Idp Signatures; Attack Types; Figure 161 Security > Idp > Signatures: Attack Types; Table 78 Security > Idp > Signature: Attack Types - ZyXEL Communications ZYWALL 35 User Manual

Chapter 13 Configuring IDP

13.3 IDP Signatures

The rules that define how to identify and respond to intrusions are called "signatures". Click
SECURITY > IDP > Signatures to see the ZyWALL's signatures.

13.3.1 Attack Types

Click SECURITY > IDP > Signature. The Attack Type list box displays all intrusion types
supported by the ZyWALL. Other covers all intrusion types not covered by other types listed.
To see signatures listed by intrusion type supported by the ZyWALL, select that type from the
Attack Type list box.
Figure 161 SECURITY > IDP > Signatures: Attack Types
The following table describes each attack type.
Table 78 SECURITY > IDP > Signature: Attack Types
TYPE
DoS/DDoS
Buffer Overflow
Access Control
Scan
Trojan Horse
282
DESCRIPTION
The goal of Denial of Service (DoS) attacks is not to steal information, but to
disable a device or network on the Internet. A distributed denial-of-service (DDoS)
attack is one in which multiple compromised systems attack a single target,
thereby causing denial of service for users of the targeted system.
A buffer overflow occurs when a program or process tries to store more data in a
buffer (temporary data storage area) than it was intended to hold. The excess
information can overflow into adjacent buffers, corrupting or overwriting the valid
data held in them.
Intruders could run codes in the overflow buffer region to obtain control of the
system, install a backdoor or use the victim to launch attacks on other devices.
Access control refers to procedures and controls that limit or detect access.
Access control is used typically to control user access to network resources such
as servers, directories, and files.
Scan refers to all port, IP or vulnerability scans. Hackers scan ports to find targets.
They may use a TCP connect() call, SYN scanning (half-open scanning), Nmap
etc. After a target has been found, a vulnerability scanner can be used to exploit
exposures.
A Trojan horse is a harmful program that's hidden inside apparently harmless
programs or data. It could be used to steal information or remotely control a
device.
ZyWALL 5/35/70 Series User's Guide