Download MAZU PROFILER

Alerting
Heuristic-based event detection
For heuristic-based event detection, Profiler compares the current behavior
for the network to a profile of typical network behavior. If the difference
between current behavior and profiled behavior exceeds the limit for any
of a number of parameters, Profiler recognizes the behavior as a network
event, and assigns a severity level to the event.
Profiler uses heuristic-based event detection to detect the following types
of events:
•
DoS/Bandwidth Surge – significant increase of traffic that conforms
to the characteristics of a Denial of Service attack.
•
Worm – increase in connections that typically results from the spread
of a worm. Profiler traces these connections over time through the
network to identify how the worm spreads from infected hosts to new
hosts.
•
Host Scan – hosts on the monitored network are being pinged.
•
Port Scan – ports of a host are being tested for running services or
being in a “listening” or “accepting” state.
•
Suspicious Connection – communication between two hosts that have
been on the monitored network for some period of time, but which do
not normally communicate with one another (for example, an
Engineering department host connecting to a Finance department
host).
•
New Host – a host that has not been seen before has joined the
network.
•
New Server Port – Profiler has discovered that a host or group of
hosts is providing or using a service over a port that is new to that host
or group of hosts.
80