3-2
Virus Throttling (Connection-Rate Filtering)
Overview of Connection-Rate Filtering
connection-rate filtering can help reduce the impact of worm-like malicious
code and give system administrators more time to isolate and eradicate the
threat. Thus, while traditional worm and virus-signature updates will still
need to be deployed to hosts, the network remains functional and the overall
distribution of the malicious code is limited.
Features and Benefits
Connection-rate filtering is a countermeasure tool you can use in your inci-
dent-management program to help detect an manage worm-type IT security
threats received in inbound IP traffic. Major benefits of this tool include:
â– Behavior-based operation that does not require identifying details
unique to the code exhibiting the worm-like operation.
â– Handles unknown worms.
â– Needs no signature updates.
â– Protects network infrastructure by slowing or stopping IP traffic from
hosts exhibiting high connection-rate behavior.
â– Allows network and individual switches to continue to operate, even
when under attack.
â– Provides Event Log and SNMP trap warnings when worm-like
behavior is detected
â– Gives IT staff more time to react before the threat escalates to a crisis.
To Next Page
Loading...
Need help?
General
