blog

History of Labor Day

-
Casting a glance back on Labor Day history is essentially about commemorating and celebrating the American Labor Movement. It is all about knowing the share that the American laborers had in building up the nation with its richness and its many achievements. The Labor Day, usually held on the first Monday in September, inspires this sense of the togetherness that workers need to feel and share in respecting their own contribution to the history of America . Labor Day is an annual recognition of all those dedicated American workers whose achievements, both socially and economically, deserve to be honored. On every Labor Day, Americans pay their tributes to those workers of strength and perseverance whose selfless efforts have added to the growth and prosperity of the American nation. Even after a century-long celebration, there is no one consistent theory about the Labor Day history. The prominent amongst these attributes the Labor Day to one Peter J. McGuire. He is the one who is cr...
Read more

Relationships Ruined by the Internet

-
10 Relationships Ruined by the Internet The wife who found pictures of her husband's wedding to another woman at Facebook Lynn France, a wife who suspected her husband was having an affair, found he was actually married to another woman through a simple Facebook search. All she had to do was type in the name of the woman she believed her husband, John, was seeing. The pair had been married at Disney World , no less, with France's husband dressed as Prince Charming , and his new bride as Sleeping Beauty . There was like an album of 200 pictures there. Their whole wedding. She had grown suspicious when her husband began taking frequent business trips, even leaving the day the couple's newborn son came home from the hospital. Once, she found his passport at home when he was supposed to be in China for business. She once caught her husband with another woman in a hotel so a girlfriend recommended checking the woman's Facebook page, where France...
Read more