-
Cisco Traffic Anomaly Detector Module Configuration Guide (Software Version 6.1 and 6.1-XG)
-
Index
-
Preface
-
Product Overview
-
Configuring the Detector Module on the Supervisor Engine
-
Initializing the Detector Module
-
Configuring the Detector
-
Configuring Zones
-
Configuring Zone Filters
-
Configuring Policy Templates and Policies
-
Learning the Zone Traffic Characteristics
-
Detecting Zone Traffic Anomalies
-
Using Interactive Detect Mode
-
Using Attack Reports
-
Using Detector Module Diagnostic Tools
-
Performing Maintenance Tasks
-
Feedback
Table Of Contents
Learning the Zone Traffic Characteristics
Understanding the Learning Process and Related Options
Understanding the Phases of the Learning Process
Verifying the Results of the Learning Process
Understanding the Detect and Learn Function
Synchronizing the Zone Learning Process Results with a Guard
Activating the Policy Construction Phase
Activating the Threshold Tuning Phase
Configuring Learning Parameters
Configuring the Threshold Selection Method
Enabling the Detect and Learn Function
Using Snapshots to Verify the Results of the Learning Process
Copying Policies to the Zone Configuration
Learning the Zone Traffic Characteristics
This chapter describes how to use the Cisco Traffic Anomaly Detector Module (Detector module) learning process to analyze zone traffic characteristics to create and tune the policies that the Detector module uses for zone anomaly detection.
This chapter refers to the Cisco Guard (Guard), the companion product of the Detector module. The Guard is a Distributed Denial of Service (DDoS) attack detection and mitigation device that cleans the zone traffic as the traffic flows through it, dropping the attack traffic and injecting the legitimate traffic back into the network. When the Detector module determines that the zone is under attack, it can activate the Guard attack mitigation services. The Detector module can also synchronize zone configurations with the Guard. For more information about the Guard, see the Cisco Anomaly Guard Module Configuration Guide or the Cisco Guard Configuration Guide.
This chapter contains the following sections:
•
Understanding the Learning Process and Related Options
•
•
•
•
•
•
Understanding the Learning Process and Related Options
The learning process allows the Detector module to analyze normal zone traffic conditions to establish a baseline for determining when traffic is normal and when traffic contains anomalies that indicate an attack on the zone. During the learning process, the Detector module creates new zone policies and modifies the policy thresholds based on the normal traffic patterns to produce the reference baseline.
For the learning process to take place, you must configure the switch to capture the traffic sent to the zone and pass a copy of it to the Detector module. See the "Configuring Traffic Sources for Capturing Traffic" section for more information.
You can enter learning-related commands for several zones at the same time. Enter the command in global mode and use an asterisk (*) as a wildcard. For example, to initiate the policy construction phase for all zones, enter the learning policy-construction * command in global mode. To accept the results of the policy construction phase for all Detector module zones with names that begin with scan (such as scannet and scanserver), enter the no learning scan* accept command in global mode.
This section contains the following topics:
•
•
•
Understanding the Phases of the Learning Process
The learning process consists of these two phases:
•
You cannot perform the policy construction phase for zones that you created using the GUARD_LINK or the DETECTOR_LINK zone templates.
•
You can activate the threshold tuning phase and activate zone anomaly detection simultaneously (the detect and learn function) to prevent the Detector module from learning malicious traffic thresholds. You can set the Detector module to constantly tune the zone policies and define the intervals in which the Detector module updates the policy thresholds.
During both phases of the learning process, the Detector module does not modify the current zone policies until the results of a learning phase are accepted as follows:
•
•
After the policies are created, you can add and delete policies or change policy parameters such as thresholds, services, timeouts, and actions.
Note
Verifying the Results of the Learning Process
You can save the current results of either learning phase at any stage during the learning process and review it later by using the snapshot command. Taking a snapshot of the learning process allows you to view the policy information that the Detector module has created up to the point of the snapshot and decide whether or not to accept the results of the learning process. Saving the results of the learning phase in a snapshot does not affect the zone configuration. You can update the zone configuration with the policy information in a snapshot.
For more information about using the snapshot command, see the "Creating Snapshots" section.
Understanding the Detect and Learn Function
After the Detector module has performed the policy construction phase, you can activate the threshold tuning phase of the learning process and enable zone anomaly detection simultaneously using the detect and learn function. The Detector module tunes the policy thresholds while monitoring the traffic for anomalies using the last saved policy thresholds. The detect and learn function enables the Detector module to detect zone anomalies, constantly update the policy thresholds based on the zone traffic characteristics, and prevents the Detector module from learning malicious traffic thresholds.
Before you activate the detect and learn function, you can configure when and how the Detector module accepts the results of the threshold tuning phase by configuring the learning parameters.
See the "Enabling the Detect and Learn Function" section for more information.
Synchronizing the Zone Learning Process Results with a Guard
You can configure the Detector module to perform threshold tuning and to update the corresponding zone configuration on a Guard using a process called zone synchronization, For example, when you enable the detect and learn function on the Detector module and it detects an anomaly, it stops the learning process, updates the Guard with the latest zone configuration using zone synchronization, and then activates the Guard's attack mitigation services. Zone synchronization enables you to use the Detector module to continuously adjust the zone policy thresholds to changes in the normal traffic for both the Detector module and the Guard. Because the Detector module analyzes a copy of the zone traffic, you avoid having to constantly divert the zone traffic to the Guard for the learning process.
To synchronize the Detector module learning process results with a Guard, you must perform the following tasks:
1.
2.
3.
4.
You can synchronize the zone configuration with the Guard manually or configure the Detector module to synchronize the zone configuration with the Guard automatically. See the "Synchronizing Zone Configurations with a Guard module" section for more information.
Activating the Policy Construction Phase
Use the policy construction phase after creating a new zone or any time that the zone configuration needs updating with new service policies. When you enable the policy construction phase, the Detector module analyzes the traffic to discover the main services (ports and protocols) that the zone uses. the Detector module creates the zone policies for the services using the rules established by the policy templates.
Note
The new policies that the Detector module creates during the policy construction phase replace the existing policies when you accept the results of the phase.
Note
Before you activate the policy construction phase, make sure that no attack on the zone is in progress so that the Detector module does not construct the policies based on the traffic characteristics of a DDoS attack. If you allow the Detector module to learn the traffic characteristics of a DDoS attack and save the results of the attack as a baseline, you may prevent the Detector module from detecting future attacks because the Detector module may view the attacks as normal traffic conditions.
To construct the zone policies, perform the following steps:
Step 1
learning policy-constructionStep 2
Wait at least 10 seconds after initiating policy construction or threshold tuning and enter the show rates command. Verify that the value of the Received traffic rate is greater than zero. A value of zero indicates that the Detector module is not receiving a copy of the zone traffic. Check the configuration of traffic sources for capturing traffic. See the "Configuring Traffic Sources for Capturing Traffic" section for more information.
Step 3
You can save a snapshot of the learning parameters (services, thresholds, and other policy-related data) by using the snapshot command at any stage during the policy construction phase, and review it later. You can save a single snapshot or save a periodic snapshot at specified intervals.
For more information, see the "Backing Up the Policy Configuration" section.
Step 4
To accept the policies that the Detector module suggested and continue the policy construction phase, use the following command:
learning acceptTo automatically accept the policies that the Detector module suggests at specified intervals, use the following command:
learning-params periodic-action auto-accept learn_params_days learn_params_hours learn_params_minutesSee the "Configuring Learning Parameters" section for more information.
Use the no learning-params periodic-action command to terminate the periodic action.
Step 5
Note
You can perform one of the following actions:
•
no learning acceptThe Detector module erases previously learned policies and thresholds.
After accepting the newly constructed policies, you can manually add or remove policies. See Chapter 7 "Configuring Policy Templates and Policies," for more information.
•
no learning rejectThe Detector module stops the process and does not save the new policies that it has just learned. The policies of the zone are the policies that the Detector module had prior to initiating the learning process or prior to the last time that you accepted the results of the policy construction phase.
After performing the policy construction phase, enable the threshold tuning phase to tune the thresholds of each policy (see the "Activating the Threshold Tuning Phase" section).
The following example shows how to initiate the policy construction phase and accept the suggested policies at 12-hour intervals. The example also shows how to stop the policy construction phase and accept the suggested policies.
user@DETECTOR-conf-zone-scannet#learning policy-constructionuser@DETECTOR-conf-zone-scannet#learning-params periodic-action auto-accept 0 12 0user@DETECTOR-conf-zone-scannet#no learning acceptActivating the Threshold Tuning Phase
Use the threshold tuning phase to enable the Detector module to analyze the zone traffic and define thresholds for the zone policies. We recommend that you run the threshold tuning phase during peak traffic time (the busiest part of the day) for a minimum of 24 hours to allow the Detector module enough time to properly tune the policy thresholds.
Note
To activate the threshold tuning phase of the learning process, perform the following steps:
Step 1
•
•
Note
•
•
Step 2
Step 3
Step 4
To accept the policies that the Detector module suggests and continue the threshold tuning phase, use the following command:
learning accept [threshold-selection {new-thresholds | max-thresholds | weighted weight}]See Table 8-2 for a description of the threshold-selection arguments and keywords.
To automatically accept the policies that the Detector module suggests at specified intervals, use the following command:
learning-params periodic-action auto-accept learn_params_days learn_params_hours learn_params_minutesSee the "Configuring Learning Parameters" section for more information.
Use the no learning-params periodic-action command to terminate the periodic action.
Step 5
Note
Perform one of the following actions:
•
no learning accept [threshold-selection {new-thresholds | max-thresholds | weighted weight}]See Table 8-2 for a description of the threshold-selection arguments and keywords.
The Detector module replaces the previously learned thresholds with the new thresholds. After accepting the newly tuned policies, you can manually change the policy parameters. See Chapter 7 "Configuring Policy Templates and Policies," for more information.
•
–
The Detector module stops tuning the thresholds and makes no changes to the current thresholds. This process may result in a situation in which new zone policies have thresholds that were obtained based on past traffic characteristics. We recommend that you enable the threshold tuning phase at a later time or that you configure the thresholds manually.
–
If you have the detect and learn function enabled, use the deactivate command to terminate anomaly detection and the threshold tuning phase without saving the current suggested thresholds.
The following example shows how to initiate the threshold tuning phase and accept the suggested policies at 1-hour intervals. The Detector module then stops the threshold tuning phase and accepts the suggested policies if the threshold values are higher than the current values (the max-thresholds method).
user@DETECTOR-conf-zone-scannet#learning threshold-tuninguser@DETECTOR-conf-zone-scannet#learning-params periodic-action auto-accept 0 1 0user@DETECTOR-conf-zone-scannet#no learning accept threshold-selection max-thresholdsAfter performing the threshold tuning phase, you can perform the following tasks:
•
•
•
•
Configuring Learning Parameters
This section shows how to configure the learning parameters to manage the following functions that affect all of the zone policies:
•
•
•
To display the current configuration of the learning parameters, use the show learning-params command in zone configuration mode.
This section contains the following topics:
•
•
Configuring Periodic Actions
You can configure the Detector module to perform one of the following actions at specified intervals:
•
•
See the "Verifying the Results of the Learning Process" section for more information on snapshots.
To set the periodic action that the Detector module performs, use the following command in zone configuration mode:
learning-params periodic-action {auto-accept | snapshot-only} learn_params_days learn_params_hours learn_params_minutes
Table 8-1 provides the arguments and keywords for the learning-params command.
The value of the interval is the sum of the learn_params_days value, the learn_params_hours value, and the learn_params_minutes value.
The following example shows how to set the Detector module to accept the policies at 1-hour intervals:
user@DETECTOR-conf-zone-scannet#learning-params periodic-action auto-accept 0 1 0Configuring the Threshold Selection Method
You can define the default method that the Detector module uses to generate new thresholds to accept during the threshold tuning phase. You can accept the results of the threshold tuning phase manually, or configure the Detector module to automatically accept the results of the threshold tuning phase at specified intervals.
To configure the threshold selection method, use the following command in zone configuration mode:
learning-params threshold-selection {new-thresholds | max-thresholds | weighted weight}
Table 8-2 provides the arguments and keywords for the learning-params threshold-selection command.
This example shows how to configure the Detector module to accept the suggested policies if the learned threshold values are higher than the current policy threshold values:
user@DETECTOR-conf-zone-scannet#learning-params threshold-selection max-thresholdsMarking the Policies as Tuned
The Detector module marks the policy threshold status that defines if the policy thresholds are tuned or not tuned and relates to this status when you enable the protect and learn function. The policy threshold status specifies if the Detector module identifies an attack on the zone when the policy threshold is exceeded.
When a new zone is created, or after you accept the policy construction phase results for a zone, the Detector module marks the zone policy thresholds as untuned. The default thresholds of the zone templates are tuned so that the Detector module activates the anti-spoofing functions quickly if it identifies traffic anomalies in the zone traffic. When you enable the protect and learn function, the learning process might stop if the current zone traffic is higher than the current policy threshold values. To avoid this situation, if the zone policies are not tuned, the Detector module does not detect attacks in the zone traffic when you enable the detect and learn function until the zone policy thresholds are accepted once.
If the zone policies are untuned, the Detector module activates only a threshold selection method of accept-new and ignores previous threshold values when accepting the new policies. If the Detector module accepts the threshold tuning phase results of the learning process for a zone with a threshold selection method other than accept-new, bad policy threshold values may result. See the "Configuring the Threshold Selection Method" section for more information about the threshold selection method.
The Detector module marks the zone policies as untuned in the following situations:
•
•
•
The Detector module marks the zone policies as tuned after accepting the threshold tuning phase results.
You can modify the settings of the zone policies. To mark the zone policies as tuned, use the following command in zone configuration mode:
learning-params threshold-tuned
To mark the zone policies as untuned, use the no form of this command.
You may want to change the status of the zone policies to tuned when one of the following applies:
•
•
You may want to change the status of the zone policies to untuned when one of the following applies:
•
•
•
When the zone policies are marked as untuned, the Detector module does not monitor the current policy thresholds and does not detect attacks on the zone if the policy thresholds are exceeded.
Caution
The following example shows how to mark the status of the zone policies as tuned:
user@DETECTOR-conf-zone-scannet# learning-params threshold-tunedEnabling the Detect and Learn Function
You can enable the threshold tuning phase of the learning process and zone anomaly detection simultaneously by using the detect and learn function. The Detector module continuously tunes the policy thresholds and at the same time monitors the traffic for anomalies using the last saved policy thresholds. If the Detector module detects an attack on the zone, it stops the learning process to prevent it from learning malicious traffic thresholds. If you have the Detector module configured to activate a Guard to mitigate the attack, it activates the Guard and then constantly polls the Guard. When the Detector module determines that the Guard has deactivated zone protection, it verifies that additional traffic anomalies do not exist before reactivating the detect and learn function.
Perform the following actions before you activate the detect and learn function:
•
•
Caution
If the policies are untuned, the Detector module functions as follows until the first time that you accept results of threshold tuning phase:
–
–
See the "Marking the Policies as Tuned" section for more information.
You can accept the results of the threshold tuning phase manually or configure the Detector module to accept the results automatically. You can also configure when and how the Detector module accepts the results of the learning process (see the "Configuring Learning Parameters" section).
To activate the learning process and zone anomaly detection simultaneously, use the detect learning command or enter both the learning threshold-tuning command and the detect command (the order is not important).
For more information about the threshold tuning phase, see the "Activating the Threshold Tuning Phase" section. For more information about enabling anomaly detection, see Chapter 9 "Detecting Zone Traffic Anomalies."
Using Snapshots to Verify the Results of the Learning Process
The snapshot function allows you to save a copy of the learning parameters (services, thresholds, and other policy-related data) at any stage of the learning process. You can use snapshots to perform the following tasks:
•
•
•
•
We recommend that you save a snapshot every few hours during the learning process. You can take the snapshot manually or configure the Detector module to automatically take a snapshot at specified intervals. The Detector module can save up to 100 snapshots for each zone. New snapshots replace the previous ones.
This section contains the following topics:
•
Creating Snapshots
You can save a single snapshot of the zone learning parameters or configure the Detector module to automatically take a snapshot at specified intervals. The Detector module continues the learning process while taking the snapshot.
To configure the Detector module to automatically take a snapshot at specified intervals, see the "Configuring Periodic Actions" section for more information.
To save a single snapshot of the zone learning parameters, use the following command in zone configuration mode:
snapshot [threshold-selection {new-thresholds | max-thresholds | cur-thresholds | weighted calc-weight}]
Table 8-3 provides the arguments and keywords for the snapshot command.
The following example shows how to create a snapshot in which the thresholds are the highest value between the current policy threshold and the new threshold of the learning process:
user@DETECTOR-conf-zone-scannet#snapshot threshold-selection max-thresholdsTo save a single snapshot in global mode, use the following command:
snapshot zone-name [threshold-selection {new-thresholds | max-thresholds | cur-thresholds | weighted weight}]
Comparing Learning Results
You can compare the learning results of two snapshots or two zones to trace the differences in policies, services, and thresholds.
This section contains the following topics:
Comparing Snapshots
To compare two snapshots, use the following command in zone configuration mode:
diff snapshots snapshot-id1 snapshot-id2 [percent]
Table 8-4 provides the arguments for the diff command.
The following example shows how to display the zone snapshots and compare the two most recent snapshots:
user@DETECTOR-conf-zone-scannet# show snapshotsID Time1 Feb 10 10:32:042 Feb 10 10:49:123 Feb 10 11:01:50user@DETECTOR-conf-zone-scannet# diff 2 3To compare snapshots in global mode, use the following command:
diff zone-name snapshots snapshot-id1 snapshot-id2 [percent]
Comparing Zones
You can compare the learning parameters of two zones by using the following command in global mode or in configuration mode:
diff zone-name1 zone-name2 [percent]
Table 8-5 provides the arguments for the diff command.
The following example shows how to compare the learning parameters of two zones:
user@DETECTOR# diff scannet scannet-mailserverDisplaying Snapshots
You can display a list of the zone snapshots or the snapshot parameters to get a comprehensive view of the zone learning results by entering the following command in zone configuration mode:
show snapshots [snapshot-id [policies policy-path]]
Table 8-6 provides the arguments and keywords for the show snapshots command.
Table 8-6 Arguments and Keywords for the show snapshots Command
snapshot-id
(Optional) Identifier of the snapshot to display. If you do not specify policies, the default is to display a list of all the zone snapshots. To view the snapshot ID, use this command with no arguments.
policies policy-path
(Optional) Specifies a group of policies to display. See the "Understanding Zone Policies" section for more information.
To compare snapshots in global mode, use the the following command:
show zone zone-name snapshots [snapshot-id [policies policy-path]]
The fields of the show zone zone-name snapshots snapshot-id policies policy-path command output are identical to the fields in the output of the show policies command. See the "Displaying Policies" section for more information.
Table 8-7 describes the fields in the show snapshots command output.
Table 8-7 Field Descriptions for show snapshots Command Output
Snapshot identifier.
Date and time that the snapshot was taken.
The following example shows how to display a list of the zone snapshots and the policies that are related to dns_tcp in snapshot 2:
user@DETECTOR-conf-zone-scannet# show snapshotsID Time1 Feb 10 10:32:042 Feb 10 10:49:12user@DETECTOR-conf-zone-scannet# show snapshots 2 policies dns_tcpDeleting Snapshots
You can delete old snapshots to free disk space by using the following command in zone configuration mode:
no snapshot snapshot-id
The snapshot-id argument specifies the ID of an existing snapshot. Enter an asterisk (*) to delete all the zone snapshots. To view the details of a snapshot, use the show snapshots command.
The following example shows how to delete all the zone snapshots:
user@DETECTOR-conf-zone-scannet# no snapshot *Copying Policies to the Zone Configuration
You can copy a complete policy configuration or a partial configuration to the current zone.
You can copy the following information:
•
•
To copy the zone policies, use the following command in zone configuration mode:
copy-policies {snapshot-id | src-zone-name [service-path]}
Table 8-8 provides the arguments and keywords for the copy-policies command.
The following example shows how to copy all services that relate to the policy template tcp_connections from the zone webnet to the current zone, scannet:
user@DETECTOR-conf-zone-scannet# copy-policies webnet tcp_connections/The following example shows how to display a list of the zone snapshots and then copy the policies from the snapshot with ID 2:
user@DETECTOR-conf-zone-scannet# show snapshotsID Time1 Feb 10 10:32:042 Feb 10 10:49:12user@DETECTOR-conf-zone-scannet# copy-policies 2Backing Up the Zone Policies
You can create a backup the current zone policies at any time by using the following command in zone configuration mode:
snapshot threshold-selection cur-thresholds
The following example shows how to back up the current zone policies:
user@DETECTOR-conf-zone-scannet# snapshot threshold-selection cur-thresholds
