DoS / DDoS pevention techniques for cisco ASA 5585-X Adaptive Security Appliance

[asad ali]

I want to ask this community on how does a cisco asa 5585-x firewall with a bultin IPS module (AIP) would detect DoS / DDoS signatures. My concept or knowledge says that for above mentioned devices , its way to detecting between the two varies about the types of singatures set avaiable to it at the time of attack.

For e.g if the device has to catch something similar to Conficker it need the certain signature to identiy the bot-net infection spreading through a planeted worm or a script running at infected attacked networks servers.

Does this same logic or methodolgy applies in case detecting DoS attacking consdiering it has a smaller scope as it detects attacks which are lets say targeted to a certain web-url (http://xy.com/abc) infecting just one part of the system. How does cisco 5585-x would qualify such an attack.?

I know there is a feature called as rate limiting that detects such attacks, but does it applies only in case when there is no signature avaiable. By asking this, I want to draw a line how does the device differenitate between the attacks, because one thing that i think is common is that if the rate limiting feature is avaiable it would detect both(dos / DDoS) using the same techniques, but for like proper classification it would match it with its signature base?

Kindly let me know if my assumptions are concept regarding this topic.

Thanks.

[Julio Carvajal]

Hello Sr,

Good question and I am sure that this will lead to a nice discussion as there is a lot of stuff to work with.

First of all are you refering to the AIP module on this ASA itself or can we mention the ASA benefits on this particular attacks??

Regards,

Julio Carvajal

[asad ali]

Thanks for replying me back.

Yes I'm reffering to AIP module included in CISCO asa 5885 itself.

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_bulletin_c25-614415.html

[Julio Carvajal]

Hello,

Okay so we are just going to focus on the SSP ( No the ASA at all)

First of all you can set a baseline of what your network traffic is by using the anomaly detection feature ( So the IPS will learn what is normal and as soon as he detects something that is not normal, it will do something, trigger an alert,etc)

We can also have several signatures used to detect this attacks as you already know ( Some of this signatures of course are rate limiting)

Its quite late on my time zone So I am dead Let me know what specific question I can answer for you and I will do that in the morning

[asad ali]

Thank you for writing so late .

Using the anomaly detection feature at which point SSP would classify or differentiate a DoS attack from DDoS attack considering.

The other problem with anomaly detection for it to be effective you have to make the system learn "clean / good" behavior in a clean environment so it doesn't learn bad patterns and thus increasing your chances of hit by false negatives.

Like for incident response plan and also for mitigation purposes considering the alerts are feeded into SIEM i want to flag DoS and DDoS attacks separately.

[Julio Carvajal · Accepted solution]

Hello Asad,

Exactly it has to built it own database.

We offer you the opportunity to use several signatures to determine whether a Scanning is happening or not ( A flooding of different or the same traffic will be detected, you can tune it to fit your needs)

We can also use the global correlation inteligence system that will allow your sensor to participate on a database that is handled by Cisco to determine malicious activity.