uOS - DoS Prevention - Protocol Anomaly Detection

Zyxel_Claudia

DoS Prevention - Protocol Anomaly Detection

Zyxel Networks has introduced Protocol Anomaly detection as a security enhancement in firmware version 1.37. While previous versions focused on traffic anomalies, this new feature identifies traffic that violates protocol specifications or relevant standards. It serves as an attack pattern identification tool for traffic that does not match standard traffic anomaly profiles.

Configuration and Settings

Users can manage these settings by navigating to Security Policy and selecting the DoS Prevention Profile. Within the profile edit screen, a new section for Protocol Anomaly Detection is available. Currently, the system supports four distinct types of protocol anomalies.

• Default Settings: By default, only IP LAN attacks are enabled. All other protocol anomaly types are disabled initially.
• Actions: Administrators have the option to enable or disable logging for these events. The available actions for detected anomalies are to Ignore or Drop the traffic.
  
  

Maintenance and Monitoring

The ability to update protocol anomaly signatures is dependent on the firewall's firmware version. If an attack is detected, specific messages will appear in the firewall event logs to notify the administrator.